last executing test programs: 9.795357793s ago: executing program 3 (id=7401): ioctl$sock_ipv6_tunnel_SIOCCHG6RD(0xffffffffffffffff, 0x89fb, &(0x7f0000000480)={'sit0\x00', &(0x7f0000000440)={@remote, @rand_addr=0x64010101, 0x1b, 0x6}}) r0 = syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r1) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, 0x0) sendmsg$NL80211_CMD_SET_KEY(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)={0x24, r3, 0x1, 0x70bd28, 0x25dfdbfd, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_KEY_IDX={0x5, 0x8, 0x5}]}, 0x24}, 0x1, 0x0, 0x0, 0xc0}, 0x4) r4 = syz_genetlink_get_family_id$smc(&(0x7f0000000040), 0xffffffffffffffff) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$SMC_PNETID_ADD(r5, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="01002dbd7000fbdbdf14020000000900010073797a320000000014000200000000"], 0x34}, 0x1, 0x0, 0x0, 0x4008011}, 0x4) sendmsg$SMC_PNETID_GET(r2, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000600)=ANY=[@ANYBLOB="3c000000fe7cf5fa0fec6dfaa645bb5429f8f7ea620dae0b97753f34818384ed3995a707ddee8f509d9f44ef774e59fc5a5321aedcf2e51f4fbf1c1797f25b99a5a67114e87271b76bae32e6810e277a413e69b36f", @ANYRES16=r4, @ANYBLOB="03042abd7000010001000100000005000400020000000900010073797a300000000014000200626f6e645f736c6176655f3100000000"], 0x3c}, 0x1, 0x0, 0x0, 0x4008050}, 0xc000) r6 = socket(0x10, 0x3, 0x0) r7 = openat$ppp(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) sendmsg$IPSET_CMD_TEST(r6, &(0x7f0000000480)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000440)={&(0x7f0000000300)=ANY=[@ANYBLOB="280100000b0601010000000000000000070000055c0008800c00078008000a40000084e9100007800c00018008000140ac1414aa0c0007800800094000000009100007800900120073797a3100000000100007800c00148008000140ac1e0001100007800c001940000000000000008030000880100007800c001840000000000000007f0c0007800500030009000000100007800c001b400000000000000009100007800c001b40000000000000000330000880140007800d001a002f6465762f707070000000cd4fbf6d8008000840000000010c00078008000840000000100900020073797a300000000005000100070000001c0008800c00078005001500090000000c00078008001c4000000003050001000700000008000940000000020500010007000000"], 0x128}, 0x1, 0x0, 0x0, 0x20008800}, 0x4004884) close(0x4) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="400000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000001800128008000100707070000c00028008000100", @ANYRES32=r7], 0x40}}, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000780)={&(0x7f0000000000)=ANY=[], &(0x7f0000003340)=""/2, 0x8c, 0x2, 0x1, 0x6abb}, 0x28) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB="5800000042000100000000000000000003010000000000002600010000112233445566778899aabb0808000000140000000001170000010203040506070800000c00020006000600894f00000c00030008001700040000010000006f607c69fe8cd5b56b58dbc13158609cff4e84f55c385ce65afe73a102075e231e27acc99b924f6912ad58f58b"], 0x58}}, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCDEL6RD(r9, 0x89fa, &(0x7f0000000340)={'sit0\x00', &(0x7f0000000180)={@mcast1, @multicast2, 0x12, 0x10}}) sendmsg$NL80211_CMD_NEW_KEY(r8, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000007c0)=ANY=[@ANYBLOB='d\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="010800000f9bff2adf250b00000008000300ceb6378e0a87e2f6d01e57fa9a8ccc385155450e8bacfb10733c90ae87cce762825499db7f8222a8c2d7c92cea9c91b0c3509c2b45d2a30726e944117add6a114b87b633933eb23bc94c4a7ccc2ad24254ab43070e02071479359d6d22217d0a614509bfbd0ea60eda3311fc43f63fd81a0ca4dcde901de7cfbd303a995e2c400a8a6c0b11946017de36946ee2f5cfe39b54c2fe89e73604db7ca572bbd635e261bba948afade9a1c8cfd75229357aeec9671c66916a04cc1bcd7050210f05791ddbe650b677493a829e3050e63b81dd4f23c4e3bbb563e156af2fcd0c98da8eab9a35e5e9d33bcd4d44ec09f69ccd1005242be54b4e6514494f108f06190231fe1201415f6baffcc10bfaff92e35bf78afe6bf0204377f8cf8daac92540990d38815f343a6e574856cc1ac779ee71310e3b55c52d6202fcd0f5080517f504414098438dd7fb689c7ef808a6b315238e228a9aae2897bea0504d", @ANYBLOB="28005080040006"], 0x64}, 0x1, 0x0, 0x0, 0x24004081}, 0x4004022) r11 = socket$netlink(0x10, 0x3, 0x0) r12 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r12, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r12, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0x14) sendmsg$nl_route(r11, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000540)=ANY=[@ANYRES32=r13, @ANYRESHEX=r13, @ANYRESOCT=r13, @ANYRESDEC=r10, @ANYRES32=r11, @ANYRESHEX=r10], 0x3c}}, 0x881) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r8, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000001c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="14000000", @ANYRES16=r0, @ANYBLOB="000425bd7000fcdbdf0847b7f272d3873e5de40bc51e2553000000"], 0x14}, 0x1, 0x0, 0x0, 0x10}, 0x4000001) sendmsg$nl_route(r12, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x54, 0x10, 0xffffff1f, 0xfffffffc, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, 0x10000}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @gretap={{0xb}, {0x14, 0x2, 0x0, 0x1, [@IFLA_GRE_REMOTE={0x8, 0x7, @dev={0xac, 0x14, 0x14, 0x28}}, @IFLA_GRE_OFLAGS={0x6, 0x3, 0x502e}]}}}, @IFLA_NUM_TX_QUEUES={0x8, 0x1f, 0x9}, @IFLA_MASTER={0x8, 0xa, r13}]}, 0x54}, 0x1, 0x0, 0x0, 0x40}, 0x0) 9.442169102s ago: executing program 3 (id=7405): unshare(0x20000400) socket$packet(0x11, 0x3, 0x300) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) r1 = openat$cgroup_devices(r0, &(0x7f0000000300)='devices.allow\x00', 0x2, 0x0) write$cgroup_devices(r1, &(0x7f00000000c0)={'a', ' *:* ', 'm\x00'}, 0x8) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x13, 0x13, 0x0, &(0x7f0000000000)='GPL\x00', 0x2, 0xde, &(0x7f00000001c0)=""/222, 0x41100, 0x8}, 0x94) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='devices.list\x00', 0x275a, 0x0) write$cgroup_subtree(r2, &(0x7f0000000380)=ANY=[], 0x32600) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$tipc(r3, &(0x7f0000000240)={0x0, 0xfffffff5, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0xfffffdef}], 0x1}, 0x0) r4 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000013c0)=[{&(0x7f00000001c0)="39000000140081ae0000dc676f97daf01e2357f9ffffffffffffff0521018701546fabca1b4e8a06a6580e88370200c54c1960b89c40ebb373", 0x39}], 0x1}, 0x80) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x50, r2, 0x0) 2.909528835s ago: executing program 1 (id=7505): r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r1, &(0x7f0000000040)={0x18, 0x0, {0x4001, @remote, 'batadv0\x00'}}, 0x1e) sendmmsg(r1, &(0x7f0000002340)=[{{0x0, 0x0, 0x0}}], 0x3e8, 0x0) r2 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) r3 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r3, 0x10f, 0x87, &(0x7f0000000900)={0x41, 0x4}, 0x10) r4 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r4, 0x10f, 0x87, &(0x7f0000000040)={0x41}, 0x10) r5 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r5, 0x10f, 0x87, &(0x7f0000000280)={0x41, 0x0, 0x2}, 0x10) r6 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r6, 0x10f, 0x87, &(0x7f0000000100)={0x41, 0x0, 0x2}, 0x1be) sendmsg$tipc(r6, &(0x7f0000000180)={&(0x7f0000000080)=@nameseq={0x1e, 0x1, 0x0, {0x41}}, 0x10, 0x0}, 0x0) ioctl$sock_inet_SIOCSIFBRDADDR(r1, 0x891a, 0x0) r7 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$inet6_mreq(r7, 0x29, 0x1c, 0x0, 0x41) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='memory.events\x00', 0x100002, 0x0) ioctl$FS_IOC_RESVSP(r8, 0x40305828, &(0x7f0000000180)={0x0, 0x2, 0x4000, 0xd8e0}) ioctl$PPPIOCGL2TPSTATS(r8, 0x80487436, &(0x7f0000000500)="d4a7e3080213db18fcc8352f5091ff557a280058e9d347855b88949442679fae10315b6062f6b30b2646898e9b0d6923ce8505b00cf0e9eec0b0c56a8edbfff4c7b4295af0efdc1047b20f0cd39cd902ee0dc39aa05625e09f9f2c0f473b6fa68458eaf8d78be0b342fb02d4ff0325f63ec5b0a56c863ee6e09cfc0d17a0dc9436b4cb896b7a0ca2d0c072b506296061cad8a7efde18e744b216721bc826b2e62db31dabe756b2e4d5b4708eb69a0e292e301b4ebd9103b9413dccae805797ad83f3408f5b04b6159060f7b16b2a91f58268f4c3d1d9591d5924664940bfb61361fa2fdf0a6d298a02fb5b7e7fd54ac823f8994369690a256547a97775f7713ef64ef91b3aa13437080461f14f30ab0bc4c5b596a08f018b724c542f0919b5557c0b9492a215b09f596654ce9abf695b3fb9fff7118df024796b2ab29dea1308af54a0923dd1cd128500f9625d3bf3d3173832cf96ea0a937da8c3a5d1dd6407b6baa61e29089e86866102b49ab6920e0d9f7766db419543d88fc87d3691a4d2a6a7becfffcd045be52f7d788b64330286842b1cc0a43fc6964d922d173deec746c8013162efef8927498e910edf3b3fde9ef54d8e403df1342a786da2abb0b83244244b8e6bc5ba6303b2f844ca9fcaadd42eb1d15de2425d66ac318e471b420aa50eeea053d3f3ddf8eb496cec4a2a49ca34d2024d3799e539a7f3d03f6d3cf4e36b48ae2d162ffc5894011fd0190d56c34485a02f50757ce18f2cf0f456624d9dfce1c42c9c33ed73e793dd3590885db121df73d246d1102869a53a056ac1a907e0cdb98cb07d21e4488e36550aa583f3611e4ee491ef9f7c63afd1bb38c87bfa4134e37202075bb2d81336d032de2fb61290f1708dfa0f1af6451b3964a2406900d95d8e4cbc89621e648ba0b57257ac58cac0e9bcc50baa990c548b58fbb6afdf1b0b9db58679a65965caf03fddd40962a28888d08f295459d5cd7d85c098c897cdd96ef480ec37ff7870c8a1ef7de2ea90d1cd52a5565f10c998215ed67e795e992cddffb203d01bb35aefa8e51bb295ec07879786094f13b36f1ed377dd67751b29b4310d4d55c85d8ede699c6d103228dab2e6586dc9061459b77d9c009752a08a5645e1d67393fa5782ead8ca4260cdba1d49f65854bc27529349f1838c912b4c9d5c48cd6ba7e87a84ce8dba434a4a36c4b216c4cb5cbd85a89400f37c0e9bbf831c9af4006db3df7cc7fc8d3190e2c4e4fd7453b0e2e22dec26aeeac449b5a6a210e76063e990048595a45b406011664db3c627b314bb4e9ea865c7f83e969c8efb41c5050df747485f6f34e87f75061630322f3c4b2b432ef8f6977b278caa270e56f12c08f38c5f8c93600f2f720f6eb2cd0fb5b5350a149a47973bb2e95ed52838d4d3d89c2ecc24e45aaa961e3e6ca496ff96fd33f049b6efae1ce4f7dcf711bfcf98e12193ab5eb116d3b4045c67a66538c5c26b083f979ce0915bc0949f6c495b1fc24bdff8812b712f4923fe6c99a24783a4214172c4f57ed93100208d1127ee439d29149cbd92bcb75f937883364282745f7728e8c0c271268cf9774cf4af6e59cd7b8d9fb5ebc43702aecb0ff9987c832c5da836df15998a12540f6118ebe83b43bf18bd7584600ba3bc87ec73200fc90824966f473eab3c0d1a9e17cad4ab6f424b1158442b5929168d7a2e7e9abe29b4dfb38010da6a761d62e8081d8ce5085082fc750c28adaa0c18fd37211d71e771232df002ccfc60e98c015c2a3b2f2d1a40d5c087f1f3ef0673d31b9b34e36edf2c2887c8da9439c6a1bcf3f31d3c59fcc82330268bf811bf6c80ac863a13296eaf9f196bf67aada18d7350e7939d373e3333aa2e147fcb222c8ee744c2a96ce95b6c3ece00a4d0c97501fd1f9d726236ff10ea58dfa713c63888b8141a7702f70d47e7149bf932d28947aa9183974bd2ee5691842ed3a34e66ac5da46178746e26320b3cb58217d88c0510f1d00c0f7e84e0920eaa57f958cd725858703fa562965361aef810f137f05ae435418cb6b283a864fc0182f68643df502d8fa0072cc8f3a55937a867c4d51097c8729b2bdd945c7b7c9e0cfb58e247e57d713cc8ea7d6f2224f6edf75fb2bb0d1f82815b7876a9c2955d0c5d7250dab52352ef44e968df7e264fe93285a201ce5d613af065277487f7fcc313afccb8ec26225a88843ff61c27be071f9d69938f0377661b1dfa0e2caccb06a920b0fc251ef648526d4847cef1c55032b58002b71f189682091828912328ab3aef08e1a6941f3370952748c7d906fc8b0aa2309a78e4b359248bb9a5992a6eae362ef0ee10c9495ab6db2ded2e65bf2e64e30618a700813bbf4e1eb437aee5cb3bd6f89fb33853b030bff6a4878c8388fa785b838047b4ddce763311f36bb07084b0749026b7b5ec2eda6b69276e280ef0fe8fd3ff9be86d83ba67a8901d6faa168fe50a3045f6c88985ca3b9016281e50674360d066ac8088023ae5a6840291b4e79e2f2e2e4c897f0fe5f001419a19771067a48acfc1318ffac123a97f7800bf00d17f691b8beed019a785616172e17597d5d6780c2bab0a80b50344d46813389ba1b5ad745fd83f4aeb11f8a92cef36220d27604d2462924309cfc0e5b556a5889c9deb028676ae319ff06bb76271dcabfbd4c4d1782f38b9586f53d118bbf78a4eb6d48b0d2108c4a4259c13d8103ba97fd781ad00888dea855b02ad30e15bf2ca4adb506c6b962c8cedb4db7eae413cd4183c259b8aaf41a94f842f9f49c183316f9ef749aceb165e47acec9d82f9cc5a0514be0288da846bf097fb1176749c5b343478105793b5c6a45e123447361ca0d6da3c54754c6918d9e6e71080ebc2c09bd0100b0f16db63e9deb77539810ecbd470bbe5fe0d2773e2f28338215c576195342ad7eefa839f1a5a52e63dd5d0989af2054668832c9424236d5ccbc3bc7d5347b5d515287aa3d9fa31cbc8c5f3a8c0372ecfd74ee80d806e05069e3f10d730794f920ecb71c12f1faa173bf9a757f9ff26f3ec9e23b897ed2fca123e959722f71e59fd6f2ed57f2e5af0b6258b19522e3ba72a1b17f051f1a3bdf8c038ce9dcec9006ed1d5b8772153e0e5625daaea6372d27583bfbdaf1660166db622e36837709631b1f808835680baaaecf11da95352506d38a4bbf7711b9bd3b1e9ba6acf5e18b96307719a555729765a7ab50334b6b3d0a5b26afd5243de6f1d2fbc530f2ded8434430da0666a700bf9464640e285eed98549ec57548e27fae9f59ff28b26a713d878919b501a91281fec2a61301d975aa8612b3037cafcfdcdbbdac8dfe9cdd0ee4e68243a4b8cac32061c4eb9f4355d18635f4a5dfcc27faf6322d7ef84b74ee633d90ec2091e7eafa7b561ff3a8122088c956bae97aad63bcb26c0158a14c30546a819f85f1040a9146b102f22c9647e24321a54976d2951c741c6c68d14e7750628e8fa1d92f31ace5f2eebf22c92b1daa5795cd6aa866efffb96edeae981a623af296779d2f318b2f7a73aafa0cfea09685b546e3cb2353ba8f23560735932dcc9580b492bd67c31c13b18d0e6a6a3e96374488638846925c59153a1214afd32a01fd9d0f21facf248f879aab89dc6de9392cf06b4328e2ab6e5382c32daf0e4919944f21121c743fbb3b08eae819844682996629106c57b215fda41742b106e068a426c1133196d91b505335e1a3907284e0c4acb786ff2a2ed5ec4034b397c4d3d01d336438e7b379292d582c5765a15cb91fa2b7bd5113ce98cd7297ba5a8a7efbd95d480a7d36519c65cf398f09a6acb87552ad3fd2667b2c50438f2de21fd2c4b205f321cfa8878f5966562d0828797ee01bbd204f2ffd97e7e01f7047309c4237311a32dc5f8fbbce0d787a45fba9c59318b1088b0d5efc593ad0ffec08996b64524623e4f8dd62edd8b8f70222ebbfbc842ec0f4bcf8f05183eb77c5c6084c7286c9be2130f29032617a509bae1b67fef3ea9428f5b7f690fdc6a96ce61e9138ab0a023acd40937889a6a7eacdb02b5dfc5c30b82aeca11c94811890adebe80c0d8eb817a7e55158d111ade7a6c58ce21dc2f63d5c0a1e2f2b8935e47a78eb97d55c5beb63385734d9e889526d3a1cb29ce1f392d6dc3b93ae95a3d08f666e523224b68ff726d062431d1ddd1d8dfbaba93a13b819c4402932ce1e758bfa51613025dda197520a6fa6251553d6b5b280ea00f963fd178fcade54c96a99049a00c7f6b79ba54ff13ffa009849adeb85bcd4a4d6f54850e85d1a4ddce4d78b3fc69713525f3c005128ff72b3330dbdd2e236e76297f16536442c50095980b29d88ebc5dbb6f79bb8232abef9121d5bd5b71afda9bdea9fc13eca8bdc9b9e4492f51e3575c3a36952f09dec673ff2ab6574f3de6dbcc9f0a6aabe2cc474804e74ce1b642f5ccbec69af770ecfbec7e2644b9454211460bd2f737d80e4c7e994529c0408822abce394c9b907e72f1d977946dafe4ef749b6bb2a6278e6d26bf1894dd4a956334e01e5267bc819ea6318dc87629e7c7895f4cae7b4f4140e35b1b4bcbedad0fcc36a17761ae65e90fa7cbf0e28b714f7d07d3e5a9469bcea37b6d2f5f512e8aced2644d7f725ba6ac752243cc88547cb6a4e0d63c7b45b22b899c4e304df121d46e4c6a7969947738180009263d6e5b8ca6860a4b82d64d305c26fe8d558b70b2f80beacaa595821d2ff92a9461c14fba48f739832ab0629be5f9316d15dc9f93d965ddea744d1c84553d7aba626c073129fc29dc19dc87fd96e0fb7cb17b3569a3cee8f53a52ef760300af8ecdc58dc45bc3dfd9afec485b71464fb055285521700ff90edde1c92e341935686a83187d2a38492805264dd4daed02450dd391c47ed3f44c10a63a492975f75aa0551712fef2e89b79458b7d64b14da162aa6246df75dac0962ebcac3c2a3d27fb5182d06d199430f50cad909d604945a74a2782037b218332dcc1a1454796fd7e8b5bf8928b9f36d9af649d125b456617f054ee23ab05070e58178b0b4356e2d28873be1871df965b50ec36de2f140b831888d0ad4c816c9cd713b98c85349e9cecca422af5b8cf163b3f1266d006a9ffdb7ba4b95bf7d98dae4a415441c67bbb843125a25f3681c7429a953751a7ecef875fc8363c8c21084c0d62dbc4046af2dbfb4cbc0710adf6d0ebfa9fdc8e6ceb8834077fdef68ac8400d1e19ccb7fe8af006ff1d83fca2cca69aae77646a18bfc6bd4e125a4228ef7925788a313c3f2be99f30cfe97ed61958ef3f307556ad9c9522d5d999ea5987743209a3a96a93e374f16e18d6adb3cfe2ac56f266ea7db01dfc510abab424ae67fd870831cdf82a97bfc3edb52149129f0381bad924e193e2bf3c17e5f25bb87856952adbd26e4dde7ab43bd22655494f3c73a7560f448fe155a95f90d28efc445f9402ce12a07cd39590a492f6c7086a7a8e26bbe486cc26ba9ca778742a2abce7b534aa9c8efe7b911f848f98731f3fdad4dda371146cdd599f710cd8a0163f7bb3964078e55a4b14064e40870ef7567d6989d9515af5628ef357a6d1b64378ed1bf3c970ef2d3b437cffb961203a2bdcf3174a39cddb2983e065fb6e71efe92af0ecf21fcd84c6f8e74b3c375b057676bb5986aeeebb615242feb7dfb82808cef23fdf0424732a5a7e99b8729945d0d0a450f35abfbb3995617e12e58a959911e16f27ce5501c89a278953e2ba4afb3bd8740a77dbcbbb5c3e96e10132ef4de82cf6b133c537abf5be2e00806ba143f5bb47787c34") ioctl$sock_SIOCSIFVLAN_SET_VLAN_INGRESS_PRIORITY_CMD(r0, 0x8983, &(0x7f0000000000)={0x2, 'gre0\x00', {0x3ff}, 0x6}) socket$nl_route(0x10, 0x3, 0x0) r9 = socket$unix(0x1, 0x1, 0x0) listen(r9, 0x5) socket$unix(0x1, 0x1, 0x0) socket$unix(0x1, 0x1, 0x0) socket$unix(0x1, 0x1, 0x0) 2.731784808s ago: executing program 1 (id=7508): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000006c0)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xfff3}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0x1, 0xd, 0x0, 0x9, 0x8}, 0x6, 0x1, 0x1, 0x4, 0x8, 0xe, 0x7, 0x1d, 0x3, 0x9, {0xa2d6, 0x200, 0xb, 0x40, 0x2, 0x1ff}}}}]}, 0x78}}, 0x10) r4 = bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000cc0)={0xffffffffffffffff, r3, 0x25, 0x8, @val=@tracing={0x0, 0x203}}, 0x20) bpf$BPF_PROG_DETACH(0x9, &(0x7f00000007c0)=ANY=[@ANYRES8=r2, @ANYBLOB="8d4123610f1753d4c26c9d2230599132ce8987a480dcbe059cb2f74fe91704507c1689306837e25ea53e7ba3ef14cf9e5c9d888f", @ANYRES32, @ANYRES32=r4, @ANYRESDEC=r3], 0x20) r5 = bpf$TOKEN_CREATE(0x24, &(0x7f00000003c0)={0x0, r4}, 0x8) r6 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000500), 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x1b, 0x2189, &(0x7f0000000100)=ANY=[@ANYRES64=r5], 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback=0x15, r6, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) r7 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) r8 = openat$cgroup_devices(r7, &(0x7f00000000c0)='devices.allow\x00', 0x2, 0x0) write$cgroup_devices(r8, &(0x7f0000000100)=ANY=[@ANYBLOB='b *:'], 0xa) unshare(0x20000400) r9 = bpf$MAP_CREATE(0x0, &(0x7f0000000780)=ANY=[@ANYBLOB="230000000800000002000000ffff000001"], 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x5, r9}, 0x38) r10 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='cpuset.memory_pressure_enabled\x00', 0x275a, 0x0) write$cgroup_subtree(r10, &(0x7f0000000080)=ANY=[], 0x10448) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x300000d, 0x40010, r10, 0x0) r11 = bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r12 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x6, 0x8, &(0x7f0000000180)=ANY=[@ANYBLOB="18020000070000000000000000000000850000004100000018110000", @ANYRES32=r11, @ANYBLOB="0000000000000000b702000001000000850000008600000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r12, 0x0, 0xe, 0x0, &(0x7f0000000200)="d94edc84d1320e395bc935f85521", 0x0, 0x3ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) r13 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1e000000000000000500000006"], 0x48) r14 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32, @ANYBLOB="0000000000000000000000000000000000000000f6522aaa70b492375e80fdb1b8461af1bfe4480696c7575c58bf3b01b8ade46d7ac5b621eeb93f3dcdf2113d1ae9807d388b3ca1b9fe4dbd28a2f5b2c6363493b909dc6699f762b9fd11bcb7bd6b04d7df527c3ff3f7331475a71b4fa6", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00'/28], 0x50) ioctl$NILFS_IOCTL_GET_BDESCS(r0, 0xc0186e87, &(0x7f0000000680)={&(0x7f0000000580)=[{0x0, 0x80000000, 0x9, 0x7, 0x80000001}, {0x2, 0x0, 0xe, 0x8, 0x7fff}, {0x5, 0x7, 0x7f, 0x9, 0x1}], 0x3, 0x28, 0x7fff, 0x91}) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r14, 0xffffffffffffffff}, &(0x7f00000000c0), &(0x7f0000000100)}, 0x20) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000300)={r14, 0xffffffffffffffff}, 0x4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000880)={0x11, 0x30, &(0x7f0000000940)=ANY=[@ANYBLOB="18000000000000000000000002000000b7080000000000007b8af8ff00000000b7080000020000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r16, @ANYBLOB="0000000000000000b70500000800000085000000a5000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000018110000", @ANYRES32=r15, @ANYBLOB="0000000000000000b7080000000080ff7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000001000000850000008200000018110000", @ANYRES32=r13, @ANYBLOB="0000000000000000b702000000000000850000008600000018110000", @ANYRES32=r15, @ANYBLOB="0000000000000000b7080000010000007b8af8ff00dd050000a20000ac00000007020000f8ffffffb703000008000004b7040000000000008500000082000000180000007f00000000000000090000009500000000000000796b846cc2da0bb58f4c5c802b2b92d12d8758effad99eff1aea864b92e2bace975af2ee4324cb658038442f7f58a303dcbafd41dff7202165ab918ce751a60b09334df8b77a32b9c8c7afc0f843395b4eec53441c07175b484c2b6e2d151ff93246bc202d886d07670e3937"], &(0x7f0000000240)='GPL\x00', 0x8, 0x0, 0x0, 0x0, 0x68}, 0x94) ioctl$sock_bt_hci(r0, 0x400448de, &(0x7f0000000000)) 1.806950343s ago: executing program 2 (id=7522): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r2, &(0x7f0000000080), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f00000000c0)={'vxcan1\x00', 0x0}) sendmsg$can_bcm(r2, 0x0, 0x40000) sendmsg$can_bcm(r2, &(0x7f0000000300)={&(0x7f00000002c0)={0x1d, r3}, 0x10, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYRES16=r0, @ANYRES32, @ANYRES16=r3, @ANYRES64=r3, @ANYBLOB="516d2e12343105d5acf5eac3ed12ae613785050df71fa3d3797537694581402399", @ANYRES32=r2, @ANYRES64, @ANYRESOCT=r3], 0x48}, 0x1, 0x0, 0x0, 0x20000080}, 0x0) 1.724932877s ago: executing program 1 (id=7523): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x8001}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0x4) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r1 = socket(0x10, 0x3, 0x0) sendto$inet6(r1, &(0x7f0000000080)="7800000018002507b9409b14ffff00000204be04020506050e020409430009003f000c200a0000000d0085a168d0bf46d32345653600648d0a00120002000a0006005ade4a460c89b6ec0cff3959547f509058ba86c902000000004a32000400160005000a0000000000e000e218d1ddf66ed538f2523250", 0x78, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000080)=@ccm_128={{0x303}, '\x00', "56df2295bfda5c4f9fecff61beaa8bb4", "a28265eb", "7f1f1c2ab4421d27"}, 0x28) writev(r0, &(0x7f0000001400)=[{&(0x7f0000000140)="58ddb007a47a8b1f458ab677d557ca50def8e5bc61dbc50bca64f7e76268cd64007095adfef77465b69ec03139854d6f03d5f9bd019fe046035ef7049f48fcc7321c34faca94ff08f59edaf2ab55eedcc278df823564618627217a527b971bdfa0afd948a6cdb9e05ccaef35c22047246a7b97a8e1b645e51c47b296c759c8dfd56beb8fa15c800ad060ab378a269557bc053d9be903", 0x96}, {&(0x7f0000000300)="2ea63d218bc1023b2e6eceeb92d548803a43d4dddc2433c76650030c188f490311ff86da69fab1539139f6dda31739c2bb4412dd471137e2a53496c5f7707e01ccfb826f2eb96895230862e11d56c19af139de912ac5e68a99080e428443fcfba8b0460290c6275affe9953a97260b0304fd7ef159c9cd30cae1bcc75d568d353575ec3b5293fb80de85c7562804230489274831b2c17dccccc523ada66a46", 0xfe86}, {&(0x7f0000000580)="63e73686513c53aec098be4b2dfc27b5be1f5f85f54c24efb8fc94ccaac29f1378e04daa49f8dcbda8b0faff57761a0ce8a311802e5dd07a159721cac7d2250f4359e04727386cc7d1a3e8bf93339f3df1340041f71046f2b1d9a80af70fb8246258d09c310af3bef017fde1fd8ce505cd4858549192a95e512257b6c676a7ebb41230e4e4fb23e9666bfdc8bc2ca77bbd11810836df4a6f3dbe3ee75c34b07c64e1af6d62d54fccb9f281eac16eca7129aa4355fd53", 0xb6}, {&(0x7f0000000500)="de21cff472aa580c2ee9f858", 0xfc96}, {&(0x7f00000014c0)="8fa68a274cab49b9c806172798e6a829701bb4eefee6919e0a30fa83a50170b6a3b499361f95ab6ff05f9001332b3a463b64282a924b0dcf6499c8c9b23d7290ab896ed6e2c7280dcda0336864e06d9570ea2cc78330859fa73080f5ddd3fd2b943287b312357816e9cfaa9e8941dd981f837506cabc6e016e507076819ff37d790c0b868166925649c9a74f4afc322ac971832fc3f12ba4dd3931c773134441bd46d9b10095eaabcfb846ac5fa9ea76f3547884091f073880656438f4406cf2051edb37139066dcaed45a544f5f92cccb1db0e2e503de3d4216d961dea1cbd9119a3f49b8bcdfe7078a7706296712eab5bd91b189f0140892b56c46912cc16dbe9fb469502eb67f36e8531dbfbed70615a836d32b5dabcf933201c97b29209e071433edb1b92ba47b514232654a36067c9b241737eb902ede1e18f99757339d2858bbe9c48484ec608e5fae534c4580d22fcd6ad28a786e0f5e675bc264ca03cf081038cb872e039100f94d25a7b5b9f2f18815e948aa65513c63a61e68c6a4ef4888980b54e3b7332112ee424e65172b2076528cd11cf63d7f4ff88c9eabf2c388bcb02beaa7e9c33cbe26149703fd3d511283739fa9638b1d6290a53b679227ee54d0fb232befdc92e59396c5bb818926e8a30a38a0aa358e1c818dbc27646fb4dc43168540cf724358d07124937cb3baa5365970e14240d727a8111d250202b39e8e3d6ff5e250eb09fdd83b8a129015567ae0f71a6b9166cd3718e3a83e711271f2ffd2d968e1153a38a8c5995e5c46fb8f22613690852bbea407b417eff9fd86e685025cbad82174164c3529407c4a27af5c6fdd911a4a87b7365655d5275c5719151b4440752785ff416a8e3a1f83f70e1f5d2538348b839f4e965e586e8b28a8aa94b79bc4e23d97d159af010918721be419234850fbeac52bb5de10a199f6591ab4deea9670e8b3d9f9341cddef4f3fe1b08a4f1943329cfa12c3972fc50525b8ebb5923235bbecd182d486169cf51e8c69259a404c0867328943358e95ad690a9c8eea73ddde677ebfe6f0d5f2e3a03541291e09a30bcce4b66550c28c6ba6cc431bb0fa87848652fb9319577a38a8ad45a87647b523fe3e452d90306c4c690b47d3c840ebbb1d96abb0735b21f557f5de101b7fbb7618d9739fabf89b8fb34c02493d1bfc31e80b1a9fcdac8aaf0fd69a0aee6f456705420ea3e7df30b478dd12ee137a6d6747750e5d6a7e5d308276c0ebd77377f000296108954f5371a9c84a01a18a76bee8ea849ddaf492a35f943ac395b9dddbd5ee05f6d75ac40237a0690584d7afaa3e117135b1406e03c9e49223ee48feccab18a3fd0325ed281bc70fb41b4f13905744afcbb588b8daee6d635007cf96dbd9549726c4cf9e350072702058bb533a4bb598a06e5505e8393b2793cc6ac2d66a0529b2aa7991a30f8bdd2bec5ac7ca2064e7b3a2a2d510de4675a7a6ce5d1729c2b98dbb08ab4a33cbd83484092d48b9c4fac7b7b6191057a2acf109565c6d49d9be0f1f2838650cdc36ad835fd78be83c6df052659ed1e8242d45891442a54205311da1814b18ed7fcc7c5bd979434040cd2133fd35ab946ff87e807a48a4802a1e4cce7cef4f2f555029cdecadaf99c5c3bf65db4be3940bfedb87cc491ac59d027496d87a792961f1f59cb72df3280b1845722282745fa77dfa1fce5e67e09466475c0e988719e528d39815cdfe0d16a6de1d871cfc4778ed47e8a7d3b2dfeea2083a41b061848324fe15e90c2dac3303992fdc42ba1a1995b87154a618660094a942074c5e02ed1a11293c5276b06439468f99c9d184c0152c44308c64c432277fe367a7fac9c9fb08d9dc8949e8ab9740a357fdc9d69df07375d011947b43072f554d63831af4319664e735c3eb08c0afe5120bd89b4d0654b6266aa4709ea2beb3dfd0449d2c3fde3f1098c9f73d994a741bb9f3c5322743c310fd7881856e5d529f4a9eb7dc43c0be6c36653b2cda92a7f07247450d666ca88863c6880d656eb8006bfe2f96543bf683fe3126e03ccf2120878a4fc46bdf64e11e323637ae0024a3d6fa52729591758c36a5ddeff1d1c5ba3e1bfedad1ff460f05ce276f1f3c2d70f9c6c5927a8fd15e65bc9c648b7dfccde510f5bf46bab8f2c5e21cb129dbf3f4df7a5a831f198f21fee429d73646eab00b1542941108592708fe8f53613d6b7dc1e4999374317b57c1e4a974fedd089c4295682d1a03d770b7639e80d25b0f428dfd3c46be492fc80b5c4913e476845a359dbe4187fd0027bd9fc814ba6a2877b61b637878f2af7ef18a0858fe5c7e75ecf92e735452456089efae8a13d3e6ac9d28c18cb1ca54522066edbf9e67ab4cf158b63c7b4d25146bafa14163cd4d171ad97f3ef93cfabae0557e237bbbe9cb80144b03f6fdb7d357d253235ddbde503829403657fdde516d3974091c40c6b9dd245f730458e1fd594f6b694af0150cbd31b6d0fb3bc04eb5096e704e039eecf4be9e93eb2f841878538ed1c46d015b1a792b599ed9225577460f72e6b4e271e5e6eeed34f69cfd76683e21d87e3ee8ed88df79901f9354823824fa6b67a91e2626161436327fc58879085d87db5dd94e09a0d24c7c381fb8fdc7198d2c2fece49e6496a119023852fca717d2ff2f9ed5e0715ddebd267ed0b8378ad852b03a539e6d03025b4a04f2483bdb79a4bd233ce3b6bd30d736ad0784b978861badc236e7106d23f26eac50e93d8ab012dc7c5d85d4f944aaa27378efc99572f932344cddc488ffa9210dc6b8f0cc29d07110362485eaa5b4b196a49c7080633c1befe802207ed0a172fa0b61fea6305f04d7b755a6e5e162aa8047f80647ad0bae8143226ce3aa8de3b0c0fc4e7cd6baab274fba47abf95ae88584778325250063855a4b9f0c966efa43dc0196d3dec619c490181c259b341b3fd370bab0b66af3cb1e9365cf6b62e44d939d36ffcc6badb924f44e86337360efbf4e3f9bd716adbc3f0ba6055ec9790504c9f3865f47e422b1c6ba16c07d0df618cc572b36ec8e519db90a499424a7d689e6fbcc9be1abd843512ec16540c6c7c6d6e2cf50ab2014e4208c2abb0ddfd2ef9dece79389f21d7a9985903f7f01b0394d268349fa41a487bacfe8deba2ffca815ad0b1c6ffa5af2eba6d9436ad298c4e11b68451c7ff001c02ddd3ceb153a865327845349e8b817aa8ed24924f49260f8209d0ddcacf5306d9222320776162fe8396914fa22c85bc261661fa547c3063e20ca37c0862c3b9abd3da9b02e3f58d89be00003509bae9b82f60975c0687c500bb213a580f6e9f08b207d7c31748e3fda05a0cc76b1fdd563610a2bb09a57020d85026a57a178c38839b5b88cd8434d1f0308d872c7356a6445de801ff14c133bda3b42b9ca099fb3ee0d5c7a835f56ed30aa75d47cd97c329b682879290faee167334500d2fe596564f3e4064f41cf3469aaae846f1e84f3d8a7f42d98d0b6b67913c376d6bbde3027aa41b753ace165f88379981685f918ada5043800b5e0a0865dcda94df85fefa9348d6ec4e1ffbd940d023fbbd3b77d5db572981dbe40cbae9f010c1ea02718b1c4b7d0447c9d83d1afea58097a0467d6cdd47aef05f97dab63462f6ea61f4b611040b30e7cf60a499aa9d0bc50c08463f25a47d2dbc958fe1d1cf2399dcf1952987b6fcbc97bf73b12177c374c8fd56c8228fc796c958687104f4eb9d46ab80eeeeedb7096a67ee440ae92a65cbf6f81939e3d1050c67245036b5dcc13d577fbb4d9c3fbf2e2e61aa154074ae225c54e23289c4ef41a07a49a9d40f3103f4c9dfd4d750cc646adadd2e1fe24c74ce099d753d4c59d806a0b7f576ac37ac58a51a120f93162c43d16c1f7e5289c75f5f0a5b838d020040c9ce512ca35d08f42acd24cdbc2e6b1ac3c6809a5ed9e272155e9fa55349bc3ce0e3f2d1624dc60e2396b954587bbab275f38911e86b826b85730c6670a92a221cdcbf18ee0c44aec4591fcd12204b3049a1b5da1215a4cf88ecbe2d877ef975f4f661999d17d7d9ec14e0895ce25034dac4705d50ae42ca162778d0dcfc4e9180517be0daca5deb10773f93e2c61a5fe9b823218a97c35d0d7b436b2e1afb670b5a4c6dacd401afd1832c1dd96e8eba7734954070c6796cc80707441404cfe95fabf214bf03a6e4643ca559c2b8dcf1fa871114f3dc973a056c9aee7cd0ed4cbaf18298377e750869551632c1713bd8372e3f11fa02edf0a68d2c01245459d9e78597ac1eec75064024c1f3c98260d34b611ba8fa4b2022babd44b76ea70c718df8268dba447038b1539f0499603cf2d79bcc49c35a8cf38892d982d153d72253a22ae68da65e84d6399e81a14ebf89ba446630814d9dcf8914acafc8603a5396167c5aa99814af62c1c39a6ba76ad2c6c51a6d56d89fbda5334e626540ef1b1ecad53247531fcdd661a48d28a6d48bac8ef70c888b00db57edceee94425df5161e1b1a1bec9c897e01867442ed8ba000b5f75832a8ec57ef0737994b95f40eac48f3c8da5db80e965fcdf3f0bbb4439a7123b59987f0fdac96bc7ce09c013562ff7c0cb23a882828e45a51f7e748db90c5eaacfdf3657d11a348f747ddd860387de41be3376a5dabf4296bc05282cb73fcd60c4a4148d9e872ae86e30b22db1ce5452ad9fe3fea029f94a583d301e74eac1818da3f1279c63690db6e7166ddaacd1278716fa3221daaa27c98fd97b88e63208d604505ad8f31bd2b83a19f89480b71198d8a31c89cadd258ce338afe1a26b0db248c1a39fe027716e417e45bb6c9a68cab1cd6c3445e9796ee1003650e97eccdadc9bea540e2c8253652c8f1586ba7e508cd29d53467bad11eef729796dbe83d3fc0bc15762c2f1de34c6380a6725f94600a82d87ccf80948babcadec31ca654671d17de360f20aaf04f4d44951661fe8fe7731174ec3aaf330aebeaed9620f694859785a36c5f787ce35e4425ed3387710fa346f04db11255c6985fa4cdbe54d25c942264b3383d60903bd2677611850fe125b", 0xdf3}], 0x5) 1.64996423s ago: executing program 1 (id=7526): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0xffff}, 0x50) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000001c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000100000c02000000000000000000000d0000000000005f"], 0x0, 0x34}, 0x28) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000100)=ANY=[@ANYBLOB="180000000100000000000000801800009500000000000000"], 0x0, 0xc, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r1, 0x8, &(0x7f00000000c0)={0x0, 0x1}, 0x8}, 0x94) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000500)=@bpf_ext={0x1a, 0xf, &(0x7f00000002c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8792}, {{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {0x85, 0x0, 0x0, 0xb8}}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000180)='GPL\x00', 0x7, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x19, r1, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x1, r2, 0x0, 0x0, 0x0, 0x10, 0x4a6}, 0x94) 1.640021365s ago: executing program 2 (id=7527): r0 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r0, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x1, {0x41}}, 0x10) listen(r0, 0x0) (async) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000440)=[{&(0x7f0000000280)="68000000000905040000000000000000020000000900010073790030000000001400028006000100000a0000050002000600000008000500000000002c0004800800010000000001200002800c000100706f6c69637930000800020000000002080003000000001e", 0x68}], 0x1}, 0x4080) r2 = socket$tipc(0x1e, 0x5, 0x0) sendmsg$tipc(r2, &(0x7f0000000240)={&(0x7f0000000080)=@name={0x1e, 0x2, 0x0, {{0x41}}}, 0x10, &(0x7f0000000340)=[{&(0x7f00000002c0)='/', 0x1}], 0x1, 0x0, 0x0, 0x40}, 0x0) (async) close(0xffffffffffffffff) 1.594027387s ago: executing program 1 (id=7528): r0 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r2, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="0500000004000000040000000001000000000000", @ANYRES32=0x0, @ANYBLOB="01000000000000000001000000ff0000000000008035f70f52474f9d609d0ecb2d9a6f80a144a8fe4007f5eb26499107c0a990a5d1bc38669e73d34a385a2de140e3576835fa7a6ee3dea3df9f2786cab4b6cd742f54cb5284c13205ed1fa847fb7792124be901952c29feff73cd411b49ae64872972679c649679fd5039fd89ae7b2607d20862b3df5a811850b30533137adfb8c7bef991ad1c297065385c7fc4", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00'/28], 0x50) (async) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="0500000004000000040000000001000000000000", @ANYRES32=0x0, @ANYBLOB="01000000000000000001000000ff0000000000008035f70f52474f9d609d0ecb2d9a6f80a144a8fe4007f5eb26499107c0a990a5d1bc38669e73d34a385a2de140e3576835fa7a6ee3dea3df9f2786cab4b6cd742f54cb5284c13205ed1fa847fb7792124be901952c29feff73cd411b49ae64872972679c649679fd5039fd89ae7b2607d20862b3df5a811850b30533137adfb8c7bef991ad1c297065385c7fc4", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00'/28], 0x50) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0100000004000008040000000001000000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00'/28], 0x48) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x1, 0xc, &(0x7f0000000280)=ANY=[@ANYBLOB="18000000000000000000000000000000611800000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000150802000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000bfa20000000000000702000001ff0000009500000000000000"], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r5, 0x0, 0xe, 0x0, &(0x7f00000003c0)='\x00'/14, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) recvmsg$unix(r1, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) ioctl$BTRFS_IOC_BALANCE(r1, 0x5000940c, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000380)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x90, 0x90, 0x9, [@type_tag={0x2, 0x0, 0x0, 0x12, 0x1}, @volatile={0x7, 0x0, 0x0, 0x9, 0x3}, @fwd={0xf}, @array={0x0, 0x0, 0x0, 0x3, 0x0, {0x2, 0x4, 0x3}}, @enum={0x4, 0x1, 0x0, 0x6, 0x4, [{0x3, 0x4}]}, @int={0xb, 0x0, 0x0, 0x1, 0x0, 0x74, 0x0, 0x76, 0x1}, @enum={0xe, 0x3, 0x0, 0x6, 0x4, [{0x3, 0x808000}, {0x1, 0x8c56}, {0xe, 0x80000000}]}, @float={0x7, 0x0, 0x0, 0x10, 0x8}]}, {0x0, [0x61, 0x0, 0x61, 0x0, 0x0, 0x2e, 0x2e]}}, &(0x7f00000002c0)=""/163, 0xb1, 0xa3, 0x1, 0x4}, 0x28) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r7, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r6, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) (async) recvmsg$unix(r6, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r9, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r8, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)}, 0x12145) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r11, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) (async) sendmsg$inet(r11, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg(r10, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001dc0)=""/4096, 0x1000}, 0x0) (async) recvmsg(r10, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001dc0)=""/4096, 0x1000}, 0x0) r12 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r12, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000540)=ANY=[@ANYBLOB="440000001000ffff22bd7000fbdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="42000000212000001c0012800c0001006d6163766c616e000c0002800800030001000000080046"], 0x44}, 0x1, 0x0, 0x0, 0x1}, 0x8000002) (async) sendmsg$nl_route(r12, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000540)=ANY=[@ANYBLOB="440000001000ffff22bd7000fbdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="42000000212000001c0012800c0001006d6163766c616e000c0002800800030001000000080046"], 0x44}, 0x1, 0x0, 0x0, 0x1}, 0x8000002) socket(0x1, 0x803, 0x0) 1.218082662s ago: executing program 4 (id=7532): socket(0x10, 0x3, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1002}) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xc1842, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$TUNSETFILTEREBPF(r2, 0x800454e1, &(0x7f00000000c0)) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={0x0}, 0x1, 0x0, 0x0, 0x4000811}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001c00)=@newtaction={0x18, 0x30, 0x871a15abc695fb3d, 0x8000000, 0x25dfdbfd, {}, [{0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x4}, 0x20000015) setsockopt$sock_int(r1, 0x1, 0x21, &(0x7f0000000040)=0x482, 0x4) sendmmsg(r1, &(0x7f00000002c0), 0x40000000000009f, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) ioctl$XFS_IOC_PATH_TO_FSHANDLE(0xffffffffffffffff, 0xc0385868, &(0x7f0000000180)={0xffffffffffffffff, &(0x7f0000000000)='cgroup\x00', 0x101, 0x0, 0xf, 0x0, 0x0}) r3 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFDSTADDR(r3, 0x8918, &(0x7f0000000040)={'ipvlan0\x00', {0x2, 0x4e20, @broadcast}}) ioctl$sock_inet_SIOCSIFDSTADDR(r3, 0x8918, &(0x7f0000000080)={'ipvlan1\x00', {0x2, 0x4e20, @broadcast}}) bpf$MAP_CREATE(0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="0e0000000400000004000000ffffffff00000000", @ANYRES32=0x1, @ANYBLOB="fdfaffff00"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) r4 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000080)={r4}, 0xc) mmap(&(0x7f0000002000/0x2000)=nil, 0x2000, 0x8, 0x32, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000500)={0x11, 0x0, 0x0, &(0x7f0000000000)='GPL\x00', 0xa, 0xde, &(0x7f0000000340)=""/222, 0x0, 0x1}, 0x94) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000140)={'bond_slave_1\x00', 0x0}) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="1c0000005e0001002bbd7000ffdbdf2500000000", @ANYRES32=r7, @ANYRES32=r6], 0x1c}, 0x1, 0x0, 0x0, 0x831e368c771a0719}, 0x400c080) r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r9, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) 1.017610443s ago: executing program 4 (id=7535): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000000000000006000000000605d0000000000000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) 1.017106269s ago: executing program 4 (id=7536): r0 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e24, @multicast2}, 0x10) connect$inet(r0, &(0x7f0000000140)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x21}}, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000000), r2) sendmsg$TIPC_NL_BEARER_DISABLE(r2, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000003c0)={0x18, r3, 0x1, 0x0, 0x4, {}, [@TIPC_NLA_BEARER={0x4}]}, 0x18}}, 0x0) sendmsg$TIPC_NL_UDP_GET_REMOTEIP(r1, &(0x7f0000000400)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000240)={0x144, r3, 0x2cee70753e8fda35, 0x70bd25, 0x25dfdbff, {}, [@TIPC_NLA_MEDIA={0x58, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x44, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8e0}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x15c}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}]}, @TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e22, 0x1000, @mcast1, 0x3}}, {0x20, 0x2, @in6={0xa, 0x4e23, 0x800, @dev={0xfe, 0x80, '\x00', 0x27}, 0x1}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x80000000}]}, @TIPC_NLA_BEARER={0x68, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x6}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x20}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}]}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x8}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}]}, @TIPC_NLA_BEARER_NAME={0xc, 0x1, @l2={'eth', 0x3a, 'wg2\x00'}}]}, @TIPC_NLA_NET={0x18, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0x40}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x2}]}]}, 0x144}}, 0x4000004) writev(r0, &(0x7f0000000200)=[{&(0x7f00000000c0)='X', 0x8030000}], 0x11) shutdown(r0, 0x1) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt(r4, 0x84, 0x80, &(0x7f0000000000)='\x00\x00\x00\x00\t\x00\x00\x00', 0x8) r5 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r5, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000f80)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, &(0x7f0000000180)=0x10) getsockopt$inet_sctp_SCTP_MAX_BURST(r5, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000001080)=0x8) setsockopt$inet_sctp6_SCTP_SET_PEER_PRIMARY_ADDR(r4, 0x84, 0x5, &(0x7f0000001840)={r6, @in6={{0xa, 0x4e22, 0x1, @remote, 0x4}}}, 0x84) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f0000000040)={r6, 0x365, 0x1}, 0x8) 1.000341392s ago: executing program 0 (id=7537): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r2, &(0x7f0000000080), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f00000000c0)={'vxcan1\x00', 0x0}) sendmsg$can_bcm(r2, 0x0, 0x40000) sendmsg$can_bcm(r2, &(0x7f0000000300)={&(0x7f00000002c0)={0x1d, r3}, 0x10, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYRES16=r0, @ANYRES32, @ANYRES16=r3, @ANYRES64=r3, @ANYBLOB="516d2e12343105d5acf5eac3ed12ae613785050df71fa3d3797537694581402399", @ANYRES32=r2, @ANYRES64, @ANYRESOCT=r3], 0x48}, 0x1, 0x0, 0x0, 0x20000080}, 0x0) 950.791938ms ago: executing program 0 (id=7538): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0xffff}, 0x50) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000001c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000100000c02000000000000000000000d0000000000005f"], 0x0, 0x34}, 0x28) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000100)=ANY=[@ANYBLOB="180000000100000000000000801800009500000000000000"], &(0x7f0000000000)='GPL\x00', 0xc, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r1}, 0x94) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000500)=@bpf_ext={0x1a, 0xf, &(0x7f00000002c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8792}, {{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {0x85, 0x0, 0x0, 0xb8}}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000180)='GPL\x00', 0x7, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x19, r1, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x1, r2, 0x0, 0x0, 0x0, 0x10, 0x4a6}, 0x94) 905.771282ms ago: executing program 0 (id=7539): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x4001}) r1 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8916, &(0x7f0000000080)={'syzkaller0\x00', {0x2, 0x0, @rand_addr=0xac140001}}) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', 0x1}) r2 = socket$inet_sctp(0x2, 0x5, 0x84) bind(r2, &(0x7f0000000000)=@in={0x2, 0x3210, @rand_addr=0xac140001}, 0x10) listen(r2, 0x5) write$tun(r0, &(0x7f0000000140)=ANY=[@ANYBLOB="00000800010000000000140008004500003c000000404084ca2502020202ac14000104d2321000000000000000000a00001c"], 0x4a) 829.371369ms ago: executing program 4 (id=7540): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) getsockopt$inet6_tcp_int(r0, 0x6, 0x5, 0x0, &(0x7f0000001300)) socket(0x1a, 0x6, 0x3) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000100)={0x6, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000002000000000000000008082295"], &(0x7f0000000240)='syzkaller\x00'}, 0x94) syz_emit_ethernet(0x8e, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaac437bf8cb64c86dd6bcce16400000000000000000001000000000000000000000000000000002c02000000000000050200090502000005020006c204"], 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0xffffffffffffff6b, &(0x7f0000000000)="ff", 0x0, 0x149c, 0x503, 0x0, 0x0, 0x0, 0x0, 0x2, 0xffff80fe}, 0x48) 702.859614ms ago: executing program 2 (id=7541): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="4800000041000501010000000000000001010000000000001c0001000600060008000000100007007f0000017f000001910040001400020005000c"], 0x48}, 0x1, 0x0, 0x0, 0x4044850}, 0xc040) (async, rerun: 32) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) (async, rerun: 32) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=@base={0x12, 0x3, 0x4, 0x2}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r2}, &(0x7f0000000040), &(0x7f0000000140)=r1}, 0x20) (async) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000600)={{r2}, &(0x7f0000000580)=0x2, &(0x7f00000000c0)=r1}, 0x20) (async) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000000)={r2, &(0x7f00000001c0)="1a36e76465bbe6", &(0x7f00000002c0)=""/215}, 0x20) 682.079552ms ago: executing program 1 (id=7542): r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb010018000000000000003400000034000000020000000000000000000003000000000300000002000000ffff0f00000000000000000105000000100000020000080000000009020000000000"], 0x0, 0x4e}, 0x28) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x44040}, 0x4000000) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a80000000060a010400000000000000000a0000010900010073797a310000000054000480500001800b00010074617267657400004000028008000240000000012c0003007339f2f10455afb9fdd672bad09dfb78c7699c74e891a0c70000000000000000000000000000000008000100544545000900020073797a320000000014000000110001"], 0xa8}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840) close(0x3) r2 = socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000180)=ANY=[@ANYBLOB="4800000010001fff000000008100000000000000", @ANYRES32=0x0, @ANYBLOB="00000000003f0000200012800b00010067656e657665000010000280060005004e24000004000e0008000a00", @ANYRES32], 0x48}, 0x1, 0x0, 0x0, 0x2000c0c1}, 0x40000) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) pipe(&(0x7f0000000040)={0xffffffffffffffff}) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000640)={r3, &(0x7f0000000000), &(0x7f0000000600)=@udp=r4, 0x2}, 0x20) r5 = syz_init_net_socket$llc(0x1a, 0x2, 0x0) bind$llc(r5, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0xff, 0x3, 0x9}, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='blkio.bfq.io_queued\x00', 0x275a, 0x0) write$cgroup_int(r6, &(0x7f0000000000), 0xffffff6a) sendfile(r5, r6, 0x0, 0xffffffff000) r7 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='hugetlb.2MB.rsvd.usage_in_bytes\x00', 0x0, 0x0) getsockopt$CAN_RAW_FILTER(r7, 0x65, 0x1, &(0x7f0000000040)=[{}, {}, {}, {}, {}, {}, {}, {}, {}], &(0x7f00000000c0)=0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x3, 0x16, &(0x7f0000000300)=ANY=[], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @sched_cls=0x2e, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, r7}, 0x94) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000600)=@base={0xf, 0x81, 0x0, 0x7, 0x20500, 0x1, 0xffffffff, '\x00', 0x0, r0, 0x1, 0x3, 0x3}, 0x50) r9 = bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="190000000400000004"], 0x50) r10 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r9, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008900000b703000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x4, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000480)={{r9}, &(0x7f0000000240), &(0x7f0000000340)=r10}, 0x20) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000007c0)=@bpf_lsm={0x1d, 0x12, &(0x7f0000000440)=@raw=[@btf_id={0x18, 0xa, 0x3, 0x0, 0x2}, @ringbuf_query, @map_val={0x18, 0xb, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x401}, @alu={0x4, 0x1, 0xb, 0x7, 0x4, 0xfffffffffffffff4, 0xffffffffffffffff}, @initr0={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, @map_val={0x18, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x40}, @tail_call], &(0x7f0000000500)='syzkaller\x00', 0x9, 0x0, &(0x7f0000000540), 0x41100, 0x9, '\x00', 0x0, 0x1b, r4, 0x8, &(0x7f0000000580)={0x9, 0x4}, 0x8, 0x10, &(0x7f00000005c0)={0x5, 0x0, 0x7, 0x4}, 0x10, 0x0, 0x0, 0x5, &(0x7f0000000680)=[r6, r2, r7, r8, r9], &(0x7f0000000740)=[{0x3, 0x1, 0xf, 0xb}, {0x1, 0x4, 0x6, 0x7}, {0x4, 0x3, 0xb, 0x2}, {0x4, 0xb, 0xe, 0x9}, {0x3, 0x2, 0x8000, 0xb}], 0x10, 0xe}, 0x94) r11 = socket$inet6(0xa, 0x2, 0x0) r12 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r13 = syz_genetlink_get_family_id$nbd(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$NBD_CMD_RECONFIGURE(r12, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r13, @ANYBLOB="63812bbd7000fcdbdf25030000000800010000000000280007800c"], 0x44}, 0x1, 0x0, 0x0, 0x440c0}, 0x40040) setsockopt$inet6_udp_int(r11, 0x11, 0x67, &(0x7f0000000240)=0x5, 0x4) connect$inet6(r11, &(0x7f0000000000)={0xa, 0xfffe, 0x8, @mcast2, 0x9}, 0x1c) sendmmsg$inet6(r11, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000000c00)=[{&(0x7f0000000700)="e42e0b9b6be4", 0x6}], 0x1}}], 0x1, 0x4000000) 473.651199ms ago: executing program 2 (id=7543): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01080000000000000000030000000900010073797a310000000020000000020a01040000000000080000000000000900070073797a3000000000340000001f0a030000000000000000000300000008000340000000000900010073797a3100000000090002"], 0x9c}}, 0x0) 473.073514ms ago: executing program 0 (id=7544): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newtaction={0xe6c, 0x30, 0x1, 0x70bd2b, 0x25dfdbfd, {}, [{0xe58, 0x1, [@m_pedit={0xe54, 0x1, 0x0, 0x0, {{0xa}, {0xe28, 0x2, 0x0, 0x1, [@TCA_PEDIT_PARMS={0xe20, 0x2, {{{0x4, 0x3, 0x7, 0x6, 0x1}, 0x3, 0x1}, [{0xab8, 0x3, 0x3, 0x1ff, 0x2, 0x4}, {0x3, 0xff, 0x2, 0x401, 0x8, 0xe9d}, {0x3, 0x5, 0x6, 0xe5, 0xffffff0d, 0x6}, {0x0, 0x7, 0x10000, 0x9, 0x3, 0x1c000}, {0x9, 0x86, 0x3000000, 0x4, 0xd, 0xff}, {0x62b1, 0x1, 0x7f, 0xc, 0x101, 0xfffffffb}, {0x1, 0x6, 0xfffffffb, 0x4, 0x2, 0x2}, {0x0, 0x2, 0xd, 0x6, 0x2, 0x3}, {0x9, 0xfffffff8, 0x3, 0x4233, 0x3, 0x8}, {0x7, 0x7fff, 0x0, 0x80000001, 0x387, 0x7}, {0x0, 0x8, 0x7, 0x8, 0x4, 0xfffffff7}, {0x5, 0x4, 0x9, 0x9, 0x1000, 0xffff}, {0x7, 0xd8, 0x6, 0x0, 0x4, 0xacd1}, {0x7, 0x0, 0x2, 0x0, 0x200, 0x2c378a9f}, {0xffff, 0x7, 0x4, 0x6, 0xc0000000, 0x1}, {0x7fffffff, 0xad, 0x0, 0x4, 0x2}, {0x6, 0xfe, 0x8, 0x9, 0x9, 0x401}, {0x3, 0x4, 0x8, 0x40, 0x8}, {0x8, 0x8f, 0x8001, 0xc2e, 0xf52f, 0xffff3b50}, {0xffffff00, 0xffffffff, 0x8, 0x9, 0xff, 0xb1}, {0x8, 0x18000000, 0x2a, 0xc6f, 0x7, 0x6}, {0x0, 0x7, 0x7b, 0x4, 0x9, 0x8d}, {0x200, 0x1, 0x7, 0x1, 0x6, 0xfffffffa}, {0x0, 0x44, 0x6, 0x0, 0x9, 0x2}, {0xfffffff8, 0x8, 0x4, 0x3, 0x5, 0x7d}, {0x3ff, 0xffff091e, 0x8925, 0x33e8, 0x3, 0x4}, {0x7, 0xd1, 0x8, 0x1, 0xe, 0xcc}, {0x200, 0x1, 0x84e, 0x4, 0x3e6, 0x9}, {0x6, 0xeb09, 0x2a082b7e, 0x1, 0x9, 0x7}, {0x10000, 0xb8, 0x3, 0x9, 0x9, 0xe9d}, {0x3, 0x3, 0x6, 0x0, 0x3, 0x8333}, {0x8000, 0x2539, 0x5, 0x6, 0x4, 0x3}, {0x5, 0x2, 0x2, 0x1, 0x4, 0x2}, {0x5, 0x4, 0xffffffd0, 0x4, 0x12000000, 0x4}, {0x1812, 0x8, 0x9c, 0x2, 0xf, 0x101}, {0xffffff71, 0x9c7e, 0x0, 0x7, 0xa17a, 0xde}, {0x9, 0x3, 0xa3b, 0x7fff, 0x5, 0xffffff08}, {0x0, 0x7, 0x0, 0x7, 0x3ff}, {0xb47, 0x7, 0x9, 0x86f7, 0x9, 0x4}, {0x3, 0x7, 0x2, 0xe3, 0x7, 0x4}, {0xffffffff, 0x6, 0x1, 0x35d, 0x29200000, 0x6}, {0x0, 0xf11, 0x5, 0x6, 0x4, 0x3}, {0x4, 0x100, 0x0, 0x79f, 0xfffff1c8, 0x70}, {0x0, 0x400, 0x7, 0x9, 0x4, 0x10000}, {0x5, 0x1, 0x5, 0x9, 0x8000, 0xad934800}, {0x4b, 0xf2, 0x7, 0xe563, 0x4, 0x7}, {0x5, 0x6, 0x7fff, 0x9, 0x365, 0x2}, {0x5, 0x5, 0x2, 0x3, 0x43, 0x1}, {0x2, 0x6, 0x80, 0x3, 0x7fff, 0x7}, {0x3, 0xd734, 0xfffffff7, 0x9, 0x40, 0xf}, {0x5, 0x800, 0xb03c, 0xf, 0x8, 0x8}, {0x6, 0x2, 0x1, 0x8, 0x6, 0xa4}, {0x1, 0x4, 0x6, 0x4, 0x8001, 0x1}, {0x6, 0x40, 0xe4, 0x5e, 0x6, 0x754}, {0x9, 0x5, 0x8, 0x4, 0x0, 0xfffffffb}, {0xdb3, 0x9, 0x2, 0x5, 0xb, 0xff}, {0x9, 0xffffffff, 0xd7, 0x2, 0xfd5, 0xfbd}, {0x1ff, 0x8, 0x10000, 0x24, 0x101, 0x3}, {0x2000000, 0x7e99, 0x0, 0x7ff, 0x0, 0x6}, {0x100, 0x0, 0xa0, 0x8, 0x0, 0x7}, {0x3, 0x2, 0x5, 0x7, 0x10, 0x9}, {0x7, 0x9, 0x265d, 0x100007, 0x3, 0x4}, {0x6, 0x1000, 0x6, 0x1, 0x5, 0x6}, {0x80, 0x7, 0x4, 0x9, 0xc2, 0x2}, {0x9, 0x1, 0x4, 0x80000000, 0xfffff238, 0xffff7c49}, {0xc, 0x10001, 0x6, 0x2, 0xfffff5a6, 0x8}, {0x8001, 0x81, 0x7, 0x6, 0x4, 0x4}, {0x2, 0x2, 0x39a3, 0x7, 0x5, 0x9}, {0xfffffff9, 0x5, 0x2000000, 0x1a, 0x200, 0x4}, {0x1, 0x9, 0xb0, 0x7, 0x400, 0x2}, {0x4, 0x7, 0x40, 0x905, 0x5, 0x4}, {0x61, 0x0, 0x4, 0x9, 0x2, 0x6}, {0xd0, 0x1, 0x2, 0x4, 0x9, 0x3}, {0x6, 0x80000000, 0xfff, 0x0, 0x43cd, 0x138a2e31}, {0x26, 0x3, 0x5, 0xd01, 0x9, 0xe7}, {0x7, 0x5, 0xed0e, 0x6, 0x2000, 0x4}, {0x400, 0xff, 0x1a6d, 0x64, 0x2, 0x7}, {0x239, 0x71, 0x5, 0x8, 0x9, 0x3}, {0x101, 0xfffffff8, 0xf4, 0x5, 0xe, 0x1000}, {0xfffffff8, 0x1000, 0x0, 0xff, 0x2, 0xfffffffa}, {0x80000000, 0x10000, 0x1, 0xe51e, 0x8, 0xfffffffd}, {0x0, 0x1, 0x1, 0x29, 0x5, 0x200}, {0x3, 0x400, 0x0, 0x3, 0x9, 0x7f}, {0x3, 0x0, 0x0, 0x9, 0x9, 0x4}, {0x10, 0x0, 0x7, 0x2, 0x8, 0x4}, {0x3, 0x40, 0x7fff, 0x46, 0x5, 0x7ea}, {0x5, 0x86d6, 0x3, 0xf, 0x401, 0x3ff}, {0x7, 0x0, 0x8, 0x1000, 0x3, 0x9}, {0x8, 0x9, 0x155a, 0x4, 0x3, 0x5}, {0x2, 0x7, 0x9, 0xffffffff, 0x6bd, 0x800}, {0x3d13, 0x5, 0x118, 0xfff, 0xff, 0x1}, {0x28, 0x4, 0x0, 0x7, 0x7, 0xad}, {0x8, 0x0, 0x5, 0x0, 0x8, 0x800}, {0x1, 0x400, 0x0, 0x4, 0x1, 0x8}, {0xfffffd18, 0x9, 0x401, 0x4, 0x4, 0x14}, {0x800, 0xa8f, 0x2, 0xfff, 0x2, 0x3}, {0x3, 0xff, 0x2, 0x7, 0xfffffffa, 0x9}, {0x401, 0x0, 0x5, 0x4, 0x7ff, 0x10000001}, {0x4, 0xffff8001, 0x3, 0x9, 0x3, 0xb}, {0x1, 0x1, 0x3bbb, 0x0, 0x9, 0x83}, {0x8, 0x2, 0x6, 0x8001, 0x40, 0x5}, {0x5, 0x7, 0x1000, 0x8, 0x3, 0x7}, {0x40000000, 0x1, 0x2, 0x4, 0x7, 0x4}, {0x7fffffff, 0x3, 0xfffffffc, 0x3, 0x0, 0xe}, {0x3, 0x515, 0x1, 0x23b2, 0xf0, 0x9}, {0x17, 0xfffffffb, 0x10000, 0x1ff, 0x10, 0x8000}, {0x8e, 0x8, 0xcc, 0x0, 0x7, 0x4}, {0x2, 0x6, 0xbbe, 0x9, 0xffff7fff, 0x8000}, {0x9, 0xfffffff0, 0x0, 0x7f, 0x3444bb35}, {0x9, 0x1ff, 0x3, 0x4544, 0x1, 0x1}, {0x385, 0x5, 0x9, 0xefffffff, 0x1000, 0x6}, {0xccef, 0x6, 0x8, 0x8001, 0x4}, {0x180000, 0x2, 0x7, 0x6, 0xff, 0xfff}, {0x400, 0x1, 0x400, 0xc, 0x1, 0x8}, {0x30, 0x6, 0xfffffffa, 0x400, 0x401, 0xbd65}, {0x1, 0x0, 0xd031, 0x4, 0x6, 0x1000}, {0x8d, 0x10000, 0x0, 0x2, 0x8, 0x9}, {0x5, 0xfffffff9, 0xd, 0x10, 0x37e8, 0x4}, {0xffff5bb1, 0x36ec, 0x7d, 0x8, 0x2, 0x7fff}, {0x7, 0x1, 0x5, 0x4, 0x3, 0xf6535ff5}, {0x80, 0x2, 0x7, 0x6, 0x5, 0x81}, {0x2, 0x3, 0x8, 0x4, 0x1, 0x1000}, {0x10000, 0x3ff, 0x4, 0x101, 0xfff, 0xc5}, {0x10001, 0x7, 0x10000, 0x8, 0x8d4, 0x2618}, {0x6, 0x2, 0x0, 0x7f, 0x8, 0x1}, {0xd3a1, 0x9, 0x7, 0x80000000, 0x8, 0x80000000}, {0x9, 0x200, 0xdfca, 0x5, 0x94d, 0xa}, {0x35f, 0xaa, 0x9, 0x40, 0x66c, 0x9}], [{0x1}, {0x4}, {0x3}, {0x4, 0x1}, {0x5}, {0x3, 0x1}, {0x0, 0x1}, {0x1, 0x1}, {0x5, 0x1}, {0x0, 0x1}, {0x0, 0x1}, {0x1, 0x1}, {}, {0x3}, {0x2}, {0x0, 0x1}, {0x5, 0x1}, {0x1, 0x1}, {0x3}, {0x0, 0x1}, {0x4, 0x1}, {0x0, 0x1}, {0x2}, {0x4, 0x1}, {}, {0x0, 0x1}, {0x3, 0x1}, {0x1}, {0x1, 0x1}, {0x5, 0x1}, {0x4, 0x1}, {0x3}, {0x3, 0x1}, {}, {0x5}, {0x3}, {0x2}, {0x4, 0x1}, {0x3}, {0x3, 0x1}, {0x1, 0x1}, {0x2, 0x1}, {0x2}, {0x2, 0x1}, {0x5, 0x1}, {0x4}, {0x1, 0x1}, {0x3}, {0x5, 0x1}, {0x0, 0x1}, {0x4}, {0x3, 0x1}, {0xbf717c5836561369}, {0x3, 0x1}, {0x4, 0x1}, {0x2}, {0x1}, {0x4}, {0x2}, {0x0, 0x1}, {}, {0x3, 0x1}, {0x2, 0x1}, {0x5, 0x1}, {0x4, 0x1}, {0x0, 0x1}, {0x1, 0x1}, {0x4, 0x1}, {0x5, 0x1}, {0x3, 0x1}, {0x4}, {}, {0x1}, {0x6}, {0x0, 0x1}, {0x3}, {0x78c0603c8fa1a1b4, 0x1}, {0x0, 0x1}, {}, {0x5}, {0x3}, {0x3}, {0x0, 0x1}, {0x2}, {0x5, 0x1}, {0x7a479a5d4662f5b3}, {0x4}, {0x0, 0x1}, {0x2, 0x1}, {0x5, 0x1}, {0x2}, {0x5, 0x1}, {0x4}, {}, {0x3, 0x1}, {0x5}, {}, {0x1}, {0x2, 0x1}, {0x2, 0x1}, {0x2, 0x1}, {0x3, 0x1}, {0x5, 0x1}, {}, {0x0, 0x1}, {0x2}, {0x0, 0x1}, {0x3}, {0x3, 0x1}, {0x3}, {0x5, 0x1}, {0x0, 0x1}, {0x5, 0x1}, {}, {0x5, 0x1}, {0x3, 0x1}, {0x5, 0x1}, {0x2}, {0x2, 0x1}, {}, {0x4}, {0x2, 0x1}, {0x5}, {0x5, 0x1}, {0x1}, {0x1}, {0x6}, {0x1}]}}, @TCA_PEDIT_KEYS_EX={0x4}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1, 0x3}}}}]}]}, 0xe6c}, 0x1, 0x0, 0x0, 0x4081}, 0x2400c800) 451.390161ms ago: executing program 3 (id=7545): sendmsg$IPVS_CMD_ZERO(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0x84, 0x0, 0x20, 0x70bd27, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_SERVICE={0x20, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_FWMARK={0x8}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@rand_addr=0x64010102}]}, @IPVS_CMD_ATTR_DAEMON={0x50, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x9}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0xb}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @ipv4={'\x00', '\xff\xff', @multicast1}}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x9}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x1}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @remote}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x6}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x3}]}]}, 0x84}}, 0xc0) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x3, 0x6, &(0x7f0000000040)=ANY=[@ANYBLOB="050000000000000073119c00000000008510000002000000850000000200000095000000000000009500a50500000000"], &(0x7f0000000080)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x6}, 0x94) 413.94143ms ago: executing program 4 (id=7546): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="3c02000019000100000000000000000000000000000000000000010000000000000000000000000000000000000000000000ffff02000000020000203c000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000100000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000001d00000000000000000000000000000000000000000000000000000000000000dd020000000000000000000000000000000100000000000084010500fc010000000000000000000000000001000000002b00000000000000ac141418000000000000000000000000000000000000fb0000000000493f0d510000000000000000000000000000000000000001000004d22b00"], 0x23c}, 0x1, 0x0, 0x0, 0x60004000}, 0xc0) 349.755725ms ago: executing program 0 (id=7547): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="140000001000010000000000000000000a00000a20000000000a010400000000000000000a00000a09000000030a010400000000000000000a00000a0900010073797a30000000000900030073797a300000000014000480080001400000000008000240000000004c000000060a010400000000000000000a00000a0900010073797a30000000000900020073797a3000000000200004801c0001800a00010071756575650000000c0002800600014000000000140000001100010000000000000000000a00000a"], 0xd4}}, 0x0) sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x28, 0x2, 0x3, 0x1, 0x0, 0x0, {}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1}}, @NFQA_CFG_PARAMS={0x9, 0x2, {0xffff, 0x2}}]}, 0x28}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r1, &(0x7f0000000240)=ANY=[@ANYBLOB="034886dd0100000000001400000060"], 0xfdef) 281.558521ms ago: executing program 2 (id=7548): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r2, &(0x7f0000000080), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f00000000c0)={'vxcan1\x00', 0x0}) sendmsg$can_bcm(r2, 0x0, 0x40000) sendmsg$can_bcm(r2, &(0x7f0000000300)={&(0x7f00000002c0)={0x1d, r3}, 0x10, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYRES16=r0, @ANYRES32, @ANYRES16=r3, @ANYRES64=r3, @ANYBLOB="516d2e12343105d5acf5eac3ed12ae613785050df71fa3d3797537694581402399", @ANYRES32=r2, @ANYRES64, @ANYRESOCT=r3], 0x48}, 0x1, 0x0, 0x0, 0x20000080}, 0x0) 277.237819ms ago: executing program 3 (id=7549): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0xffff}, 0x50) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000001c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000100000c02000000000000000000000d0000000000005f"], 0x0, 0x34}, 0x28) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000100)=ANY=[@ANYBLOB="180000000100000000000000801800009500000000000000"], &(0x7f0000000000)='GPL\x00', 0xc, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r1}, 0x94) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000500)=@bpf_ext={0x1a, 0xf, &(0x7f00000002c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8792}, {{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {0x85, 0x0, 0x0, 0xb8}}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000180)='GPL\x00', 0x7, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x19, r1, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x1, r2, 0x0, 0x0, 0x0, 0x10, 0x4a6}, 0x94) 194.184002ms ago: executing program 4 (id=7550): unshare(0x20000400) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_buf(r0, 0x6, 0x8, &(0x7f00000004c0)="1353e306c804", 0xffffffffffffffbc) r1 = socket$inet_sctp(0x2, 0x5, 0x84) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x1c, &(0x7f0000000000)=[@in6={0xa, 0x0, 0x0, @private0={0xfc, 0x0, '\x00', 0x1}, 0x9}]}, &(0x7f00000002c0)=0x10) getsockopt$inet_sctp6_SCTP_MAX_BURST(r2, 0x84, 0x83, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000300)=0x8) getsockopt$inet_sctp_SCTP_RTOINFO(r1, 0x84, 0x0, &(0x7f0000000180)={r3, 0x4, 0x9}, &(0x7f00000002c0)=0x10) 125.545315ms ago: executing program 3 (id=7551): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0x6, 0x4, 0x8, 0xc}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000280)=ANY=[@ANYBLOB="1800bfffffff00000000000000000000850000000e00000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000fcffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 117.636413ms ago: executing program 2 (id=7552): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x18, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[], 0xcdc}, 0x1, 0x0, 0x0, 0x8000}, 0x20040010) pipe(&(0x7f0000000000)={0xffffffffffffffff}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000019800)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r2, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) recvmsg$unix(r1, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r4, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r3, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r6, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) r7 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r7, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r7, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x5c, &(0x7f0000000780)=[@in6={0xa, 0x0, 0x0, @private2}, @in={0x2, 0x4e23, @loopback}, @in={0x2, 0x4e20, @empty}, @in={0x2, 0x4e21, @multicast1}, @in={0x2, 0x4e23, @multicast2}]}, &(0x7f0000000180)=0x10) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r7, 0x84, 0x72, &(0x7f0000000080)={r8, 0x9, 0x10}, &(0x7f0000000100)=0xc) recvmsg$unix(r5, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000900), 0x100}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) sendmsg$inet(r0, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg(r9, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001dc0)=""/4096, 0x1000}, 0x0) close(r0) syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) r10 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(0xffffffffffffffff, &(0x7f0000002540)={0x0, 0x0, &(0x7f0000002500)={&(0x7f0000000140)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r10, @ANYBLOB="010000000000000000000c000000140003800400040008000200fd7f01000400010018000180140002006e657464657673696d3000"], 0x40}}, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000140)={'vcan0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_wireguard(r5, 0x8933, &(0x7f0000000180)={'wg1\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r2, 0x8933, &(0x7f0000000200)={'batadv_slave_0\x00', 0x0}) sendmsg$ETHTOOL_MSG_WOL_GET(r0, &(0x7f0000000740)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000700)={&(0x7f0000000300)=ANY=[@ANYBLOB="84ecd500", @ANYRES16=r10, @ANYBLOB="08002dbd7000fddbdf25090000000c00018008000100", @ANYRES32=r11, @ANYBLOB="0400018030000180080003000300000008000300030000001400020070696d7265673000000000000000000008000100", @ANYRES32=r12, @ANYBLOB="300001800800030001000000140002006d6163766c616e30000000000000000008000100", @ANYRES32=r13, @ANYBLOB="0800030003000000"], 0x84}, 0x1, 0x0, 0x0, 0x4044850}, 0xe010) r14 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000440)=@raw={'raw\x00', 0x9, 0x3, 0x250, 0x98, 0xffffffff, 0xffffffff, 0x98, 0xffffffff, 0x1b8, 0xffffffff, 0xffffffff, 0x1b8, 0xffffffff, 0x3, &(0x7f0000000040), {[{{@ip={@loopback, @dev={0xac, 0x14, 0x14, 0x38}, 0xffffffff, 0xff, 'erspan0\x00', 'veth0_macvtap\x00', {}, {}, 0x1, 0x1}, 0x0, 0x70, 0x98}, @common=@inet=@SYNPROXY={0x28, 'SYNPROXY\x00', 0x0, {0xc, 0x3}}}, {{@ip={@multicast2, @loopback, 0xff, 0x0, 'macvlan1\x00', 'veth0_to_bridge\x00', {}, {}, 0x5c, 0x1, 0x11}, 0x0, 0xc0, 0x120, 0x0, {}, [@common=@unspec=@connlabel={{0x28}, {0x6, 0x1}}, @inet=@rpfilter={{0x28}, {0x4}}]}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast, 0x2a, 0xf, [0x34, 0x11, 0x11, 0x21, 0x2c, 0x12, 0x31, 0x22, 0x1b, 0x14, 0x2d, 0x2f, 0x2c, 0x14, 0x1b, 0x3c], 0x1, 0xbb, 0x3ae}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x2b0) r15 = syz_genetlink_get_family_id$nbd(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(r14, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYRES16=r15, @ANYBLOB="010000000000000000000100000008000100400000000c000200700f0000000000000c00060003000000000000000a000a00272d5d29212b0000140007"], 0x6c}}, 0x0) 822.054µs ago: executing program 0 (id=7553): bpf$PROG_LOAD_XDP(0x5, &(0x7f00000003c0)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x100}, 0x94) r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00'}, 0x90) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb01063d0000000000000028000000280000000200000000000000000000030000020000000200000000000000010000000000000104"], 0x0, 0x42}, 0x28) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd63"], 0xfdef) socket$kcm(0x29, 0x0, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x8000) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x3300, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000003c0)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x100}, 0x94) (async) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00'}, 0x90) (async) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb01063d0000000000000028000000280000000200000000000000000000030000020000000200000000000000010000000000000104"], 0x0, 0x42}, 0x28) (async) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd63"], 0xfdef) (async) socket$kcm(0x29, 0x0, 0x0) (async) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x8000) (async) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x3300, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) (async) 0s ago: executing program 3 (id=7554): r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_PROG_DETACH(0x9, &(0x7f00000002c0)=ANY=[@ANYRES32, @ANYRES32, @ANYBLOB='\f\x00\x00\x00\f \x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="c09f89c3e345cff84ea8489659b9abb4dae8730e7b737a62f4119b448c7cf9f290ee0a152f52b2aae3c1d90a4de3f9afc4e6f565a86683d6ca6824110c55cdd316e6ec79d66d077987d0503cab0f198724829c731845d0213c8194c2ff221249858c7c1901016da9a60dea01d9e06d592c09fc11f8d43bb98a1e63736f6bc85e459324246d853018a3450dd4f7e13d1b219272aa0c08749953466a5d142c260eec6f6d5d5686d5390939ac537657de6a9f13062fcafd3a741b", @ANYRES64=0x0], 0x20) unshare(0x2c020400) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0xc, &(0x7f0000000000)=0xfffffff7, 0x4) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000e40), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ENABLE(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000001080)={&(0x7f0000000080)=ANY=[@ANYBLOB="0800f900", @ANYRES16=r4, @ANYBLOB="010000000000fed3df25030000005800018044000400200001000a000000000000000000000000000000000000000000000100000000200002000a00000000000000fe8000000000000000000000000000bb000000000d0001007564703a73797a3000000000"], 0x6c}}, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000740)='blkio.bfq.io_queued\x00', 0x275a, 0x0) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0, 0x13, r6, 0x0) mmap(&(0x7f0000000000/0x95c000)=nil, 0x95c000, 0x9, 0x8c4b815a5465c2b1, 0xffffffffffffffff, 0xb0260000) mmap(&(0x7f0000d8c000/0x1000)=nil, 0x1000, 0x1000001, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000867000/0x2000)=nil, 0x2000, 0x0, 0x11, r5, 0xffffe000) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x7000000, 0x6e073, r6, 0x2000) sendmsg$TIPC_NL_LINK_RESET_STATS(r2, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={&(0x7f0000000600)=ANY=[@ANYBLOB="7e54387e7a6fd46e89179ac9e923f12729cd0fcb3554a1edccaa216856af001e26000697d3f0affff8f4c3153583e4533313800fc28add78d2a821cca2", @ANYRES16=r4, @ANYRESOCT=r5], 0x104}, 0x1, 0x0, 0x0, 0x24004080}, 0x4008050) r7 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x27, &(0x7f0000000180)={@multicast2, @loopback}, 0xc) close(0xffffffffffffffff) getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, &(0x7f00000004c0)={'broute\x00', 0x0, 0x3, 0x1b, [0x8, 0x0, 0x3, 0x4, 0x4, 0x7], 0x1, &(0x7f0000000440)=[{}], &(0x7f0000000480)=""/27}, &(0x7f0000000540)=0x78) sendmsg$nl_generic(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000280)=ANY=[@ANYBLOB="2400000047000701feffffffffffffff04000000080001"], 0x24}, 0x1, 0x0, 0x0, 0x4048011}, 0x24008802) r8 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r8, 0x0, 0x40, &(0x7f0000000000)=@filter={'filter\x00', 0xe, 0x4, 0x260, 0xffffffff, 0x0, 0x130, 0x1c8, 0xffffffff, 0xffffffff, 0x98, 0x130, 0x1c8, 0xffffffff, 0x4, 0x0, {[{{@ip={@empty, @empty, 0x0, 0x0, '\x00', '\x00', {}, {}, 0x6}, 0x0, 0x70, 0x98}, @common=@inet=@SYNPROXY={0x28, 'SYNPROXY\x00', 0x0, {0xf, 0x7, 0x5b4}}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x2c0) syz_emit_ethernet(0x4e, &(0x7f0000000580)=ANY=[@ANYBLOB="aaaaaaaaaaaa3cdc119848ac080045f40040006410000006907864010102e0000001fdfc4e21", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="ec0200079078000813124215de32491b2e2007220f6b45fd046ffe82f9890000"], 0x0) r9 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r1) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000d80)=ANY=[@ANYRES16=r4, @ANYRES16=r9, @ANYRES32=r3, @ANYRES32=r10], 0x1c}, 0x1, 0x0, 0x0, 0x400c804}, 0x804) write$nci(r0, &(0x7f00000003c0)=ANY=[@ANYBLOB="400109b0427899a9d3bb3e22ba4ced35b8fbdc98e7487bf0ef55bede8e96bfa327ef5ce1905b937d7426409ceff0109064805513235a9e08642e4a76940a39df7833f06ac0b54d7b86f70b"], 0x87) kernel console output (not intermixed with test programs): [T25869] veth1_macvtap: entered promiscuous mode [ 825.049823][T25869] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 825.095672][T25869] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 825.195871][T26319] bond7: entered allmulticast mode [ 825.196286][T26319] 8021q: adding VLAN 0 to HW filter on device bond7 [ 825.225081][T26322] sch_tbf: burst 0 is lower than device ip6gre0 mtu (1448) ! [ 825.233740][ T49] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 825.235333][ T1150] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 825.235379][ T1150] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 825.235416][ T1150] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 825.651050][ T3997] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 825.651074][ T3997] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 825.733707][ T6821] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 825.733731][ T6821] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 826.493254][T26373] netlink: 28 bytes leftover after parsing attributes in process `syz.0.6079'. [ 827.549220][T26406] rdma_rxe: rxe_newlink: failed to add team_slave_0 [ 828.274607][T26440] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6100'. [ 828.519886][T26455] openvswitch: ovs-s!: Dropping previously announced user features [ 828.724812][T26465] FAULT_INJECTION: forcing a failure. [ 828.724812][T26465] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 828.724846][T26465] CPU: 1 UID: 0 PID: 26465 Comm: syz.2.6108 Not tainted syzkaller #0 PREEMPT(full) [ 828.724870][T26465] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 828.724882][T26465] Call Trace: [ 828.724890][T26465] [ 828.724899][T26465] dump_stack_lvl+0xe8/0x150 [ 828.724940][T26465] should_fail_ex+0x410/0x560 [ 828.724973][T26465] _copy_to_user+0x31/0xb0 [ 828.725000][T26465] bpf_test_finish+0x52e/0x690 [ 828.725043][T26465] ? __pfx_bpf_test_finish+0x10/0x10 [ 828.725080][T26465] ? _copy_from_user+0x94/0xb0 [ 828.725105][T26465] ? bpf_test_init+0x113/0x150 [ 828.725135][T26465] bpf_prog_test_run_xdp+0x8bc/0x11d0 [ 828.725182][T26465] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 828.725218][T26465] ? __fget_files+0x2a/0x420 [ 828.725251][T26465] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 828.725280][T26465] bpf_prog_test_run+0x2c5/0x340 [ 828.725310][T26465] __sys_bpf+0xa22/0xd90 [ 828.725342][T26465] ? __pfx___sys_bpf+0x10/0x10 [ 828.725377][T26465] ? __fget_files+0x2a/0x420 [ 828.725421][T26465] ? ksys_write+0x242/0x270 [ 828.725453][T26465] ? __pfx_ksys_write+0x10/0x10 [ 828.725487][T26465] __x64_sys_bpf+0xba/0xd0 [ 828.725511][T26465] do_syscall_64+0x166/0x520 [ 828.725549][T26465] ? trace_irq_disable+0x3b/0x140 [ 828.725568][T26465] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 828.725595][T26465] ? clear_bhb_loop+0x70/0xc0 [ 828.725621][T26465] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 828.725640][T26465] RIP: 0033:0x7f89da39e159 [ 828.725660][T26465] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 828.725676][T26465] RSP: 002b:00007f89db2ff028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 828.725699][T26465] RAX: ffffffffffffffda RBX: 00007f89da625fa0 RCX: 00007f89da39e159 [ 828.725715][T26465] RDX: 0000000000000050 RSI: 0000200000000c80 RDI: 000000000000000a [ 828.725728][T26465] RBP: 00007f89db2ff090 R08: 0000000000000000 R09: 0000000000000000 [ 828.725742][T26465] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 828.725755][T26465] R13: 00007f89da626038 R14: 00007f89da625fa0 R15: 00007ffdc785f758 [ 828.725789][T26465] [ 829.223534][T26481] bond1: entered allmulticast mode [ 829.226233][T26481] 8021q: adding VLAN 0 to HW filter on device bond1 [ 829.230585][T26490] batadv_slave_0: entered allmulticast mode [ 829.230716][T26490] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6119'. [ 829.230734][T26490] A link change request failed with some changes committed already. Interface batadv_slave_0 may have been left with an inconsistent configuration, please check. [ 829.284622][T26485] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6116'. [ 829.318966][T26489] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 829.394035][T26497] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 829.510891][T26503] netlink: 'syz.0.6123': attribute type 1 has an invalid length. [ 829.510916][T26503] netlink: 'syz.0.6123': attribute type 2 has an invalid length. [ 829.530562][T26503] netlink: 28 bytes leftover after parsing attributes in process `syz.0.6123'. [ 829.629168][T26501] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6121'. [ 829.662087][T26507] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6125'. [ 829.662119][T26507] netlink: 36 bytes leftover after parsing attributes in process `syz.0.6125'. [ 830.105146][T26523] netlink: 260 bytes leftover after parsing attributes in process `syz.2.6129'. [ 830.105720][T26523] vlan3: left allmulticast mode [ 830.105738][T26523] geneve0: left allmulticast mode [ 830.105811][T26523] vlan3: left promiscuous mode [ 830.105824][T26523] geneve0: left promiscuous mode [ 830.106244][T26523] bridge0: port 1(vlan3) entered disabled state [ 830.757992][T26561] bond10 (unregistering): Released all slaves [ 830.815757][T26562] sch_fq: defrate 0 ignored. [ 831.058313][T26574] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6142'. [ 831.666639][ T4933] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 831.673679][ T4933] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 831.684141][ T4933] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 831.697788][ T4933] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 831.698587][ T4933] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 831.741260][T26592] netlink: 20 bytes leftover after parsing attributes in process `syz.4.6150'. [ 831.978456][T26600] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 832.140206][T26605] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6155'. [ 832.158712][T26600] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 832.326950][T26620] ip_tables: iptables: counters copy to user failed while replacing table [ 832.480458][T26622] vlan2: entered promiscuous mode [ 832.480484][T26622] bridge0: entered promiscuous mode [ 832.494376][T26623] netlink: 65039 bytes leftover after parsing attributes in process `syz.1.6161'. [ 832.554862][T26628] netlink: 'syz.4.6162': attribute type 1 has an invalid length. [ 832.554891][T26628] netlink: 224 bytes leftover after parsing attributes in process `syz.4.6162'. [ 833.020485][T26590] wg2 speed is unknown, defaulting to 1000 [ 833.505958][T26652] openvswitch: netlink: Missing valid actions attribute. [ 833.506007][T26652] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 833.538279][T26652] netlink: 24 bytes leftover after parsing attributes in process `syz.3.6169'. [ 833.592343][T26656] netlink: 24 bytes leftover after parsing attributes in process `syz.3.6169'. [ 833.639667][T26659] FAULT_INJECTION: forcing a failure. [ 833.639667][T26659] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 833.639703][T26659] CPU: 0 UID: 0 PID: 26659 Comm: syz.1.6168 Not tainted syzkaller #0 PREEMPT(full) [ 833.639725][T26659] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 833.639737][T26659] Call Trace: [ 833.639745][T26659] [ 833.639755][T26659] dump_stack_lvl+0xe8/0x150 [ 833.639790][T26659] should_fail_ex+0x410/0x560 [ 833.639818][T26659] _copy_to_user+0x31/0xb0 [ 833.639846][T26659] simple_read_from_buffer+0xe1/0x170 [ 833.639878][T26659] proc_fail_nth_read+0x1bb/0x230 [ 833.639911][T26659] ? common_file_perm+0x20e/0x2b0 [ 833.639939][T26659] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 833.639973][T26659] ? rw_verify_area+0x24a/0x4c0 [ 833.640003][T26659] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 833.640032][T26659] vfs_read+0x213/0xa80 [ 833.640065][T26659] ? __pfx___mutex_lock+0x10/0x10 [ 833.640093][T26659] ? __pfx_vfs_read+0x10/0x10 [ 833.640132][T26659] ? __fget_files+0x2a/0x420 [ 833.640163][T26659] ? __fget_files+0x3a2/0x420 [ 833.640188][T26659] ? __fget_files+0x2a/0x420 [ 833.640224][T26659] ksys_read+0x150/0x270 [ 833.640255][T26659] ? __pfx_ksys_read+0x10/0x10 [ 833.640296][T26659] do_syscall_64+0x166/0x520 [ 833.640320][T26659] ? trace_irq_disable+0x3b/0x140 [ 833.640340][T26659] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 833.640360][T26659] ? clear_bhb_loop+0x70/0xc0 [ 833.640387][T26659] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 833.640408][T26659] RIP: 0033:0x7f2f8475e98e [ 833.640429][T26659] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 833.640446][T26659] RSP: 002b:00007f2f82950fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 833.640469][T26659] RAX: ffffffffffffffda RBX: 00007f2f829516c0 RCX: 00007f2f8475e98e [ 833.640484][T26659] RDX: 000000000000000f RSI: 00007f2f829510a0 RDI: 0000000000000006 [ 833.640497][T26659] RBP: 00007f2f82951090 R08: 0000000000000000 R09: 0000000000000000 [ 833.640510][T26659] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 833.640522][T26659] R13: 00007f2f84a264e8 R14: 00007f2f84a26450 R15: 00007ffd6430d528 [ 833.640556][T26659] [ 833.661382][T26661] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6169'. [ 833.785658][ T4933] Bluetooth: hci3: command tx timeout [ 833.983974][ T6286] netdevsim netdevsim2 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 834.506363][T26672] netlink: 84 bytes leftover after parsing attributes in process `syz.1.6175'. [ 834.518234][ T6286] netdevsim netdevsim2 netdevsim2 (unregistering): left allmulticast mode [ 834.526046][ T6286] netdevsim netdevsim2 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 834.545527][T26668] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6172'. [ 834.701079][ T6286] bond0: (slave netdevsim1): Releasing backup interface [ 834.714312][ T6286] netdevsim netdevsim2 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 834.717903][T26683] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6179'. [ 834.884980][T26692] netlink: 'syz.4.6180': attribute type 10 has an invalid length. [ 835.861942][ T4933] Bluetooth: hci3: command tx timeout [ 836.200381][T26732] netlink: 'syz.0.6189': attribute type 10 has an invalid length. [ 836.309035][T26741] IPv6: NLM_F_CREATE should be specified when creating new route [ 836.309149][T26741] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 836.309160][T26741] IPv6: NLM_F_CREATE should be set when creating new route [ 836.309216][T26741] IPv6: NLM_F_CREATE should be set when creating new route [ 836.309243][T26741] IPv6: NLM_F_CREATE should be set when creating new route [ 836.825991][ T6286] bond0 (unregistering): Released all slaves [ 836.830951][ T6286] bond1 (unregistering): Released all slaves [ 836.844808][ T6286] bond2 (unregistering): Released all slaves [ 836.861210][ T6286] bond3 (unregistering): Released all slaves [ 836.907983][ T6286] bond4 (unregistering): (slave veth3): Releasing active interface [ 836.909135][ T6286] bond4 (unregistering): Released all slaves [ 836.929236][ T6286] bond5 (unregistering): (slave wireguard0): Releasing backup interface [ 836.929937][ T6286] bond5 (unregistering): Released all slaves [ 836.947327][ T6286] bond6 (unregistering): Released all slaves [ 836.968362][ T6286] bond7 (unregistering): Released all slaves [ 837.013860][T26590] bridge0: port 1(bridge_slave_0) entered blocking state [ 837.014197][T26590] bridge0: port 1(bridge_slave_0) entered disabled state [ 837.014352][T26590] bridge_slave_0: entered allmulticast mode [ 837.016892][T26590] bridge_slave_0: entered promiscuous mode [ 837.056619][T26742] batman_adv: batadv0: Adding interface: syzkaller0 [ 837.056641][T26742] batman_adv: batadv0: The MTU of interface syzkaller0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 837.056675][T26742] batman_adv: batadv0: Interface activated: syzkaller0 [ 837.214963][T26736] batman_adv: batadv0: Interface deactivated: syzkaller0 [ 837.299612][T26736] batman_adv: batadv0: Removing interface: syzkaller0 [ 837.321772][T26590] bridge0: port 2(bridge_slave_1) entered blocking state [ 837.321991][T26590] bridge0: port 2(bridge_slave_1) entered disabled state [ 837.322135][T26590] bridge_slave_1: entered allmulticast mode [ 837.324360][T26590] bridge_slave_1: entered promiscuous mode [ 837.376494][ T6286] ovs-s!: left promiscuous mode [ 837.467164][T26766] syzkaller0: entered promiscuous mode [ 837.467193][T26766] syzkaller0: entered allmulticast mode [ 837.547234][T26772] bond1: option mode: invalid value (7) [ 837.549972][T26772] bond1 (unregistering): Released all slaves [ 837.700378][T26590] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 837.701069][ T6286] ovs-dp0: left promiscuous mode [ 837.920029][T26590] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 837.945877][ T4933] Bluetooth: hci3: command tx timeout [ 837.990514][ T6286] tipc: Disabling bearer [ 837.993109][ T6286] tipc: Left network mode [ 838.221249][ T6286] IPVS: stopping master sync thread 21270 ... [ 838.345335][ C1] openvswitch: cpu_id mismatch with handler threads [ 840.031016][ T4933] Bluetooth: hci3: command tx timeout [ 841.480602][ T5278] 8021q: adding VLAN 0 to HW filter on device eth1 [ 841.484232][T26590] team0: Port device team_slave_0 added [ 841.487385][T26590] team0: Port device team_slave_1 added [ 841.644646][T26590] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 841.644666][T26590] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 841.644689][T26590] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 841.705660][T26590] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 841.705680][T26590] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 841.705708][T26590] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 842.074797][T26835] openvswitch: ovs-s!: Dropping previously announced user features [ 842.284268][T26590] hsr_slave_0: entered promiscuous mode [ 842.288154][T26590] hsr_slave_1: entered promiscuous mode [ 842.288989][T26590] debugfs: 'hsr0' already exists in 'hsr' [ 842.289012][T26590] Cannot create hsr debugfs directory [ 842.552632][T26853] x_tables: ip6_tables: .0 target: invalid size 8 (kernel) != (user) 0 [ 843.556797][T26866] bond2: entered allmulticast mode [ 843.570398][ T31] audit: type=1107 audit(1790235134.687:9): pid=26876 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa [ 843.659370][ T6286] hsr_slave_0: left promiscuous mode [ 843.672019][ T6286] hsr_slave_1: left promiscuous mode [ 843.974432][T26890] __nla_validate_parse: 7 callbacks suppressed [ 843.974459][T26890] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6231'. [ 843.974481][T26890] netlink: 36 bytes leftover after parsing attributes in process `syz.4.6231'. [ 844.380085][T24810] hid-generic 0005:0008:0009.003F: item fetching failed at offset 2/3 [ 844.380984][T24810] hid-generic 0005:0008:0009.003F: probe with driver hid-generic failed with error -22 [ 844.654720][ T6286] team0 (unregistering): Port device wg2 removed [ 844.800514][T26908] netlink: 16 bytes leftover after parsing attributes in process `syz.1.6238'. [ 844.919210][ T5278] 8021q: adding VLAN 0 to HW filter on device eth2 [ 845.030830][T26915] netlink: 52 bytes leftover after parsing attributes in process `syz.1.6238'. [ 845.036982][T26914] netlink: 52 bytes leftover after parsing attributes in process `syz.1.6238'. [ 845.115020][T26915] ip6gre1: entered promiscuous mode [ 845.115048][T26915] ip6gre1: entered allmulticast mode [ 845.498025][T26926] syzkaller0: entered promiscuous mode [ 845.498051][T26926] syzkaller0: entered allmulticast mode [ 845.505189][T26926] ip6t_hbh: unknown flags AD [ 845.834013][ T6286] IPVS: stop unused estimator thread 0... [ 846.156020][T26949] netlink: 'syz.4.6252': attribute type 1 has an invalid length. [ 846.200167][T26949] bond6 (unregistering): Released all slaves [ 846.269301][T26953] netlink: 28 bytes leftover after parsing attributes in process `syz.4.6252'. [ 846.768360][ T5811] hid-generic 0005:0008:0009.0040: item fetching failed at offset 2/3 [ 846.769273][ T5811] hid-generic 0005:0008:0009.0040: probe with driver hid-generic failed with error -22 [ 847.766391][T26908] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 847.784570][T26590] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 847.844536][T26590] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 847.846698][T26590] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 847.859089][T26590] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 847.982745][T26590] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 848.002397][T26590] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 848.005380][T26590] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 848.024689][T26590] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 848.058736][T26980] netlink: 24 bytes leftover after parsing attributes in process `syz.3.6259'. [ 848.348790][T27000] sch_tbf: burst 0 is lower than device ip6gre0 mtu (1448) ! [ 848.375427][T26999] netlink: 'syz.1.6263': attribute type 6 has an invalid length. [ 848.461225][ T10] netdevsim netdevsim1 netdevsim0: entered promiscuous mode [ 848.480039][T26999] 8021q: adding VLAN 0 to HW filter on device macsec1 [ 848.720343][T27012] ip6gretap1: entered allmulticast mode [ 848.743908][T27012] batman_adv: batadv0: Adding interface: ip6gretap1 [ 848.743930][T27012] batman_adv: batadv0: The MTU of interface ip6gretap1 is too small (1434) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 848.744065][T27012] batman_adv: batadv0: Interface activated: ip6gretap1 [ 848.965880][T26590] 8021q: adding VLAN 0 to HW filter on device bond0 [ 849.137084][T26590] 8021q: adding VLAN 0 to HW filter on device team0 [ 849.144566][T13247] bridge0: port 1(bridge_slave_0) entered blocking state [ 849.144699][T13247] bridge0: port 1(bridge_slave_0) entered forwarding state [ 849.164057][T13247] bridge0: port 2(bridge_slave_1) entered blocking state [ 849.164181][T13247] bridge0: port 2(bridge_slave_1) entered forwarding state [ 849.241306][T27031] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6271'. [ 849.265367][T27034] netlink: 'syz.1.6269': attribute type 2 has an invalid length. [ 849.265393][T27034] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6269'. [ 849.334987][T27038] netlink: 72 bytes leftover after parsing attributes in process `syz.4.6271'. [ 849.496479][T27046] netlink: 14 bytes leftover after parsing attributes in process `syz.1.6276'. [ 849.722026][T27046] hsr_slave_0 (unregistering): left promiscuous mode [ 849.819476][T27062] xt_SECMARK: invalid mode: 9 [ 849.984561][T27067] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6281'. [ 850.011589][T27067] netlink: 20 bytes leftover after parsing attributes in process `syz.3.6281'. [ 850.398238][T27090] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6287'. [ 850.398272][T27090] netlink: 36 bytes leftover after parsing attributes in process `syz.4.6287'. [ 850.600428][T27096] netlink: 16 bytes leftover after parsing attributes in process `syz.4.6290'. [ 850.623725][T27096] netlink: 24 bytes leftover after parsing attributes in process `syz.4.6290'. [ 850.820717][T27103] ip_tables: iptables: counters copy to user failed while replacing table [ 851.427394][T26590] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 851.762140][T26590] veth0_vlan: entered promiscuous mode [ 851.796790][T26590] veth1_vlan: entered promiscuous mode [ 851.975755][T26590] veth0_macvtap: entered promiscuous mode [ 852.021469][T26590] veth1_macvtap: entered promiscuous mode [ 852.155658][T26590] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 852.214745][T26590] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 852.264066][ T49] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 852.264126][ T49] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 852.264160][ T49] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 852.264194][ T49] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 852.418963][T27169] FAULT_INJECTION: forcing a failure. [ 852.418963][T27169] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 852.418999][T27169] CPU: 1 UID: 0 PID: 27169 Comm: syz.4.6304 Not tainted syzkaller #0 PREEMPT(full) [ 852.419022][T27169] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 852.419034][T27169] Call Trace: [ 852.419044][T27169] [ 852.419054][T27169] dump_stack_lvl+0xe8/0x150 [ 852.419090][T27169] should_fail_ex+0x410/0x560 [ 852.419121][T27169] _copy_from_iter+0x1d3/0x1660 [ 852.419144][T27169] ? skb_set_owner_w+0x263/0x3d0 [ 852.419187][T27169] ? __pfx__copy_from_iter+0x10/0x10 [ 852.419220][T27169] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 852.419254][T27169] skb_copy_datagram_from_iter+0xe6/0x720 [ 852.419290][T27169] ? skb_put+0x112/0x210 [ 852.419318][T27169] tun_get_user+0xc7f/0x44d0 [ 852.419361][T27169] ? aa_file_perm+0x18b/0x15f0 [ 852.419394][T27169] ? aa_file_perm+0x4ed/0x15f0 [ 852.419431][T27169] ? __pfx_tun_get_user+0x10/0x10 [ 852.419457][T27169] ? __lock_acquire+0x747/0x2de0 [ 852.419484][T27169] ? kstrtoull+0x137/0x1d0 [ 852.419522][T27169] ? ref_tracker_alloc+0x341/0x4b0 [ 852.419546][T27169] ? lock_acquire+0x115/0x350 [ 852.419568][T27169] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 852.419595][T27169] ? lock_acquire+0x115/0x350 [ 852.419617][T27169] ? tun_get+0x1c/0x2f0 [ 852.419645][T27169] ? tun_get+0x1c/0x2f0 [ 852.419667][T27169] ? tun_get+0x1c/0x2f0 [ 852.419695][T27169] tun_chr_write_iter+0x113/0x200 [ 852.419730][T27169] vfs_write+0x612/0xba0 [ 852.419777][T27169] ? __pfx_vfs_write+0x10/0x10 [ 852.419819][T27169] ? __fget_files+0x2a/0x420 [ 852.419855][T27169] ksys_write+0x150/0x270 [ 852.419887][T27169] ? __pfx_ksys_write+0x10/0x10 [ 852.419926][T27169] do_syscall_64+0x166/0x520 [ 852.419956][T27169] ? trace_irq_disable+0x3b/0x140 [ 852.419975][T27169] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 852.419997][T27169] ? clear_bhb_loop+0x70/0xc0 [ 852.420023][T27169] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 852.420043][T27169] RIP: 0033:0x7f8fe4f9e159 [ 852.420063][T27169] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 852.420079][T27169] RSP: 002b:00007f8fe5e23028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 852.420102][T27169] RAX: ffffffffffffffda RBX: 00007f8fe5225fa0 RCX: 00007f8fe4f9e159 [ 852.420117][T27169] RDX: 000000000000004a RSI: 0000200000000140 RDI: 0000000000000003 [ 852.420131][T27169] RBP: 00007f8fe5e23090 R08: 0000000000000000 R09: 0000000000000000 [ 852.420145][T27169] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 852.420157][T27169] R13: 00007f8fe5226038 R14: 00007f8fe5225fa0 R15: 00007ffeb9b28168 [ 852.420189][T27169] [ 852.430371][T27166] netlink: 'syz.3.6303': attribute type 1 has an invalid length. [ 852.781921][T27166] 8021q: adding VLAN 0 to HW filter on device bond10 [ 852.820646][T27167] bond10: (slave veth5): Enslaving as an active interface with a down link [ 852.864954][T27170] bond10 (unregistering): (slave veth5): Releasing active interface [ 852.875297][T27170] bond10 (unregistering): Released all slaves [ 853.206195][ T3997] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 853.206220][ T3997] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 853.272406][T27194] openvswitch: ovs-s!: Dropping previously announced user features [ 853.409302][ T1150] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 853.409327][ T1150] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 853.761193][T27217] Bluetooth: hci0: invalid length 0, exp 2 for type 25 [ 854.340275][T27244] netlink: 'syz.2.6327': attribute type 10 has an invalid length. [ 854.340304][T27244] __nla_validate_parse: 7 callbacks suppressed [ 854.340318][T27244] netlink: 2 bytes leftover after parsing attributes in process `syz.2.6327'. [ 854.428161][T27244] team0: Device wg2 is of different type [ 854.707733][T27260] netlink: 104 bytes leftover after parsing attributes in process `syz.2.6333'. [ 854.977049][T27266] bond1: entered allmulticast mode [ 854.977548][T27266] 8021q: adding VLAN 0 to HW filter on device bond1 [ 855.172138][T27276] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6339'. [ 855.203096][ T5718] hid-generic 0005:0008:0009.0041: item fetching failed at offset 2/3 [ 855.206480][ T5718] hid-generic 0005:0008:0009.0041: probe with driver hid-generic failed with error -22 [ 855.225392][T27280] netlink: 84 bytes leftover after parsing attributes in process `syz.0.6337'. [ 855.313536][T27284] netlink: 65039 bytes leftover after parsing attributes in process `syz.1.6340'. [ 855.519670][T27290] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6341'. [ 855.623365][ T6286] netdevsim netdevsim0 netdevsim3: set [1, 1] type 2 family 0 port 20004 - 0 [ 855.625241][ T1150] netdevsim netdevsim0 netdevsim2: set [1, 1] type 2 family 0 port 20004 - 0 [ 855.625361][ T1150] netdevsim netdevsim0 netdevsim1: set [1, 1] type 2 family 0 port 20004 - 0 [ 855.625406][ T1150] netdevsim netdevsim0 netdevsim0: set [1, 1] type 2 family 0 port 20004 - 0 [ 855.741148][T27296] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6340'. [ 856.119733][T27309] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6346'. [ 856.702854][T27327] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6352'. [ 856.784795][T27332] netlink: 'syz.0.6356': attribute type 1 has an invalid length. [ 856.927115][T27338] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6356'. [ 856.957076][T27332] bond3: entered promiscuous mode [ 856.957562][T27332] 8021q: adding VLAN 0 to HW filter on device bond3 [ 857.030326][T27336] 8021q: adding VLAN 0 to HW filter on device bond3 [ 857.042720][T27336] bond3: (slave gre1): The slave device specified does not support setting the MAC address [ 857.042747][T27336] bond3: (slave gre1): Setting fail_over_mac to active for active-backup mode [ 857.115049][T27336] bond3: (slave gre1): making interface the new active one [ 857.115075][T27336] gre1: entered promiscuous mode [ 857.134475][T27336] bond3: (slave gre1): Enslaving as an active interface with an up link [ 857.230515][T27338] bond3 (unregistering): (slave gre1): Releasing backup interface [ 857.230545][T27338] gre1: left promiscuous mode [ 857.248779][T27338] bond3 (unregistering): Released all slaves [ 857.336159][T17243] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 857.360165][T17243] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 857.361515][T17243] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 857.381200][T17243] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 857.398507][T17243] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 857.873151][ T3997] netdevsim netdevsim4 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 857.873193][ T3997] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 857.996083][T27362] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 857.996202][T27362] syzkaller1: linktype set to 773 [ 858.103810][ T3997] netdevsim netdevsim4 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 858.103850][ T3997] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 858.374969][ T3997] netdevsim netdevsim4 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 858.380383][ T3997] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 858.482537][T27391] bond10: entered allmulticast mode [ 858.483817][T27391] 8021q: adding VLAN 0 to HW filter on device bond10 [ 858.635978][ T3997] netdevsim netdevsim4 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 858.636017][ T3997] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 858.646044][T27397] netlink: 'syz.2.6372': attribute type 1 has an invalid length. [ 858.652321][ T1150] IPVS: starting estimator thread 0... [ 858.754668][T27400] IPVS: using max 49 ests per chain, 117600 per kthread [ 858.809640][T27348] wg2 speed is unknown, defaulting to 1000 [ 859.434781][T27424] __nla_validate_parse: 9 callbacks suppressed [ 859.434805][T27424] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6381'. [ 859.462493][ T4933] Bluetooth: hci1: command tx timeout [ 859.465085][T27420] bridge3: entered allmulticast mode [ 859.791711][T27430] FAULT_INJECTION: forcing a failure. [ 859.791711][T27430] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 859.791747][T27430] CPU: 1 UID: 0 PID: 27430 Comm: syz.1.6383 Not tainted syzkaller #0 PREEMPT(full) [ 859.791770][T27430] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 859.791783][T27430] Call Trace: [ 859.791793][T27430] [ 859.791802][T27430] dump_stack_lvl+0xe8/0x150 [ 859.791839][T27430] should_fail_ex+0x410/0x560 [ 859.791870][T27430] _copy_from_user+0x2d/0xb0 [ 859.791897][T27430] kstrtouint_from_user+0xd6/0x180 [ 859.791938][T27430] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 859.791970][T27430] ? lock_acquire+0x115/0x350 [ 859.791999][T27430] proc_fail_nth_write+0x8e/0x210 [ 859.792020][T27430] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 859.792050][T27430] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 859.792071][T27430] vfs_write+0x296/0xba0 [ 859.792109][T27430] ? __pfx_vfs_write+0x10/0x10 [ 859.792140][T27430] ? __fget_files+0x2a/0x420 [ 859.792178][T27430] ? __fget_files+0x3a2/0x420 [ 859.792204][T27430] ? __fget_files+0x2a/0x420 [ 859.792242][T27430] ksys_write+0x150/0x270 [ 859.792274][T27430] ? __pfx_ksys_write+0x10/0x10 [ 859.792318][T27430] do_syscall_64+0x166/0x520 [ 859.792347][T27430] ? trace_irq_disable+0x3b/0x140 [ 859.792368][T27430] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 859.792389][T27430] ? clear_bhb_loop+0x70/0xc0 [ 859.792414][T27430] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 859.792434][T27430] RIP: 0033:0x7f2f8475e98e [ 859.792455][T27430] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 859.792472][T27430] RSP: 002b:00007f2f829f5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 859.792495][T27430] RAX: ffffffffffffffda RBX: 00007f2f829f66c0 RCX: 00007f2f8475e98e [ 859.792511][T27430] RDX: 0000000000000001 RSI: 00007f2f829f60a0 RDI: 0000000000000006 [ 859.792524][T27430] RBP: 00007f2f829f6090 R08: 0000000000000000 R09: 0000000000000000 [ 859.792537][T27430] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 859.792550][T27430] R13: 00007f2f84a26038 R14: 00007f2f84a25fa0 R15: 00007ffd6430d528 [ 859.792585][T27430] [ 860.098491][ T3997] batman_adv: batadv0: Interface deactivated: ip6gretap1 [ 860.307665][ T3997] batman_adv: batadv0: Removing interface: ip6gretap1 [ 860.934229][ T3997] bond0 (unregistering): Released all slaves [ 860.939824][ T3997] bond1 (unregistering): Released all slaves [ 860.967173][ T3997] bond2 (unregistering): Released all slaves [ 860.985016][ T3997] bond3 (unregistering): Released all slaves [ 861.000727][ T3997] bond4 (unregistering): Released all slaves [ 861.023564][ T3997] bond5 (unregistering): Released all slaves [ 861.091312][T27456] openvswitch: ovs-s!: Dropping previously announced user features [ 861.117851][ T5278] 8021q: adding VLAN 0 to HW filter on device eth1 [ 861.276550][T27469] netlink: 'syz.3.6389': attribute type 10 has an invalid length. [ 861.276577][T27469] netlink: 2 bytes leftover after parsing attributes in process `syz.3.6389'. [ 861.317523][ T3997] : left promiscuous mode [ 861.364175][T27469] team0: Device wg2 is of different type [ 861.390189][ T3997] ovs-s!: left promiscuous mode [ 861.547382][ T4933] Bluetooth: hci1: command tx timeout [ 861.619003][T27470] x_tables: ip6_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 861.628572][ T3997] tipc: Left network mode [ 861.755225][T27470] netlink: 48 bytes leftover after parsing attributes in process `syz.0.6388'. [ 861.841006][T27492] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6395'. [ 861.846532][T27493] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 861.847196][T27489] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6394'. [ 861.910939][T27501] ip_tables: iptables: counters copy to user failed while replacing table [ 862.004318][T27493] xt_CT: No such helper "netbios-ns" [ 862.167034][ T31] audit: type=1800 audit(1790235153.297:10): pid=27509 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.6396" name="memory.events" dev="tmpfs" ino=367 res=0 errno=0 [ 862.575202][T27520] bridge0: port 1(bridge_slave_0) entered listening state [ 862.610817][T27527] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6400'. [ 862.657664][T27520] netlink: 20 bytes leftover after parsing attributes in process `syz.2.6399'. [ 862.657697][T27520] netlink: 36 bytes leftover after parsing attributes in process `syz.2.6399'. [ 862.881955][T27533] netlink: 'syz.3.6402': attribute type 10 has an invalid length. [ 862.933146][T27544] netlink: 'syz.3.6402': attribute type 10 has an invalid length. [ 862.992021][T27533] team0: Port device dummy0 added [ 862.997355][ T5278] 8021q: adding VLAN 0 to HW filter on device eth2 [ 863.035713][T27544] team0: Port device dummy0 removed [ 863.120270][T13246] IPVS: starting estimator thread 0... [ 863.201939][T27551] IPVS: using max 26 ests per chain, 62400 per kthread [ 863.218201][T27348] bridge0: port 1(bridge_slave_0) entered blocking state [ 863.218987][T27348] bridge0: port 1(bridge_slave_0) entered disabled state [ 863.219143][T27348] bridge_slave_0: entered allmulticast mode [ 863.228688][T27348] bridge_slave_0: entered promiscuous mode [ 863.250914][T27348] bridge0: port 2(bridge_slave_1) entered blocking state [ 863.251133][T27348] bridge0: port 2(bridge_slave_1) entered disabled state [ 863.251292][T27348] bridge_slave_1: entered allmulticast mode [ 863.273197][T27348] bridge_slave_1: entered promiscuous mode [ 863.536274][T27348] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 863.554003][T27348] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 863.624277][ T4933] Bluetooth: hci1: command tx timeout [ 863.665879][T27567] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6410'. [ 863.772190][T27570] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6412'. [ 863.987446][T27348] team0: Port device team_slave_0 added [ 864.105709][T27348] team0: Port device team_slave_1 added [ 864.375241][ T3997] hsr_slave_0: left promiscuous mode [ 864.397762][ T3997] hsr_slave_1: left promiscuous mode [ 864.436512][ T3997] veth1_macvtap: left promiscuous mode [ 864.446839][ T3997] veth1_vlan: left promiscuous mode [ 864.446953][ T3997] veth0_vlan: left promiscuous mode [ 864.585946][ C0] bridge0: port 1(bridge_slave_0) entered learning state [ 864.623522][T27602] netlink: 'syz.1.6420': attribute type 83 has an invalid length. [ 864.643384][T27602] __nla_validate_parse: 2 callbacks suppressed [ 864.643404][T27602] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6420'. [ 865.264804][ T3997] team0 (unregistering): Port device wg2 removed [ 865.265562][T13246] smc: removing ib device syz2 [ 865.308522][T13246] smbdirect: ib_dev[syz2] removed [ 865.664319][T27348] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 865.664340][T27348] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 865.664367][T27348] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 865.702313][ T4933] Bluetooth: hci1: command tx timeout [ 865.740729][T27602] workqueue: Failed to create a rescuer kthread for wq "bond2": -EINTR [ 865.743523][ T5278] 8021q: adding VLAN 0 to HW filter on device eth3 [ 865.851577][T27348] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 865.851596][T27348] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 865.851624][T27348] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 866.652750][T27348] hsr_slave_0: entered promiscuous mode [ 866.673576][T27348] hsr_slave_1: entered promiscuous mode [ 866.674462][T27348] debugfs: 'hsr0' already exists in 'hsr' [ 866.674499][T27348] Cannot create hsr debugfs directory [ 867.058091][T27656] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6426'. [ 867.290245][T27657] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6427'. [ 867.417806][T27673] netlink: 72 bytes leftover after parsing attributes in process `syz.1.6427'. [ 867.864811][T27689] netlink: 'syz.2.6431': attribute type 4 has an invalid length. [ 868.297079][T27680] netdevsim netdevsim3 netdevsim3 (unregistering): left allmulticast mode [ 868.350049][ T5278] 8021q: adding VLAN 0 to HW filter on device eth4 [ 868.539577][T27700] netlink: 388 bytes leftover after parsing attributes in process `syz.0.6434'. [ 868.712511][T27704] netlink: 24 bytes leftover after parsing attributes in process `syz.0.6434'. [ 868.712553][T27704] netlink: 16 bytes leftover after parsing attributes in process `syz.0.6434'. [ 869.050005][T27712] netlink: 84 bytes leftover after parsing attributes in process `syz.2.6438'. [ 869.239674][T27701] 8021q: adding VLAN 0 to HW filter on device bond2 [ 869.297876][ T3997] IPVS: stop unused estimator thread 0... [ 869.318039][T27719] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6440'. [ 869.648593][T27727] netlink: 2 bytes leftover after parsing attributes in process `syz.1.6445'. [ 869.779682][T27735] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6446'. [ 869.823543][T27735] netlink: 20 bytes leftover after parsing attributes in process `syz.2.6446'. [ 870.195761][T27754] netlink: 'syz.2.6451': attribute type 1 has an invalid length. [ 870.195785][T27754] netlink: 224 bytes leftover after parsing attributes in process `syz.2.6451'. [ 870.195802][T27754] netlink: 16 bytes leftover after parsing attributes in process `syz.2.6451'. [ 870.197007][T27754] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6451'. [ 870.266951][T27749] bond3: entered allmulticast mode [ 870.269067][T27749] 8021q: adding VLAN 0 to HW filter on device bond3 [ 870.494859][T27766] x_tables: duplicate underflow at hook 1 [ 870.919585][T27784] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6454'. [ 871.026158][T27786] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6455'. [ 871.064432][T27786] netlink: 72 bytes leftover after parsing attributes in process `syz.2.6455'. [ 871.207691][T27792] xt_SECMARK: invalid mode: 9 [ 871.267317][T27797] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6459'. [ 871.328479][T27800] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6459'. [ 871.350565][T27795] sch_tbf: burst 7 is lower than device bridge0 mtu (1464) ! [ 871.368562][T27801] sch_tbf: peakrate 896 is lower than or equals to rate 3850 ! [ 871.375417][T27794] syzkaller0: entered promiscuous mode [ 871.375440][T27794] syzkaller0: entered allmulticast mode [ 871.494735][T27794] tipc: Started in network mode [ 871.494769][T27794] tipc: Node identity 163a74ddd5c1, cluster identity 4711 [ 871.500261][T27794] tipc: Enabled bearer , priority 0 [ 871.534744][T27798] tipc: Resetting bearer [ 871.657028][T27798] tipc: Disabling bearer [ 871.680348][T27806] ip6_tunnel: non-ECT from 0000:0000:0000:0000:0000:ffff:7f00:0001 with DS=0xb [ 871.994258][T27348] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 872.009382][T27348] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 872.010643][T27348] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 872.058005][T27348] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 872.059673][T27348] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 872.135905][T27348] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 872.140352][T27348] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 872.162801][T27348] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 872.553958][T27348] 8021q: adding VLAN 0 to HW filter on device bond0 [ 872.599861][T27348] 8021q: adding VLAN 0 to HW filter on device team0 [ 872.621610][ T6821] bridge0: port 1(bridge_slave_0) entered blocking state [ 872.621801][ T6821] bridge0: port 1(bridge_slave_0) entered forwarding state [ 872.652899][ T6821] bridge0: port 2(bridge_slave_1) entered blocking state [ 872.653026][ T6821] bridge0: port 2(bridge_slave_1) entered forwarding state [ 872.923435][T27861] Bluetooth: hci0: invalid len left 17, exp >= 93 [ 873.135110][T27867] netlink: 'syz.1.6476': attribute type 10 has an invalid length. [ 873.471018][T27883] netlink: 'syz.3.6480': attribute type 11 has an invalid length. [ 873.894954][T27902] FAULT_INJECTION: forcing a failure. [ 873.894954][T27902] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 873.894991][T27902] CPU: 0 UID: 0 PID: 27902 Comm: syz.0.6485 Not tainted syzkaller #0 PREEMPT(full) [ 873.895024][T27902] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 873.895037][T27902] Call Trace: [ 873.895045][T27902] [ 873.895055][T27902] dump_stack_lvl+0xe8/0x150 [ 873.895091][T27902] should_fail_ex+0x410/0x560 [ 873.895122][T27902] _copy_from_user+0x2d/0xb0 [ 873.895148][T27902] __copy_msghdr+0x390/0x590 [ 873.895183][T27902] ___sys_sendmsg+0x213/0x360 [ 873.895209][T27902] ? __lock_acquire+0x747/0x2de0 [ 873.895235][T27902] ? __pfx____sys_sendmsg+0x10/0x10 [ 873.895268][T27902] ? kstrtouint+0x6e/0xe0 [ 873.895320][T27902] ? __fget_files+0x2a/0x420 [ 873.895346][T27902] ? __fget_files+0x3a2/0x420 [ 873.895383][T27902] __sys_sendmmsg+0x273/0x4d0 [ 873.895415][T27902] ? __pfx___sys_sendmmsg+0x10/0x10 [ 873.895451][T27902] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 873.895493][T27902] ? ksys_write+0x242/0x270 [ 873.895523][T27902] ? __pfx_ksys_write+0x10/0x10 [ 873.895559][T27902] __x64_sys_sendmmsg+0xa0/0xc0 [ 873.895585][T27902] do_syscall_64+0x166/0x520 [ 873.895609][T27902] ? trace_irq_disable+0x3b/0x140 [ 873.895629][T27902] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 873.895650][T27902] ? clear_bhb_loop+0x70/0xc0 [ 873.895676][T27902] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 873.895696][T27902] RIP: 0033:0x7ff9f2d9e159 [ 873.895717][T27902] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 873.895734][T27902] RSP: 002b:00007ff9f3d23028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 873.895757][T27902] RAX: ffffffffffffffda RBX: 00007ff9f3025fa0 RCX: 00007ff9f2d9e159 [ 873.895772][T27902] RDX: 0000000000000001 RSI: 0000200000000440 RDI: 0000000000000010 [ 873.895785][T27902] RBP: 00007ff9f3d23090 R08: 0000000000000000 R09: 0000000000000000 [ 873.895798][T27902] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 873.895810][T27902] R13: 00007ff9f3026038 R14: 00007ff9f3025fa0 R15: 00007ffd3d6befa8 [ 873.895842][T27902] [ 874.678221][T27348] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 875.024428][T27943] netlink: 'syz.2.6492': attribute type 6 has an invalid length. [ 875.024462][T27943] netlink: 'syz.2.6492': attribute type 7 has an invalid length. [ 875.024476][T27943] netlink: 'syz.2.6492': attribute type 8 has an invalid length. [ 875.177782][T27951] __nla_validate_parse: 8 callbacks suppressed [ 875.177805][T27951] netlink: 104 bytes leftover after parsing attributes in process `syz.1.6495'. [ 875.493994][T27348] veth0_vlan: entered promiscuous mode [ 875.544857][T27348] veth1_vlan: entered promiscuous mode [ 875.738950][T27348] veth0_macvtap: entered promiscuous mode [ 875.760743][T27348] veth1_macvtap: entered promiscuous mode [ 875.776597][T27975] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6499'. [ 875.779103][T27975] netlink: 72 bytes leftover after parsing attributes in process `syz.3.6499'. [ 875.891185][T27348] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 875.938157][T27348] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 875.994365][ T49] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 875.994737][ T49] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 875.994776][ T49] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 875.994810][ T49] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 876.224884][T27987] netlink: 80 bytes leftover after parsing attributes in process `syz.3.6502'. [ 876.256539][T27987] netlink: 'syz.3.6502': attribute type 1 has an invalid length. [ 876.416467][T27948] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6493'. [ 876.632470][T27948] bond0: (slave bond_slave_1): Releasing backup interface [ 876.696843][ T6821] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 876.696867][ T6821] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 876.833917][ T6821] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 876.833941][ T6821] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 877.183974][T28013] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6505'. [ 878.038612][T28050] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6517'. [ 878.277490][T28063] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6521'. [ 878.360063][T17243] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 878.370696][T17243] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 878.380406][T17243] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 878.395048][T17243] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 878.400072][T17243] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 879.301035][T28104] netlink: 104 bytes leftover after parsing attributes in process `syz.4.6530'. [ 879.301359][T28096] sch_tbf: burst 0 is lower than device ip6gre0 mtu (1448) ! [ 879.338604][T28101] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6530'. [ 879.339034][T28101] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 879.890463][T28125] bond1: entered allmulticast mode [ 879.891020][T28125] 8021q: adding VLAN 0 to HW filter on device bond1 [ 879.942737][ C0] bridge0: port 1(bridge_slave_0) entered forwarding state [ 880.504697][ T4933] Bluetooth: hci2: command tx timeout [ 880.544407][T28158] netlink: 16 bytes leftover after parsing attributes in process `syz.4.6545'. [ 880.567231][ T6286] vlan3: left allmulticast mode [ 880.567256][ T6286] geneve0: left allmulticast mode [ 880.567415][ T6286] bridge0: port 1(vlan3) entered disabled state [ 880.792796][ T6286] bond2 (unregistering): (slave ip6gretap1): Releasing active interface [ 881.156582][T28183] netlink: 28 bytes leftover after parsing attributes in process `syz.0.6547'. [ 881.397446][ T6286] bond6 (unregistering): (slave bridge4): Releasing backup interface [ 881.397478][ T6286] bridge4 (unregistering): left promiscuous mode [ 881.397575][ T6286] bridge4 (unregistering): left allmulticast mode [ 881.435631][ T6286] bond0 (unregistering): Released all slaves [ 881.458539][ T6286] bond1 (unregistering): Released all slaves [ 881.470231][ T3997] smbdirect: ib_dev[syz1] removed [ 881.527495][ T6286] team0: Port device macvlan2 removed [ 881.545475][ T6286] bond2 (unregistering): Released all slaves [ 881.565012][ T6286] bond3 (unregistering): Released all slaves [ 881.567961][T28193] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6547'. [ 881.597592][ T6286] bond4 (unregistering): Released all slaves [ 881.618707][ T6286] team0: Port device bond5 removed [ 881.620196][ T6286] bond5 (unregistering): Released all slaves [ 881.644785][ T6286] bond6 (unregistering): Released all slaves [ 881.666519][ T6286] bond7 (unregistering): Released all slaves [ 881.689506][ T6286] bond8 (unregistering): Released all slaves [ 881.720001][ T6286] bond9 (unregistering): (slave veth0_to_bond): Releasing active interface [ 881.744571][ T6286] bond9 (unregistering): Released all slaves [ 881.778581][ T6286] bond10 (unregistering): Released all slaves [ 881.976652][T28178] workqueue: Failed to create a rescuer kthread for wq "bond2": -EINTR [ 881.977930][T28174] veth0: entered promiscuous mode [ 881.978010][T28174] veth0: left promiscuous mode [ 882.181319][T28187] veth0: entered promiscuous mode [ 882.181393][T28187] veth0: left promiscuous mode [ 882.357594][ T6286] ovs-s!: left promiscuous mode [ 882.490754][ T6286] tipc: Disabling bearer [ 882.499817][ T6286] tipc: Left network mode [ 882.584502][ T4933] Bluetooth: hci2: command tx timeout [ 882.701908][T28207] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6550'. [ 883.253773][T28240] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6555'. [ 883.297499][T28238] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6554'. [ 883.611525][T28255] ip_tables: iptables: counters copy to user failed while replacing table [ 883.995971][T28262] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6560'. [ 884.109517][T28278] netlink: 144 bytes leftover after parsing attributes in process `syz.2.6563'. [ 884.159660][ T6286] hsr_slave_0: left promiscuous mode [ 884.668923][ T4933] Bluetooth: hci2: command tx timeout [ 885.044288][ T5278] 8021q: adding VLAN 0 to HW filter on device eth1 [ 885.066843][T28285] dvmrp8: entered allmulticast mode [ 885.108992][T28300] syzkaller0: entered promiscuous mode [ 885.109010][T28300] syzkaller0: entered allmulticast mode [ 885.137403][T28062] bridge0: port 1(bridge_slave_0) entered blocking state [ 885.137529][T28062] bridge0: port 1(bridge_slave_0) entered disabled state [ 885.137705][T28062] bridge_slave_0: entered allmulticast mode [ 885.147643][T28062] bridge_slave_0: entered promiscuous mode [ 885.149806][T28295] netlink: 'syz.0.6565': attribute type 23 has an invalid length. [ 885.159461][T28062] bridge0: port 2(bridge_slave_1) entered blocking state [ 885.159571][T28062] bridge0: port 2(bridge_slave_1) entered disabled state [ 885.162366][T28062] bridge_slave_1: entered allmulticast mode [ 885.168288][T28062] bridge_slave_1: entered promiscuous mode [ 885.393492][T28062] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 885.409640][T28062] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 885.539867][T28318] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6566'. [ 885.669264][T28326] netlink: 72 bytes leftover after parsing attributes in process `syz.4.6566'. [ 886.028216][T28062] team0: Port device team_slave_0 added [ 886.037230][T28062] team0: Port device team_slave_1 added [ 886.261470][ T6286] IPVS: stop unused estimator thread 0... [ 886.290391][T28062] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 886.290411][T28062] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 886.290437][T28062] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 886.375440][T28062] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 886.375460][T28062] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 886.375488][T28062] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 886.619886][ T5278] 8021q: adding VLAN 0 to HW filter on device eth2 [ 886.653416][T28062] hsr_slave_0: entered promiscuous mode [ 886.659083][T28062] hsr_slave_1: entered promiscuous mode [ 886.659606][T28062] debugfs: 'hsr0' already exists in 'hsr' [ 886.659628][T28062] Cannot create hsr debugfs directory [ 886.751809][ T4933] Bluetooth: hci2: command tx timeout [ 887.399346][T28367] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6578'. [ 887.399379][T28367] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6578'. [ 887.625768][T28364] bridge0: port 2(bridge_slave_1) entered disabled state [ 887.626426][T28364] bridge0: port 1(bridge_slave_0) entered disabled state [ 887.960125][T28364] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 887.996023][T28364] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 888.442756][ T5278] 8021q: adding VLAN 0 to HW filter on device eth3 [ 888.722247][ T12] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 888.722704][T13246] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 888.722744][T13246] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 888.722777][T13246] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 888.728942][T28410] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6586'. [ 888.728975][T28410] netlink: 36 bytes leftover after parsing attributes in process `syz.2.6586'. [ 888.756091][T28397] syzkaller0: entered promiscuous mode [ 888.756117][T28397] syzkaller0: entered allmulticast mode [ 888.880152][T28414] netlink: 'syz.0.6587': attribute type 10 has an invalid length. [ 888.931150][T28419] netlink: 'syz.0.6587': attribute type 10 has an invalid length. [ 889.038469][T28423] netlink: 168 bytes leftover after parsing attributes in process `syz.4.6590'. [ 889.085325][T28414] team0: Port device dummy0 added [ 889.151049][T28419] team0: Port device dummy0 removed [ 889.208188][ T30] hid-generic 0005:0008:0009.0042: item fetching failed at offset 2/3 [ 889.208931][ T30] hid-generic 0005:0008:0009.0042: probe with driver hid-generic failed with error -22 [ 889.235611][T28414] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6587'. [ 890.481066][T28062] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 890.517253][T28062] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 890.518259][T28062] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 890.540360][T28062] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 890.549308][T28062] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 890.563229][T28062] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 890.564217][T28062] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 890.591322][T28062] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 890.733712][T28062] 8021q: adding VLAN 0 to HW filter on device bond0 [ 890.767595][T28062] 8021q: adding VLAN 0 to HW filter on device team0 [ 890.788030][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 890.788128][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 890.833886][ T6286] bridge0: port 2(bridge_slave_1) entered blocking state [ 890.834034][ T6286] bridge0: port 2(bridge_slave_1) entered forwarding state [ 891.104598][T28480] netlink: 104 bytes leftover after parsing attributes in process `syz.4.6601'. [ 891.648531][T28502] netlink: 65039 bytes leftover after parsing attributes in process `syz.1.6605'. [ 891.648625][T28500] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6607'. [ 891.722171][T28500] netlink: 72 bytes leftover after parsing attributes in process `syz.0.6607'. [ 891.959226][T28502] bridge_slave_0: left allmulticast mode [ 891.959252][T28502] bridge_slave_0: left promiscuous mode [ 891.959441][T28502] bridge0: port 1(bridge_slave_0) entered disabled state [ 892.013198][T28502] bridge_slave_1: left allmulticast mode [ 892.013227][T28502] bridge_slave_1: left promiscuous mode [ 892.013462][T28502] bridge0: port 2(bridge_slave_1) entered disabled state [ 892.060879][T28502] bond0: (slave bond_slave_0): Releasing backup interface [ 892.094153][ T10] hid-generic 0005:0008:0009.0043: item fetching failed at offset 2/3 [ 892.099063][ T10] hid-generic 0005:0008:0009.0043: probe with driver hid-generic failed with error -22 [ 892.139566][T28502] bond0: (slave bond_slave_1): Releasing backup interface [ 892.209120][T28502] team0: Port device team_slave_0 removed [ 892.228753][T28502] team0: Port device team_slave_1 removed [ 892.231599][T28502] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 892.231628][T28502] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 892.256836][T28502] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 892.256855][T28502] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 892.260798][T28502] A link change request failed with some changes committed already. Interface hsr_slave_1 may have been left with an inconsistent configuration, please check. [ 892.359972][T28062] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 892.535946][T28525] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6612'. [ 892.635411][T28062] veth0_vlan: entered promiscuous mode [ 892.694707][T28062] veth1_vlan: entered promiscuous mode [ 892.758485][T28062] veth0_macvtap: entered promiscuous mode [ 892.770319][T28062] veth1_macvtap: entered promiscuous mode [ 892.795262][T28062] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 892.800271][T28062] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 892.865100][ T12] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 892.985526][T13246] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 892.985721][ T12] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 892.985761][ T12] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 893.155139][T28544] netlink: 84 bytes leftover after parsing attributes in process `syz.4.6617'. [ 893.171147][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 893.171170][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 893.335837][ T3997] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 893.335862][ T3997] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 893.339752][T28546] netlink: 24 bytes leftover after parsing attributes in process `syz.1.6618'. [ 894.901240][T28615] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6638'. [ 894.992082][T28615] netlink: 20 bytes leftover after parsing attributes in process `syz.4.6638'. [ 895.040936][T28615] vcan1: entered allmulticast mode [ 895.410614][T28634] netlink: 24 bytes leftover after parsing attributes in process `syz.1.6642'. [ 895.571209][T28643] A link change request failed with some changes committed already. Interface hsr_slave_1 may have been left with an inconsistent configuration, please check. [ 896.046323][T28669] netlink: 'syz.1.6653': attribute type 10 has an invalid length. [ 896.105278][T28669] team0: Port device wg2 added [ 896.206828][T28672] vlan2: entered promiscuous mode [ 896.206853][T28672] bridge0: entered promiscuous mode [ 896.210016][T28672] __nla_validate_parse: 4 callbacks suppressed [ 896.210039][T28672] netlink: 65039 bytes leftover after parsing attributes in process `syz.0.6654'. [ 896.368058][T28675] netlink: 28 bytes leftover after parsing attributes in process `syz.1.6655'. [ 896.370428][T28675] tipc: Started in network mode [ 896.370459][T28675] tipc: Node identity 469fbf16edac, cluster identity 4711 [ 896.370625][T28675] tipc: Enabled bearer , priority 0 [ 896.690930][T28684] netlink: 'syz.4.6658': attribute type 3 has an invalid length. [ 896.908006][T28689] batman_adv: batadv0: Adding interface: macvtap1 [ 896.908027][T28689] batman_adv: batadv0: The MTU of interface macvtap1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 896.908055][T28689] batman_adv: batadv0: Not using interface macvtap1 (retrying later): interface not active [ 896.925673][T28690] netlink: 28 bytes leftover after parsing attributes in process `syz.0.6661'. [ 897.097826][T28689] batman_adv: batadv0: Removing interface: macvtap1 [ 897.195734][T28673] tipc: Disabling bearer [ 897.376047][T28707] x_tables: unsorted entry at hook 2 [ 897.861301][T28733] netlink: 28 bytes leftover after parsing attributes in process `syz.3.6675'. [ 898.847680][T28759] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6684'. [ 898.886324][T28759] netlink: 72 bytes leftover after parsing attributes in process `syz.0.6684'. [ 899.150854][T28765] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6687'. [ 899.341889][T28775] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6690'. [ 899.341921][T28775] netlink: 36 bytes leftover after parsing attributes in process `syz.0.6690'. [ 899.459270][T28783] netlink: 104 bytes leftover after parsing attributes in process `syz.4.6695'. [ 900.039895][T28788] bridge0: port 2(bridge_slave_1) entered disabled state [ 900.170705][T28805] syzkaller0: entered promiscuous mode [ 900.170729][T28805] syzkaller0: entered allmulticast mode [ 900.938707][T28838] tc_dump_action: action bad kind [ 901.542592][T28864] __nla_validate_parse: 4 callbacks suppressed [ 901.542618][T28864] netlink: 40 bytes leftover after parsing attributes in process `syz.2.6721'. [ 902.140672][T28879] syzkaller0: entered promiscuous mode [ 902.140699][T28879] syzkaller0: entered allmulticast mode [ 902.257668][T28889] netlink: 'syz.1.6729': attribute type 1 has an invalid length. [ 902.257698][T28889] netlink: 'syz.1.6729': attribute type 2 has an invalid length. [ 902.389220][T28891] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6730'. [ 902.547380][ T4933] block nbd0: Receive control failed (result -32) [ 902.550844][T17243] block nbd0: Receive control failed (result -32) [ 902.607840][T28897] FAULT_INJECTION: forcing a failure. [ 902.607840][T28897] name failslab, interval 1, probability 0, space 0, times 0 [ 902.607865][T28897] CPU: 0 UID: 0 PID: 28897 Comm: syz.4.6732 Not tainted syzkaller #0 PREEMPT(full) [ 902.607880][T28897] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 902.607888][T28897] Call Trace: [ 902.607893][T28897] [ 902.607899][T28897] dump_stack_lvl+0xe8/0x150 [ 902.607930][T28897] should_fail_ex+0x410/0x560 [ 902.607946][T28897] ? __alloc_skb+0x1db/0x7a0 [ 902.607960][T28897] should_failslab+0xa8/0x100 [ 902.607977][T28897] ? __alloc_skb+0x1db/0x7a0 [ 902.607988][T28897] kmem_cache_alloc_node_noprof+0xa1/0x610 [ 902.608005][T28897] ? __alloc_skb+0x18d/0x7a0 [ 902.608018][T28897] ? __alloc_skb+0x1db/0x7a0 [ 902.608035][T28897] __alloc_skb+0x1db/0x7a0 [ 902.608050][T28897] ppp_write+0xb1/0x400 [ 902.608151][T28897] ? vfs_writev+0x495/0x990 [ 902.608176][T28897] vfs_writev+0x4bb/0x990 [ 902.608200][T28897] ? __pfx_ppp_write+0x10/0x10 [ 902.608230][T28897] ? __pfx_vfs_writev+0x10/0x10 [ 902.608260][T28897] ? __fget_files+0x2a/0x420 [ 902.608278][T28897] ? __fget_files+0x3a2/0x420 [ 902.608292][T28897] ? __fget_files+0x2a/0x420 [ 902.608311][T28897] __x64_sys_pwritev+0x19c/0x2b0 [ 902.608326][T28897] ? __pfx___x64_sys_pwritev+0x10/0x10 [ 902.608344][T28897] do_syscall_64+0x166/0x520 [ 902.608359][T28897] ? trace_irq_disable+0x3b/0x140 [ 902.608371][T28897] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 902.608383][T28897] ? clear_bhb_loop+0x70/0xc0 [ 902.608397][T28897] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 902.608409][T28897] RIP: 0033:0x7f02d779e159 [ 902.608425][T28897] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 902.608435][T28897] RSP: 002b:00007f02d8587028 EFLAGS: 00000246 ORIG_RAX: 0000000000000128 [ 902.608450][T28897] RAX: ffffffffffffffda RBX: 00007f02d7a25fa0 RCX: 00007f02d779e159 [ 902.608459][T28897] RDX: 0000000000000001 RSI: 0000200000000400 RDI: 0000000000000004 [ 902.608467][T28897] RBP: 00007f02d8587090 R08: 0000000000000008 R09: 0000000000000000 [ 902.608475][T28897] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000001 [ 902.608482][T28897] R13: 00007f02d7a26038 R14: 00007f02d7a25fa0 R15: 00007ffe523c1c18 [ 902.608501][T28897] [ 903.177943][ T10] hid-generic 0005:0008:0009.0044: item fetching failed at offset 2/3 [ 903.190453][ T10] hid-generic 0005:0008:0009.0044: probe with driver hid-generic failed with error -22 [ 903.335257][T28928] netlink: 76 bytes leftover after parsing attributes in process `syz.0.6740'. [ 903.388060][T28929] openvswitch: netlink: IP tunnel attribute has 8 unknown bytes. [ 903.388104][T28929] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 903.859080][T28938] batman_adv: batadv0: Adding interface: syzkaller0 [ 903.859101][T28938] batman_adv: batadv0: The MTU of interface syzkaller0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 903.859135][T28938] batman_adv: batadv0: Interface activated: syzkaller0 [ 903.938428][T28946] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6747'. [ 903.938463][T28946] netlink: 36 bytes leftover after parsing attributes in process `syz.1.6747'. [ 903.979019][T28936] batman_adv: batadv0: Interface deactivated: syzkaller0 [ 904.085391][T28948] netlink: 68 bytes leftover after parsing attributes in process `syz.2.6748'. [ 904.097852][T28936] batman_adv: batadv0: Removing interface: syzkaller0 [ 904.147601][T28948] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6748'. [ 904.207624][T28948] bond0: (slave bond_slave_0): Releasing backup interface [ 904.217988][T28942] netlink: 16 bytes leftover after parsing attributes in process `syz.3.6745'. [ 904.326841][T28956] netlink: 'syz.4.6753': attribute type 10 has an invalid length. [ 904.326870][T28956] netlink: 2 bytes leftover after parsing attributes in process `syz.4.6753'. [ 904.394441][T28956] team0: Device wg2 is of different type [ 904.554076][T28965] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6754'. [ 904.672563][T28967] §: renamed from sit0 (while UP) [ 904.708673][T28976] netlink: 'syz.0.6758': attribute type 2 has an invalid length. [ 905.137798][T28997] ±ÿ: renamed from lo (while UP) [ 905.226833][T28995] ovs-s!: entered promiscuous mode [ 905.626831][T29010] netlink: 'syz.3.6771': attribute type 11 has an invalid length. [ 905.774815][T29017] netdevsim netdevsim1 netdevsim0: entered allmulticast mode [ 906.654857][T29036] netdevsim netdevsim1 netdevsim0: left allmulticast mode [ 906.778704][T29036] vlan2: left promiscuous mode [ 906.778729][T29036] bridge0: left promiscuous mode [ 906.780605][T29036] ip6gre1: left promiscuous mode [ 906.780623][T29036] ip6gre1: left allmulticast mode [ 906.805786][T29036] bond1: left allmulticast mode [ 906.817621][T29036] bridge3: left allmulticast mode [ 906.868300][T29062] __nla_validate_parse: 2 callbacks suppressed [ 906.868323][T29062] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6787'. [ 906.871919][ T12] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 906.871962][ T12] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 906.871992][ T12] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 906.872023][ T12] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 907.215802][T29067] syzkaller0: entered promiscuous mode [ 907.215827][T29067] syzkaller0: entered allmulticast mode [ 907.259780][T29071] xt_SECMARK: mode already set to 1 cannot mix with rules for mode 9 [ 907.372580][T29074] netlink: 40 bytes leftover after parsing attributes in process `syz.3.6792'. [ 907.456637][T29077] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6793'. [ 907.480905][T29078] macvlan0: entered promiscuous mode [ 907.482134][T29078] macvlan0: entered allmulticast mode [ 907.482154][T29078] veth1_vlan: entered allmulticast mode [ 907.527033][T29077] netlink: 20 bytes leftover after parsing attributes in process `syz.1.6793'. [ 907.853619][T29096] sch_tbf: burst 0 is lower than device ip6gre0 mtu (32769) ! [ 907.951764][ T4933] Bluetooth: hci2: command 0x0405 tx timeout [ 907.977827][T29092] xt_hashlimit: size too large, truncated to 1048576 [ 908.255437][T29107] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6802'. [ 908.478533][T29116] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6805'. [ 908.764283][T29135] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6811'. [ 908.764316][T29135] netlink: 36 bytes leftover after parsing attributes in process `syz.2.6811'. [ 909.339799][T29148] syzkaller0: entered promiscuous mode [ 909.339836][T29148] syzkaller0: entered allmulticast mode [ 909.515525][T29150] syzkaller0: entered promiscuous mode [ 909.515556][T29150] syzkaller0: entered allmulticast mode [ 909.847919][T29166] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6819'. [ 910.038203][T29172] IPVS: set_ctl: invalid protocol: 22 100.1.1.0:20004 [ 912.542606][T29177] netlink: 'syz.0.6821': attribute type 10 has an invalid length. [ 912.542630][T29177] netlink: 2 bytes leftover after parsing attributes in process `syz.0.6821'. [ 912.703743][T29177] team0: Device wg2 is of different type [ 912.754938][T29185] FAULT_INJECTION: forcing a failure. [ 912.754938][T29185] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 912.754975][T29185] CPU: 0 UID: 0 PID: 29185 Comm: syz.3.6825 Not tainted syzkaller #0 PREEMPT(full) [ 912.754999][T29185] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 912.755012][T29185] Call Trace: [ 912.755021][T29185] [ 912.755032][T29185] dump_stack_lvl+0xe8/0x150 [ 912.755070][T29185] should_fail_ex+0x410/0x560 [ 912.755101][T29185] _copy_from_user+0x2d/0xb0 [ 912.755130][T29185] ___sys_sendmsg+0x1c6/0x360 [ 912.755158][T29185] ? __lock_acquire+0x747/0x2de0 [ 912.755186][T29185] ? __pfx____sys_sendmsg+0x10/0x10 [ 912.755254][T29185] ? __fget_files+0x2a/0x420 [ 912.755282][T29185] ? __fget_files+0x3a2/0x420 [ 912.755322][T29185] __x64_sys_sendmsg+0x1b1/0x290 [ 912.755354][T29185] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 912.755416][T29185] do_syscall_64+0x166/0x520 [ 912.755442][T29185] ? trace_irq_disable+0x3b/0x140 [ 912.755464][T29185] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 912.755485][T29185] ? clear_bhb_loop+0x70/0xc0 [ 912.755512][T29185] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 912.755534][T29185] RIP: 0033:0x7f3681d9e159 [ 912.755559][T29185] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 912.755578][T29185] RSP: 002b:00007f3682c32028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 912.755604][T29185] RAX: ffffffffffffffda RBX: 00007f3682025fa0 RCX: 00007f3681d9e159 [ 912.755620][T29185] RDX: 0000000000000000 RSI: 0000200000000340 RDI: 0000000000000004 [ 912.755634][T29185] RBP: 00007f3682c32090 R08: 0000000000000000 R09: 0000000000000000 [ 912.755648][T29185] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 912.755661][T29185] R13: 00007f3682026038 R14: 00007f3682025fa0 R15: 00007ffe9f983e28 [ 912.755698][T29185] [ 913.019678][T29193] netlink: 40 bytes leftover after parsing attributes in process `syz.4.6826'. [ 913.046617][T29193] netlink: 36 bytes leftover after parsing attributes in process `syz.4.6826'. [ 913.058567][T29193] netlink: 36 bytes leftover after parsing attributes in process `syz.4.6826'. [ 913.058600][T29193] netlink: 36 bytes leftover after parsing attributes in process `syz.4.6826'. [ 913.066110][T29193] netlink: 36 bytes leftover after parsing attributes in process `syz.4.6826'. [ 913.066141][T29193] netlink: 36 bytes leftover after parsing attributes in process `syz.4.6826'. [ 913.090023][T29193] netlink: 36 bytes leftover after parsing attributes in process `syz.4.6826'. [ 913.090055][T29193] netlink: 36 bytes leftover after parsing attributes in process `syz.4.6826'. [ 913.136828][T29193] netlink: 36 bytes leftover after parsing attributes in process `syz.4.6826'. [ 913.379365][T29193] bridge0: port 2(bridge_slave_1) entered disabled state [ 913.380007][T29193] bridge0: port 1(bridge_slave_0) entered disabled state [ 913.835953][T29193] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 913.856188][T29193] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 914.057573][T29193] veth1_vlan: left allmulticast mode [ 914.261969][ T49] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 914.262096][ T49] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 914.262136][ T49] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 914.262172][ T49] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 914.550548][ T5278] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 914.595186][T29251] vlan2: entered promiscuous mode [ 914.595209][T29251] bridge0: entered promiscuous mode [ 914.731045][T29236] syzkaller0: entered promiscuous mode [ 914.731073][T29236] syzkaller0: entered allmulticast mode [ 914.768155][T29261] xt_SECMARK: mode already set to 1 cannot mix with rules for mode 9 [ 917.657203][T29251] bridge_slave_0: left allmulticast mode [ 917.657234][T29251] bridge_slave_0: left promiscuous mode [ 917.657485][T29251] bridge0: port 1(bridge_slave_0) entered disabled state [ 917.665078][T29251] bridge_slave_1: left allmulticast mode [ 917.665104][T29251] bridge_slave_1: left promiscuous mode [ 917.665326][T29251] bridge0: port 2(bridge_slave_1) entered disabled state [ 917.723460][T29251] bond0: (slave bond_slave_0): Releasing backup interface [ 917.735750][T29251] bond0: (slave bond_slave_1): Releasing backup interface [ 917.779800][T29251] team0: Port device team_slave_0 removed [ 917.802427][T29251] team0: Port device team_slave_1 removed [ 917.803341][T29251] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 917.803361][T29251] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 917.808202][T29251] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 917.808222][T29251] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 917.819612][T29251] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 917.875470][T29277] __nla_validate_parse: 155 callbacks suppressed [ 917.875495][T29277] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6843'. [ 918.032818][T29281] syzkaller0: entered promiscuous mode [ 918.032846][T29281] syzkaller0: entered allmulticast mode [ 918.184925][T29287] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6846'. [ 918.835680][T29323] FAULT_INJECTION: forcing a failure. [ 918.835680][T29323] name failslab, interval 1, probability 0, space 0, times 0 [ 918.835713][T29323] CPU: 0 UID: 0 PID: 29323 Comm: syz.1.6856 Not tainted syzkaller #0 PREEMPT(full) [ 918.835728][T29323] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 918.835736][T29323] Call Trace: [ 918.835742][T29323] [ 918.835748][T29323] dump_stack_lvl+0xe8/0x150 [ 918.835771][T29323] should_fail_ex+0x410/0x560 [ 918.835787][T29323] ? __alloc_skb+0x1db/0x7a0 [ 918.835801][T29323] should_failslab+0xa8/0x100 [ 918.835816][T29323] ? __alloc_skb+0x1db/0x7a0 [ 918.835828][T29323] kmem_cache_alloc_node_noprof+0xa1/0x610 [ 918.835850][T29323] ? __alloc_skb+0x18d/0x7a0 [ 918.835863][T29323] ? __alloc_skb+0x1db/0x7a0 [ 918.835880][T29323] __alloc_skb+0x1db/0x7a0 [ 918.835896][T29323] netlink_sendmsg+0x5d4/0xb40 [ 918.835914][T29323] ? __pfx_netlink_sendmsg+0x10/0x10 [ 918.835931][T29323] ? apparmor_socket_sendmsg+0x98/0x360 [ 918.835946][T29323] ? __pfx_netlink_sendmsg+0x10/0x10 [ 918.835956][T29323] sock_sendmsg_nosec+0x13a/0x180 [ 918.835970][T29323] ____sys_sendmsg+0x54e/0x850 [ 918.835989][T29323] ? __pfx_____sys_sendmsg+0x10/0x10 [ 918.836009][T29323] ? import_iovec+0x73/0xa0 [ 918.836026][T29323] ___sys_sendmsg+0x2a5/0x360 [ 918.836040][T29323] ? __lock_acquire+0x747/0x2de0 [ 918.836055][T29323] ? __pfx____sys_sendmsg+0x10/0x10 [ 918.836091][T29323] ? __fget_files+0x2a/0x420 [ 918.836106][T29323] ? __fget_files+0x3a2/0x420 [ 918.836127][T29323] __x64_sys_sendmsg+0x1b1/0x290 [ 918.836144][T29323] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 918.836171][T29323] do_syscall_64+0x166/0x520 [ 918.836185][T29323] ? trace_irq_disable+0x3b/0x140 [ 918.836197][T29323] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 918.836212][T29323] ? clear_bhb_loop+0x70/0xc0 [ 918.836234][T29323] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 918.836251][T29323] RIP: 0033:0x7f2f8479e159 [ 918.836264][T29323] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 918.836276][T29323] RSP: 002b:00007f2f829f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 918.836291][T29323] RAX: ffffffffffffffda RBX: 00007f2f84a25fa0 RCX: 00007f2f8479e159 [ 918.836300][T29323] RDX: 0000000000000000 RSI: 0000200000000340 RDI: 0000000000000004 [ 918.836308][T29323] RBP: 00007f2f829f6090 R08: 0000000000000000 R09: 0000000000000000 [ 918.836316][T29323] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 918.836324][T29323] R13: 00007f2f84a26038 R14: 00007f2f84a25fa0 R15: 00007ffd6430d528 [ 918.836343][T29323] [ 919.410320][T29332] syzkaller0: entered promiscuous mode [ 919.410349][T29332] syzkaller0: entered allmulticast mode [ 919.533956][T29348] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6861'. [ 919.641747][T29352] netlink: 104 bytes leftover after parsing attributes in process `syz.1.6863'. [ 919.971849][T29367] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6869'. [ 920.095810][T29371] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6871'. [ 920.356039][T29381] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6875'. [ 920.466322][T29386] tipc: Started in network mode [ 920.466355][T29386] tipc: Node identity 0e9dedeec944, cluster identity 4711 [ 920.466548][T29386] tipc: Enabled bearer , priority 0 [ 920.778400][T29385] tipc: Disabling bearer [ 920.944813][T29409] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6883'. [ 920.951377][T29410] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6882'. [ 921.159988][T29421] syzkaller1: entered promiscuous mode [ 921.160016][T29421] syzkaller1: entered allmulticast mode [ 921.191349][T29423] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6887'. [ 921.239947][T29423] bond2: up delay (10) is not a multiple of miimon (7), value rounded to 7 ms [ 921.255611][T29423] bond2 (unregistering): Released all slaves [ 921.763525][T29448] set match dimension is over the limit! [ 921.764411][T29448] IPVS: set_ctl: invalid protocol: 5678 172.20.20.187:0 [ 921.764836][T29448] netlink: 'syz.2.6898': attribute type 1 has an invalid length. [ 922.035251][T29448] 8021q: adding VLAN 0 to HW filter on device bond2 [ 923.428715][T29515] vlan2: entered promiscuous mode [ 923.428742][T29515] bridge0: entered promiscuous mode [ 923.471725][T29516] __nla_validate_parse: 8 callbacks suppressed [ 923.471748][T29516] netlink: 65039 bytes leftover after parsing attributes in process `syz.2.6920'. [ 923.639796][T29516] bridge_slave_0: left allmulticast mode [ 923.640201][T29516] bridge0: port 1(bridge_slave_0) entered disabled state [ 923.661367][T29516] bridge_slave_1: left allmulticast mode [ 923.661398][T29516] bridge_slave_1: left promiscuous mode [ 923.661706][T29516] bridge0: port 2(bridge_slave_1) entered disabled state [ 923.716555][T29516] bond0: (slave bond_slave_1): Releasing backup interface [ 923.733284][T29516] team0: Port device team_slave_0 removed [ 923.735361][T29516] team0: Port device team_slave_1 removed [ 923.735778][T29516] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 923.737576][T29516] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 923.738676][T29516] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 923.774803][T29528] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6923'. [ 924.160372][T29545] netlink: 'syz.4.6930': attribute type 1 has an invalid length. [ 924.213652][T29551] netlink: 48 bytes leftover after parsing attributes in process `syz.4.6930'. [ 924.330356][T29545] bond3: (slave veth0_to_bond): Enslaving as an active interface with a down link [ 924.357228][T29564] netlink: 'syz.3.6933': attribute type 1 has an invalid length. [ 924.357251][T29564] netlink: 224 bytes leftover after parsing attributes in process `syz.3.6933'. [ 925.352527][T29600] netlink: 28 bytes leftover after parsing attributes in process `syz.4.6942'. [ 925.352562][T29600] netlink: 28 bytes leftover after parsing attributes in process `syz.4.6942'. [ 925.372477][T29608] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 925.393825][T29610] netlink: 28 bytes leftover after parsing attributes in process `syz.4.6942'. [ 925.393847][T29610] netlink: 28 bytes leftover after parsing attributes in process `syz.4.6942'. [ 925.394013][T29610] netlink: 28 bytes leftover after parsing attributes in process `syz.4.6942'. [ 925.394025][T29610] netlink: 28 bytes leftover after parsing attributes in process `syz.4.6942'. [ 925.540652][T29608] team0: Port device team_slave_0 removed [ 925.607259][T29616] batadv0: entered promiscuous mode [ 925.628884][T29609] batadv0: left promiscuous mode [ 925.999552][T29651] FAULT_INJECTION: forcing a failure. [ 925.999552][T29651] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 925.999589][T29651] CPU: 0 UID: 0 PID: 29651 Comm: syz.0.6953 Not tainted syzkaller #0 PREEMPT(full) [ 925.999612][T29651] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 925.999625][T29651] Call Trace: [ 925.999634][T29651] [ 925.999644][T29651] dump_stack_lvl+0xe8/0x150 [ 925.999678][T29651] should_fail_ex+0x410/0x560 [ 925.999708][T29651] _copy_to_user+0x31/0xb0 [ 925.999736][T29651] simple_read_from_buffer+0xe1/0x170 [ 925.999769][T29651] proc_fail_nth_read+0x1bb/0x230 [ 925.999796][T29651] ? common_file_perm+0x20e/0x2b0 [ 925.999823][T29651] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 925.999856][T29651] ? rw_verify_area+0x24a/0x4c0 [ 925.999886][T29651] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 925.999913][T29651] vfs_read+0x213/0xa80 [ 925.999946][T29651] ? __pfx___mutex_lock+0x10/0x10 [ 925.999973][T29651] ? __pfx_vfs_read+0x10/0x10 [ 926.000003][T29651] ? __fget_files+0x2a/0x420 [ 926.000036][T29651] ? __fget_files+0x3a2/0x420 [ 926.000062][T29651] ? __fget_files+0x2a/0x420 [ 926.000100][T29651] ksys_read+0x150/0x270 [ 926.000133][T29651] ? __pfx_ksys_read+0x10/0x10 [ 926.000263][T29651] do_syscall_64+0x166/0x520 [ 926.000288][T29651] ? trace_irq_disable+0x3b/0x140 [ 926.000309][T29651] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 926.000331][T29651] ? clear_bhb_loop+0x70/0xc0 [ 926.000358][T29651] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 926.000379][T29651] RIP: 0033:0x7ff9f2d5e98e [ 926.000400][T29651] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 926.000418][T29651] RSP: 002b:00007ff9f3d01fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 926.000443][T29651] RAX: ffffffffffffffda RBX: 00007ff9f3d026c0 RCX: 00007ff9f2d5e98e [ 926.000459][T29651] RDX: 000000000000000f RSI: 00007ff9f3d020a0 RDI: 0000000000000007 [ 926.000473][T29651] RBP: 00007ff9f3d02090 R08: 0000000000000000 R09: 0000000000000000 [ 926.000487][T29651] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 926.000500][T29651] R13: 00007ff9f3026128 R14: 00007ff9f3026090 R15: 00007ffd3d6befa8 [ 926.000537][T29651] [ 926.826713][ T5811] hid-generic 0005:0008:0009.0045: item fetching failed at offset 2/3 [ 926.830266][ T5811] hid-generic 0005:0008:0009.0045: probe with driver hid-generic failed with error -22 [ 926.990060][T29687] ovs-s!: entered promiscuous mode [ 927.209590][T29698] syzkaller1: entered promiscuous mode [ 927.209617][T29698] syzkaller1: entered allmulticast mode [ 927.228803][T29702] ipvlan2: entered promiscuous mode [ 927.228867][T29702] ipvlan2: entered allmulticast mode [ 927.228889][T29702] netdevsim netdevsim4 netdevsim0: entered allmulticast mode [ 927.231185][T29702] 8021q: adding VLAN 0 to HW filter on device ipvlan2 [ 927.800007][T29733] sch_tbf: burst 0 is lower than device ip6gre0 mtu (1448) ! [ 928.019858][T29743] bridge0: port 1(vlan3) entered blocking state [ 928.019985][T29743] bridge0: port 1(vlan3) entered disabled state [ 928.020071][T29743] vlan3: entered allmulticast mode [ 928.020081][T29743] geneve0: entered allmulticast mode [ 929.513639][T29764] batman_adv: batadv0: Adding interface: syzkaller0 [ 929.513655][T29764] batman_adv: batadv0: The MTU of interface syzkaller0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 929.513773][T29764] batman_adv: batadv0: Interface activated: syzkaller0 [ 929.518411][T29763] batman_adv: batadv0: Interface deactivated: syzkaller0 [ 929.556559][T29763] batman_adv: batadv0: Removing interface: syzkaller0 [ 930.599767][T29719] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 930.600509][T29730] __nla_validate_parse: 8 callbacks suppressed [ 930.600528][T29730] netlink: 136 bytes leftover after parsing attributes in process `syz.0.6978'. [ 930.816171][T29773] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6995'. [ 930.852050][T29773] netlink: 72 bytes leftover after parsing attributes in process `syz.3.6995'. [ 931.221145][T29793] batman_adv: batadv0: Adding interface: syzkaller0 [ 931.221167][T29793] batman_adv: batadv0: The MTU of interface syzkaller0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 931.221386][T29793] batman_adv: batadv0: Interface activated: syzkaller0 [ 931.272329][T29792] batman_adv: batadv0: Interface deactivated: syzkaller0 [ 931.340555][T29792] batman_adv: batadv0: Removing interface: syzkaller0 [ 931.405152][T29779] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6996'. [ 931.423132][T29795] netlink: 24 bytes leftover after parsing attributes in process `syz.4.7002'. [ 931.491519][T29795] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7002'. [ 931.562085][T29808] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7005'. [ 932.173139][T29800] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 932.177937][T29779] netlink: 'syz.1.6996': attribute type 10 has an invalid length. [ 932.337885][T29836] netlink: 104 bytes leftover after parsing attributes in process `syz.0.7012'. [ 932.443973][T29838] netlink: 'syz.3.7013': attribute type 1 has an invalid length. [ 932.533003][T29838] 8021q: adding VLAN 0 to HW filter on device bond1 [ 932.566847][T29838] netlink: 28 bytes leftover after parsing attributes in process `syz.3.7013'. [ 932.591844][T29846] 8021q: adding VLAN 0 to HW filter on device bond1 [ 932.592281][T29846] bond1: (slave xfrm1): The slave device specified does not support setting the MAC address [ 932.592901][T29846] bond1: (slave xfrm1): Error -95 calling set_mac_address [ 932.665328][T29851] ip_tables: iptables: counters copy to user failed while replacing table [ 932.672091][T29855] netlink: 'syz.0.7019': attribute type 10 has an invalid length. [ 932.672113][T29855] netlink: 2 bytes leftover after parsing attributes in process `syz.0.7019'. [ 932.727474][T29855] team0: Device wg2 is of different type [ 933.620480][T29890] IPv6: Can't replace route, no match found [ 933.862053][T17243] Bluetooth: hci4: command 0x0406 tx timeout [ 935.106969][T29954] batman_adv: batadv0: Adding interface: syzkaller0 [ 935.106990][T29954] batman_adv: batadv0: The MTU of interface syzkaller0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 935.107917][T29954] batman_adv: batadv0: Interface activated: syzkaller0 [ 935.161307][T29953] batman_adv: batadv0: Interface deactivated: syzkaller0 [ 935.237731][T29953] batman_adv: batadv0: Removing interface: syzkaller0 [ 935.471098][T29972] netlink: 'syz.4.7057': attribute type 6 has an invalid length. [ 935.724831][T29983] netlink: 'syz.3.7063': attribute type 10 has an invalid length. [ 935.724859][T29983] __nla_validate_parse: 12 callbacks suppressed [ 935.724872][T29983] netlink: 2 bytes leftover after parsing attributes in process `syz.3.7063'. [ 936.437897][T29983] team0: Port device wg2 added [ 941.928695][T30005] netlink: 12 bytes leftover after parsing attributes in process `syz.4.7072'. [ 942.021356][T30010] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7075'. [ 942.038988][T30008] ip_tables: iptables: counters copy to user failed while replacing table [ 942.070211][T30014] ip_tables: iptables: counters copy to user failed while replacing table [ 942.501558][T30036] vlan2: entered promiscuous mode [ 942.614846][T30041] netlink: 65039 bytes leftover after parsing attributes in process `syz.2.7081'. [ 942.758176][T30041] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 943.139408][T30052] netlink: 20 bytes leftover after parsing attributes in process `syz.3.7084'. [ 943.209732][T30055] macvlan2: entered promiscuous mode [ 943.209757][T30055] vlan3: entered promiscuous mode [ 943.209770][T30055] gretap0: entered promiscuous mode [ 943.236956][T30055] vlan3: left promiscuous mode [ 943.275360][T29045] gretap0: left promiscuous mode [ 943.466266][T30070] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7091'. [ 943.631190][T30083] netlink: 'syz.1.7095': attribute type 8 has an invalid length. [ 943.837640][T30093] sch_tbf: burst 0 is lower than device ip6gre0 mtu (32769) ! [ 943.976810][T30104] netlink: 'syz.2.7103': attribute type 6 has an invalid length. [ 943.976837][T30104] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7103'. [ 944.051244][T30110] netlink: 104 bytes leftover after parsing attributes in process `syz.1.7105'. [ 944.077345][T30109] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7106'. [ 944.101922][ T4933] Bluetooth: hci5: command 0x0406 tx timeout [ 944.177045][T30115] FAULT_INJECTION: forcing a failure. [ 944.177045][T30115] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 944.177082][T30115] CPU: 1 UID: 0 PID: 30115 Comm: syz.2.7107 Not tainted syzkaller #0 PREEMPT(full) [ 944.177106][T30115] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 944.177118][T30115] Call Trace: [ 944.177128][T30115] [ 944.177138][T30115] dump_stack_lvl+0xe8/0x150 [ 944.177177][T30115] should_fail_ex+0x410/0x560 [ 944.177218][T30115] _copy_from_user+0x2d/0xb0 [ 944.177247][T30115] kstrtouint_from_user+0xd6/0x180 [ 944.177274][T30115] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 944.177308][T30115] ? lock_acquire+0x115/0x350 [ 944.177337][T30115] proc_fail_nth_write+0x8e/0x210 [ 944.177360][T30115] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 944.177391][T30115] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 944.177412][T30115] vfs_write+0x296/0xba0 [ 944.177454][T30115] ? __pfx_vfs_write+0x10/0x10 [ 944.177487][T30115] ? __fget_files+0x2a/0x420 [ 944.177521][T30115] ? __fget_files+0x3a2/0x420 [ 944.177548][T30115] ? __fget_files+0x2a/0x420 [ 944.177587][T30115] ksys_write+0x150/0x270 [ 944.177621][T30115] ? __pfx_ksys_write+0x10/0x10 [ 944.177665][T30115] do_syscall_64+0x166/0x520 [ 944.177690][T30115] ? trace_irq_disable+0x3b/0x140 [ 944.177711][T30115] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 944.177733][T30115] ? clear_bhb_loop+0x70/0xc0 [ 944.177759][T30115] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 944.177780][T30115] RIP: 0033:0x7f258095e98e [ 944.177801][T30115] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 944.177820][T30115] RSP: 002b:00007f2581885fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 944.177848][T30115] RAX: ffffffffffffffda RBX: 00007f25818866c0 RCX: 00007f258095e98e [ 944.177864][T30115] RDX: 0000000000000001 RSI: 00007f25818860a0 RDI: 0000000000000005 [ 944.177878][T30115] RBP: 00007f2581886090 R08: 0000000000000000 R09: 0000000000000000 [ 944.177892][T30115] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 944.177904][T30115] R13: 00007f2580c26038 R14: 00007f2580c25fa0 R15: 00007ffc6a1b8098 [ 944.177942][T30115] [ 944.319370][T30121] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7111'. [ 944.319400][T30121] netlink: 36 bytes leftover after parsing attributes in process `syz.4.7111'. [ 944.575435][T30129] xt_SECMARK: mode already set to 1 cannot mix with rules for mode 9 [ 944.607974][T30130] netlink: 'syz.2.7114': attribute type 10 has an invalid length. [ 944.640557][T30130] team0: Port device wg2 added [ 945.045426][T30154] block nbd1: server does not support multiple connections per device. [ 945.046003][T30154] block nbd1: shutting down sockets [ 945.800228][T30189] veth1: entered promiscuous mode [ 945.894271][T30201] openvswitch: ovs-s!: Dropping previously announced user features [ 946.206792][T30219] FAULT_INJECTION: forcing a failure. [ 946.206792][T30219] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 946.206824][T30219] CPU: 1 UID: 0 PID: 30219 Comm: syz.4.7150 Not tainted syzkaller #0 PREEMPT(full) [ 946.206846][T30219] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 946.206857][T30219] Call Trace: [ 946.206866][T30219] [ 946.206874][T30219] dump_stack_lvl+0xe8/0x150 [ 946.206909][T30219] should_fail_ex+0x410/0x560 [ 946.206937][T30219] _copy_to_user+0x31/0xb0 [ 946.206965][T30219] simple_read_from_buffer+0xe1/0x170 [ 946.206997][T30219] proc_fail_nth_read+0x1bb/0x230 [ 946.207025][T30219] ? common_file_perm+0x20e/0x2b0 [ 946.207050][T30219] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 946.207082][T30219] ? rw_verify_area+0x24a/0x4c0 [ 946.207111][T30219] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 946.207138][T30219] vfs_read+0x213/0xa80 [ 946.207173][T30219] ? __pfx_vfs_read+0x10/0x10 [ 946.207207][T30219] ? do_sys_openat2+0x14e/0x200 [ 946.207228][T30219] ? kmem_cache_free+0x182/0x650 [ 946.207265][T30219] ksys_read+0x150/0x270 [ 946.207294][T30219] ? __pfx_ksys_read+0x10/0x10 [ 946.207333][T30219] do_syscall_64+0x166/0x520 [ 946.207357][T30219] ? trace_irq_disable+0x3b/0x140 [ 946.207376][T30219] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 946.207396][T30219] ? clear_bhb_loop+0x70/0xc0 [ 946.207422][T30219] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 946.207441][T30219] RIP: 0033:0x7f02d775e98e [ 946.207459][T30219] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 946.207486][T30219] RSP: 002b:00007f02d8586fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 946.207510][T30219] RAX: ffffffffffffffda RBX: 00007f02d85876c0 RCX: 00007f02d775e98e [ 946.207525][T30219] RDX: 000000000000000f RSI: 00007f02d85870a0 RDI: 0000000000000006 [ 946.207537][T30219] RBP: 00007f02d8587090 R08: 0000000000000000 R09: 0000000000000000 [ 946.207548][T30219] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 946.207560][T30219] R13: 00007f02d7a26038 R14: 00007f02d7a25fa0 R15: 00007ffe523c1c18 [ 946.207593][T30219] [ 946.613703][T30227] RDS: rds_bind could not find a transport for ::ffff:172.30.0.1, load rds_tcp or rds_rdma? [ 946.856780][T30245] TCP: request_sock_TCPv6: Possible SYN flooding on port [::]:20002. Sending cookies. [ 946.909606][T30248] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 946.972434][T30249] syzkaller0: entered promiscuous mode [ 946.972452][T30249] syzkaller0: entered allmulticast mode [ 948.827982][T30196] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 949.065253][T30258] xt_SECMARK: mode already set to 1 cannot mix with rules for mode 9 [ 949.143369][T30257] 8021q: adding VLAN 0 to HW filter on device ipvlan2 [ 949.143974][T30257] team0: Device ipvlan2 is already an upper device of the team interface [ 949.444404][T30279] __nla_validate_parse: 9 callbacks suppressed [ 949.444433][T30279] netlink: 24 bytes leftover after parsing attributes in process `syz.3.7174'. [ 949.581318][T30286] netlink: 'syz.2.7177': attribute type 1 has an invalid length. [ 949.683831][T30286] 8021q: adding VLAN 0 to HW filter on device bond3 [ 949.822905][T30300] netlink: 28 bytes leftover after parsing attributes in process `syz.2.7177'. [ 949.825976][T30300] netlink: 40 bytes leftover after parsing attributes in process `syz.2.7177'. [ 950.010315][T30296] bond3: (slave veth3): Enslaving as an active interface with a down link [ 950.637007][T30333] netlink: 65039 bytes leftover after parsing attributes in process `syz.0.7189'. [ 950.653076][T30333] netlink: 'syz.0.7189': attribute type 21 has an invalid length. [ 950.751043][T30335] netlink: 64 bytes leftover after parsing attributes in process `syz.4.7187'. [ 950.761532][T30338] netlink: 64 bytes leftover after parsing attributes in process `syz.4.7187'. [ 950.855221][T30333] bridge_slave_0: left allmulticast mode [ 950.855242][T30333] bridge_slave_0: left promiscuous mode [ 950.855386][T30333] bridge0: port 1(bridge_slave_0) entered disabled state [ 950.858534][T30333] bridge_slave_1: left promiscuous mode [ 950.858678][T30333] bridge0: port 2(bridge_slave_1) entered disabled state [ 950.887539][T30333] bond0: (slave bond_slave_0): Releasing backup interface [ 950.914057][T30333] team0: Port device team_slave_1 removed [ 950.914697][T30333] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 950.914712][T30333] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 950.917425][T30333] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 950.917439][T30333] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 950.920300][T30333] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 951.038239][T30343] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7192'. [ 952.555834][T30287] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 952.879552][T30346] syzkaller0: entered promiscuous mode [ 952.879580][T30346] syzkaller0: entered allmulticast mode [ 953.469132][T30380] FAULT_INJECTION: forcing a failure. [ 953.469132][T30380] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 953.469175][T30380] CPU: 0 UID: 0 PID: 30380 Comm: syz.2.7203 Not tainted syzkaller #0 PREEMPT(full) [ 953.469196][T30380] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 953.469209][T30380] Call Trace: [ 953.469217][T30380] [ 953.469226][T30380] dump_stack_lvl+0xe8/0x150 [ 953.469268][T30380] should_fail_ex+0x410/0x560 [ 953.469297][T30380] _copy_to_user+0x31/0xb0 [ 953.469324][T30380] simple_read_from_buffer+0xe1/0x170 [ 953.469357][T30380] proc_fail_nth_read+0x1bb/0x230 [ 953.469385][T30380] ? common_file_perm+0x20e/0x2b0 [ 953.469411][T30380] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 953.469441][T30380] ? rw_verify_area+0x24a/0x4c0 [ 953.469466][T30380] ? tun_chr_write_iter+0xe0/0x200 [ 953.469489][T30380] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 953.469515][T30380] vfs_read+0x213/0xa80 [ 953.469546][T30380] ? __pfx___mutex_lock+0x10/0x10 [ 953.469574][T30380] ? __pfx_vfs_read+0x10/0x10 [ 953.469601][T30380] ? __fget_files+0x2a/0x420 [ 953.469630][T30380] ? __fget_files+0x3a2/0x420 [ 953.469652][T30380] ? __fget_files+0x2a/0x420 [ 953.469686][T30380] ksys_read+0x150/0x270 [ 953.469714][T30380] ? __pfx_ksys_read+0x10/0x10 [ 953.469751][T30380] do_syscall_64+0x166/0x520 [ 953.469773][T30380] ? trace_irq_disable+0x3b/0x140 [ 953.469792][T30380] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 953.469814][T30380] ? clear_bhb_loop+0x70/0xc0 [ 953.469837][T30380] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 953.469856][T30380] RIP: 0033:0x7f258095e98e [ 953.469875][T30380] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 953.469891][T30380] RSP: 002b:00007f2581843fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 953.469913][T30380] RAX: ffffffffffffffda RBX: 00007f25818446c0 RCX: 00007f258095e98e [ 953.469927][T30380] RDX: 000000000000000f RSI: 00007f25818440a0 RDI: 0000000000000007 [ 953.469939][T30380] RBP: 00007f2581844090 R08: 0000000000000000 R09: 0000000000000000 [ 953.469951][T30380] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 953.469962][T30380] R13: 00007f2580c26218 R14: 00007f2580c26180 R15: 00007ffc6a1b8098 [ 953.469996][T30380] [ 954.259170][T30399] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7206'. [ 956.710626][T30378] batman_adv: batadv0: Adding interface: syzkaller0 [ 956.710645][T30378] batman_adv: batadv0: The MTU of interface syzkaller0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 956.710747][T30378] batman_adv: batadv0: Interface activated: syzkaller0 [ 956.819846][T30378] batman_adv: batadv0: Interface deactivated: syzkaller0 [ 956.920113][T30378] batman_adv: batadv0: Removing interface: syzkaller0 [ 956.992138][T30417] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7210'. [ 957.126277][T30430] netlink: 12 bytes leftover after parsing attributes in process `syz.3.7213'. [ 957.171458][T30430] netlink: 388 bytes leftover after parsing attributes in process `syz.3.7213'. [ 958.154379][T30450] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7220'. [ 958.967088][T30463] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7224'. [ 958.967123][T30463] netlink: 36 bytes leftover after parsing attributes in process `syz.2.7224'. [ 959.044788][T30465] netlink: 12 bytes leftover after parsing attributes in process `syz.2.7225'. [ 959.078545][T30465] netlink: 388 bytes leftover after parsing attributes in process `syz.2.7225'. [ 959.915006][T30411] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 960.179905][T30486] netlink: 12 bytes leftover after parsing attributes in process `syz.3.7233'. [ 960.245495][T30486] netlink: 388 bytes leftover after parsing attributes in process `syz.3.7233'. [ 960.334667][T30493] batman_adv: batadv0: Adding interface: syzkaller0 [ 960.334689][T30493] batman_adv: batadv0: The MTU of interface syzkaller0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 960.334819][T30493] batman_adv: batadv0: Interface activated: syzkaller0 [ 960.725431][T30491] batman_adv: batadv0: Interface deactivated: syzkaller0 [ 960.790749][T30491] batman_adv: batadv0: Removing interface: syzkaller0 [ 964.026906][T30521] __nla_validate_parse: 4 callbacks suppressed [ 964.026924][T30521] netlink: 24 bytes leftover after parsing attributes in process `syz.4.7242'. [ 964.074368][T30520] bond4 (unregistering): Released all slaves [ 964.207954][T30535] team0: Port device wg2 removed [ 964.236061][T30535] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 964.310736][T30561] netlink: 12 bytes leftover after parsing attributes in process `syz.2.7245'. [ 964.583479][T30577] netlink: 28 bytes leftover after parsing attributes in process `syz.0.7252'. [ 964.712843][T30590] ip_tables: iptables: counters copy to user failed while replacing table [ 964.781556][T30593] netlink: 1004 bytes leftover after parsing attributes in process `syz.4.7254'. [ 964.968823][T30601] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7258'. [ 964.968862][T30601] netlink: 'syz.2.7258': attribute type 5 has an invalid length. [ 965.000624][T30601] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7258'. [ 965.000661][T30601] netlink: 'syz.2.7258': attribute type 5 has an invalid length. [ 965.020141][T30549] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 965.020195][T30549] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 965.020230][T30549] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 965.087351][T30604] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7259'. [ 965.178132][T30609] netlink: 88 bytes leftover after parsing attributes in process `syz.2.7261'. [ 965.404157][T30615] nbd1: detected capacity change from 0 to 63 [ 965.424565][ T4933] block nbd1: Receive control failed (result -104) [ 965.580910][T30619] netlink: 12 bytes leftover after parsing attributes in process `syz.3.7267'. [ 965.613967][T30619] netlink: 388 bytes leftover after parsing attributes in process `syz.3.7267'. [ 965.834878][T30630] xt_TCPMSS: Only works on TCP SYN packets [ 966.385864][T30656] sch_tbf: burst 0 is lower than device ip6gre0 mtu (1448) ! [ 966.464626][T30630] netlink: 'syz.3.7271': attribute type 10 has an invalid length. [ 966.492648][T30630] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 966.517037][T30630] team0: Port device netdevsim1 added [ 966.547894][T30659] tipc: Failed to remove unknown binding: 66,0,0/0:432080879/432080880 [ 966.548383][T30659] tipc: Failed to remove unknown binding: 66,0,0/0:432080879/432080880 [ 966.565939][T30661] openvswitch: ovs-s!: Dropping previously announced user features [ 966.611126][T30664] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 966.917304][T30659] 8021q: adding VLAN 0 to HW filter on device bond2 [ 966.945921][T30672] syzkaller0: entered promiscuous mode [ 966.945939][T30672] syzkaller0: entered allmulticast mode [ 967.055839][T30672] A link change request failed with some changes committed already. Interface gre1 may have been left with an inconsistent configuration, please check. [ 967.212380][T30692] netlink: 'syz.1.7292': attribute type 2 has an invalid length. [ 967.222568][T30687] ip_tables: iptables: counters copy to user failed while replacing table [ 967.283831][T30687] tipc: Started in network mode [ 967.283850][T30687] tipc: Node identity 4, cluster identity 4711 [ 967.283860][T30687] tipc: Node number set to 4 [ 967.468629][T30702] Bluetooth: MGMT ver 1.23 [ 967.554141][T30705] ksmbd: Unknown IPC event: 0, ignore. [ 967.654837][T30704] bond0: option min_links: invalid value (18446744073709551615) [ 967.654867][T30704] bond0: option min_links: allowed values 0 - 2147483647 [ 967.667614][T30713] syzkaller0: entered promiscuous mode [ 967.667639][T30713] syzkaller0: entered allmulticast mode [ 967.678798][T30713] tipc: Enabled bearer , priority 0 [ 967.698495][T30710] tipc: Resetting bearer [ 967.744597][T30710] tipc: Disabling bearer [ 968.929203][T30755] netlink: 'syz.2.7311': attribute type 10 has an invalid length. [ 969.415723][T30770] __nla_validate_parse: 12 callbacks suppressed [ 969.415748][T30770] netlink: 12 bytes leftover after parsing attributes in process `syz.2.7318'. [ 969.444311][T30774] netlink: 132 bytes leftover after parsing attributes in process `syz.0.7320'. [ 969.577421][T30776] netlink: 20 bytes leftover after parsing attributes in process `syz.2.7318'. [ 970.010525][T30796] batman_adv: batadv0: Adding interface: syzkaller0 [ 970.010545][T30796] batman_adv: batadv0: The MTU of interface syzkaller0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 970.010660][T30796] batman_adv: batadv0: Interface activated: syzkaller0 [ 970.682903][T30783] batman_adv: batadv0: Interface deactivated: syzkaller0 [ 970.804812][T30783] batman_adv: batadv0: Removing interface: syzkaller0 [ 970.994924][T30830] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7336'. [ 970.994958][T30830] netlink: 36 bytes leftover after parsing attributes in process `syz.2.7336'. [ 971.109601][T30835] netlink: 12 bytes leftover after parsing attributes in process `syz.4.7338'. [ 971.126956][T30836] xt_SECMARK: mode already set to 1 cannot mix with rules for mode 9 [ 971.257773][T30840] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7341'. [ 971.306984][T30840] netlink: 72 bytes leftover after parsing attributes in process `syz.3.7341'. [ 971.553185][T30858] vlan2: entered promiscuous mode [ 971.553211][T30858] bridge0: entered promiscuous mode [ 971.637244][T30865] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7352'. [ 971.792531][T30874] netlink: 'syz.3.7352': attribute type 32 has an invalid length. [ 972.081130][T30882] bridge_slave_0: left allmulticast mode [ 972.081160][T30882] bridge_slave_0: left promiscuous mode [ 972.081404][T30882] bridge0: port 1(bridge_slave_0) entered disabled state [ 972.120017][T30882] bridge_slave_1: left allmulticast mode [ 972.120044][T30882] bridge_slave_1: left promiscuous mode [ 972.120357][T30882] bridge0: port 2(bridge_slave_1) entered disabled state [ 972.144751][T30882] bond3: (slave veth0_to_bond): Releasing active interface [ 972.167642][T30882] bond0: (slave bond_slave_0): Releasing backup interface [ 972.180104][T30882] bond0: (slave bond_slave_1): Releasing backup interface [ 972.196715][T30882] team0: Port device team_slave_0 removed [ 972.199264][T30882] team0: Port device team_slave_1 removed [ 972.199784][T30882] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 972.200800][T30882] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 972.229628][T30882] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 972.274461][T30892] netlink: 72 bytes leftover after parsing attributes in process `syz.2.7355'. [ 972.278945][T30892] block nbd2: Unsupported socket: should be TCP or UNIX. [ 972.693731][T30911] netlink: 'syz.4.7361': attribute type 1 has an invalid length. [ 972.693780][T30911] netlink: 'syz.4.7361': attribute type 2 has an invalid length. [ 973.580858][T30953] bond4: Unable to set down delay as MII monitoring is disabled [ 973.598187][T30953] bond4 (unregistering): Released all slaves [ 973.710600][ T1150] IPVS: starting estimator thread 0... [ 973.802671][T30965] IPVS: using max 26 ests per chain, 62400 per kthread [ 973.903838][T30974] openvswitch: ovs-s!: Dropping previously announced user features [ 974.428350][T30995] vlan2: entered promiscuous mode [ 974.457352][T30996] __nla_validate_parse: 9 callbacks suppressed [ 974.457376][T30996] netlink: 65039 bytes leftover after parsing attributes in process `syz.4.7386'. [ 974.535962][T31003] netlink: 12 bytes leftover after parsing attributes in process `syz.1.7388'. [ 974.557535][T30996] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 974.683292][T31008] xt_SECMARK: mode already set to 1 cannot mix with rules for mode 9 [ 974.809599][T31014] batman_adv: batadv0: Adding interface: syzkaller0 [ 974.809619][T31014] batman_adv: batadv0: The MTU of interface syzkaller0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 974.809759][T31014] batman_adv: batadv0: Interface activated: syzkaller0 [ 975.086309][T31013] batman_adv: batadv0: Interface deactivated: syzkaller0 [ 975.122901][T31013] batman_adv: batadv0: Removing interface: syzkaller0 [ 975.507853][T31027] syzkaller1: entered promiscuous mode [ 975.507878][T31027] syzkaller1: entered allmulticast mode [ 975.697984][T31038] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7401'. [ 975.725748][T31038] netlink: 72 bytes leftover after parsing attributes in process `syz.3.7401'. [ 975.755530][T31042] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7403'. [ 975.820913][T31042] macvtap1: entered promiscuous mode [ 975.820933][T31042] batadv0: entered promiscuous mode [ 975.821071][T31042] macvtap1: entered allmulticast mode [ 975.821081][T31042] batadv0: entered allmulticast mode [ 975.822142][T31042] 8021q: adding VLAN 0 to HW filter on device macvtap1 [ 975.848072][T31044] netlink: 16 bytes leftover after parsing attributes in process `syz.4.7404'. [ 976.124183][T31052] netlink: 'syz.4.7408': attribute type 8 has an invalid length. [ 976.124206][T31052] sch_fq: defrate 0 ignored. [ 976.127599][T31053] netlink: 'syz.4.7408': attribute type 8 has an invalid length. [ 976.127622][T31053] sch_fq: defrate 0 ignored. [ 976.131129][T31052] netlink: 40 bytes leftover after parsing attributes in process `syz.4.7408'. [ 976.354943][T31066] netlink: 44 bytes leftover after parsing attributes in process `syz.0.7413'. [ 976.435283][T31072] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7415'. [ 976.464725][T31072] netlink: 72 bytes leftover after parsing attributes in process `syz.4.7415'. [ 976.650463][T31082] IPVS: lblc: SCTP 172.20.20.187:0 - no destination available [ 976.738675][T31086] bridge0: port 1(bond0) entered blocking state [ 976.740422][T31086] bridge0: port 1(bond0) entered disabled state [ 976.740601][T31086] bond0: entered allmulticast mode [ 976.748114][T31086] bond0: entered promiscuous mode [ 977.157164][T31107] xt_SECMARK: mode already set to 1 cannot mix with rules for mode 9 [ 977.249100][T31110] vcan0: tx drop: invalid sa for name 0x0000001000000003 [ 978.278915][T31167] sch_tbf: burst 0 is lower than device ip6gre0 mtu (1448) ! [ 978.872197][T31187] batman_adv: batadv0: Adding interface: syzkaller0 [ 978.872217][T31187] batman_adv: batadv0: The MTU of interface syzkaller0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 978.872279][T31187] batman_adv: batadv0: Interface activated: syzkaller0 [ 979.473469][T31179] batman_adv: batadv0: Interface deactivated: syzkaller0 [ 979.524296][T31179] batman_adv: batadv0: Removing interface: syzkaller0 [ 979.686210][T31209] __nla_validate_parse: 8 callbacks suppressed [ 979.686235][T31209] netlink: 65039 bytes leftover after parsing attributes in process `syz.1.7460'. [ 979.838762][T31217] syzkaller1: entered promiscuous mode [ 979.838788][T31217] syzkaller1: entered allmulticast mode [ 979.859627][T31221] team0: Port device wg2 removed [ 979.860234][T31221] A link change request failed with some changes committed already. Interface hsr_slave_1 may have been left with an inconsistent configuration, please check. [ 979.942734][T31147] Bluetooth: hci3: command 0x0406 tx timeout [ 979.943941][T31147] Bluetooth: hci1: command 0x0406 tx timeout [ 980.398819][T31236] x_tables: duplicate underflow at hook 1 [ 980.398919][T31236] x_tables: duplicate underflow at hook 1 [ 980.399007][T31236] x_tables: duplicate underflow at hook 1 [ 980.399091][T31236] x_tables: duplicate underflow at hook 1 [ 980.399173][T31236] x_tables: duplicate underflow at hook 1 [ 980.399286][T31236] x_tables: duplicate underflow at hook 1 [ 980.399373][T31236] x_tables: duplicate underflow at hook 1 [ 980.399455][T31236] x_tables: duplicate underflow at hook 1 [ 980.399540][T31236] x_tables: duplicate underflow at hook 1 [ 980.399623][T31236] x_tables: duplicate underflow at hook 1 [ 980.939960][T31261] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7479'. [ 980.949351][T31259] block nbd0: reconnected socket [ 981.192463][T31272] netlink: 'syz.0.7481': attribute type 1 has an invalid length. [ 981.232203][T31272] bond4: entered promiscuous mode [ 981.232702][T31272] 8021q: adding VLAN 0 to HW filter on device bond4 [ 981.280216][T31272] veth3: entered allmulticast mode [ 981.288666][T31272] bond4: (slave veth3): making interface the new active one [ 981.288691][T31272] veth3: entered promiscuous mode [ 981.298688][T31272] bond4: (slave veth3): Enslaving as an active interface with an up link [ 981.624406][T31292] FAULT_INJECTION: forcing a failure. [ 981.624406][T31292] name failslab, interval 1, probability 0, space 0, times 0 [ 981.624442][T31292] CPU: 1 UID: 0 PID: 31292 Comm: syz.0.7490 Not tainted syzkaller #0 PREEMPT(full) [ 981.624464][T31292] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 981.624476][T31292] Call Trace: [ 981.624485][T31292] [ 981.624499][T31292] dump_stack_lvl+0xe8/0x150 [ 981.624536][T31292] should_fail_ex+0x410/0x560 [ 981.624565][T31292] ? __alloc_skb+0x1db/0x7a0 [ 981.624592][T31292] should_failslab+0xa8/0x100 [ 981.624621][T31292] ? __alloc_skb+0x1db/0x7a0 [ 981.624641][T31292] kmem_cache_alloc_node_noprof+0xa1/0x610 [ 981.624682][T31292] ? __alloc_skb+0x18d/0x7a0 [ 981.624705][T31292] ? __alloc_skb+0x1db/0x7a0 [ 981.624735][T31292] __alloc_skb+0x1db/0x7a0 [ 981.624762][T31292] netlink_sendmsg+0x5d4/0xb40 [ 981.624794][T31292] ? __pfx_netlink_sendmsg+0x10/0x10 [ 981.624822][T31292] ? apparmor_socket_sendmsg+0x98/0x360 [ 981.624848][T31292] ? __pfx_netlink_sendmsg+0x10/0x10 [ 981.624867][T31292] sock_sendmsg_nosec+0x13a/0x180 [ 981.624890][T31292] ____sys_sendmsg+0x54e/0x850 [ 981.624917][T31292] ? __pfx_____sys_sendmsg+0x10/0x10 [ 981.624949][T31292] ? import_iovec+0x73/0xa0 [ 981.624975][T31292] ___sys_sendmsg+0x2a5/0x360 [ 981.624997][T31292] ? __lock_acquire+0x747/0x2de0 [ 981.625024][T31292] ? __pfx____sys_sendmsg+0x10/0x10 [ 981.625087][T31292] ? __fget_files+0x2a/0x420 [ 981.625111][T31292] ? __fget_files+0x3a2/0x420 [ 981.625147][T31292] __x64_sys_sendmsg+0x1b1/0x290 [ 981.625175][T31292] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 981.625223][T31292] do_syscall_64+0x166/0x520 [ 981.625249][T31292] ? trace_irq_disable+0x3b/0x140 [ 981.625270][T31292] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 981.625290][T31292] ? clear_bhb_loop+0x70/0xc0 [ 981.625316][T31292] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 981.625336][T31292] RIP: 0033:0x7ff9f2d9e159 [ 981.625354][T31292] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 981.625371][T31292] RSP: 002b:00007ff9f3d23028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 981.625393][T31292] RAX: ffffffffffffffda RBX: 00007ff9f3025fa0 RCX: 00007ff9f2d9e159 [ 981.625409][T31292] RDX: 0000000004008054 RSI: 0000200000000200 RDI: 0000000000000005 [ 981.625422][T31292] RBP: 00007ff9f3d23090 R08: 0000000000000000 R09: 0000000000000000 [ 981.625434][T31292] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 981.625447][T31292] R13: 00007ff9f3026038 R14: 00007ff9f3025fa0 R15: 00007ffd3d6befa8 [ 981.625481][T31292] [ 981.759269][T17243] block nbd0: Receive control failed (result -32) [ 981.983472][T31303] batman_adv: batadv0: Adding interface: syzkaller0 [ 981.983495][T31303] batman_adv: batadv0: The MTU of interface syzkaller0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 981.983619][T31303] batman_adv: batadv0: Interface activated: syzkaller0 [ 981.988843][T31300] batman_adv: batadv0: Interface deactivated: syzkaller0 [ 982.104743][T31300] batman_adv: batadv0: Removing interface: syzkaller0 [ 982.110522][T31305] sch_fq: defrate 4294967293 ignored. [ 982.196989][T31315] tipc: Invalid UDP bearer configuration [ 982.197040][T31315] tipc: Enabling of bearer rejected, failed to enable media [ 982.435399][T31325] netlink: 'syz.4.7503': attribute type 10 has an invalid length. [ 982.435427][T31325] netlink: 2 bytes leftover after parsing attributes in process `syz.4.7503'. [ 982.482162][T31325] team0: Port device wg2 added [ 982.649465][T31338] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7506'. [ 982.669423][T31338] netlink: 72 bytes leftover after parsing attributes in process `syz.2.7506'. [ 983.083992][T31357] bond4: entered allmulticast mode [ 983.084466][T31357] 8021q: adding VLAN 0 to HW filter on device bond4 [ 983.572301][T31347] Bluetooth: hci2: Opcode 0x0c20 failed: -4 [ 983.662051][T31389] netlink: 'syz.1.7523': attribute type 5 has an invalid length. [ 983.873931][T31401] netlink: 24 bytes leftover after parsing attributes in process `syz.0.7524'. [ 983.902740][T31405] netlink: 20 bytes leftover after parsing attributes in process `syz.4.7529'. [ 983.938515][T31391] netlink: 104 bytes leftover after parsing attributes in process `syz.0.7524'. [ 984.262874][T31419] netlink: 52 bytes leftover after parsing attributes in process `syz.0.7534'. [ 984.707702][T31438] netlink: Conntrack attr has 1 unknown bytes [ 984.707762][T31438] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 984.708115][T31438] netlink: Conntrack attr has 1 unknown bytes [ 984.708144][T31438] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 984.708527][T31438] netlink: Conntrack attr has 1 unknown bytes [ 984.708558][T31438] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 984.708916][T31438] netlink: Conntrack attr has 1 unknown bytes [ 984.747590][T31438] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 984.747961][T31438] netlink: Conntrack attr has 1 unknown bytes [ 984.902024][T17243] Bluetooth: hci2: command 0x0405 tx timeout [ 985.011865][T31450] nbd: socks must be embedded in a SOCK_ITEM attr [ 985.475751][T31476] netlink: 20 bytes leftover after parsing attributes in process `syz.2.7552'. [ 985.638332][T31476] [ 985.640740][T31476] ====================================================== [ 985.647891][T31476] WARNING: possible circular locking dependency detected [ 985.655054][T31476] syzkaller #0 Not tainted [ 985.659500][T31476] ------------------------------------------------------ [ 985.666592][T31476] syz.2.7552/31476 is trying to acquire lock: [ 985.672691][T31476] ffff88805644ee98 (set->srcu){.+.+}-{0:0}, at: __synchronize_srcu+0xb5/0x2f0 [ 985.681719][T31476] [ 985.681719][T31476] but task is already holding lock: [ 985.689105][T31476] ffff88802b0f0ed8 (&q->elevator_lock){+.+.}-{4:4}, at: elevator_change+0x1af/0x480 [ 985.698703][T31476] [ 985.698703][T31476] which lock already depends on the new lock. [ 985.698703][T31476] [ 985.709306][T31476] [ 985.709306][T31476] the existing dependency chain (in reverse order) is: [ 985.718529][T31476] [ 985.718529][T31476] -> #6 (&q->elevator_lock){+.+.}-{4:4}: [ 985.726448][T31476] __mutex_lock+0x19d/0x1550 [ 985.731582][T31476] elevator_change+0x1af/0x480 [ 985.736886][T31476] elevator_set_none+0xb5/0x140 [ 985.742271][T31476] blk_mq_update_nr_hw_queues+0x5ef/0x19f0 [ 985.748682][T31476] nbd_start_device+0x189/0xb30 [ 985.754130][T31476] nbd_genl_connect+0x167d/0x1cd0 [ 985.759727][T31476] genl_family_rcv_msg_doit+0x233/0x340 [ 985.765813][T31476] genl_rcv_msg+0x614/0x7a0 [ 985.770851][T31476] netlink_rcv_skb+0x226/0x4a0 [ 985.776153][T31476] genl_rcv+0x28/0x40 [ 985.780681][T31476] netlink_unicast+0x7bd/0x940 [ 985.785988][T31476] netlink_sendmsg+0x813/0xb40 [ 985.791391][T31476] sock_sendmsg_nosec+0x13a/0x180 [ 985.796950][T31476] ____sys_sendmsg+0x54e/0x850 [ 985.802257][T31476] ___sys_sendmsg+0x2a5/0x360 [ 985.807489][T31476] __x64_sys_sendmsg+0x1b1/0x290 [ 985.813013][T31476] do_syscall_64+0x166/0x520 [ 985.818233][T31476] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 985.824688][T31476] [ 985.824688][T31476] -> #5 (&q->q_usage_counter(io)#49){++++}-{0:0}: [ 985.833404][T31476] blk_alloc_queue+0x544/0x690 [ 985.838756][T31476] __blk_mq_alloc_disk+0x194/0x390 [ 985.844408][T31476] nbd_dev_add+0x494/0xb60 [ 985.849359][T31476] nbd_init+0x168/0x1f0 [ 985.854139][T31476] do_one_initcall+0x250/0x870 [ 985.859449][T31476] do_initcall_level+0x10a/0x1a0 [ 985.865034][T31476] do_initcalls+0x59/0xa0 [ 985.869917][T31476] kernel_init_freeable+0x29d/0x3e0 [ 985.875659][T31476] kernel_init+0x22/0x1d0 [ 985.880534][T31476] ret_from_fork+0x514/0xb70 [ 985.885693][T31476] ret_from_fork_asm+0x1a/0x30 [ 985.891003][T31476] [ 985.891003][T31476] -> #4 (fs_reclaim){+.+.}-{0:0}: [ 985.898404][T31476] fs_reclaim_acquire+0x71/0x100 [ 985.903884][T31476] __kmalloc_cache_node_noprof+0x66/0x620 [ 985.910321][T31476] create_worker+0x112/0x7c0 [ 985.915621][T31476] workqueue_prepare_cpu+0xe4/0x170 [ 985.921356][T31476] cpuhp_invoke_callback+0x434/0x810 [ 985.927190][T31476] _cpu_up+0x2ce/0x5b0 [ 985.931889][T31476] cpu_up+0x1d2/0x220 [ 985.936416][T31476] cpuhp_bringup_mask+0xb2/0x1a0 [ 985.941949][T31476] cpuhp_bringup_cpus_parallel+0x109/0x120 [ 985.948294][T31476] bringup_nonboot_cpus+0x17/0x30 [ 985.953874][T31476] smp_init+0x32/0x110 [ 985.958623][T31476] kernel_init_freeable+0x27f/0x3e0 [ 985.964440][T31476] kernel_init+0x22/0x1d0 [ 985.969306][T31476] ret_from_fork+0x514/0xb70 [ 985.974509][T31476] ret_from_fork_asm+0x1a/0x30 [ 985.979830][T31476] [ 985.979830][T31476] -> #3 (cpu_hotplug_lock){++++}-{0:0}: [ 985.987680][T31476] cpus_read_lock+0x42/0x160 [ 985.992813][T31476] static_key_slow_inc+0x12/0x30 [ 985.998487][T31476] nbd_genl_reconnect_sock_cb+0x69a/0xbb0 [ 986.004872][T31476] nbd_genl_foreach_sock+0x265/0x450 [ 986.010703][T31476] nbd_genl_reconfigure+0xbbb/0x1040 [ 986.016550][T31476] genl_family_rcv_msg_doit+0x233/0x340 [ 986.022646][T31476] genl_rcv_msg+0x614/0x7a0 [ 986.027706][T31476] netlink_rcv_skb+0x226/0x4a0 [ 986.033029][T31476] genl_rcv+0x28/0x40 [ 986.037581][T31476] netlink_unicast+0x7bd/0x940 [ 986.042902][T31476] netlink_sendmsg+0x813/0xb40 [ 986.048216][T31476] sock_sendmsg_nosec+0x13a/0x180 [ 986.053794][T31476] ____sys_sendmsg+0x54e/0x850 [ 986.059132][T31476] ___sys_sendmsg+0x2a5/0x360 [ 986.064362][T31476] __x64_sys_sendmsg+0x1b1/0x290 [ 986.069835][T31476] do_syscall_64+0x166/0x520 [ 986.074986][T31476] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 986.081447][T31476] [ 986.081447][T31476] -> #2 (&nsock->tx_lock){+.+.}-{4:4}: [ 986.089124][T31476] __mutex_lock+0x19d/0x1550 [ 986.094253][T31476] nbd_queue_rq+0x373/0xff0 [ 986.099299][T31476] blk_mq_dispatch_rq_list+0x499/0x1990 [ 986.105380][T31476] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 986.112315][T31476] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 986.118856][T31476] blk_mq_run_work_fn+0x16c/0x300 [ 986.124412][T31476] process_scheduled_works+0xc3d/0x1630 [ 986.130519][T31476] worker_thread+0xa47/0xfb0 [ 986.135672][T31476] kthread+0x38b/0x480 [ 986.139827][T31489] sch_tbf: burst 0 is lower than device ip6gre0 mtu (1448) ! [ 986.147656][T31476] ret_from_fork+0x514/0xb70 [ 986.152843][T31476] ret_from_fork_asm+0x1a/0x30 [ 986.158173][T31476] [ 986.158173][T31476] -> #1 (&cmd->lock){+.+.}-{4:4}: [ 986.165408][T31476] __mutex_lock+0x19d/0x1550 [ 986.170561][T31476] nbd_queue_rq+0xc1/0xff0 [ 986.175530][T31476] blk_mq_dispatch_rq_list+0x499/0x1990 [ 986.181617][T31476] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 986.188532][T31476] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 986.195058][T31476] blk_mq_run_work_fn+0x16c/0x300 [ 986.200676][T31476] process_scheduled_works+0xc3d/0x1630 [ 986.206819][T31476] worker_thread+0xa47/0xfb0 [ 986.211963][T31476] kthread+0x38b/0x480 [ 986.216570][T31476] ret_from_fork+0x514/0xb70 [ 986.221716][T31476] ret_from_fork_asm+0x1a/0x30 [ 986.227048][T31476] [ 986.227048][T31476] -> #0 (set->srcu){.+.+}-{0:0}: [ 986.234199][T31476] __lock_acquire+0x164c/0x2de0 [ 986.239607][T31476] lock_sync+0xb3/0x130 [ 986.244581][T31476] __synchronize_srcu+0xc9/0x2f0 [ 986.250232][T31476] elevator_switch+0x1e8/0x7b0 [ 986.255529][T31476] elevator_change+0x2fa/0x480 [ 986.260841][T31476] elevator_set_default+0x375/0x440 [ 986.266565][T31476] blk_register_queue+0x3f3/0x4e0 [ 986.272217][T31476] __add_disk+0x6b8/0xdb0 [ 986.277083][T31476] add_disk_fwnode+0x100/0x3a0 [ 986.282375][T31476] nbd_dev_add+0x733/0xb60 [ 986.287313][T31476] nbd_genl_connect+0x96c/0x1cd0 [ 986.292871][T31476] genl_family_rcv_msg_doit+0x233/0x340 [ 986.298960][T31476] genl_rcv_msg+0x614/0x7a0 [ 986.304003][T31476] netlink_rcv_skb+0x226/0x4a0 [ 986.309394][T31476] genl_rcv+0x28/0x40 [ 986.313907][T31476] netlink_unicast+0x7bd/0x940 [ 986.319228][T31476] netlink_sendmsg+0x813/0xb40 [ 986.324542][T31476] sock_sendmsg_nosec+0x13a/0x180 [ 986.330129][T31476] ____sys_sendmsg+0x54e/0x850 [ 986.335495][T31476] ___sys_sendmsg+0x2a5/0x360 [ 986.340715][T31476] __x64_sys_sendmsg+0x1b1/0x290 [ 986.346189][T31476] do_syscall_64+0x166/0x520 [ 986.351313][T31476] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 986.357736][T31476] [ 986.357736][T31476] other info that might help us debug this: [ 986.357736][T31476] [ 986.367965][T31476] Chain exists of: [ 986.367965][T31476] set->srcu --> &q->q_usage_counter(io)#49 --> &q->elevator_lock [ 986.367965][T31476] [ 986.381648][T31476] Possible unsafe locking scenario: [ 986.381648][T31476] [ 986.389189][T31476] CPU0 CPU1 [ 986.394643][T31476] ---- ---- [ 986.400030][T31476] lock(&q->elevator_lock); [ 986.404647][T31476] lock(&q->q_usage_counter(io)#49); [ 986.412550][T31476] lock(&q->elevator_lock); [ 986.419669][T31476] sync(set->srcu); [ 986.423570][T31476] [ 986.423570][T31476] *** DEADLOCK *** [ 986.423570][T31476] [ 986.431731][T31476] locks held by syz.2.7552/31476: 6, last CPU#1: [ 986.438135][T31476] #0: ffffffff902c47a8 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 986.446465][T31476] #1: ffffffff902c45e0 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10b/0x7a0 [ 986.455456][T31476] #2: ffff8880349d59c0 (&set->update_nr_hwq_lock){++++}-{4:4}, at: add_disk_fwnode+0xea/0x3a0 [ 986.465930][T31476] #3: ffff88802b0f0f60 (&q->sysfs_lock){+.+.}-{4:4}, at: blk_register_queue+0x10d/0x4e0 [ 986.475893][T31476] #4: ffff88802b0f09e8 (&q->q_usage_counter(queue)#53){+.+.}-{0:0}, at: elevator_change+0x194/0x480 [ 986.486795][T31476] #5: ffff88802b0f0ed8 (&q->elevator_lock){+.+.}-{4:4}, at: elevator_change+0x1af/0x480 [ 986.496645][T31476] [ 986.496645][T31476] stack backtrace: [ 986.502552][T31476] CPU: 1 UID: 0 PID: 31476 Comm: syz.2.7552 Not tainted syzkaller #0 PREEMPT(full) [ 986.512028][T31476] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 986.522105][T31476] Call Trace: [ 986.525404][T31476] [ 986.528353][T31476] dump_stack_lvl+0xe8/0x150 [ 986.532964][T31476] print_circular_bug+0x2e2/0x300 [ 986.538002][T31476] check_noncircular+0x12f/0x150 [ 986.543047][T31476] __lock_acquire+0x164c/0x2de0 [ 986.547936][T31476] ? lockdep_unlock+0x5c/0xd0 [ 986.552635][T31476] ? __lock_acquire+0x1511/0x2de0 [ 986.557785][T31476] lock_sync+0xb3/0x130 [ 986.561964][T31476] ? __synchronize_srcu+0xb5/0x2f0 [ 986.567120][T31476] ? __synchronize_srcu+0xb5/0x2f0 [ 986.572248][T31476] __synchronize_srcu+0xc9/0x2f0 [ 986.577207][T31476] ? __pfx___synchronize_srcu+0x10/0x10 [ 986.582797][T31476] ? do_raw_spin_lock+0x12b/0x2f0 [ 986.587853][T31476] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 986.593668][T31476] ? ktime_get_mono_fast_ns+0x2d2/0x2f0 [ 986.599234][T31476] ? synchronize_srcu+0x20a/0x260 [ 986.604266][T31476] elevator_switch+0x1e8/0x7b0 [ 986.609045][T31476] ? blk_mq_cancel_work_sync+0xa5/0xe0 [ 986.614610][T31476] elevator_change+0x2fa/0x480 [ 986.619381][T31476] ? do_raw_spin_unlock+0xf5/0x200 [ 986.624505][T31476] elevator_set_default+0x375/0x440 [ 986.629723][T31476] ? __pfx_elevator_set_default+0x10/0x10 [ 986.635455][T31476] ? disk_register_independent_access_ranges+0x2d8/0x380 [ 986.642567][T31476] ? blk_crypto_sysfs_register+0x11c/0x170 [ 986.648426][T31476] blk_register_queue+0x3f3/0x4e0 [ 986.653471][T31476] __add_disk+0x6b8/0xdb0 [ 986.657819][T31476] add_disk_fwnode+0x100/0x3a0 [ 986.662594][T31476] nbd_dev_add+0x733/0xb60 [ 986.667038][T31476] ? __pfx_nbd_dev_add+0x10/0x10 [ 986.671986][T31476] ? __pfx_nbd_genl_foreach_sock+0x10/0x10 [ 986.677800][T31476] ? bpf_lsm_capable+0x9/0x20 [ 986.682479][T31476] ? security_capable+0x7e/0x2c0 [ 986.687425][T31476] ? radix_tree_lookup+0x25c/0x290 [ 986.692612][T31476] nbd_genl_connect+0x96c/0x1cd0 [ 986.697577][T31476] ? __pfx_nbd_genl_connect+0x10/0x10 [ 986.702964][T31476] ? rcu_is_watching+0x16/0xb0 [ 986.707737][T31476] ? trace_kmalloc+0x2a/0xf0 [ 986.712363][T31476] ? __kmalloc_noprof+0x38c/0x720 [ 986.717482][T31476] ? __nla_parse+0x40/0x60 [ 986.721923][T31476] ? genl_family_rcv_msg_attrs_parse+0x20b/0x2f0 [ 986.728258][T31476] ? genl_family_rcv_msg_attrs_parse+0x265/0x2f0 [ 986.734608][T31476] genl_family_rcv_msg_doit+0x233/0x340 [ 986.740170][T31476] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 986.746251][T31476] ? __lock_acquire+0x747/0x2de0 [ 986.751289][T31476] genl_rcv_msg+0x614/0x7a0 [ 986.755899][T31476] ? __pfx_genl_rcv_msg+0x10/0x10 [ 986.761041][T31476] ? __pfx_nbd_genl_connect+0x10/0x10 [ 986.766450][T31476] netlink_rcv_skb+0x226/0x4a0 [ 986.771243][T31476] ? __pfx_genl_rcv_msg+0x10/0x10 [ 986.776297][T31476] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 986.781637][T31476] ? down_read+0x2be/0x330 [ 986.786154][T31476] genl_rcv+0x28/0x40 [ 986.790177][T31476] netlink_unicast+0x7bd/0x940 [ 986.794960][T31476] netlink_sendmsg+0x813/0xb40 [ 986.799756][T31476] ? __pfx_netlink_sendmsg+0x10/0x10 [ 986.805056][T31476] ? apparmor_socket_sendmsg+0x98/0x360 [ 986.810632][T31476] ? __pfx_netlink_sendmsg+0x10/0x10 [ 986.815940][T31476] sock_sendmsg_nosec+0x13a/0x180 [ 986.820979][T31476] ____sys_sendmsg+0x54e/0x850 [ 986.825760][T31476] ? __pfx_____sys_sendmsg+0x10/0x10 [ 986.831067][T31476] ? import_iovec+0x73/0xa0 [ 986.835604][T31476] ___sys_sendmsg+0x2a5/0x360 [ 986.840304][T31476] ? __lock_acquire+0x747/0x2de0 [ 986.845257][T31476] ? __pfx____sys_sendmsg+0x10/0x10 [ 986.850589][T31476] ? futex_wait+0x2a2/0x390 [ 986.855463][T31476] ? __fget_files+0x2a/0x420 [ 986.860157][T31476] ? __fget_files+0x3a2/0x420 [ 986.864847][T31476] __x64_sys_sendmsg+0x1b1/0x290 [ 986.869801][T31476] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 986.875278][T31476] do_syscall_64+0x166/0x520 [ 986.879922][T31476] ? trace_irq_disable+0x3b/0x140 [ 986.884955][T31476] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 986.891057][T31476] ? clear_bhb_loop+0x70/0xc0 [ 986.895752][T31476] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 986.901749][T31476] RIP: 0033:0x7f258099e159 [ 986.906448][T31476] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 986.926419][T31476] RSP: 002b:00007f2581844028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 986.934879][T31476] RAX: ffffffffffffffda RBX: 00007f2580c26180 RCX: 00007f258099e159 [ 986.942960][T31476] RDX: 0000000000000000 RSI: 0000200000000240 RDI: 00000000000000c3 [ 986.950962][T31476] RBP: 00007f2580a3506b R08: 0000000000000000 R09: 0000000000000000 [ 986.958942][T31476] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 986.966921][T31476] R13: 00007f2580c26218 R14: 00007f2580c26180 R15: 00007ffc6a1b8098 [ 986.974996][T31476] [ 987.156993][T30990] udevd[30990]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory