last executing test programs: 22.668827765s ago: executing program 4 (id=5838): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a300000001f0900030073797a320000000014000000110001"], 0x7c}}, 0x810) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETRULE(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)={0x38, 0x7, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_RULE_HANDLE={0xc, 0x3, 0x1, 0x0, 0x2}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}, 0x38}, 0x1, 0x0, 0x0, 0x4001}, 0x20000014) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, &(0x7f0000000240)=0x100000001, 0x59) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000000300)="d8000000180081054e81f782db4cb904021d080406037c09e8fe55a10a0015400400142603600e122f00160006000600a8000600200005400700027c035c0461c1d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9e00360db798262f3d40fad95667e006dcdf63951f215ce3bb9ad809d5ed0bffec02b52a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703920723f9a94100000000", 0xd8}], 0x1, 0x0, 0x0, 0x4a0f0000}, 0x0) connect$inet6(r2, &(0x7f0000000200)={0xa, 0x4e22, 0xb7, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r2, 0x6, 0x1f, &(0x7f0000000040), 0x1e) setsockopt$inet6_tcp_TLS_TX(r2, 0x11a, 0x1, &(0x7f0000000000)=@gcm_256={{0x304}, "eeba1daa3c696e33", "8cd11084a86e02071031ecd5f1cb8efeeee1da564cf9831268724500b699fa5e", "990ff934", "917ab8da99afa933"}, 0x38) sendmsg$ETHTOOL_MSG_WOL_SET(r2, &(0x7f0000001c40)={0x0, 0x0, &(0x7f0000001c00)={&(0x7f0000001c80)=ANY=[], 0x14}, 0x1, 0x0, 0x0, 0x804}, 0x8000) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f0000000280)={0x26, 'hash\x00', 0x0, 0x0, 'sha384\x00'}, 0x58) accept4(r4, 0x0, 0x0, 0x0) bpf$PROG_LOAD(0x23, 0x0, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB="dbdf25000000003024fa8e0a58801fbf9a000000", @ANYRES32=0x0, @ANYBLOB="9d07070006060400200012800b0001006272696467650000100002800c002e000000000013699385"], 0x40}, 0x1, 0x0, 0x0, 0x24040054}, 0x8000) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r6 = socket$inet(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r8 = socket$netlink(0x10, 0x3, 0x0) r9 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000340), r8) sendmsg$IPVS_CMD_GET_CONFIG(r8, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x1c, r9, 0x100, 0x70bd25, 0x3, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x10}]}, 0x1c}, 0x1, 0x0, 0x0, 0x74841}, 0x40) sendmsg$nl_route_sched(r8, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000480)=@newqdisc={0x40, 0x24, 0xf0b, 0x70bd2b, 0x0, {0x0, 0x0, 0x12, r7, {0x0, 0xc}, {0xffff, 0xffff}, {0x2, 0xd}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x3f, 0x2, [@TCA_TAPRIO_ATTR_SCHED_CYCLE_TIME={0xc, 0x8, 0xffffffffffffffff}]}}]}, 0x40}}, 0x0) ioctl$NILFS_IOCTL_GET_SUINFO(r2, 0x80186e84, &(0x7f00000004c0)={&(0x7f0000000140)=[{0x39, 0x8, 0x2}, {0x5, 0xfffffff7, 0x1}, {0x6, 0x0, 0x2}, {0x8, 0xfffffffd, 0x1}, {0x8000000000000001, 0x3, 0x2}, {0x9, 0x3}, {0x9, 0xfffffffa, 0x2}, {0x3b, 0x5}, {0x1, 0x7}], 0x9, 0x10, 0x800, 0x56c8}) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x0, 0x20000000ec071, r2, 0x5ac1a000) sendto$inet6(r2, 0x0, 0x0, 0x0, 0x0, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff}) sendmsg$NFT_BATCH(r10, &(0x7f0000000480)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x80000000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x20040010}, 0x0) 22.312570287s ago: executing program 4 (id=5842): r0 = epoll_create(0x7) r1 = epoll_create1(0x0) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f0000000e80)=ANY=[@ANYBLOB="0b000000080000000c000000ffbfff"], 0x48) r2 = epoll_create(0x7) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000180)) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000040)={0x201c}) r3 = epoll_create1(0x80000) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000000100)) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f0000000140)={0x60000000}) 22.025012136s ago: executing program 4 (id=5844): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt(r1, 0x84, 0x80, &(0x7f0000000000)='\x00\x00\x00\x00\t\x00\x00\x00', 0x8) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x1c, &(0x7f0000000000)=[@in6={0xa, 0x4e2c, 0xfffffffe, @private1={0xfc, 0x1, '\x00', 0x2}, 0x9}]}, 0x0) getsockopt$inet_sctp6_SCTP_MAX_BURST(r2, 0x84, 0x83, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f00000004c0)=0x8) setsockopt$inet_sctp6_SCTP_SET_PEER_PRIMARY_ADDR(r1, 0x84, 0x5, &(0x7f00000001c0)={r3, @in={{0x2, 0x4e24, @multicast1}}}, 0x84) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r0, 0x84, 0x10, &(0x7f0000000000)=@assoc_value={r3, 0x30000000}, 0x8) 21.843914546s ago: executing program 4 (id=5848): bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0xd, 0x4, &(0x7f00000005c0)=ANY=[@ANYBLOB="180000000100000000000000000000007112bf000000000095"], &(0x7f0000000100)='syzkaller\x00', 0xa, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0xf00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0xa, &(0x7f00000000c0)=ANY=[@ANYBLOB="18080000d0ff00000000000000000000851000000600000018000000", @ANYRES32, @ANYBLOB="00000000000000005f0800000000000018000000000000000000000000010000950000000000000095"], &(0x7f0000000000)='GPL\x00', 0x2, 0x0, 0x0, 0x41000, 0x8, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x10000000}, 0x94) r0 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000080)=@generic={&(0x7f0000000040)='./file0\x00', 0x0, 0x14}, 0x18) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_int(r1, 0x0, 0x12, &(0x7f0000000180)=0x1f5, 0x4) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=@newsa={0x13c, 0x10, 0x413, 0x0, 0x25dfdbfa, {{@in6=@private2={0xfc, 0x2, '\x00', 0x1}, @in6=@dev={0xfe, 0x80, '\x00', 0x2b}, 0x4e20, 0x0, 0x4e24, 0x0, 0x2, 0x0, 0x20, 0x6}, {@in6=@private1, 0x4d4, 0x32}, @in6=@ipv4={'\x00', '\xff\xff', @loopback}, {0x0, 0x3, 0x76a, 0x80000000000010, 0x3, 0x0, 0x9}, {0x0, 0xffffffffffffffff, 0x4}, {0xf6, 0x0, 0x7}, 0x70bd26, 0x0, 0xa, 0x0, 0x9, 0x110}, [@algo_aead={0x4c, 0x12, {{'rfc4309(ccm(aes))\x00'}, 0x0, 0x60}}]}, 0x13c}, 0x1, 0x0, 0x0, 0x80c0}, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff}) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) tee(r3, r4, 0x2, 0x100000000000003) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r4, 0x84, 0x72, &(0x7f0000000140)={0x0, 0x2, 0x30}, &(0x7f0000000500)=0xc) getsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r3, 0x84, 0x13, &(0x7f0000000540)={0x0, 0x5}, &(0x7f0000000580)=0x8) getsockopt$inet_sctp6_SCTP_STATUS(r4, 0x84, 0xe, &(0x7f0000000a40)={r5, 0xaf, 0x80000000, 0x401, 0x9, 0x24a, 0x0, 0x9, {r6, @in6={{0xa, 0x4e23, 0x3, @mcast2, 0x7}}, 0x8, 0xc, 0xe415, 0x14f}}, &(0x7f0000000b00)=0xb0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000700)={'syztnl1\x00', &(0x7f0000000600)={'ip_vti0\x00', 0x0, 0x8, 0x1, 0xfffffffb, 0x7f, {{0x32, 0x4, 0x2, 0x8, 0xc8, 0x66, 0x0, 0x6, 0x4, 0x0, @private=0xa010100, @local, {[@timestamp_addr={0x44, 0x44, 0x37, 0x1, 0xe, [{@multicast1, 0x3}, {@loopback, 0x9}, {@local, 0x6}, {@broadcast, 0x4}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x2}, {@multicast2, 0xffffffff}, {@rand_addr=0x64010100, 0x1}, {@remote, 0x5}]}, @timestamp_addr={0x44, 0x34, 0x50, 0x1, 0x7, [{@initdev={0xac, 0x1e, 0x1, 0x0}, 0x4}, {@empty, 0xbddb}, {@local, 0x9071}, {@local, 0x9}, {@multicast1, 0xf}, {@dev={0xac, 0x14, 0x14, 0x2f}, 0x7}]}, @rr={0x7, 0x23, 0xa7, [@multicast1, @broadcast, @multicast2, @multicast2, @remote, @dev={0xac, 0x14, 0x14, 0x2d}, @multicast1, @empty]}, @rr={0x7, 0xf, 0xe6, [@loopback, @multicast1, @initdev={0xac, 0x1e, 0x1, 0x0}]}, @timestamp={0x44, 0x8, 0xe5, 0x0, 0x9, [0xf]}]}}}}}) socket$inet_icmp_raw(0x2, 0x3, 0x1) r8 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000008c0)={&(0x7f0000000740)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xf8, 0xf8, 0x6, [@var={0xe, 0x0, 0x0, 0xe, 0x1, 0x1}, @func_proto={0x0, 0x4, 0x0, 0xd, 0x0, [{0x8, 0x1}, {0x8, 0x1}, {0x3, 0x5}, {0xa, 0x5}]}, @fwd={0x10}, @var={0xb, 0x0, 0x0, 0xe, 0x2}, @decl_tag={0x10, 0x0, 0x0, 0x11, 0x1, 0x6}, @enum={0x7, 0x6, 0x0, 0x6, 0x4, [{0x4}, {0x1, 0xa903}, {0x6, 0xe}, {0xc, 0xffffffff}, {0x0, 0x5cf}, {0x0, 0xa}]}, @fwd={0x3}, @struct={0x3, 0x4, 0x0, 0x4, 0x1, 0xc0, [{0x3, 0x0, 0x2}, {0x2, 0x1, 0x24f4}, {0x1, 0x2, 0x2}, {0xb, 0x3, 0x1ff}]}, @typedef={0xf, 0x0, 0x0, 0x8, 0x3}]}, {0x0, [0x61, 0x61, 0x30, 0x2e]}}, &(0x7f0000000880)=""/53, 0x116, 0x35, 0x0, 0x6}, 0x28) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000980)={0x11, 0x7, &(0x7f00000001c0)=ANY=[@ANYBLOB="18000000950d0000000000000200000018190000", @ANYRES32=r0, @ANYBLOB="228f95ae86ff7878e4ff364a28f01218000000968fd0a5b45536baee3a63e275368db90100000000000000055f00400095"], &(0x7f0000000180)='GPL\x00', 0x5, 0xe9, &(0x7f0000000300)=""/233, 0x41100, 0x56, '\x00', r7, 0x0, r8, 0x8, &(0x7f0000000900)={0xa, 0x5}, 0x8, 0x10, &(0x7f0000000940)={0x5, 0xf, 0x4, 0xc837}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) 21.68073814s ago: executing program 4 (id=5850): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_GET_SURVEY(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r0, 0x2, 0x70bd2b, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r1}, @void}}, ["", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000050}, 0x4000004) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl802154(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$NL802154_CMD_NEW_INTERFACE(r2, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x54, r3, 0x1, 0x70bd2a, 0x25dfdbfe, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_IFTYPE={0x8, 0x5, 0xffffffff}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x2}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x2}, @NL802154_ATTR_IFTYPE={0x8, 0x5, 0x1}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan3\x00'}, @NL802154_ATTR_EXTENDED_ADDR={0xc}]}, 0x54}, 0x1, 0x0, 0x0, 0x44000}, 0x10) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$team(&(0x7f0000000340), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000380)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_OPTIONS_SET(r4, &(0x7f00000004c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000480)={&(0x7f00000003c0)={0x58, r5, 0x800, 0x70bd27, 0x25dfdbfc, {}, [{{0x8}, {0x3c, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x7}}}]}}]}, 0x58}, 0x1, 0x0, 0x0, 0x80c0}, 0x20000800) recvmsg(r4, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000540)=""/245, 0xf5}], 0x1, &(0x7f0000000680)=""/8, 0x8}, 0x3) ioctl$XFS_IOC_START_COMMIT(r4, 0x80585882, &(0x7f0000000700)={0xffffffffffffffff}) setsockopt$IP6T_SO_SET_REPLACE(r7, 0x29, 0x40, &(0x7f00000007c0)=@security={'security\x00', 0xe, 0x4, 0x408, 0xffffffff, 0xe8, 0xe8, 0x208, 0xffffffff, 0xffffffff, 0x338, 0x338, 0x338, 0xffffffff, 0x4, &(0x7f0000000780), {[{{@ipv6={@empty, @private2={0xfc, 0x2, '\x00', 0x1}, [0x0, 0x1feffff00, 0x0, 0xff], [0xffff00, 0xffffffff, 0xff, 0xff], 'veth1_to_team\x00', 'gretap0\x00', {}, {}, 0x0, 0x8, 0x7, 0x41}, 0x0, 0xa8, 0xe8}, @common=@inet=@LOG={0x40, 'LOG\x00', 0x0, {0xff, 0xd, "f20cbd812b29363875ed7317b90ef5fe1ea67130eed06485eb1c756c42ad"}}}, {{@uncond, 0x0, 0xd8, 0x120, 0x0, {}, [@common=@srh={{0x30}, {0x33, 0x2, 0x6, 0x40, 0x101, 0x460, 0x61}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv4=@multicast1, 'veth1_to_bond\x00', {0x8}}}}, {{@ipv6={@private0, @private1={0xfc, 0x1, '\x00', 0x1}, [0xff, 0xff, 0xffffff00, 0xff], [0xff, 0x0, 0xffffff00], 'veth0_to_bond\x00', 'syzkaller0\x00', {}, {0xff}, 0x6c, 0x5, 0x5, 0x4}, 0x0, 0x100, 0x130, 0x0, {}, [@common=@srh={{0x30}, {0x2b, 0xe, 0xeb, 0x4, 0x5, 0x900, 0x80}}, @common=@ipv6header={{0x28}, {0x2c, 0x40, 0x1}}]}, @common=@inet=@SET2={0x30, 'SET\x00', 0x2, {{0x3, 0x6, 0x1}, {0x3, 0x0, 0x6}, 0x8000, 0xf}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x468) ioctl$SIOCGETLINKNAME(r7, 0x89e0, &(0x7f0000000c40)={0x0, 0x1}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r7, 0x89f2, &(0x7f0000000d40)={'ip6gre0\x00', &(0x7f0000000cc0)={'ip6tnl0\x00', r6, 0x29, 0x7, 0xc, 0x4, 0x10, @loopback, @ipv4={'\x00', '\xff\xff', @remote}, 0x40, 0x700, 0x1, 0x9}}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r7, 0x89f1, &(0x7f0000000ec0)={'gretap0\x00', &(0x7f0000000d80)={'ip_vti0\x00', r8, 0x10, 0x700, 0x7, 0x168, {{0x46, 0x4, 0x0, 0x9, 0x118, 0x68, 0x0, 0x80, 0x4, 0x0, @rand_addr=0x64010102, @multicast1, {[@timestamp_prespec={0x44, 0x14, 0xfd, 0x3, 0xe, [{@multicast2}, {@multicast1, 0x8}]}, @generic={0x88, 0x4, 'Z5'}, @timestamp_prespec={0x44, 0x24, 0x5b, 0x3, 0x4, [{@initdev={0xac, 0x1e, 0x0, 0x0}, 0xe}, {@empty, 0xe}, {@loopback, 0x7}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x7fffffff}]}, @ssrr={0x89, 0xb, 0x0, [@empty, @rand_addr=0x64010102]}, @ssrr={0x89, 0x1b, 0x4e, [@multicast1, @empty, @multicast2, @multicast2, @dev={0xac, 0x14, 0x14, 0x41}, @dev={0xac, 0x14, 0x14, 0x3b}]}, @rr={0x7, 0x1f, 0xab, [@multicast2, @broadcast, @initdev={0xac, 0x1e, 0x0, 0x0}, @initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast, @remote, @loopback]}, @timestamp={0x44, 0x8, 0xe1, 0x0, 0xb, [0x10000]}, @timestamp_addr={0x44, 0x24, 0x2c, 0x1, 0xb, [{@remote, 0x3}, {@loopback, 0x7}, {@dev={0xac, 0x14, 0x14, 0x1f}, 0x7}, {@multicast1, 0x2b59}]}, @timestamp_addr={0x44, 0x54, 0x53, 0x1, 0x0, [{@private=0xa010102, 0x8}, {@rand_addr=0x64010100, 0x8000}, {@private=0xa010101, 0x5}, {@multicast1, 0x8}, {@local, 0x7f}, {@rand_addr=0x64010102, 0x7}, {@rand_addr=0x64010100, 0x800}, {@local, 0x1}, {@loopback, 0x81}, {@dev={0xac, 0x14, 0x14, 0x14}, 0x2}]}]}}}}}) setsockopt$TIPC_GROUP_JOIN(r7, 0x10f, 0x87, &(0x7f0000000f00)={0x41, 0x2, 0x2}, 0x10) getsockopt$PNPIPE_IFINDEX(r7, 0x113, 0x2, &(0x7f0000000f40), &(0x7f0000000f80)=0x4) r10 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001000), r4) sendmsg$ETHTOOL_MSG_RINGS_GET(0xffffffffffffffff, &(0x7f0000001100)={&(0x7f0000000fc0), 0xc, &(0x7f00000010c0)={&(0x7f0000001040)={0x58, r10, 0x10, 0x70bd25, 0x25dfdbfd, {}, [@HEADER={0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vlan1\x00'}]}, @HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r9}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}]}, 0x58}, 0x1, 0x0, 0x0, 0x20000000}, 0x8c4) openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000001140)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0) bind$inet6(r7, &(0x7f0000001180)={0xa, 0x4e24, 0x5, @mcast2, 0x4}, 0x1c) sendmsg$nl_xfrm(r7, &(0x7f00000012c0)={&(0x7f00000011c0)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000001280)={&(0x7f0000001200)=@newae={0x4c, 0x1e, 0x200, 0x70bd28, 0x25dfdbfd, {{@in6=@loopback, 0x4d6, 0xa, 0x3c}, @in6=@mcast1, 0xb1e}, [@offload={0xc, 0x1c, {0x0, 0x3}}]}, 0x4c}}, 0x10) ioctl$sock_inet6_SIOCSIFADDR(r7, 0x8916, &(0x7f0000001300)={@private0={0xfc, 0x0, '\x00', 0x1}, 0x2c, r6}) r11 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000001380), r2) sendmsg$IEEE802154_ASSOCIATE_RESP(r2, &(0x7f0000001480)={&(0x7f0000001340)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000001440)={&(0x7f00000013c0)={0x28, r11, 0x0, 0x70bd2c, 0x25dfdbfb, {}, [@IEEE802154_ATTR_STATUS={0x5, 0x3, 0xc}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0202}}]}, 0x28}, 0x1, 0x0, 0x0, 0x20000000}, 0x20008000) r12 = syz_genetlink_get_family_id$mptcp(&(0x7f0000001500), r7) sendmsg$MPTCP_PM_CMD_SET_LIMITS(r7, &(0x7f0000001600)={&(0x7f00000014c0)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f00000015c0)={&(0x7f0000001540)={0x4c, r12, 0x1800, 0x70bd25, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}, @MPTCP_PM_ATTR_ADDR_REMOTE={0x28, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast2}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @ipv4={'\x00', '\xff\xff', @broadcast}}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8}]}]}, 0x4c}, 0x1, 0x0, 0x0, 0x10}, 0x8) getsockopt$inet_sctp_SCTP_RECVNXTINFO(r7, 0x84, 0x21, &(0x7f0000001640), &(0x7f0000001680)=0x4) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000016c0)={0x1b, 0x0, 0x0, 0x0, 0x0, r7, 0x9619, '\x00', r6, 0xffffffffffffffff, 0x5, 0x4, 0x2}, 0x50) 21.401540156s ago: executing program 4 (id=5852): unshare(0x6a040000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x42082, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x100}) openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbfe, {0x0, 0x0, 0x0, r2, {0x0, 0x8}, {0xffff, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0xffffffffffffff59}}]}, 0x34}, 0x1, 0x0, 0x0, 0x40000b0}, 0x4890) setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x67, &(0x7f0000000040)=0x91, 0x4) setsockopt$SO_BINDTODEVICE_wg(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000000)='wg0\x00', 0x4) sendmmsg$inet6(0xffffffffffffffff, 0x0, 0x0, 0x4001c00) socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, 0x0) r5 = bpf$PROG_LOAD(0x5, 0x0, 0x0) close(r5) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$MAP_UPDATE_CONST_STR(0x2, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) sendmsg$nl_route_sched(r3, 0x0, 0x40000) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$inet_udp(0x2, 0x2, 0x0) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@newlink={0x40, 0x10, 0x49920d862a92153b, 0x70bd28, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, 0x441, 0x11001}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @gtp={{0x8}, {0x14, 0x2, 0x0, 0x1, [@IFLA_GTP_FD0={0x8, 0x1, @udp=r8}, @IFLA_GTP_FD1={0x8, 0x2, @udp=r8}]}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x6008009}, 0x800) syz_genetlink_get_family_id$devlink(&(0x7f0000000140), 0xffffffffffffffff) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) 6.839022372s ago: executing program 1 (id=5910): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x18, 0xf, &(0x7f0000000400)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x88, 0x0, 0x0, 0x0, 0x80}, {{0x18, 0x1, 0x1, 0x0, r0}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xfeff}, {0x85, 0x0, 0x0, 0x86}, {0x7, 0x1, 0xb, 0x9, 0x0, 0x20}}, {{0x5, 0x0, 0x5, 0x9, 0x0, 0x1, 0x80000000}}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}, {0x7, 0x0, 0xb, 0x0, 0x0, 0x0, 0x5fe}}}, &(0x7f0000000000)='GPL\x00', 0x3, 0xfed, &(0x7f0000000780)=""/4077, 0x41000, 0x4b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8000d}, 0x94) 6.659206983s ago: executing program 1 (id=5912): pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newtaction={0xa0, 0x30, 0x9, 0x0, 0x0, {}, [{0x8c, 0x1, [@m_bpf={0x88, 0x1, 0x0, 0x0, {{0x8}, {0x60, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x7}, @TCA_ACT_BPF_OPS={0x3c, 0x4, [{0x45, 0x0, 0x0, 0x80000000}, {0x24, 0x0, 0x0, 0x686b}, {0x3, 0xfd}, {0x4d, 0x0, 0x0, 0x10000000}, {}, {0x0, 0x0, 0xf8}, {0x6}]}, @TCA_ACT_BPF_PARMS={0x18}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xa0}, 0x1, 0x0, 0x0, 0x40000}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x16, 0x5, &(0x7f0000000040)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3ffd, 0x0, 0x0, 0x0, 0x9}, [@call={0x85, 0x0, 0x0, 0xd0}, @call={0x85, 0x0, 0x0, 0xf}]}, &(0x7f0000000080)='GPL\x00', 0x2, 0x0, 0x0, 0x41000, 0x20, '\x00', 0x0, @fallback=0x34, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r4, 0x0, 0xe, 0x0, &(0x7f00000000c0)="00000000000000ce94327fc1a80c", 0x0, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x3, 0xc, &(0x7f0000000140)=@framed={{0x18, 0x2, 0x0, 0x0, 0xfffff000, 0x0, 0x0, 0x0, 0x9}, [@call={0x85, 0x0, 0x0, 0x28}, @printk={@d, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x17}}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x20}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r5, 0x0, 0xe, 0x0, &(0x7f0000000340)="e0b9547e3987dbdd0000cf000000", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x50) close(r3) socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r7 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r1, 0x84, 0x76, &(0x7f00000001c0)={0x0, 0x3}, &(0x7f0000000200)=0x8) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x1f, &(0x7f0000000480)={0x0, @in6={{0xa, 0x4e24, 0x7, @rand_addr=' \x01\x00', 0xd}}, 0x0, 0x80}, &(0x7f0000000540)=0x90) getsockopt$inet_sctp_SCTP_STATUS(r7, 0x84, 0xe, &(0x7f0000000580)={r8, 0x268, 0x2, 0x100, 0x108, 0x2b80, 0x6, 0xe10, {r9, @in6={{0xa, 0x4e24, 0x400, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x7}}, 0x4b61, 0x1, 0x8, 0xffffffff, 0xffffffff}}, &(0x7f0000000640)=0xb0) sendmsg$NL80211_CMD_REGISTER_BEACONS(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="010027bd5000fadbdf255500"], 0x30}, 0x1, 0x0, 0x0, 0x200440c1}, 0x24008000) write$cgroup_subtree(r1, &(0x7f0000000140)=ANY=[], 0x48) splice(r0, 0x0, r3, 0x0, 0x3000, 0x100000000000000d) 5.954120144s ago: executing program 1 (id=5915): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000580)=@newtfilter={0x23, 0x2c, 0x1, 0x70bd26, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x3, 0x5}, {0x10, 0xb}, {0x8, 0xffe0}}, [@TCA_CHAIN={0x8, 0xb, 0x1}, @TCA_CHAIN={0x8}]}, 0x34}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="12000000090000000800000002"], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000140)={{r1, 0xffffffffffffffff}, &(0x7f0000000180), &(0x7f0000000280)=r0}, 0x20) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000480)={r2, &(0x7f00000002c0)="e6a9138790b46bd0e5e1b0b2b62cdfd49d574447a7af2a03634a090fe21881b9bcae29496b7ca4187cf64f82788d901fa55b0100255d07e07500000021", 0x0}, 0x20) socket$nl_generic(0x10, 0x3, 0x10) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$smc(&(0x7f0000000040), r3) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), r6) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r6, &(0x7f0000000240)={0x0, 0x300, &(0x7f00000001c0)={&(0x7f0000000000)={0x40, r7, 0x7, 0x2, 0x0, {}, [@ETHTOOL_A_LINKMODES_OURS={0xc, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_BITS={0x4}, @ETHTOOL_A_BITSET_NOMASK={0x4}]}, @ETHTOOL_A_LINKMODES_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syz_tun\x00'}]}, @ETHTOOL_A_LINKMODES_SPEED={0x8, 0x5, 0x2}]}, 0x40}, 0x1, 0x3000000, 0x0, 0x4060850}, 0x400d4) (async) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r6, &(0x7f0000000240)={0x0, 0x300, &(0x7f00000001c0)={&(0x7f0000000000)={0x40, r7, 0x7, 0x2, 0x0, {}, [@ETHTOOL_A_LINKMODES_OURS={0xc, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_BITS={0x4}, @ETHTOOL_A_BITSET_NOMASK={0x4}]}, @ETHTOOL_A_LINKMODES_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syz_tun\x00'}]}, @ETHTOOL_A_LINKMODES_SPEED={0x8, 0x5, 0x2}]}, 0x40}, 0x1, 0x3000000, 0x0, 0x4060850}, 0x400d4) sendmsg$ETHTOOL_MSG_DEBUG_SET(r5, &(0x7f0000000800)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000007c0)={&(0x7f00000005c0)=ANY=[@ANYBLOB="4a0daf51", @ANYRES16=r7, @ANYBLOB="000127bd7000fbdbdf250800000014000180080003000100000008000100", @ANYRES32=0x0, @ANYBLOB="08000280040001008c010280c600050012ad80c2b6207c1e767e27ea3cd89f43dfd7945c26d377a8c29395ab5b146d0dfedd8015cf33e333388f4420fe46799804fdd7cf24040b3aa6fb6644b92f5d42951e6f65bc8bb8940da7c07b36bb5873ea362307b3ffac021941a9b0eea75f418bf7b228d4dce5fa0c0d1f3f4d5dde89d21a0c9cd2623379c6a86f2343e7e4da5f41e2550e4e0ebafc417e53cc12937658c283cb1ea4b88f1661f5e12b9d99eb0b9df1559e92d22793c27a2781c5575696b57d3120febda0497e2402266198e47063000004000100b3000500cffdc755a97c8e35ca5e7531afbaa95c4169903e0f291ccf1ce03918feb370362522ef64482b7bc74a411d6303b0756e0b66305c55be5c56ed7377f3dbe790806401842b9edad938556ab6668209de1ede2ecd080b608b3ee72f40703566d2753f0486dfee931c8c578e1c4442f133ae95873b0c68d4a74006889733e5a737da2d52655c14073f44ee15f98e0c08deca09b24bfd3a77cc6a058cbaef2296a05bb9dd9b5f50edc58e59eb566b34d07c0008000200ffff000018000180140002006d616373656330000000000000000000"], 0x1d4}, 0x1, 0x0, 0x0, 0x80}, 0x8040) (async) sendmsg$ETHTOOL_MSG_DEBUG_SET(r5, &(0x7f0000000800)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000007c0)={&(0x7f00000005c0)=ANY=[@ANYBLOB="4a0daf51", @ANYRES16=r7, @ANYBLOB="000127bd7000fbdbdf250800000014000180080003000100000008000100", @ANYRES32=0x0, @ANYBLOB="08000280040001008c010280c600050012ad80c2b6207c1e767e27ea3cd89f43dfd7945c26d377a8c29395ab5b146d0dfedd8015cf33e333388f4420fe46799804fdd7cf24040b3aa6fb6644b92f5d42951e6f65bc8bb8940da7c07b36bb5873ea362307b3ffac021941a9b0eea75f418bf7b228d4dce5fa0c0d1f3f4d5dde89d21a0c9cd2623379c6a86f2343e7e4da5f41e2550e4e0ebafc417e53cc12937658c283cb1ea4b88f1661f5e12b9d99eb0b9df1559e92d22793c27a2781c5575696b57d3120febda0497e2402266198e47063000004000100b3000500cffdc755a97c8e35ca5e7531afbaa95c4169903e0f291ccf1ce03918feb370362522ef64482b7bc74a411d6303b0756e0b66305c55be5c56ed7377f3dbe790806401842b9edad938556ab6668209de1ede2ecd080b608b3ee72f40703566d2753f0486dfee931c8c578e1c4442f133ae95873b0c68d4a74006889733e5a737da2d52655c14073f44ee15f98e0c08deca09b24bfd3a77cc6a058cbaef2296a05bb9dd9b5f50edc58e59eb566b34d07c0008000200ffff000018000180140002006d616373656330000000000000000000"], 0x1d4}, 0x1, 0x0, 0x0, 0x80}, 0x8040) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c000000020000000000000000000004"], 0x0, 0x26, 0x0, 0x2}, 0x28) (async) r8 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c000000020000000000000000000004"], 0x0, 0x26, 0x0, 0x2}, 0x28) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xd, 0x3, &(0x7f0000000800)=ANY=[@ANYBLOB="18000000000000000000000000000000950000000000000009000000dfa2bff372df8cdbeb318ab2bec8fc36903c0ec359caa1af3c914019395cc154010c693709800000000000000016a85adef34bf78c76e6222337923e1bea6ef682cc4375f594425d408ccc58187feb0e3d43347f989007a7c63f6dae2acb4af936461f34a8a32a50bbbb69ec85168947b86df9f2609bf93f7a1be259621818c3c75da31290bce645451b851111dd98ac4d8da9317c2c082020e0b2d634086785f3fe41a3053645cc413790faf7e229c782845b5bb774f7f154263178151ea93ff2cac4b181332c9c9a1c7d85616c8100000000000000d8300d19d585000000fc005774b56a7142047326f940e95b8489e1c5650f5c61299a295f39c88456391cffdef93e29f10f4a11f0cfbfc0ff976b20fef6033495b9b94777db9bb9b678ffc1130000009faa798226a080c01e47151268a02dc1a557cfdcf76305fbf6643df66b1b4d2d5e7bf698fc5a18d984ecb91e6683a5f522d536e2f3c43b89823659d1945258fc668950e5aacfffffffffffffff7f7a266c90e64efc8d8f730867202a9ee94e6a00"], &(0x7f0000000080)='GPL\x00', 0x5, 0x1f6, &(0x7f00000002c0)=""/168, 0x0, 0x0, '\x00', 0x0, @sock_ops, r8, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000200), 0x1, 0x0, 0xffffffffffffffff, 0xf5010000}, 0x6d) (async) r9 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xd, 0x3, &(0x7f0000000800)=ANY=[@ANYBLOB="18000000000000000000000000000000950000000000000009000000dfa2bff372df8cdbeb318ab2bec8fc36903c0ec359caa1af3c914019395cc154010c693709800000000000000016a85adef34bf78c76e6222337923e1bea6ef682cc4375f594425d408ccc58187feb0e3d43347f989007a7c63f6dae2acb4af936461f34a8a32a50bbbb69ec85168947b86df9f2609bf93f7a1be259621818c3c75da31290bce645451b851111dd98ac4d8da9317c2c082020e0b2d634086785f3fe41a3053645cc413790faf7e229c782845b5bb774f7f154263178151ea93ff2cac4b181332c9c9a1c7d85616c8100000000000000d8300d19d585000000fc005774b56a7142047326f940e95b8489e1c5650f5c61299a295f39c88456391cffdef93e29f10f4a11f0cfbfc0ff976b20fef6033495b9b94777db9bb9b678ffc1130000009faa798226a080c01e47151268a02dc1a557cfdcf76305fbf6643df66b1b4d2d5e7bf698fc5a18d984ecb91e6683a5f522d536e2f3c43b89823659d1945258fc668950e5aacfffffffffffffff7f7a266c90e64efc8d8f730867202a9ee94e6a00"], &(0x7f0000000080)='GPL\x00', 0x5, 0x1f6, &(0x7f00000002c0)=""/168, 0x0, 0x0, '\x00', 0x0, @sock_ops, r8, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000200), 0x1, 0x0, 0xffffffffffffffff, 0xf5010000}, 0x6d) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000007c0)={r9, 0xe0, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, &(0x7f0000001a00), 0x0, 0xfeffffff, 0x10, 0x8, 0x0, 0x0}}, 0x10) socket$inet_smc(0x2b, 0x1, 0x0) (async) r10 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$IP_VS_SO_SET_ADD(r10, 0x0, 0x482, &(0x7f0000000140)={0x84, @empty, 0x4e22, 0x3, 'sh\x00', 0x10, 0x80005, 0x6f}, 0x2c) r11 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f0000000440), r3) (async) r12 = syz_genetlink_get_family_id$tipc(&(0x7f0000000440), r3) sendmsg$TIPC_CMD_ENABLE_BEARER(r6, &(0x7f0000000a80)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x34, r12, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x18, 0x17, {0x1, 0xedd, @udp='udp:syz2\x00'}}}, ["", "", "", "", ""]}, 0x34}, 0x1, 0x0, 0x0, 0x80}, 0x0) ioctl$TUNSETIFF(r11, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) (async) ioctl$TUNSETIFF(r11, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r13 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r13, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) r14 = socket$nl_netfilter(0x10, 0x3, 0xc) socket(0x10, 0x2, 0x0) sendmsg$NFT_BATCH(r14, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000009c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000040000000160a01000900000000000000010000000900010073797a30000000000900020073797a3000000000140003800800014000000000080002400000000048000000160a0101000b000000000000010000000900020073797a30000000000900010073797a30000000001c00038018000380140002"], 0xd0}, 0x1, 0x0, 0x0, 0x24040841}, 0x0) (async) sendmsg$NFT_BATCH(r14, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000009c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000040000000160a01000900000000000000010000000900010073797a30000000000900020073797a3000000000140003800800014000000000080002400000000048000000160a0101000b000000000000010000000900020073797a30000000000900010073797a30000000001c00038018000380140002"], 0xd0}, 0x1, 0x0, 0x0, 0x24040841}, 0x0) write$tun(r11, &(0x7f0000001280)=ANY=[@ANYBLOB="000086dd00001100"], 0xfce) socket$nl_generic(0x10, 0x3, 0x10) (async) r15 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$SMC_PNETID_ADD(r15, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x34, r4, 0x1, 0x70bd2b, 0x25dfdbfb, {}, [@SMC_PNETID_NAME={0x9, 0x1, 'syz2\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'vlan1\x00'}]}, 0x34}, 0x1, 0x0, 0x0, 0x4008011}, 0x4) 4.871849106s ago: executing program 2 (id=5920): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r1, &(0x7f0000514ff4)={0x10, 0x0, 0x25dfdbfc, 0x2ffffffff}, 0xc) socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000940)={0x0, 0xfffffff0, &(0x7f0000000900)={&(0x7f0000000400)=ANY=[@ANYBLOB="54020000170001000000000000000000200100000000000000000000000000010000000000000000ac141400000000000000000000000000fc020000000000000003000000000000e000000200001000000000000000000000000000000000080a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="1242ffff040000000000000000000037660b6aff00000000000000000000000000000000000000000200002000000000", @ANYRES32, @ANYRES32, @ANYBLOB="00000000000000000000000000000000000000000000000000000000000000e0270300000000000000000000000000000000000000000000000000000600000000000000000000000010000000000000000000000000000000000000000000650d000000000000e1000000000000000007000000ff0f0000000000000000000008000b000000000008001600000000000c001500000000005d0000000401050000000000000000000000ffff00000000000000003300000002000000e00000020000000000000000000000000000000000000000000000000000000000000000ff010000000000000000000000000001000000003c0000000a000000fe8000000000000000000000000000aa0000000001000000000000000000000000000000ff010000000000000000000000000001000000002b0000000a000000fe8800000000000000000000000000010000000000000000000000000000000000000000ff020000000000000000000000000001000000003200000002000000fe8000000000000000000000000000000000000004"], 0x254}}, 0x0) ioctl$XFS_IOC_FSBULKSTAT_SINGLE(r0, 0xc0205866, &(0x7f0000000e40)={&(0x7f0000000000)=0x4, 0x4, &(0x7f0000000980)=[{}, {}, {}, {}, {}, {}], 0x0}) 4.661762508s ago: executing program 2 (id=5921): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000b40)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={0x0}, 0x1, 0x0, 0x0, 0x40088c1}, 0x4) sendmsg$IPVS_CMD_NEW_DAEMON(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)={0x20, 0x0, 0x1, 0x201, 0x0, {}, [@IPVS_CMD_ATTR_DAEMON={0xc, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_STATE={0x8}]}]}, 0x20}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001400b595000000000000f2000a"], 0x48}, 0x1, 0x0, 0x0, 0x84}, 0x0) r1 = socket(0x10, 0x3, 0x0) sendmmsg(r1, &(0x7f0000000000), 0x4000000000001f2, 0xfc) ioctl$SIOCSIFHWADDR(r0, 0x8b2b, &(0x7f0000000040)={'wlan1\x00', @broadcast}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000b40)) (async) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={0x0}, 0x1, 0x0, 0x0, 0x40088c1}, 0x4) (async) sendmsg$IPVS_CMD_NEW_DAEMON(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)={0x20, 0x0, 0x1, 0x201, 0x0, {}, [@IPVS_CMD_ATTR_DAEMON={0xc, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_STATE={0x8}]}]}, 0x20}}, 0x0) (async) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001400b595000000000000f2000a"], 0x48}, 0x1, 0x0, 0x0, 0x84}, 0x0) (async) socket(0x10, 0x3, 0x0) (async) sendmmsg(r1, &(0x7f0000000000), 0x4000000000001f2, 0xfc) (async) ioctl$SIOCSIFHWADDR(r0, 0x8b2b, &(0x7f0000000040)={'wlan1\x00', @broadcast}) (async) 4.582884301s ago: executing program 1 (id=5923): unshare(0x6020400) (async, rerun: 64) r0 = gettid() (rerun: 64) syz_open_procfs$namespace(r0, &(0x7f0000000000)='ns/uts\x00') (async) unshare(0x2c060000) (async) r1 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000005c0)=ANY=[@ANYBLOB="b40000001900010000000000000000001d0109004d0011806f9886ff8308eb1d7c03414adb7fa1c790a421ea2a089f6ab00ada4e5605b2e72655b3cc4c48e609000cf5329cb7f1821ec7ecca1db0eb2d7144f29af11fe655838a74d923d12c78e80000004d0010"], 0xb4}, 0x1, 0x0, 0x0, 0x8000}, 0x0) (async) r2 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) (async, rerun: 64) r3 = syz_genetlink_get_family_id$devlink(&(0x7f0000000e00), 0xffffffffffffffff) (async, rerun: 64) r4 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r4, 0x1, 0xf, &(0x7f0000000040)=0x80000004, 0x4) (async, rerun: 64) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x33, &(0x7f0000000140)={0x1, &(0x7f0000000680)=[{0x6, 0x0, 0x10, 0x5}]}, 0x10) (async, rerun: 64) bind$inet6(r4, &(0x7f0000000000)={0xa, 0x4e22, 0x1, @empty, 0xfffffffc}, 0x1c) unshare(0x20000400) (async) r5 = syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/time\x00') bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000480)={@cgroup=r5, 0x11, 0x0, 0x0, 0x0, 0x1000000, 0x0, 0x0, 0x0, 0x0}, 0x40) (async, rerun: 32) listen(r4, 0x40) (rerun: 32) r6 = socket$tipc(0x1e, 0x5, 0x0) sendmsg$tipc(r6, &(0x7f0000000080)={&(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x0, {0x43, 0x101d0, 0x4}}, 0x10, 0x0}, 0x0) (async, rerun: 64) sendmsg$DEVLINK_CMD_SB_PORT_POOL_GET(r2, &(0x7f0000000f40)={0x0, 0x0, &(0x7f0000000f00)={&(0x7f0000000e40)=ANY=[@ANYBLOB="5c5a7ac0", @ANYRES16=r3, @ANYBLOB="01002bbd7000fedbdf25130000000e0001006e657464657673696d0000000f0002006e657464657673696d300000080003000000000008000b00060000000600110009000000"], 0x4c}, 0x1, 0x0, 0x0, 0x20000004}, 0x20000000) (async, rerun: 64) r7 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_FLUSH(r7, 0x0, 0xd4, &(0x7f0000000000)=0x1, 0x4) r8 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x11, 0x10, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000001000000000000000100000018110000", @ANYRES32=r8, @ANYBLOB="00000000ff000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000047090000fcffffffbf91000000000000b70200000100000085000000c6000000b7000000000000009500000000000000"], &(0x7f0000000000)='syzkaller\x00', 0x8, 0x0, 0x0, 0x41100, 0x5, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) close(0x3) 4.496825955s ago: executing program 2 (id=5925): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x19, 0xd, &(0x7f0000000200)=@framed={{0x18, 0x2, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x10000}, [@call={0x85, 0x0, 0x0, 0x36}, @ringbuf_output={{}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x3}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @cgroup_sockopt=0x15, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0}, 0x94) socket$kcm(0x2, 0x3, 0x2) (async) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) (async) close(0x3) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x275a, 0x0) (async) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x4, 0x6}, 0x50) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0xc, 0x4, 0x4, 0x10000, 0x0, r3, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3}, 0x50) r4 = socket$inet6(0xa, 0x3, 0x3) connect$inet6(r4, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2}, 0x1c) (async) write$cgroup_int(r2, &(0x7f0000000200), 0x806000) (async) ioctl$FS_IOC_RESVSP(r2, 0x40305829, &(0x7f0000000380)={0x0, 0x0, 0x4000, 0x9ffffc}) (async) sendfile(r2, r1, 0x0, 0x7d1d7457) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x22052, r1, 0x0) (async) r5 = socket$inet(0xa, 0x801, 0x84) connect$inet(r5, &(0x7f00000004c0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r5, 0x8) r6 = accept4(r5, 0x0, 0x0, 0x0) write(r6, &(0x7f0000000000)="ea", 0x1) (async, rerun: 32) sendmmsg$alg(r6, &(0x7f0000000340)=[{0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000440)="95", 0x1}], 0x1, 0x0, 0x0, 0x400401c}], 0x1, 0x8000) (rerun: 32) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r6, 0x84, 0x22, &(0x7f0000000100)={0x3}, 0x10) (async) sendto$inet6(r6, &(0x7f0000000200)='x', 0x1, 0x0, 0x0, 0x0) (async, rerun: 64) ioctl$sock_SIOCGIFBR(r6, 0x8940, &(0x7f0000000140)=@get={0x1, &(0x7f0000000080)=""/128, 0x4}) (async, rerun: 64) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r6, 0x84, 0x7b, &(0x7f0000000040)={0x0, 0x2}, 0x8) (async) close(r6) (async) ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f0000000000)={0xffffffffffffffff, 0x2, 0x4, 0x7}) ioctl$SIOCSIFHWADDR(r7, 0x8b0b, &(0x7f0000000100)={'veth1_vlan\x00', @random="9fff860a00"}) (async, rerun: 64) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01040000000000000000010000000900010073797a3100000000ac000000030a010300000000580000000100000014000480080002400000000008000140000000050900030073797a30000000000900010073797a310000000008000b4000000003640008800c00014000000000800000000c00014000000000000000010c00014000000000000000050c000140000000000000a0a20c000140000010000000c6930c0002"], 0x92fc}}, 0x20000000) (rerun: 64) 4.119460705s ago: executing program 2 (id=5927): unshare(0x22020400) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) setsockopt$sock_int(r0, 0x1, 0x2a, &(0x7f0000000200)=0x6000, 0x4) bpf$OBJ_PIN_PROG(0x11, 0x0, 0x0) unshare(0x22020400) (async) socket$nl_netfilter(0x10, 0x3, 0xc) (async) setsockopt$sock_int(r0, 0x1, 0x2a, &(0x7f0000000200)=0x6000, 0x4) (async) bpf$OBJ_PIN_PROG(0x11, 0x0, 0x0) (async) 4.041517395s ago: executing program 3 (id=5928): r0 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$nl_route(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000180)=@newlink={0x58, 0x10, 0x300, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @ipip={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_IPTUN_FWMARK={0x8, 0x14, 0x400002}, @IFLA_IPTUN_PROTO={0x5, 0x9, 0x89}]}}}, @IFLA_IFNAME={0x14, 0x3, 'tunl0\x00'}]}, 0x58}}, 0x1020) 4.010739123s ago: executing program 2 (id=5929): socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/cgroup\x00') mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, r0, 0x215eb000) pipe(&(0x7f0000000300)) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f00000002c0), 0x3) setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x2, &(0x7f00000001c0)=@gcm_128={{0x303}, "70810000fd87a892", "8a0e680dbecca37de773d45385cd7778", "df8bb1ea", "3dc2984790c5be2d"}, 0x28) r2 = socket$kcm(0xa, 0x2, 0x0) setsockopt$IP_VS_SO_SET_ADDDEST(0xffffffffffffffff, 0x0, 0x487, &(0x7f0000000000)={{0x84, @rand_addr=0x64010100, 0x4e24, 0x3, 'lc\x00', 0x8, 0x323b, 0x55}, {@remote, 0x4e24, 0x10000, 0x0, 0x12d5c, 0x12d4c}}, 0x44) sendmsg$sock(r2, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e22, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x7}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) 3.68616164s ago: executing program 3 (id=5930): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r1, &(0x7f0000514ff4)={0x10, 0x0, 0x25dfdbfc, 0x2ffffffff}, 0xc) socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000940)={0x0, 0xfffffff0, &(0x7f0000000900)={&(0x7f0000000400)=ANY=[@ANYBLOB="54020000170001000000000000000000200100000000000000000000000000010000000000000000ac141400000000000000000000000000fc020000000000000003000000000000e000000200001000000000000000000000000000000000080a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="1242ffff040000000000000000000037660b6aff00000000000000000000000000000000000000000200002000000000", @ANYRES32, @ANYRES32, @ANYBLOB="00000000000000000000000000000000000000000000000000000000000000e0270300000000000000000000000000000000000000000000000000000700000000000000000000000010000000000000000000000000000000000000000000650d000000000000e1000000000000000007000000ff0f0000000000000000000008000b000000000008001600000000000c001500000000005d0000000401050000000000000000000000ffff00000000000000003300000002000000e00000020000000000000000000000000000000000000000000000000000000000000000ff010000000000000000000000000001000000003c0000000a000000fe8000000000000000000000000000aa0000000001000000000000000000000000000000ff010000000000000000000000000001000000002b0000000a000000fe8800000000000000000000000000010000000000000000000000000000000000000000ff020000000000000000000000000001000000003200000002000000fe8000000000000000000000000000000000000004"], 0x254}}, 0x0) ioctl$XFS_IOC_FSBULKSTAT_SINGLE(r0, 0xc0205866, &(0x7f0000000e40)={&(0x7f0000000000)=0x4, 0x4, &(0x7f0000000980)=[{}, {}, {}, {}, {}, {}], 0x0}) 3.550305519s ago: executing program 1 (id=5931): socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/cgroup\x00') pipe(&(0x7f0000000300)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0x3) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f00000001c0)=@gcm_128={{0x303}, "70810000fd87a892", "8a0e680dbecca37de773d45385cd7778", "df8bb1ea", "3dc2984790c5be2d"}, 0x28) r1 = socket$kcm(0xa, 0x2, 0x0) setsockopt$IP_VS_SO_SET_ADDDEST(0xffffffffffffffff, 0x0, 0x487, &(0x7f0000000000)={{0x84, @rand_addr=0x64010100, 0x4e24, 0x3, 'lc\x00', 0x8, 0x323b, 0x55}, {@remote, 0x4e24, 0x10000, 0x0, 0x12d5c, 0x12d4c}}, 0x44) sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e22, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x7}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) 3.397162045s ago: executing program 3 (id=5932): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r1 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r1, &(0x7f00000005c0), 0x10) recvmmsg(r1, &(0x7f00000099c0)=[{{0x0, 0x0, &(0x7f0000007040)=[{&(0x7f0000006040)=""/4086, 0xff6}], 0x1}, 0x8000}], 0x1, 0x10002, 0x0) sendmsg$can_bcm(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="050000007f0000000000010000000000", @ANYRES64=0x0, @ANYRES64=0x2710], 0x48}}, 0x0) unshare(0x20000400) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) connect$netlink(r2, &(0x7f0000000000)=@unspec, 0xc) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_GET(r5, &(0x7f000000aa40)={0x0, 0x0, &(0x7f000000aa00)={&(0x7f000000a740)={0x18, r6, 0x1, 0x70bd28, 0x25dfdbfb, {}, [@TIPC_NLA_BEARER={0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x4000000}, 0x80) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/cgroup\x00') mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x215eb000) bpf$MAP_CREATE(0x0, 0x0, 0x48) r7 = socket$netlink(0x10, 0x3, 0x12) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000001300)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000180)=@newtfilter={0x44, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, 0xffffffff, {}, {0x1}, {0x2, 0xc}}, [@filter_kind_options=@f_flower={{0xb}, {0x14, 0x2, [@TCA_FLOWER_KEY_ENC_OPTS={0x8, 0x54, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_GENEVE={0x4}]}, @TCA_FLOWER_CLASSID={0x8, 0x1, {0xfff1, 0xb}}]}}]}, 0x44}}, 0x0) sendmsg$nl_generic(r7, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000480)={0x18, 0x31, 0x200, 0x70bd29, 0x25dfdbfe, {0x10}, [@generic="f9ac"]}, 0x18}, 0x1, 0x0, 0x0, 0x4084094}, 0x20000000) mmap(&(0x7f0000002000/0x4000)=nil, 0x4000, 0xedc623580215bdcd, 0x12, r3, 0x0) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) ioctl$NILFS_IOCTL_SET_ALLOC_RANGE(r4, 0x40106e8c, &(0x7f0000000080)=[0x0, 0x3]) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x5, 0x3032, 0xffffffffffffffff, 0x0) select(0x40, &(0x7f0000000280)={0x5, 0x4, 0x845, 0x7, 0x9, 0x7, 0x4, 0x8}, &(0x7f0000001300)={0x2, 0x100000001, 0xd01, 0x2, 0x100000000, 0x3, 0xff, 0x7}, 0x0, &(0x7f0000001380)={0x0, 0x2710}) pwritev(r8, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000140)='\x00\x00\x00\x00\x00\x00', 0x6}], 0x3, 0x803fffc, 0x0) sendmsg$IPSET_CMD_ADD(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000100)={0x14, 0x9, 0x6, 0x201, 0x0, 0x0, {0x2, 0x0, 0x7}}, 0x14}, 0x1, 0x0, 0x0, 0x20040815}, 0x20000010) 3.233693004s ago: executing program 1 (id=5933): syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nfc(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f0000000100)) r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nfc(&(0x7f0000000300), r1) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000d80)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB="010426bd7000f8dbdf250200000008000100", @ANYRES32=r3], 0x1c}}, 0x4008054) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'vcan0\x00'}) connect$can_bcm(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x10) r4 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_int(r4, 0x29, 0x38, &(0x7f00000000c0), &(0x7f0000000140)=0x4) r5 = socket(0x1, 0x1, 0x1) socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000012c0)={0x11, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000ffffffff0000000000008000d71a0000400002009500000000000000"], &(0x7f0000000040)='GPL\x00', 0x7}, 0x94) r7 = syz_genetlink_get_family_id$nbd(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(r6, &(0x7f00000027c0)={0x0, 0x0, &(0x7f0000002780)={&(0x7f0000000500)={0x3c, r7, 0x1, 0x70bd29, 0x25dfdbfb, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x40d5}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r5}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r5}}]}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4000004}, 0x4000) syz_genetlink_get_family_id$netlbl_unlabel(0x0, 0xffffffffffffffff) r8 = socket(0x11, 0x3, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r5, 0x89f3, &(0x7f0000000680)={'syztnl0\x00', &(0x7f0000000600)={'syztnl2\x00', 0x0, 0x29, 0x1, 0x0, 0x4e6a, 0x50, @private0={0xfc, 0x0, '\x00', 0x1}, @loopback, 0x7, 0x7, 0xbd22, 0x5}}) connect$can_bcm(r8, &(0x7f00000006c0)={0x1d, r9}, 0x10) socket$netlink(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x13, &(0x7f0000000040)=ANY=[@ANYBLOB="18020000000000000000000000000000180100002020702500000000002020207baaf8ff00000000bda106000000000047010000f8ffffffb702000008000000b70300000040000085000000050000001801000020696c2500000000002020"], &(0x7f0000000100)='syzkaller\x00', 0xa, 0x0, 0x0, 0x0, 0xc, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r10 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) syz_emit_ethernet(0xd4, &(0x7f0000000340)=ANY=[@ANYBLOB="bbbbbbbbbbbbaaaaaaaaaa008100000086dd64ecaa25009a2900ff010000000000000000000000000001fe880000000000000000000000000101f77f527c45266c967dbf9e6d4334de8d27a4ab6a41a6b7c1f93b382c581e8432255362b3fdca226a31a9d23c070bbc65de68e16486cf29397810ba064a49c2d7093cd9b1fe0dc0899290b13a96f1bdd67de0acbfe98890c16e4a723c4c03f9a84c59d29e981a0a1575f5ddd12e1d6b67e0dc5eb7d3fa2885909cdb77c8e0c08ed4f3c7b9ef10f7ae0869816d7781ef0beaf7"], 0x0) write$rfkill(r10, &(0x7f0000000080)={0x0, 0x0, 0x3, 0x1}, 0x8) r11 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_int(r11, 0x6, 0x19, &(0x7f00000001c0)=0x1, 0x4) 2.861153745s ago: executing program 0 (id=5935): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001100), 0xb4dac462410a8f85, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=@allocspi={0xf8, 0x16, 0x1, 0x0, 0x0, {{{@in, @in6=@private2, 0x4e20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {@in6=@mcast1, 0x0, 0x3c}, @in=@broadcast, {0x5, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, {0x0, 0x4, 0xfffffffffffffff8}, {0x0, 0x3}, 0x0, 0x0, 0xa}, 0x5, 0x5}}, 0xf8}, 0x1, 0x0, 0x0, 0x1}, 0x4000080) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) writev(r0, &(0x7f0000000040)=[{&(0x7f0000000440)="2e9b3d0007e03dd65193dfb6c575963f8864", 0x12}, {&(0x7f0000000300)="1100f8ae", 0x4}, {&(0x7f00000002c0)="00020281", 0x4}], 0x3) r3 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000100)={0xb, 0xa31, 0x5, 0xcd}, 0x10) r4 = openat$cgroup(0xffffffffffffffff, &(0x7f0000000080)='syz1\x00', 0x200002, 0x0) r5 = openat$cgroup(r4, &(0x7f0000000000)='syz1\x00', 0x200002, 0x0) mkdirat$cgroup(r5, &(0x7f0000000040)='syz0\x00', 0x1ff) setsockopt$inet6_group_source_req(r3, 0x29, 0x2e, &(0x7f0000000240)={0x8, {{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @private1}}}, 0x108) 2.453369399s ago: executing program 2 (id=5936): r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000440)={'sit0\x00', &(0x7f0000000400)={'syztnl0\x00', 0x0, 0x0, 0x0, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0xd1, 0x0, 0x0, @loopback, @multicast1}}}}) (async) r2 = socket(0x2, 0x80805, 0x0) getsockopt$MRT(r2, 0x0, 0xce, 0x0, 0x0) (async, rerun: 32) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f5, &(0x7f0000000200)={'syztnl0\x00', &(0x7f0000001580)={'erspan0\x00', r1, 0x40, 0x7807, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x1, 0x0, 0x0, @empty, @multicast2}}}}) (rerun: 32) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) (async) sendmsg$NFT_BATCH(r3, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000740)={{0x14}, [@NFT_MSG_NEWRULE={0x12c, 0x6, 0xa, 0x160b, 0x0, 0x0, {0x2, 0x0, 0x8008}, [@NFTA_RULE_EXPRESSIONS={0x24, 0x4, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, @osf={{0x8}, @void}}, {0x14, 0x1, 0x0, 0x1, @masq={{0x9}, @val={0x4}}}]}, @NFTA_RULE_USERDATA={0xe5, 0x7, 0x1, 0x0, "02df4e71f68cea857d056d1540c889c2609563c29ee4a2b82b625281d051c93a9bc28c382b9e28d59f64ccaefb5859bea55efd211731fe1b526dc8fdeb85b662e10bd93b6f6efb3fc87584318eac60fef88b4e2acbd4a709d3072728ec51096b0bfa5979696057b2d64dbe6e0eb83acd087ac9da4d56dcce35c22fa9d1d9c0b70d29a79b187fccf054f8b4bff2df3653a026410eebc9509a11dfe1187670dc5dfc715f84b6ae2cc77bffeb79868b35e6a13194878c7ac011d486685580596dc8493afa4d8e41c6b0deb6e8add801e4da0836d0bb5d5218eb813a1ceb3914c3bedf"}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x154}, 0x1, 0x0, 0x0, 0x850}, 0x4040080) (async, rerun: 32) socket(0x2b, 0x1, 0x1) (async, rerun: 32) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r5, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r6, 0x5, 0x70bd28, 0x0, {{}, {@val={0x8, 0x3, r7}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) (async) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000080)={'veth1_macvtap\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=@newlink={0x44, 0x10, 0x401, 0x0, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, 0x31943}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macsec={{0xb}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r8}, @IFLA_LINKMODE={0x5, 0x11, 0x1}]}, 0x44}, 0x1, 0x0, 0x0, 0x2004d808}, 0x0) r9 = syz_init_net_socket$x25(0x9, 0x5, 0x0) bind$x25(r9, &(0x7f00000000c0), 0x12) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0xffff}, 0x50) (async) r10 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000100000c02000000000000000000000d0000000000005f"], 0x0, 0x34}, 0x20) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000100)=ANY=[@ANYBLOB="180000000100000000000000801800009500000000000000"], &(0x7f0000000000)='GPL\x00', 0xc, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r10, 0x8, &(0x7f00000000c0)={0x0, 0x1}, 0x1}, 0x94) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r12, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) recvmsg$unix(r11, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0), 0x100}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r14, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) (async) recvmsg$unix(r13, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000700), 0x100}, 0x0) (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r16, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) (async) recvmsg$unix(r15, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000e80), 0x100}, 0x0) 2.048122959s ago: executing program 0 (id=5937): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=@bloom_filter={0x1e, 0x0, 0xca, 0x3, 0x0, 0x1}, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000280)={0x18, 0xf, &(0x7f0000000000)=@ringbuf={{0x18, 0x2, 0x0, 0x0, 0x4000}, {{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0x2}, {}, {0x85, 0x0, 0x0, 0x59}}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}}}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffe}, 0x94) unshare(0x400) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x7a44, 0x1700) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$tun(r2, &(0x7f00000002c0)=ANY=[], 0x33) sendfile(r2, r1, 0x0, 0x10000) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000380)='memory.events\x00', 0x275a, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) pwritev(r4, &(0x7f0000000100)=[{&(0x7f0000000040)="8e", 0x1}], 0x1, 0x4008001, 0x80) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000080)=@newlink={0x3c, 0x10, 0x403, 0x1, 0x0, {0x0, 0x0, 0x4, 0x0, 0x8301, 0x31e1c}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @veth={{0x9}, {0x4, 0x2, 0x0, 0x1, @void}}}, @IFLA_NUM_TX_QUEUES={0x8, 0x1f, 0x1}]}, 0x3c}, 0x1, 0x0, 0x0, 0x14}, 0x8044) close(r4) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, 0x0, 0x40) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r7, &(0x7f0000000000)=[{&(0x7f00000001c0)='\b', 0x1}], 0x1, 0x0) ioctl$PPPIOCGIDLE(r7, 0x8010743f, &(0x7f00000000c0)) syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), r4) sendfile(r4, r3, 0x0, 0xf03a0005) 1.580757135s ago: executing program 3 (id=5938): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c9200, 0x0) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) (async) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=@newsa={0x138, 0x10, 0x1, 0xfffffffe, 0x25dfdbfd, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private1, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x80, 0x3c}, {@in=@dev={0xac, 0x14, 0x14, 0x17}, 0x4d4, 0x6c}, @in=@broadcast, {0x0, 0x192, 0x6, 0xffff, 0x8251a, 0x1, 0xfffffffffffffff8, 0x2}, {0xffffffffffffffff, 0x2a, 0x1f, 0x101}, {0x2, 0xfffffffc, 0xffffffbc}, 0x70bd2a, 0x0, 0x2, 0x5, 0x0, 0x60}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000600)={0x18, 0x26, 0x301, 0x270bd1d, 0x25dfdbfa, {0x1}, [@nested={0x4, 0xae}]}, 0x18}}, 0x0) (async) recvmsg(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000001480)=[{&(0x7f0000000140)=""/106, 0x6a}, {&(0x7f00000000c0)=""/23, 0x16}, {&(0x7f00000014c0)=""/4095, 0xccd}], 0x3}, 0x1) (async) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0xca58c30f81b6079f}) (async) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000780)={'batadv_slave_0\x00', 0x400}) (async) close(0x3) 1.444327703s ago: executing program 3 (id=5939): r0 = bpf$ITER_CREATE(0x21, &(0x7f0000000000), 0x8) (async) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$TIPC_NL_MEDIA_GET(r0, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000001c0)={&(0x7f00000000c0)={0xfc, r1, 0x400, 0x70bd2d, 0x25dfdbff, {}, [@TIPC_NLA_MEDIA={0x38, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x93f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x10}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}]}, @TIPC_NLA_PUBL={0x2c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x6}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0xcbf7}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0xff}, @TIPC_NLA_PUBL_UPPER={0x8}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x77}]}, @TIPC_NLA_MON={0x24, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x7}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x7ff}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x2239}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x7}]}, @TIPC_NLA_NET={0x60, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x5cf}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x506}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x9}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x9}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x23}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x1}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x5e64}]}]}, 0xfc}, 0x1, 0x0, 0x0, 0x20000040}, 0x4085) r2 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCSIFVLAN_GET_VLAN_EGRESS_PRIORITY_CMD(r0, 0x8983, &(0x7f0000000240)) (async) sendmsg$NL80211_CMD_SET_BEACON(r0, &(0x7f0000000ec0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000e80)={&(0x7f00000002c0)={0xb7c, 0x0, 0x8, 0x70bd2b, 0x25dfdbfc, {{}, {@val={0x8}, @val={0xc, 0x99, {0x9f, 0x7a}}}}, [@NL80211_ATTR_BEACON_TAIL={0x4d, 0xf, [@mesh_id={0x72, 0x6}, @preq={0x82, 0x3b, {{0x1, 0x1, 0x1}, 0x99, 0xa7, 0x6, @broadcast, 0x3, @void, 0x3899aa78, 0x7fffffff, 0x3, [{{0x0, 0x0, 0x1}, @broadcast, 0x6}, {{0x0, 0x0, 0x1}, @broadcast, 0x6}, {{0x0, 0x0, 0x1}, @device_b, 0x7}]}}, @ibss={0x6, 0x2, 0xc}]}, @NL80211_ATTR_IE={0x16f, 0x2a, [@ext_channel_switch={0x3c, 0x4, {0x0, 0x2, 0x99, 0xff}}, @random={0x5, 0xda, "925d1e0c0b9b5e05fed672aba75ff42e3011aeaebbc98451f52821674d741bb85de9a2357bb915cff9c55490e8f68b4b601810fde15da175a71b547b6981d26309b82e44b131caa0610957bf2809a2d81b95fabf35be31542f2870b84ea2a5a40c9ab0a7259fc57d2735608ae1c31711983986a8142fa119a2b4a74881cb21ecc3212a758f123ccfe1ea99d22aaf2eec709279c27f70d7a6c75fc03da62ebdea98d7ea7d7f7da9b310a4b12f0512a7e464da90d55db2fa98b388d6a420a8c70a77086aa8a00f173c8f8b0ea61612514a44c0c0b0228cffcbb28b"}, @ht={0x2d, 0x1a, {0x40, 0x3, 0x0, 0x0, {0x6, 0x2, 0x0, 0x6, 0x0, 0x0, 0x1, 0x2, 0x1}, 0x306, 0x83, 0x6}}, @preq={0x82, 0x62, {{0x1, 0x1, 0x1, 0x0, 0x1}, 0x4, 0x8, 0x9, @broadcast, 0x0, @value=@broadcast, 0x6, 0x7, 0x6, [{{0x0, 0x0, 0x1}, @device_a, 0x9}, {{0x1, 0x0, 0x1}, @device_b, 0xc34}, {{0x1, 0x0, 0x1}, @device_b, 0x400}, {{}, @broadcast, 0x3}, {{}, @device_b, 0x2}, {{0x0, 0x0, 0x1}, @broadcast, 0xa7}]}}, @erp={0x2a, 0x1, {0x0, 0x1, 0x1}}, @supported_rates={0x1, 0x4, [{0x5}, {0x2}, {0x5}, {0x3, 0x1}]}]}, @NL80211_ATTR_BEACON_HEAD={0x37d, 0xe, {{{0x0, 0x0, 0x8, 0x0, 0x0, 0x1, 0x1}, {0x2}, @device_b, @broadcast, @initial, {0x0, 0xffe}}, 0x1, @random=0xffff, 0x1, @void, @val={0x1, 0x2, [{0x48, 0x1}, {0x48}]}, @val={0x3, 0x1, 0xaf}, @void, @val={0x6, 0x2, 0x10}, @void, @void, @val={0x2a, 0x1, {0x1}}, @void, @void, @val={0x72, 0x6}, @val={0x71, 0x7, {0x1, 0x0, 0x1, 0xffffffffffffffff, 0x2, 0x3, 0x49}}, @val={0x76, 0x6, {0xa, 0x7, 0x16, 0x1}}, [{0xdd, 0xb3, "93abe823eb8311f5b322cea2fe8086e0d283b5d0f13eef1860add9abfa9d3a663425c2f069875df8861a0b6f84440040b3434048cb0bc23dae719652f4e033cd305ed3a8d3d5f761cb28ef38b594fe6f91a926e4dc9ffa2301023622cb7ee1bc5919e5a15c0e2bb244d9d271aa5b6ef49d38d98d9eeabf976a3b6b9fbb6bd2a32692d18d8f2b6f0ea03afe269585c53d10e51da750c233bf658f07ffe069246e9a6c68c7e738b6e0dac28efef9d67e5764ea9e"}, {0xdd, 0x4d, "b5f25bac92d9bb3ae268b64a59a91704e7ffd4b00314f2a4f39f10a7980a42b24e405e67ee9be4e77b76aaf3e79ecfce16711c02414d14168ab00a4ae78e152b3108b6b3a89419529bb3e1a1aa"}, {0xdd, 0x86, "af82a490cd527efd6d70d6aa694a4199fb325048df769b98813d9206e97eb6e7061cdd76e88fde914277a47db5e34aa0f98505bedd6c2496ec85455424a9909e95d5cf7bac4e0da55faf143aa8a21280064e0f80634e9420d76fe792b97b3a22d5f8cfc08c41e26f3495a7a2bc0e3e17ef1800c9c43f866d8f348b32f3409eac921e86d7cb70"}, {0xdd, 0xcc, "7f7c36b21ead4cd5ef37ce788bb95b765f4cb8323293cdad22a43d16c51feb9fb1547016eb7d9db6e96b483c6ad24be680c8b1e8eacdf6370af30378d81b8beedb833096d85bf0db2d6697fd91ddbc8f71e62ed0109498d26ba05d74ce66ee15a25fd33ae3973c80010377437c45e88485fd430bc8d5aeff67ba9a5ee25ff90bb7ba1e442949f624a853770024142e24cbfdf337cfc9b3c2dcd37e41a6d6c37833270edcb051f59df55344653dda0be71d73141a742c158eb94fb89aab688a50bba910712c4838fc01ad7959"}, {0xdd, 0xd2, "fef35afc5e93252476b971de2261cf1a01a9f29d63abb9293b36a6a86c87df1dd568bb699326969c1075330c39488386ad4378cb7bbe4b60e941901c2abf5075806edd4fde85f4a4aea01827072e20b8ca0809739c0fd28df1ae24db5fe24401a8f8cb3a1272f9a950fbc23db9e7c5403f83b8a23e86d48d8da1455ea23344ee2f146d55bd2504cbff7b6864be9217a3f9a05603d520d2c85837faa85d54378a5db00ec89b211c4d1d5bc392763c52c440e96f9bd4f8238ba05b144d731a1c4262c10214c75c2d31f5f958568cf3c907cd35"}]}}, @NL80211_ATTR_BEACON_TAIL={0x36, 0xf, [@mesh_config={0x71, 0x7, {0x1, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x2, 0x48}}, @ibss={0x6, 0x2, 0x8d17}, @rann={0x7e, 0x15, {{0x1, 0x1}, 0x6, 0x7, @device_b, 0x6, 0xfd36, 0x2}}, @mesh_chsw={0x76, 0x6, {0x6, 0x6, 0x18, 0x40}}, @ext_channel_switch={0x3c, 0x4, {0x1, 0xf7, 0xb1}}]}, @NL80211_ATTR_IE_ASSOC_RESP={0x4c, 0x80, [@ext_channel_switch={0x3c, 0x4, {0x1, 0x3, 0xd, 0xe}}, @ssid={0x0, 0x6, @default_ap_ssid}, @chsw_timing={0x68, 0x4, {0x6, 0x80}}, @link_id={0x65, 0x12, {@random="20746b72d9bb", @device_a, @device_b}}, @peer_mgmt={0x75, 0x18, {0x0, 0x6, @val=0xf5f, @val=0x3e, @val="88a300fc48873844089a5885a2ef5a95"}}, @chsw_timing={0x68, 0x4, {0x0, 0x2}}]}, @NL80211_ATTR_PROBE_RESP={0x58d, 0x91, "69af5878b46342a693125482947eb9907f14a4f499f562f144e8ff696a323b11d762d8ebba35722277de9fc5d8dfcbdaabae09bbf94fa27e81489f9f0d19919fe006a179bcc8d5931052effd294443f72b8172847fa38d8d6d0f30b59a5d13cc1356013f088e00e579f2544971cdcebbe1e92f2bb50409cabd435ae2e33215bdab8663a47f91071916157db4649c44de45b650a11a4ffe6ea8006cde2c68db39fc5f28e052b92eaedfed9a5ef55dfecf00c60298ed97316a2d3c1ca83b30a3d0205a66f14bfa29a66810207ad35e510e0f30b7960cbaf49708f6df2e0fd7d4f4b27ee8d007ed3397adc20fcdf9c65de7c289c7bcfdaad8de5a2f7cfbdbf201c06a7ed61f8b3cb0bff1ed4c84c7c14fe8000da8f9ceb83863795b6a8c7d3cdb0dc7097154026190830d92065a2dfca878649ba2c15b560a6b45027ffada2553e6f7ee10cbbd0d17feacb33d98f864a58569e7d4d7eb52c64f1528461042ec5e68867dbb95ab8e50390cd575eaae2fee8d1f7813f3a762313086d7109ab5691a82bae52760880a3c5b45b4fefb745efeed3a5a45384243d9a746366b43b7b6f102d8960fe552f66c18016846858bbba125521ef3a2c6c2060c746f0eaf9205d65cae70d2f5308a0c3dc80f72d565789bdb35d07ffb9bd1eb1aad6304de9c4fd4ed5e07576a31cfa8cbc9b07c9f9ec1f516462b15386c8f3684219684609280439e3b18fe9372a98cb510c1db9074ecc1e6a6edeb816aabb01b31cba883cfa8b0c7d58e10ee5257eea152f94667018fab584e9f4524752715a943e0c98efe2df9f1009cdfab5bb3dcac5a9f971259674be38d020bf7bd56fa3a4bb51299294e4d0f34c25f883b2ef95a6269abda8ffb7cdd7d2a71558a0d7f95220c3fe01de941c6eff863cd291985a80f259de87a8144c531c3a021b02a88bea3e4540b1406fedef4dcd3020018d7eafa36349588faad1d844b1a8f88df84da27321ee1e29e87b47c545dfc31c7a87ffec9b8807d61c1b845dd9c88f93954c98022f155077b3547619875ff8ca3eb022f2a17697be02e1aa3aea971b9303e51cb368ea90879fbf1766e0c67f19a3e1571bcf579be904f43653db0eb2aa414baf22d6a17c018bce1410ddf377c9452192b52457ce121b7c0f78d241ca846eff6973128563fd5835ed6366f4d11a8bfc26c53adc2555c14bc7ac859dd55349136dcd79b72055b27b661632297336d15eb28973ad95b78364d1cddbb2e40739272b5ccf629176a0944e7ee7f74b61b918d2728666cddc662a56192babf233385caab8e20780ecd673bb3428e5d2ec7293471e07d4c6fba8b67c6c8b3bf54c767ec1240477681e663349b40e0c51dd91890af9d1dcc11d12ba72c8f47055e62f82e570f646ee997e47b9d6d3d249236959a7e7e1e66b3066870a1a6d0b842664b32389b6dce1f6de307b0b394fb68264840ba12bc1a65a99f4e0f6a10d32af7a7b385806b887f95ecfeb43733e17636e1dcc96502cf905cf3f1b2c1087a0968aeff7c3031e2ccb60e15c84ff756ec5112b9a614d1c61834ecca89ec6edbdd472ce159f0b43f4398fa50d4795bcc86e2eaa2f8b8670f5fc641cea34de58d42e48947b6d11b09810c3f0cdb2ccb0d852f15e46cfc34f7b8c2c357e32d13f49ccbc5d46ef0b7659ad7b76242413d1672ffe0e06a43a17adf59b1f43ebf394bb4280275e9837aa69abdc9bf292651eeee4e21ca56bd1bd671fec4e05e0d956bd39d6e3a9cee7e3ab652971b9f905c701ee30b0754f5f7deef2e5d153e3d8eee4f1af4387fd28a336cb1e45c4c75a9d1d1195045686d31f6c9cc8b6852cb421cdaec007073d8f39eb9ec5e1ba26d66429ad277a67c3d00e9e9404d32db50bf2d1bcb0062febbbb0a4ac5a4558a27c0951ef46ade299499adc3fad0b2c471c1b1872ba3ddef35beda4013266338965360761b5d9d9d4e6a72d093db5f8e856485709a9cdcd062cf28271ba782dc8284612194fdb499"}]}, 0xb7c}, 0x1, 0x0, 0x0, 0x4810}, 0x880) (async) r3 = socket$inet6(0xa, 0x6, 0x210c) (async) recvmmsg(r2, &(0x7f0000001000)=[{{&(0x7f0000000f00)=@nl=@proc, 0x80, &(0x7f0000000f80), 0x0, &(0x7f0000000fc0)=""/31, 0x1f}, 0xc}], 0x1, 0x0, &(0x7f0000001040)={0x77359400}) bpf$PROG_LOAD(0x5, &(0x7f0000001240)={0x3, 0xe, &(0x7f0000001080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x8}, [@kfunc={0x85, 0x0, 0x2, 0x0, 0x1}, @func, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x7}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}}]}, &(0x7f0000001100)='GPL\x00', 0x1, 0xb0, &(0x7f0000001140)=""/176, 0x40f00, 0x2, '\x00', 0x0, @fallback=0x7, r0, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, r0, 0x0, &(0x7f0000001200)=[r0, r0, r0, r0, r0, r0, r0], 0x0, 0x10, 0x7fff}, 0x94) (async) pselect6(0x40, &(0x7f0000001300)={0x7, 0x8000, 0xf4, 0x6, 0x3, 0x0, 0x2, 0xc}, &(0x7f0000001340)={0xc8, 0x8, 0x1, 0x1, 0x4d7, 0x6, 0x9, 0xd61}, &(0x7f0000001380)={0x2, 0x1ff, 0x4, 0x6, 0x6, 0x1, 0x2, 0x2aa}, &(0x7f00000013c0)={0x77359400}, &(0x7f0000001440)={&(0x7f0000001400)={[0x7]}, 0x8}) (async) ioctl$sock_inet_SIOCGIFADDR(r3, 0x8915, &(0x7f0000001480)={'syzkaller1\x00', {0x2, 0x0, @loopback}}) (async) sendmsg$unix(r0, &(0x7f00000016c0)={&(0x7f00000014c0)=@abs={0x0, 0x0, 0x4e24}, 0x6e, &(0x7f0000001640)=[{&(0x7f0000001540)="8755b1a20d60333e9f64fd642e199e8ccb5b570800341b075a91a8b09b55c4acbf9c18dde4fa282e07c56c57e9e4516b4f8d20f51082baa52bb11c4bae8f10ab8d2c85a50e544ca8744816d740de36e34a090fe2fc04a4338c0450cfc44b211ef2c02a55ef6ce057ef82a6bcb47521fcdd7d252870978204791b8133aebc0d7e78a21483eb11074742de6069441e0280c29c7dce1c3f40da5da674ca66db368d4e2c", 0xa2}, {&(0x7f0000001600)="8dee100ad93f1211769144473d31149ab235e39e0f2e4ff7abc74a24", 0x1c}], 0x2, &(0x7f0000001680)=[@rights={{0x14, 0x1, 0x1, [r0]}}], 0x18, 0x40}, 0x404c840) (async) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r0, 0x84, 0xa, &(0x7f0000001700)={0x5, 0x5, 0x0, 0x9, 0x1, 0xffffffff, 0x344, 0x8, 0x0}, &(0x7f0000001740)=0x20) setsockopt$inet_sctp_SCTP_SET_PEER_PRIMARY_ADDR(r0, 0x84, 0x5, &(0x7f0000001780)={r4, @in={{0x2, 0x4e22, @empty}}}, 0x84) r5 = socket$inet6_mptcp(0xa, 0x1, 0x106) getsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000001840), 0x10) ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x89e2, &(0x7f0000001880)={r2}) sendmsg$NL80211_CMD_GET_WOWLAN(r6, &(0x7f0000001980)={&(0x7f00000018c0)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000001940)={&(0x7f0000001900)={0x14, 0x0, 0x300, 0x70bd25, 0x25dfdbfe, {{}, {@void, @void, @void}}, ["", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x4000810}, 0x10) (async) syz_genetlink_get_family_id$team(&(0x7f00000019c0), r0) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001a00)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r7, &(0x7f0000001bc0)={&(0x7f0000001a40)=@in6={0xa, 0x0, 0x0, @dev}, 0x80, &(0x7f0000001b40)=[{&(0x7f0000001ac0)=""/92, 0x5c}], 0x1, &(0x7f0000001b80)=""/54, 0x36}, 0x140) setsockopt$inet6_tcp_TCP_CONGESTION(r6, 0x6, 0xd, &(0x7f0000001c00)='dctcp', 0x5) (async) listen(r3, 0x3) (async) clock_gettime(0x2, &(0x7f0000001c40)) (async) recvfrom$unix(r8, &(0x7f0000001c80)=""/212, 0xd4, 0x20, 0x0, 0x0) r9 = socket$unix(0x1, 0xa, 0x0) bind$unix(r9, &(0x7f0000001d80)=@abs={0x1, 0x0, 0x4e23}, 0x6e) (async) getsockopt$inet_sctp_SCTP_STATUS(r6, 0x84, 0xe, &(0x7f0000001e00)={r4, 0x1cb, 0x9, 0x9, 0x2cd4, 0x0, 0x3, 0x7, {r4, @in6={{0xa, 0x4, 0x5, @private1, 0x3}}, 0x7d0cc9fa, 0x10, 0x0, 0x3, 0x9}}, &(0x7f0000001ec0)=0xb0) (async) r10 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000001f40)=@o_path={&(0x7f0000001f00)='./file0\x00', 0x0, 0x10, r7}, 0x18) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000002000)={r10, 0x58, &(0x7f0000001f80)}, 0x10) 1.057162315s ago: executing program 0 (id=5940): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x5005}) r2 = socket$inet(0x2, 0x2, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@newqdisc={0x30, 0x24, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {0x0, 0xffff}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000300)=@newtfilter={0x38, 0x2c, 0x100, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {0x13}, {0x0, 0xffff}, {0x300, 0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0xfffffffffffffde6, 0x2, [@TCA_BASIC_ACT={0xfffffffffffffe8c}]}}]}, 0x38}}, 0x8010) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', 0x1}) write$tun(r1, &(0x7f00000003c0)=ANY=[@ANYBLOB="46030800030016000c0045"], 0x66) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000400)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a3c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc14000000110001"], 0x64}, 0x1, 0x0, 0x0, 0x94}, 0x24000000) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000100000a3c000000090a010100000000000000000a000008090002007d797a310000000008000a40fffffffc0900010073797a3100000000080005400000003c140000001100010000000000000000000a00000a"], 0x64}, 0x1, 0x0, 0x0, 0x4044050}, 0x48090) 681.233609ms ago: executing program 0 (id=5941): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="48000000100001060100000000000000000000000000000000000000000000001000030073797a6b616c6c65723000001800128008000100767266000c00028008000100e8"], 0x48}}, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000200)={'syzkaller0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'veth0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000500)=ANY=[@ANYBLOB="28000000130001000200"/20, @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r2], 0x28}}, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000700)=ANY=[@ANYBLOB="20000000130001000300"/20, @ANYBLOB="010000"], 0x20}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000120)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000007c0)=ANY=[@ANYBLOB="340000001400010604000000000000000a402000", @ANYRES32=r3, @ANYBLOB="14000200200100"/18], 0x34}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000160)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000800)=ANY=[@ANYBLOB="340000001400010605000000000000000a402000", @ANYRES32=r2, @ANYBLOB="1400020020010000000000000000000000000002"], 0x34}}, 0x0) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000880)='veth0\x00', 0x6) ioctl$sock_SIOCGIFBR(r0, 0x8940, &(0x7f00000001c0)=@add_del={0x2, &(0x7f0000000000)='veth1\x00'}) sendto$inet6(r1, 0x0, 0x0, 0x0, &(0x7f0000000a00)={0xa, 0x5000, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, 0x1c) 384.854319ms ago: executing program 0 (id=5942): socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/cgroup\x00') pipe(&(0x7f0000000300)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0x3) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f00000001c0)=@gcm_128={{0x303}, "70810000fd87a892", "8a0e680dbecca37de773d45385cd7778", "df8bb1ea", "3dc2984790c5be2d"}, 0x28) r1 = socket$kcm(0xa, 0x2, 0x0) setsockopt$IP_VS_SO_SET_ADDDEST(0xffffffffffffffff, 0x0, 0x487, &(0x7f0000000000)={{0x84, @rand_addr=0x64010100, 0x4e24, 0x3, 'lc\x00', 0x8, 0x323b, 0x55}, {@remote, 0x4e24, 0x10000, 0x0, 0x12d5c, 0x12d4c}}, 0x44) sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e22, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x7}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) 145.389928ms ago: executing program 0 (id=5943): bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="0bc0bc00"/20, @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$PROG_BIND_MAP(0xa, 0x0, 0x0) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r0, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r1 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPCONNADD(r1, 0x400442c8, &(0x7f00000001c0)=ANY=[@ANYRESOCT=r1, @ANYBLOB="fd"]) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="4800000041000501010000000000000001010000000000001c0001000600060008000000100007007f0000017f0000019100400014000200100003000400"], 0x48}, 0x1, 0x0, 0x0, 0x2c048040}, 0xe800) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xc1842, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1000}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r4) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) socket$nl_generic(0x10, 0x3, 0x10) syz_emit_ethernet(0x56, &(0x7f0000003200)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, @link_local, @val={@val={0x88a8, 0x0, 0x0, 0x1}, {0x8100, 0x0, 0x0, 0x3}}, {@ipv6={0x86dd, @udp={0x5, 0x6, "efdf22", 0x18, 0x11, 0x1, @private2={0xfc, 0x2, '\x00', 0x1}, @local, {[@srh={0x2f, 0x0, 0x4, 0x0, 0x11, 0x8, 0x6}], {0x4e20, 0x4e20, 0x10, 0x0, @gue={{0x2, 0x1, 0x3, 0x9}}}}}}}}, 0x0) r5 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_DELAYED_SACK(r5, 0x84, 0x10, &(0x7f00000000c0)=@assoc_value={0x0, 0x600000}, &(0x7f0000000140)=0x8) write$cgroup_devices(r3, &(0x7f0000000840)=ANY=[@ANYBLOB="1e0308004d6b71ef288563"], 0xffdd) 0s ago: executing program 3 (id=5944): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x13, 0x10, &(0x7f0000000080)=ANY=[@ANYBLOB="18080000d0ff0000000000000000000018d0ff00", @ANYRES32, @ANYBLOB="00000000000000006608fdff0000000018000000000000000000000000000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000700b50a000000000000850000000600000095"], &(0x7f0000000000)='GPL\x00', 0xf, 0x0, 0x0, 0x0, 0x8}, 0x94) kernel console output (not intermixed with test programs): free_cma:0kB [ 894.052887][T27902] lowmem_reserve[]: 0 0 0 0 0 [ 894.052992][T27902] Node 1 Normal free:3949324kB boost:0kB min:55760kB low:69700kB high:83640kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:216kB unevictable:0kB writepending:4kB zspages:0kB present:4194300kB managed:4111104kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 894.053160][T27902] lowmem_reserve[]: 0 0 0 0 0 [ 894.053266][T27902] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 894.053647][T27902] Node 0 DMA32: 221*4kB (UME) 600*8kB (UME) 510*16kB (UME) 239*32kB (UME) 215*64kB (UME) 81*128kB (UME) 23*256kB (UME) 10*512kB (M) 7*1024kB (UME) 10*2048kB (UME) 186*4096kB (UM) = 846132kB [ 894.054130][T27902] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 894.063436][T27902] Node 1 Normal: 1*4kB (M) 3*8kB (UM) 7*16kB (UM) 4*32kB (UM) 10*64kB (UM) 3*128kB (UM) 4*256kB (UM) 3*512kB (UM) 3*1024kB (UM) 3*2048kB (U) 961*4096kB (M) = 3949324kB [ 894.063920][T27902] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 894.063973][T27902] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 894.064024][T27902] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 894.064070][T27902] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 894.064114][T27902] 44678 total pagecache pages [ 894.064143][T27902] 0 pages in swap cache [ 894.064164][T27902] Free swap = 124996kB [ 894.064181][T27902] Total swap = 124996kB [ 894.064203][T27902] 2097051 pages RAM [ 894.064232][T27902] 0 pages HighMem/MovableOnly [ 894.064254][T27902] 428780 pages reserved [ 894.064285][T27902] 0 pages cma reserved [ 894.198539][T27903] x_tables: duplicate underflow at hook 1 [ 895.307593][T27911] netlink: 44 bytes leftover after parsing attributes in process `syz.3.5385'. [ 895.379009][T27913] netlink: 'syz.3.5385': attribute type 1 has an invalid length. [ 895.892927][T27913] 8021q: adding VLAN 0 to HW filter on device bond4 [ 896.037530][T27915] bond4: (slave geneve3): making interface the new active one [ 896.049620][T27915] bond4: (slave geneve3): Enslaving as an active interface with an up link [ 896.700305][ T38] net_ratelimit: 25 callbacks suppressed [ 896.700330][ T38] bond1: (slave dummy0): failed to get link speed/duplex [ 896.809958][ T8532] bond1: (slave dummy0): failed to get link speed/duplex [ 896.861540][T27956] FAULT_INJECTION: forcing a failure. [ 896.861540][T27956] name failslab, interval 1, probability 0, space 0, times 0 [ 896.861605][T27956] CPU: 0 UID: 0 PID: 27956 Comm: syz.3.5395 Not tainted syzkaller #0 PREEMPT(full) [ 896.861635][T27956] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 896.861650][T27956] Call Trace: [ 896.861660][T27956] [ 896.861670][T27956] dump_stack_lvl+0xe8/0x150 [ 896.861710][T27956] should_fail_ex+0x410/0x560 [ 896.861743][T27956] should_failslab+0xa8/0x100 [ 896.861775][T27956] __kvmalloc_node_noprof+0x176/0x820 [ 896.861810][T27956] ? __kvmalloc_node_noprof+0x345/0x820 [ 896.861835][T27956] ? sort_subprogs_topo+0xf5/0xf20 [ 896.861861][T27956] ? sort_subprogs_topo+0xf5/0xf20 [ 896.861900][T27956] sort_subprogs_topo+0xf5/0xf20 [ 896.861928][T27956] ? bpf_prune_dead_branches+0xa3b/0xab0 [ 896.861979][T27956] bpf_check+0x25a5/0x2e10 [ 896.862017][T27956] ? ktime_get_with_offset+0x93/0x2d0 [ 896.862047][T27956] ? __pfx_bpf_check+0x10/0x10 [ 896.862083][T27956] ? bpf_obj_name_cpy+0x194/0x1e0 [ 896.862121][T27956] bpf_prog_load+0x14d6/0x1c20 [ 896.862162][T27956] ? __pfx_bpf_prog_load+0x10/0x10 [ 896.862218][T27956] __sys_bpf+0xd0d/0xd90 [ 896.862254][T27956] ? __pfx___sys_bpf+0x10/0x10 [ 896.862293][T27956] ? __fget_files+0x2a/0x420 [ 896.862345][T27956] ? ksys_write+0x242/0x270 [ 896.862384][T27956] ? __pfx_ksys_write+0x10/0x10 [ 896.862425][T27956] __x64_sys_bpf+0xba/0xd0 [ 896.862460][T27956] do_syscall_64+0x166/0x520 [ 896.862486][T27956] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 896.862511][T27956] ? clear_bhb_loop+0x70/0xc0 [ 896.862540][T27956] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 896.862564][T27956] RIP: 0033:0x7fe76c79e159 [ 896.862587][T27956] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 896.862607][T27956] RSP: 002b:00007fe76d660028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 896.862634][T27956] RAX: ffffffffffffffda RBX: 00007fe76ca25fa0 RCX: 00007fe76c79e159 [ 896.862652][T27956] RDX: 0000000000000094 RSI: 0000200000000100 RDI: 0000000000000005 [ 896.862668][T27956] RBP: 00007fe76d660090 R08: 0000000000000000 R09: 0000000000000000 [ 896.862683][T27956] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 896.862698][T27956] R13: 00007fe76ca26038 R14: 00007fe76ca25fa0 R15: 00007ffcdaf7a868 [ 896.862735][T27956] [ 896.973700][T21417] bond1: (slave dummy0): failed to get link speed/duplex [ 897.088988][T21909] bond1: (slave dummy0): failed to get link speed/duplex [ 897.191659][T21417] bond1: (slave dummy0): failed to get link speed/duplex [ 897.255935][T27963] FAULT_INJECTION: forcing a failure. [ 897.255935][T27963] name failslab, interval 1, probability 0, space 0, times 0 [ 897.255973][T27963] CPU: 1 UID: 0 PID: 27963 Comm: syz.1.5396 Not tainted syzkaller #0 PREEMPT(full) [ 897.256000][T27963] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 897.256015][T27963] Call Trace: [ 897.256025][T27963] [ 897.256036][T27963] dump_stack_lvl+0xe8/0x150 [ 897.256075][T27963] should_fail_ex+0x410/0x560 [ 897.256108][T27963] should_failslab+0xa8/0x100 [ 897.256139][T27963] __kmalloc_node_noprof+0x100/0x720 [ 897.256161][T27963] ? __get_vm_area_node+0x200/0x2f0 [ 897.256193][T27963] ? __get_vm_area_node+0x283/0x2f0 [ 897.256223][T27963] ? __vmalloc_node_range_noprof+0x5b4/0x1540 [ 897.256257][T27963] ? __vmalloc_node_range_noprof+0x5b4/0x1540 [ 897.256300][T27963] __vmalloc_node_range_noprof+0x5b4/0x1540 [ 897.256367][T27963] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 897.256412][T27963] ? __kasan_kmalloc+0x93/0xb0 [ 897.256441][T27963] ? __kmalloc_cache_noprof+0x321/0x600 [ 897.256465][T27963] ? __kmalloc_cache_noprof+0x14d/0x600 [ 897.256487][T27963] ? bpf_diag_init+0x87/0x140 [ 897.256515][T27963] ? bpf_diag_init+0x87/0x140 [ 897.256545][T27963] ? bpf_check+0x10ee/0x2e10 [ 897.256569][T27963] __vmalloc_noprof+0xd2/0x120 [ 897.256603][T27963] ? bpf_check+0x10ee/0x2e10 [ 897.256632][T27963] bpf_check+0x10ee/0x2e10 [ 897.256670][T27963] ? ktime_get_with_offset+0x93/0x2d0 [ 897.256698][T27963] ? __pfx_bpf_check+0x10/0x10 [ 897.256727][T27963] ? bpf_obj_name_cpy+0x194/0x1e0 [ 897.256764][T27963] bpf_prog_load+0x14d6/0x1c20 [ 897.256804][T27963] ? __pfx_bpf_prog_load+0x10/0x10 [ 897.256861][T27963] __sys_bpf+0xd0d/0xd90 [ 897.256898][T27963] ? __pfx___sys_bpf+0x10/0x10 [ 897.256937][T27963] ? __fget_files+0x2a/0x420 [ 897.256991][T27963] ? ksys_write+0x242/0x270 [ 897.257030][T27963] ? __pfx_ksys_write+0x10/0x10 [ 897.257071][T27963] __x64_sys_bpf+0xba/0xd0 [ 897.257101][T27963] do_syscall_64+0x166/0x520 [ 897.257127][T27963] ? trace_irq_disable+0x3b/0x140 [ 897.257150][T27963] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 897.257175][T27963] ? clear_bhb_loop+0x70/0xc0 [ 897.257203][T27963] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 897.257227][T27963] RIP: 0033:0x7fe700d9e159 [ 897.257250][T27963] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 897.257271][T27963] RSP: 002b:00007fe701bf0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 897.257297][T27963] RAX: ffffffffffffffda RBX: 00007fe701025fa0 RCX: 00007fe700d9e159 [ 897.257315][T27963] RDX: 0000000000000094 RSI: 0000200000000240 RDI: 0000000000000005 [ 897.257330][T27963] RBP: 00007fe701bf0090 R08: 0000000000000000 R09: 0000000000000000 [ 897.257347][T27963] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 897.257361][T27963] R13: 00007fe701026038 R14: 00007fe701025fa0 R15: 00007ffdcd2d4438 [ 897.257408][T27963] [ 897.392546][ T8528] bond1: (slave dummy0): failed to get link speed/duplex [ 897.512613][T21908] bond1: (slave dummy0): failed to get link speed/duplex [ 897.628376][ T38] bond1: (slave dummy0): failed to get link speed/duplex [ 897.691404][T27970] netlink: 844 bytes leftover after parsing attributes in process `syz.4.5400'. [ 897.691438][T27970] netlink: 844 bytes leftover after parsing attributes in process `syz.4.5400'. [ 897.740244][ T8532] bond1: (slave dummy0): failed to get link speed/duplex [ 897.853780][T21909] bond1: (slave dummy0): failed to get link speed/duplex [ 898.336757][T27989] netlink: 'syz.3.5403': attribute type 1 has an invalid length. [ 898.344649][T27986] netlink: 844 bytes leftover after parsing attributes in process `syz.2.5402'. [ 898.344737][T27986] netlink: 844 bytes leftover after parsing attributes in process `syz.2.5402'. [ 899.433822][T28006] bridge0: port 3(veth0_virt_wifi) entered blocking state [ 899.435227][T28006] bridge0: port 3(veth0_virt_wifi) entered disabled state [ 899.435427][T28006] veth0_virt_wifi: entered allmulticast mode [ 899.465722][T28006] veth0_virt_wifi: entered promiscuous mode [ 899.466312][T28006] bridge0: port 3(veth0_virt_wifi) entered blocking state [ 899.466449][T28006] bridge0: port 3(veth0_virt_wifi) entered forwarding state [ 899.775405][T28014] FAULT_INJECTION: forcing a failure. [ 899.775405][T28014] name failslab, interval 1, probability 0, space 0, times 0 [ 899.775446][T28014] CPU: 1 UID: 0 PID: 28014 Comm: syz.0.5410 Not tainted syzkaller #0 PREEMPT(full) [ 899.775472][T28014] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 899.775486][T28014] Call Trace: [ 899.775496][T28014] [ 899.775507][T28014] dump_stack_lvl+0xe8/0x150 [ 899.775548][T28014] should_fail_ex+0x410/0x560 [ 899.775580][T28014] should_failslab+0xa8/0x100 [ 899.775613][T28014] __kmalloc_node_noprof+0x100/0x720 [ 899.775635][T28014] ? __get_vm_area_node+0x200/0x2f0 [ 899.775668][T28014] ? __get_vm_area_node+0x283/0x2f0 [ 899.775699][T28014] ? __vmalloc_node_range_noprof+0x5b4/0x1540 [ 899.775732][T28014] ? __vmalloc_node_range_noprof+0x5b4/0x1540 [ 899.775776][T28014] __vmalloc_node_range_noprof+0x5b4/0x1540 [ 899.775854][T28014] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 899.775891][T28014] ? __kasan_kmalloc+0x93/0xb0 [ 899.775919][T28014] ? __kmalloc_cache_noprof+0x321/0x600 [ 899.775943][T28014] ? __kmalloc_cache_noprof+0x14d/0x600 [ 899.775966][T28014] ? bpf_diag_init+0x87/0x140 [ 899.775993][T28014] ? bpf_diag_init+0x87/0x140 [ 899.776025][T28014] ? bpf_check+0x10ee/0x2e10 [ 899.776048][T28014] __vmalloc_noprof+0xd2/0x120 [ 899.776084][T28014] ? bpf_check+0x10ee/0x2e10 [ 899.776112][T28014] bpf_check+0x10ee/0x2e10 [ 899.776151][T28014] ? ktime_get_with_offset+0x93/0x2d0 [ 899.776182][T28014] ? __pfx_bpf_check+0x10/0x10 [ 899.776212][T28014] ? bpf_obj_name_cpy+0x194/0x1e0 [ 899.776250][T28014] bpf_prog_load+0x14d6/0x1c20 [ 899.776293][T28014] ? __pfx_bpf_prog_load+0x10/0x10 [ 899.776350][T28014] __sys_bpf+0xd0d/0xd90 [ 899.776387][T28014] ? __pfx___sys_bpf+0x10/0x10 [ 899.776428][T28014] ? __fget_files+0x2a/0x420 [ 899.776481][T28014] ? ksys_write+0x242/0x270 [ 899.776519][T28014] ? __pfx_ksys_write+0x10/0x10 [ 899.776561][T28014] __x64_sys_bpf+0xba/0xd0 [ 899.776589][T28014] do_syscall_64+0x166/0x520 [ 899.776615][T28014] ? trace_irq_disable+0x3b/0x140 [ 899.776638][T28014] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 899.776664][T28014] ? clear_bhb_loop+0x70/0xc0 [ 899.776694][T28014] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 899.776718][T28014] RIP: 0033:0x7f266eb9e159 [ 899.776740][T28014] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 899.776761][T28014] RSP: 002b:00007f266fa75028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 899.776787][T28014] RAX: ffffffffffffffda RBX: 00007f266ee25fa0 RCX: 00007f266eb9e159 [ 899.776805][T28014] RDX: 0000000000000094 RSI: 0000200000000240 RDI: 0000000000000005 [ 899.776820][T28014] RBP: 00007f266fa75090 R08: 0000000000000000 R09: 0000000000000000 [ 899.776843][T28014] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 899.776858][T28014] R13: 00007f266ee26038 R14: 00007f266ee25fa0 R15: 00007ffe2863f718 [ 899.776896][T28014] [ 901.061915][T28030] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5416'. [ 901.332579][T28038] ip6gre3: entered promiscuous mode [ 901.332606][T28038] ip6gre3: entered allmulticast mode [ 901.565688][T28008] IPVS: set_ctl: invalid protocol: 1 10.1.1.0:20001 [ 901.582256][T28042] tc_dump_action: action bad kind [ 901.768765][ T8521] net_ratelimit: 32 callbacks suppressed [ 901.768793][ T8521] bond1: (slave dummy0): failed to get link speed/duplex [ 902.073216][T28053] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5420'. [ 902.073247][T28053] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5420'. [ 902.080378][ T38] bond1: (slave dummy0): failed to get link speed/duplex [ 902.336150][T28060] FAULT_INJECTION: forcing a failure. [ 902.336150][T28060] name failslab, interval 1, probability 0, space 0, times 0 [ 902.336188][T28060] CPU: 1 UID: 0 PID: 28060 Comm: syz.4.5422 Not tainted syzkaller #0 PREEMPT(full) [ 902.336215][T28060] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 902.336230][T28060] Call Trace: [ 902.336240][T28060] [ 902.336254][T28060] dump_stack_lvl+0xe8/0x150 [ 902.336295][T28060] should_fail_ex+0x410/0x560 [ 902.336328][T28060] should_failslab+0xa8/0x100 [ 902.336360][T28060] __kmalloc_cache_node_noprof+0xaa/0x620 [ 902.336384][T28060] ? unwind_get_return_address+0x4d/0x90 [ 902.336415][T28060] ? __get_vm_area_node+0x155/0x2f0 [ 902.336445][T28060] ? __get_vm_area_node+0x155/0x2f0 [ 902.336486][T28060] __get_vm_area_node+0x155/0x2f0 [ 902.336524][T28060] __vmalloc_node_range_noprof+0x343/0x1540 [ 902.336561][T28060] ? bpf_prog_calc_tag+0x51/0x370 [ 902.336592][T28060] ? format_decode+0xdc/0xda0 [ 902.336634][T28060] ? vsnprintf+0xe42/0xef0 [ 902.336692][T28060] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 902.336730][T28060] ? bpf_verifier_vlog+0x3c7/0x900 [ 902.336777][T28060] ? bpf_prog_calc_tag+0x51/0x370 [ 902.336803][T28060] __vmalloc_noprof+0xd2/0x120 [ 902.336837][T28060] ? bpf_prog_calc_tag+0x51/0x370 [ 902.336868][T28060] bpf_prog_calc_tag+0x51/0x370 [ 902.336903][T28060] check_and_resolve_insns+0xbb/0x21d0 [ 902.336935][T28060] ? __pfx_bpf_check_btf_info+0x10/0x10 [ 902.336962][T28060] ? add_subprog+0x2e2/0x3f0 [ 902.336994][T28060] ? __pfx_check_and_resolve_insns+0x10/0x10 [ 902.337034][T28060] bpf_check+0x180a/0x2e10 [ 902.337073][T28060] ? ktime_get_with_offset+0x93/0x2d0 [ 902.337104][T28060] ? __pfx_bpf_check+0x10/0x10 [ 902.337133][T28060] ? bpf_obj_name_cpy+0x194/0x1e0 [ 902.337171][T28060] bpf_prog_load+0x14d6/0x1c20 [ 902.337214][T28060] ? __pfx_bpf_prog_load+0x10/0x10 [ 902.337271][T28060] __sys_bpf+0xd0d/0xd90 [ 902.337307][T28060] ? __pfx___sys_bpf+0x10/0x10 [ 902.337347][T28060] ? __fget_files+0x2a/0x420 [ 902.337400][T28060] ? ksys_write+0x242/0x270 [ 902.337440][T28060] ? __pfx_ksys_write+0x10/0x10 [ 902.337481][T28060] __x64_sys_bpf+0xba/0xd0 [ 902.337509][T28060] do_syscall_64+0x166/0x520 [ 902.337534][T28060] ? trace_irq_disable+0x3b/0x140 [ 902.337557][T28060] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 902.337582][T28060] ? clear_bhb_loop+0x70/0xc0 [ 902.337612][T28060] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 902.337636][T28060] RIP: 0033:0x7f87aa59e159 [ 902.337666][T28060] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 902.337687][T28060] RSP: 002b:00007f87ab4b4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 902.337713][T28060] RAX: ffffffffffffffda RBX: 00007f87aa825fa0 RCX: 00007f87aa59e159 [ 902.337732][T28060] RDX: 0000000000000094 RSI: 0000200000000240 RDI: 0000000000000005 [ 902.337748][T28060] RBP: 00007f87ab4b4090 R08: 0000000000000000 R09: 0000000000000000 [ 902.337763][T28060] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 902.337777][T28060] R13: 00007f87aa826038 R14: 00007f87aa825fa0 R15: 00007ffc7fa1bd68 [ 902.337816][T28060] [ 902.728960][ T8521] bond1: (slave dummy0): failed to get link speed/duplex [ 902.835003][T28062] syzkaller0: entered allmulticast mode [ 902.859609][ T8521] bond1: (slave dummy0): failed to get link speed/duplex [ 902.968368][ C1] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 903.157368][T28079] netlink: 844 bytes leftover after parsing attributes in process `syz.2.5426'. [ 903.157403][T28079] netlink: 844 bytes leftover after parsing attributes in process `syz.2.5426'. [ 908.229224][ T8521] bond1: (slave dummy0): failed to get link speed/duplex [ 908.343891][T21417] bond1: (slave dummy0): failed to get link speed/duplex [ 908.451179][ T38] bond1: (slave dummy0): failed to get link speed/duplex [ 908.557967][T28098] netlink: 'syz.1.5430': attribute type 1 has an invalid length. [ 908.557993][T28098] netlink: 36 bytes leftover after parsing attributes in process `syz.1.5430'. [ 908.577502][ T8516] bond1: (slave dummy0): failed to get link speed/duplex [ 908.682060][ T8516] bond1: (slave dummy0): failed to get link speed/duplex [ 908.703793][T28098] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5430'. [ 908.795593][T28110] FAULT_INJECTION: forcing a failure. [ 908.795593][T28110] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 908.795630][T28110] CPU: 1 UID: 0 PID: 28110 Comm: syz.0.5435 Not tainted syzkaller #0 PREEMPT(full) [ 908.795655][T28110] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 908.795671][T28110] Call Trace: [ 908.795680][T28110] [ 908.795690][T28110] dump_stack_lvl+0xe8/0x150 [ 908.795730][T28110] should_fail_ex+0x410/0x560 [ 908.795761][T28110] prepare_alloc_pages+0x223/0x600 [ 908.795800][T28110] __alloc_frozen_pages_noprof+0x185/0x5a0 [ 908.795830][T28110] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 908.795861][T28110] ? __pfx_policy_nodemask+0x10/0x10 [ 908.795888][T28110] ? __get_vm_area_node+0x155/0x2f0 [ 908.795919][T28110] ? __vmalloc_node_range_noprof+0x343/0x1540 [ 908.795953][T28110] ? __vmalloc_noprof+0xd2/0x120 [ 908.795984][T28110] ? bpf_prog_calc_tag+0x51/0x370 [ 908.796011][T28110] ? check_and_resolve_insns+0xbb/0x21d0 [ 908.796038][T28110] ? bpf_prog_load+0x14d6/0x1c20 [ 908.796063][T28110] ? __sys_bpf+0xd0d/0xd90 [ 908.796086][T28110] ? __x64_sys_bpf+0xba/0xd0 [ 908.796107][T28110] ? do_syscall_64+0x166/0x520 [ 908.796131][T28110] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 908.796161][T28110] alloc_pages_mpol+0x21e/0x390 [ 908.796197][T28110] alloc_pages_noprof+0xb1/0x2b0 [ 908.796230][T28110] get_free_pages_noprof+0xf/0x80 [ 908.796256][T28110] __kasan_populate_vmalloc+0x38/0x1c0 [ 908.796279][T28110] ? do_raw_spin_unlock+0xf5/0x200 [ 908.796317][T28110] alloc_vmap_area+0xd1a/0x1420 [ 908.796365][T28110] ? __pfx_alloc_vmap_area+0x10/0x10 [ 908.796395][T28110] ? __kmalloc_cache_node_noprof+0x3d1/0x620 [ 908.796421][T28110] ? __kmalloc_cache_node_noprof+0x1f7/0x620 [ 908.796445][T28110] ? __get_vm_area_node+0x155/0x2f0 [ 908.796482][T28110] __get_vm_area_node+0x200/0x2f0 [ 908.796523][T28110] __vmalloc_node_range_noprof+0x343/0x1540 [ 908.796559][T28110] ? bpf_prog_calc_tag+0x51/0x370 [ 908.796596][T28110] ? format_decode+0xdc/0xda0 [ 908.796636][T28110] ? vsnprintf+0xe42/0xef0 [ 908.796683][T28110] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 908.796718][T28110] ? bpf_verifier_vlog+0x3c7/0x900 [ 908.796762][T28110] ? bpf_prog_calc_tag+0x51/0x370 [ 908.796787][T28110] __vmalloc_noprof+0xd2/0x120 [ 908.796820][T28110] ? bpf_prog_calc_tag+0x51/0x370 [ 908.796851][T28110] bpf_prog_calc_tag+0x51/0x370 [ 908.796883][T28110] check_and_resolve_insns+0xbb/0x21d0 [ 908.796917][T28110] ? __pfx_bpf_check_btf_info+0x10/0x10 [ 908.796944][T28110] ? add_subprog+0x2e2/0x3f0 [ 908.796974][T28110] ? __pfx_check_and_resolve_insns+0x10/0x10 [ 908.797014][T28110] bpf_check+0x180a/0x2e10 [ 908.797052][T28110] ? ktime_get_with_offset+0x93/0x2d0 [ 908.797083][T28110] ? __pfx_bpf_check+0x10/0x10 [ 908.797112][T28110] ? bpf_obj_name_cpy+0x194/0x1e0 [ 908.797148][T28110] bpf_prog_load+0x14d6/0x1c20 [ 908.797188][T28110] ? __pfx_bpf_prog_load+0x10/0x10 [ 908.797242][T28110] __sys_bpf+0xd0d/0xd90 [ 908.797278][T28110] ? __pfx___sys_bpf+0x10/0x10 [ 908.797317][T28110] ? __fget_files+0x2a/0x420 [ 908.797370][T28110] ? ksys_write+0x242/0x270 [ 908.797409][T28110] ? __pfx_ksys_write+0x10/0x10 [ 908.797450][T28110] __x64_sys_bpf+0xba/0xd0 [ 908.797478][T28110] do_syscall_64+0x166/0x520 [ 908.797504][T28110] ? trace_irq_disable+0x3b/0x140 [ 908.797527][T28110] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 908.797551][T28110] ? clear_bhb_loop+0x70/0xc0 [ 908.797590][T28110] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 908.797614][T28110] RIP: 0033:0x7f266eb9e159 [ 908.797637][T28110] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 908.797657][T28110] RSP: 002b:00007f266fa75028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 908.797683][T28110] RAX: ffffffffffffffda RBX: 00007f266ee25fa0 RCX: 00007f266eb9e159 [ 908.797702][T28110] RDX: 0000000000000094 RSI: 0000200000000240 RDI: 0000000000000005 [ 908.797718][T28110] RBP: 00007f266fa75090 R08: 0000000000000000 R09: 0000000000000000 [ 908.797734][T28110] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 908.797749][T28110] R13: 00007f266ee26038 R14: 00007f266ee25fa0 R15: 00007ffe2863f718 [ 908.797787][T28110] [ 908.921632][T28110] warn_alloc: 3 callbacks suppressed [ 908.921689][T28110] syz.0.5435: vmalloc error: size 128, align 0x1, vm_struct allocation failed, mode:0x400cc0(GFP_KERNEL_ACCOUNT), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 908.921871][T28110] CPU: 0 UID: 0 PID: 28110 Comm: syz.0.5435 Not tainted syzkaller #0 PREEMPT(full) [ 908.921943][T28110] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 908.921977][T28110] Call Trace: [ 908.921999][T28110] [ 908.922029][T28110] dump_stack_lvl+0xe8/0x150 [ 908.922125][T28110] warn_alloc+0x24d/0x270 [ 908.922205][T28110] ? lockdep_hardirqs_on+0x7b/0x110 [ 908.922278][T28110] ? __pfx_warn_alloc+0x10/0x10 [ 908.922340][T28110] ? kfree+0x1c5/0x650 [ 908.922445][T28110] ? __get_vm_area_node+0x219/0x2f0 [ 908.922549][T28110] __vmalloc_node_range_noprof+0x36b/0x1540 [ 908.922614][T28110] ? format_decode+0xdc/0xda0 [ 908.922653][T28110] ? vsnprintf+0xe42/0xef0 [ 908.922700][T28110] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 908.922735][T28110] ? bpf_verifier_vlog+0x3c7/0x900 [ 908.922780][T28110] ? bpf_prog_calc_tag+0x51/0x370 [ 908.922806][T28110] __vmalloc_noprof+0xd2/0x120 [ 908.922840][T28110] ? bpf_prog_calc_tag+0x51/0x370 [ 908.922870][T28110] bpf_prog_calc_tag+0x51/0x370 [ 908.922903][T28110] check_and_resolve_insns+0xbb/0x21d0 [ 908.922934][T28110] ? __pfx_bpf_check_btf_info+0x10/0x10 [ 908.922960][T28110] ? add_subprog+0x2e2/0x3f0 [ 908.922991][T28110] ? __pfx_check_and_resolve_insns+0x10/0x10 [ 908.923030][T28110] bpf_check+0x180a/0x2e10 [ 908.923067][T28110] ? ktime_get_with_offset+0x93/0x2d0 [ 908.923096][T28110] ? __pfx_bpf_check+0x10/0x10 [ 908.923126][T28110] ? bpf_obj_name_cpy+0x194/0x1e0 [ 908.923169][T28110] bpf_prog_load+0x14d6/0x1c20 [ 908.923211][T28110] ? __pfx_bpf_prog_load+0x10/0x10 [ 908.923267][T28110] __sys_bpf+0xd0d/0xd90 [ 908.923303][T28110] ? __pfx___sys_bpf+0x10/0x10 [ 908.923342][T28110] ? __fget_files+0x2a/0x420 [ 908.923392][T28110] ? ksys_write+0x242/0x270 [ 908.923430][T28110] ? __pfx_ksys_write+0x10/0x10 [ 908.923471][T28110] __x64_sys_bpf+0xba/0xd0 [ 908.923537][T28110] do_syscall_64+0x166/0x520 [ 908.923630][T28110] ? trace_irq_disable+0x3b/0x140 [ 908.923705][T28110] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 908.923776][T28110] ? clear_bhb_loop+0x70/0xc0 [ 908.923851][T28110] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 908.923914][T28110] RIP: 0033:0x7f266eb9e159 [ 908.923975][T28110] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 908.924020][T28110] RSP: 002b:00007f266fa75028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 908.924089][T28110] RAX: ffffffffffffffda RBX: 00007f266ee25fa0 RCX: 00007f266eb9e159 [ 908.924133][T28110] RDX: 0000000000000094 RSI: 0000200000000240 RDI: 0000000000000005 [ 908.924177][T28110] RBP: 00007f266fa75090 R08: 0000000000000000 R09: 0000000000000000 [ 908.924219][T28110] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 908.924258][T28110] R13: 00007f266ee26038 R14: 00007f266ee25fa0 R15: 00007ffe2863f718 [ 908.924356][T28110] [ 908.977532][T28110] Mem-Info: [ 908.977587][T28110] active_anon:5796 inactive_anon:0 isolated_anon:0 [ 908.977587][T28110] active_file:17 inactive_file:44120 isolated_file:0 [ 908.977587][T28110] unevictable:0 dirty:228 writeback:0 [ 908.977587][T28110] slab_reclaimable:12566 slab_unreclaimable:133606 [ 908.977587][T28110] mapped:29846 shmem:538 pagetables:1399 [ 908.977587][T28110] sec_pagetables:0 bounce:0 [ 908.977587][T28110] kernel_misc_reclaimable:0 [ 908.977587][T28110] free:1202793 free_pcp:10429 free_cma:0 [ 908.977679][T28110] Node 0 active_anon:23184kB inactive_anon:0kB active_file:68kB inactive_file:176264kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:119384kB dirty:908kB writeback:0kB shmem:2152kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:17392kB pagetables:5444kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 908.977841][T28110] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:216kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:4kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:64kB pagetables:152kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 908.978006][T28110] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 908.978188][T28110] lowmem_reserve[]: 0 2486 2486 2486 2486 [ 908.978305][T28110] Node 0 DMA32 free:846488kB boost:0kB min:34140kB low:42672kB high:51204kB reserved_highatomic:0kB free_highatomic:0kB active_anon:23184kB inactive_anon:0kB active_file:68kB inactive_file:176264kB unevictable:0kB writepending:1008kB zspages:0kB present:3129332kB managed:2546620kB mlocked:0kB bounce:0kB free_pcp:41716kB local_pcp:20732kB free_cma:0kB [ 908.978485][T28110] lowmem_reserve[]: 0 0 0 0 0 [ 908.978586][T28110] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:0kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 908.978739][T28110] lowmem_reserve[]: 0 0 0 0 0 [ 908.978846][T28110] Node 1 Normal free:3949324kB boost:0kB min:55760kB low:69700kB high:83640kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:216kB unevictable:0kB writepending:4kB zspages:0kB present:4194300kB managed:4111104kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 908.979014][T28110] lowmem_reserve[]: 0 0 0 0 0 [ 909.089900][T28110] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 909.090276][T28110] Node 0 DMA32: 1860*4kB (UM) 837*8kB (UM) 588*16kB (UM) 209*32kB (UME) 212*64kB (UME) 81*128kB (UME) 23*256kB (UME) 10*512kB (M) 7*1024kB (UME) 6*2048kB (UE) 186*4096kB (UM) = 846488kB [ 909.090796][T28110] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 909.091156][T28110] Node 1 Normal: 1*4kB (M) 3*8kB (UM) 7*16kB (UM) 4*32kB (UM) 10*64kB (UM) 3*128kB (UM) 4*256kB (UM) 3*512kB (UM) 3*1024kB (UM) 3*2048kB (U) 961*4096kB (M) = 3949324kB [ 909.091663][T28110] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 909.091717][T28110] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 909.091761][T28110] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 909.091822][T28110] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 909.091868][T28110] 44671 total pagecache pages [ 909.091899][T28110] 0 pages in swap cache [ 909.226600][T28110] Free swap = 124996kB [ 909.226644][T28110] Total swap = 124996kB [ 909.226676][T28110] 2097051 pages RAM [ 909.226698][T28110] 0 pages HighMem/MovableOnly [ 909.226720][T28110] 428780 pages reserved [ 909.226742][T28110] 0 pages cma reserved [ 909.994421][T21417] bond1: (slave dummy0): failed to get link speed/duplex [ 910.091733][T28120] openvswitch: netlink: nsh attr 1 has unexpected len 335 expected 8 [ 910.155360][T21417] bond1: (slave dummy0): failed to get link speed/duplex [ 910.343015][T28137] xt_CT: You must specify a L4 protocol and not use inversions on it [ 914.858828][ T8529] bond1: (slave dummy0): failed to get link speed/duplex [ 914.899791][T28139] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 915.032967][ T8529] bond1: (slave dummy0): failed to get link speed/duplex [ 915.144554][ T8521] bond1: (slave dummy0): failed to get link speed/duplex [ 915.189998][T28164] FAULT_INJECTION: forcing a failure. [ 915.189998][T28164] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 915.190037][T28164] CPU: 1 UID: 0 PID: 28164 Comm: syz.2.5448 Not tainted syzkaller #0 PREEMPT(full) [ 915.190064][T28164] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 915.190080][T28164] Call Trace: [ 915.190089][T28164] [ 915.190099][T28164] dump_stack_lvl+0xe8/0x150 [ 915.190141][T28164] should_fail_ex+0x410/0x560 [ 915.190173][T28164] prepare_alloc_pages+0x223/0x600 [ 915.190208][T28164] __alloc_frozen_pages_noprof+0x185/0x5a0 [ 915.190240][T28164] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 915.190265][T28164] ? __alloc_frozen_pages_noprof+0x29e/0x5a0 [ 915.190295][T28164] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 915.190326][T28164] ? __pfx_policy_nodemask+0x10/0x10 [ 915.190354][T28164] ? __get_vm_area_node+0x155/0x2f0 [ 915.190386][T28164] ? __vmalloc_node_range_noprof+0x343/0x1540 [ 915.190420][T28164] ? __vmalloc_noprof+0xd2/0x120 [ 915.190459][T28164] __alloc_pages_noprof+0x10/0x100 [ 915.190485][T28164] alloc_pages_bulk_noprof+0x5fa/0x7c0 [ 915.190529][T28164] ? alloc_pages_noprof+0x140/0x2b0 [ 915.190564][T28164] __kasan_populate_vmalloc+0xb7/0x1c0 [ 915.190596][T28164] alloc_vmap_area+0xd1a/0x1420 [ 915.190647][T28164] ? __pfx_alloc_vmap_area+0x10/0x10 [ 915.190678][T28164] ? __kmalloc_cache_node_noprof+0x3d1/0x620 [ 915.190707][T28164] ? __kmalloc_cache_node_noprof+0x1f7/0x620 [ 915.190731][T28164] ? __get_vm_area_node+0x155/0x2f0 [ 915.190769][T28164] __get_vm_area_node+0x200/0x2f0 [ 915.190811][T28164] __vmalloc_node_range_noprof+0x343/0x1540 [ 915.190848][T28164] ? bpf_prog_calc_tag+0x51/0x370 [ 915.190879][T28164] ? format_decode+0xdc/0xda0 [ 915.190921][T28164] ? vsnprintf+0xe42/0xef0 [ 915.190970][T28164] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 915.191005][T28164] ? bpf_verifier_vlog+0x3c7/0x900 [ 915.191051][T28164] ? bpf_prog_calc_tag+0x51/0x370 [ 915.191077][T28164] __vmalloc_noprof+0xd2/0x120 [ 915.191112][T28164] ? bpf_prog_calc_tag+0x51/0x370 [ 915.191143][T28164] bpf_prog_calc_tag+0x51/0x370 [ 915.191176][T28164] check_and_resolve_insns+0xbb/0x21d0 [ 915.191207][T28164] ? __pfx_bpf_check_btf_info+0x10/0x10 [ 915.191234][T28164] ? add_subprog+0x2e2/0x3f0 [ 915.191264][T28164] ? __pfx_check_and_resolve_insns+0x10/0x10 [ 915.191303][T28164] bpf_check+0x180a/0x2e10 [ 915.191342][T28164] ? ktime_get_with_offset+0x93/0x2d0 [ 915.191374][T28164] ? __pfx_bpf_check+0x10/0x10 [ 915.191403][T28164] ? bpf_obj_name_cpy+0x194/0x1e0 [ 915.191443][T28164] bpf_prog_load+0x14d6/0x1c20 [ 915.191484][T28164] ? __pfx_bpf_prog_load+0x10/0x10 [ 915.191546][T28164] __sys_bpf+0xd0d/0xd90 [ 915.191583][T28164] ? __pfx___sys_bpf+0x10/0x10 [ 915.191622][T28164] ? __fget_files+0x2a/0x420 [ 915.191676][T28164] ? ksys_write+0x242/0x270 [ 915.191715][T28164] ? __pfx_ksys_write+0x10/0x10 [ 915.191755][T28164] __x64_sys_bpf+0xba/0xd0 [ 915.191782][T28164] do_syscall_64+0x166/0x520 [ 915.191806][T28164] ? trace_irq_disable+0x3b/0x140 [ 915.191829][T28164] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 915.191854][T28164] ? clear_bhb_loop+0x70/0xc0 [ 915.191884][T28164] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 915.191908][T28164] RIP: 0033:0x7f303e59e159 [ 915.191931][T28164] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 915.191953][T28164] RSP: 002b:00007f303f549028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 915.191979][T28164] RAX: ffffffffffffffda RBX: 00007f303e825fa0 RCX: 00007f303e59e159 [ 915.191996][T28164] RDX: 0000000000000094 RSI: 0000200000000240 RDI: 0000000000000005 [ 915.192012][T28164] RBP: 00007f303f549090 R08: 0000000000000000 R09: 0000000000000000 [ 915.192027][T28164] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 915.192041][T28164] R13: 00007f303e826038 R14: 00007f303e825fa0 R15: 00007ffd598660b8 [ 915.192079][T28164] [ 915.516017][T28165] siw: device registration error -23 [ 915.585744][T21909] bond1: (slave dummy0): failed to get link speed/duplex [ 915.696362][ T38] bond1: (slave dummy0): failed to get link speed/duplex [ 915.717494][T28173] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 915.751483][T28162] netlink: 68 bytes leftover after parsing attributes in process `syz.0.5449'. [ 915.803085][ T8516] bond1: (slave dummy0): failed to get link speed/duplex [ 915.912437][ T8521] bond1: (slave dummy0): failed to get link speed/duplex [ 916.020237][T21908] bond1: (slave dummy0): failed to get link speed/duplex [ 916.426106][T28200] netlink: 'syz.1.5458': attribute type 1 has an invalid length. [ 916.426132][T28200] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5458'. [ 916.811636][T28213] FAULT_INJECTION: forcing a failure. [ 916.811636][T28213] name failslab, interval 1, probability 0, space 0, times 0 [ 916.811674][T28213] CPU: 0 UID: 0 PID: 28213 Comm: syz.3.5462 Not tainted syzkaller #0 PREEMPT(full) [ 916.811700][T28213] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 916.811716][T28213] Call Trace: [ 916.811726][T28213] [ 916.811736][T28213] dump_stack_lvl+0xe8/0x150 [ 916.811776][T28213] should_fail_ex+0x410/0x560 [ 916.811809][T28213] should_failslab+0xa8/0x100 [ 916.811842][T28213] __kmalloc_node_noprof+0x100/0x720 [ 916.811865][T28213] ? __get_vm_area_node+0x200/0x2f0 [ 916.811897][T28213] ? __get_vm_area_node+0x283/0x2f0 [ 916.811928][T28213] ? __vmalloc_node_range_noprof+0x5b4/0x1540 [ 916.811962][T28213] ? __vmalloc_node_range_noprof+0x5b4/0x1540 [ 916.812005][T28213] __vmalloc_node_range_noprof+0x5b4/0x1540 [ 916.812054][T28213] ? vsnprintf+0xe42/0xef0 [ 916.812104][T28213] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 916.812139][T28213] ? bpf_verifier_vlog+0x3c7/0x900 [ 916.812187][T28213] ? bpf_prog_calc_tag+0x51/0x370 [ 916.812214][T28213] __vmalloc_noprof+0xd2/0x120 [ 916.812247][T28213] ? bpf_prog_calc_tag+0x51/0x370 [ 916.812279][T28213] bpf_prog_calc_tag+0x51/0x370 [ 916.812312][T28213] check_and_resolve_insns+0xbb/0x21d0 [ 916.812344][T28213] ? __pfx_bpf_check_btf_info+0x10/0x10 [ 916.812371][T28213] ? add_subprog+0x2e2/0x3f0 [ 916.812408][T28213] ? __pfx_check_and_resolve_insns+0x10/0x10 [ 916.812449][T28213] bpf_check+0x180a/0x2e10 [ 916.812488][T28213] ? ktime_get_with_offset+0x93/0x2d0 [ 916.812518][T28213] ? __pfx_bpf_check+0x10/0x10 [ 916.812548][T28213] ? bpf_obj_name_cpy+0x194/0x1e0 [ 916.812586][T28213] bpf_prog_load+0x14d6/0x1c20 [ 916.812628][T28213] ? __pfx_bpf_prog_load+0x10/0x10 [ 916.812685][T28213] __sys_bpf+0xd0d/0xd90 [ 916.812720][T28213] ? __pfx___sys_bpf+0x10/0x10 [ 916.812760][T28213] ? __fget_files+0x2a/0x420 [ 916.812814][T28213] ? ksys_write+0x242/0x270 [ 916.812853][T28213] ? __pfx_ksys_write+0x10/0x10 [ 916.812903][T28213] __x64_sys_bpf+0xba/0xd0 [ 916.812931][T28213] do_syscall_64+0x166/0x520 [ 916.812955][T28213] ? trace_irq_disable+0x3b/0x140 [ 916.812979][T28213] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 916.813004][T28213] ? clear_bhb_loop+0x70/0xc0 [ 916.813034][T28213] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 916.813058][T28213] RIP: 0033:0x7fe76c79e159 [ 916.813080][T28213] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 916.813102][T28213] RSP: 002b:00007fe76d660028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 916.813127][T28213] RAX: ffffffffffffffda RBX: 00007fe76ca25fa0 RCX: 00007fe76c79e159 [ 916.813145][T28213] RDX: 0000000000000094 RSI: 0000200000000240 RDI: 0000000000000005 [ 916.813161][T28213] RBP: 00007fe76d660090 R08: 0000000000000000 R09: 0000000000000000 [ 916.813176][T28213] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 916.813190][T28213] R13: 00007fe76ca26038 R14: 00007fe76ca25fa0 R15: 00007ffcdaf7a868 [ 916.813228][T28213] [ 917.400392][T28215] netlink: 'syz.3.5463': attribute type 1 has an invalid length. [ 917.547193][T28216] bond5: (slave bridge7): Enslaving as a backup interface with an up link [ 917.601624][T28220] macvlan2: entered promiscuous mode [ 917.601650][T28220] macvlan2: entered allmulticast mode [ 917.602340][T28220] bond5: entered promiscuous mode [ 917.602361][T28220] bridge7: entered promiscuous mode [ 917.605375][T28220] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 917.645157][T28220] bond5: left promiscuous mode [ 917.645182][T28220] bridge7: left promiscuous mode [ 917.657613][T28221] netlink: 24 bytes leftover after parsing attributes in process `syz.2.5464'. [ 917.754130][T28229] netlink: 844 bytes leftover after parsing attributes in process `syz.0.5467'. [ 917.754160][T28229] netlink: 844 bytes leftover after parsing attributes in process `syz.0.5467'. [ 918.088216][T28239] netlink: 844 bytes leftover after parsing attributes in process `syz.3.5468'. [ 918.088251][T28239] netlink: 844 bytes leftover after parsing attributes in process `syz.3.5468'. [ 918.456536][T28243] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5470'. [ 918.706300][T28249] netlink: 220 bytes leftover after parsing attributes in process `syz.1.5471'. [ 918.796479][T28253] netlink: 60 bytes leftover after parsing attributes in process `syz.4.5473'. [ 919.860626][T28277] pim6reg1: entered promiscuous mode [ 919.860653][T28277] pim6reg1: entered allmulticast mode [ 920.122851][T28291] net_ratelimit: 30 callbacks suppressed [ 920.122877][T28291] openvswitch: netlink: Missing key (keys=c0, expected=100) [ 920.167126][T21908] bond1: (slave dummy0): failed to get link speed/duplex [ 920.303839][ T31] audit: type=1804 audit(1789147157.033:14): pid=28302 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.1.5483" name="/newroot/511/memory.events" dev="tmpfs" ino=2633 res=1 errno=0 [ 920.304007][ T31] audit: type=1800 audit(1789147157.033:15): pid=28302 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.5483" name="memory.events" dev="tmpfs" ino=2633 res=0 errno=0 [ 920.333208][ T38] bond1: (slave dummy0): failed to get link speed/duplex [ 920.425801][ T31] audit: type=1804 audit(1789147157.173:16): pid=28303 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.1.5483" name="/newroot/511/memory.events" dev="tmpfs" ino=2633 res=1 errno=0 [ 920.463064][ T8529] bond1: (slave dummy0): failed to get link speed/duplex [ 920.578673][ T8516] bond1: (slave dummy0): failed to get link speed/duplex [ 920.593431][T28309] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 920.694048][T21909] bond1: (slave dummy0): failed to get link speed/duplex [ 920.829946][T28317] wg2 speed is unknown, defaulting to 1000 [ 920.840845][ T8521] bond1: (slave dummy0): failed to get link speed/duplex [ 920.949680][T21909] bond1: (slave dummy0): failed to get link speed/duplex [ 921.058540][ T8529] bond1: (slave dummy0): failed to get link speed/duplex [ 921.157266][T28326] netlink: 'syz.0.5488': attribute type 9 has an invalid length. [ 921.157294][T28326] netlink: 'syz.0.5488': attribute type 6 has an invalid length. [ 921.157310][T28326] netlink: 'syz.0.5488': attribute type 7 has an invalid length. [ 921.157325][T28326] netlink: 'syz.0.5488': attribute type 8 has an invalid length. [ 921.220792][T28326] netlink: 'syz.0.5488': attribute type 3 has an invalid length. [ 921.336564][T28334] IPVS: set_ctl: invalid protocol: 135 224.0.0.2:20000 [ 921.386083][T28337] __nla_validate_parse: 4 callbacks suppressed [ 921.386138][T28337] netlink: 24 bytes leftover after parsing attributes in process `syz.3.5490'. [ 921.538001][ C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 921.686137][T28345] netlink: 'syz.3.5490': attribute type 3 has an invalid length. [ 922.011489][T28350] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5492'. [ 922.186283][T28364] netlink: 44 bytes leftover after parsing attributes in process `syz.3.5495'. [ 923.046448][T28371] dvmrp0: entered allmulticast mode [ 923.382359][T28391] netlink: 844 bytes leftover after parsing attributes in process `syz.3.5498'. [ 923.382392][T28391] netlink: 844 bytes leftover after parsing attributes in process `syz.3.5498'. [ 923.924363][T28393] bond8: invalid NS target :: specified for addition [ 923.924401][T28393] bond8: option ns_ip6_target: invalid value (18446744073709551615) [ 923.962641][T28393] bond8 (unregistering): Released all slaves [ 924.387199][T28413] mac80211_hwsim hwsim47 syzkaller0: entered promiscuous mode [ 924.387321][T28413] mac80211_hwsim hwsim47 syzkaller0: entered allmulticast mode [ 924.414653][T28413] tipc: Resetting bearer [ 924.606183][T28426] PF_CAN: dropped non conform CAN FD skbuff: dev type 65534, len 64993 [ 924.697622][T28425] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5503'. [ 924.697648][T28425] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5503'. [ 924.736258][T28425] 8021q: adding VLAN 0 to HW filter on device bond0 [ 924.739078][T28425] bond6: (slave bond0): making interface the new active one [ 924.740112][T28425] bond6: (slave bond0): Enslaving as an active interface with an up link [ 924.745837][T28425] netlink: 'syz.3.5503': attribute type 4 has an invalid length. [ 924.745859][T28425] netlink: 152 bytes leftover after parsing attributes in process `syz.3.5503'. [ 924.800689][T28425] .`: renamed from bond0 (while UP) [ 924.939290][T28436] netlink: 16 bytes leftover after parsing attributes in process `syz.2.5504'. [ 925.128917][ T8529] net_ratelimit: 12 callbacks suppressed [ 925.128942][ T8529] bond1: (slave dummy0): failed to get link speed/duplex [ 925.240272][ T8521] bond1: (slave dummy0): failed to get link speed/duplex [ 925.249991][T28454] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5509'. [ 925.348710][ T8529] bond1: (slave dummy0): failed to get link speed/duplex [ 925.459238][ T8529] bond1: (slave dummy0): failed to get link speed/duplex [ 925.572119][T21417] bond1: (slave dummy0): failed to get link speed/duplex [ 925.678589][T21909] bond1: (slave dummy0): failed to get link speed/duplex [ 925.789732][T21909] bond1: (slave dummy0): failed to get link speed/duplex [ 925.898841][T21417] bond1: (slave dummy0): failed to get link speed/duplex [ 926.009304][ T8521] bond1: (slave dummy0): failed to get link speed/duplex [ 926.119097][T21417] bond1: (slave dummy0): failed to get link speed/duplex [ 926.643239][ C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 928.032041][T28499] netlink: 'syz.0.5518': attribute type 1 has an invalid length. [ 928.032068][T28499] netlink: 'syz.0.5518': attribute type 2 has an invalid length. [ 928.646112][T28470] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 928.660701][T28480] __nla_validate_parse: 2 callbacks suppressed [ 928.660724][T28480] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5514'. [ 928.859750][T28502] netlink: 'syz.4.5519': attribute type 32 has an invalid length. [ 929.272140][T28521] netlink: 16 bytes leftover after parsing attributes in process `syz.0.5523'. [ 929.294055][T28521] netlink: 24 bytes leftover after parsing attributes in process `syz.0.5523'. [ 929.403690][T28526] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5523'. [ 929.439179][T28524] netlink: 'syz.2.5524': attribute type 1 has an invalid length. [ 929.640174][T28524] bond14: entered promiscuous mode [ 929.643321][T28524] 8021q: adding VLAN 0 to HW filter on device bond14 [ 929.933650][T28534] syzkaller0: entered promiscuous mode [ 929.935204][T28534] sch_tbf: burst 65537 is lower than device syzkaller0 mtu (65589) ! [ 930.144216][T28545] net_ratelimit: 29 callbacks suppressed [ 930.144244][T28545] openvswitch: netlink: Unknown VXLAN extension attribute 0 [ 930.166430][T28545] netlink: 'syz.2.5528': attribute type 1 has an invalid length. [ 930.301858][T28538] IPVS: Scheduler module ip_vs_sip not found [ 930.365662][T28545] 8021q: adding VLAN 0 to HW filter on device bond15 [ 930.375334][T21432] bond1: (slave dummy0): failed to get link speed/duplex [ 930.398247][T28549] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5531'. [ 930.460326][T28545] netlink: 68 bytes leftover after parsing attributes in process `syz.2.5528'. [ 930.523306][T21906] bond1: (slave dummy0): failed to get link speed/duplex [ 930.648699][T21432] bond1: (slave dummy0): failed to get link speed/duplex [ 930.758886][T21432] bond1: (slave dummy0): failed to get link speed/duplex [ 930.868244][T21906] bond1: (slave dummy0): failed to get link speed/duplex [ 930.907085][T28563] netlink: 28 bytes leftover after parsing attributes in process `syz.2.5536'. [ 930.907112][T28563] nbd: must specify at least one socket [ 930.981645][T28566] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5534'. [ 930.981795][T28567] netlink: 80 bytes leftover after parsing attributes in process `syz.3.5537'. [ 930.983690][T28568] netlink: 332 bytes leftover after parsing attributes in process `syz.1.5535'. [ 930.983747][T28568] netlink: 'syz.1.5535': attribute type 9 has an invalid length. [ 931.138023][T21418] bond1: (slave dummy0): failed to get link speed/duplex [ 931.150722][T28562] netlink: 'syz.1.5535': attribute type 5 has an invalid length. [ 931.150748][T28562] netlink: 'syz.1.5535': attribute type 9 has an invalid length. [ 931.244132][ T38] bond1: (slave dummy0): failed to get link speed/duplex [ 931.276559][T28576] syzkaller1: entered promiscuous mode [ 931.276584][T28576] syzkaller1: entered allmulticast mode [ 931.387294][T21432] bond1: (slave dummy0): failed to get link speed/duplex [ 931.476454][T28585] tipc: Enabling of bearer rejected, failed to enable media [ 931.521802][T28588] bridge5: entered promiscuous mode [ 931.521831][T28588] bridge5: entered allmulticast mode [ 931.537259][T28588] team0: Port device bridge5 added [ 931.586091][T21432] bond1: (slave dummy0): failed to get link speed/duplex [ 931.591142][T28588] bridge0: port 4(team0) entered blocking state [ 931.591246][T28588] bridge0: port 4(team0) entered disabled state [ 931.591442][T28588] team0: entered allmulticast mode [ 931.591462][T28588] team_slave_0: entered allmulticast mode [ 931.591483][T28588] team_slave_1: entered allmulticast mode [ 931.617988][T28588] team0: entered promiscuous mode [ 931.618052][T28588] team_slave_0: entered promiscuous mode [ 931.618631][T28588] team_slave_1: entered promiscuous mode [ 931.623131][T28588] bridge0: port 4(team0) entered blocking state [ 931.623568][T28588] bridge0: port 4(team0) entered forwarding state [ 931.774199][ C0] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 931.886778][T28563] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 931.886808][T28563] Bluetooth: hci5: Error when powering off device on rfkill (-4) [ 931.967376][T28563] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 931.967449][T28563] Bluetooth: hci2: Error when powering off device on rfkill (-4) [ 932.012349][T28563] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 932.012376][T28563] Bluetooth: hci1: Error when powering off device on rfkill (-4) [ 932.062927][T28563] tipc: Resetting bearer [ 932.112295][T28563] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 932.112322][T28563] Bluetooth: hci4: Error when powering off device on rfkill (-4) [ 932.275210][T28563] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 932.275237][T28563] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 932.616580][T28627] gre0: entered promiscuous mode [ 932.616607][T28627] gre0: entered allmulticast mode [ 933.487852][T28663] netlink: 'syz.3.5561': attribute type 1 has an invalid length. [ 933.629222][T28663] 8021q: adding VLAN 0 to HW filter on device bond0 [ 933.751642][T28679] netlink: 'syz.1.5563': attribute type 5 has an invalid length. [ 933.821052][T28680] netlink: 'syz.2.5562': attribute type 1 has an invalid length. [ 933.842575][T28667] bond0: (slave veth5): Enslaving as an active interface with a down link [ 934.128334][T28669] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 934.131277][T28669] bond0: (slave batadv0): making interface the new active one [ 934.155915][T28669] batadv0: entered promiscuous mode [ 934.156394][T28669] bond0: (slave batadv0): Enslaving as an active interface with an up link [ 934.421554][T28680] 8021q: adding VLAN 0 to HW filter on device bond16 [ 934.453320][T28682] bond16: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 934.673319][T28703] syzkaller0: entered promiscuous mode [ 934.673346][T28703] syzkaller0: entered allmulticast mode [ 935.127573][T28731] netlink: 'syz.4.5570': attribute type 2 has an invalid length. [ 935.397363][ T31] audit: type=1800 audit(1789147172.143:17): pid=28735 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.5571" name="r" dev="tmpfs" ino=2690 res=0 errno=0 [ 935.885645][T28748] __nla_validate_parse: 11 callbacks suppressed [ 935.885692][T28748] netlink: 7 bytes leftover after parsing attributes in process `syz.4.5575'. [ 935.921670][T28748] netlink: 20 bytes leftover after parsing attributes in process `syz.4.5575'. [ 936.026312][T28756] netlink: 20 bytes leftover after parsing attributes in process `syz.4.5575'. [ 936.026347][T28756] nbd: nbd64 already in use [ 936.288687][T28752] bond7: entered promiscuous mode [ 936.293567][T28766] tipc: Started in network mode [ 936.293604][T28766] tipc: Node identity 6e1a089bb856, cluster identity 4711 [ 936.293783][T28766] tipc: Enabled bearer , priority 0 [ 936.388341][T28770] bond8: entered promiscuous mode [ 936.445435][T28769] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5578'. [ 936.474987][T28753] tipc: Disabling bearer [ 936.540939][T28781] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5581'. [ 936.647532][T28778] netlink: 'syz.2.5580': attribute type 7 has an invalid length. [ 936.647568][T28778] netlink: 148 bytes leftover after parsing attributes in process `syz.2.5580'. [ 936.648381][T28778] netlink: 2 bytes leftover after parsing attributes in process `syz.2.5580'. [ 936.880696][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 936.932623][T28797] syzkaller0: entered promiscuous mode [ 936.932650][T28797] syzkaller0: entered allmulticast mode [ 937.396341][T28808] FAULT_INJECTION: forcing a failure. [ 937.396341][T28808] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 937.396387][T28808] CPU: 0 UID: 0 PID: 28808 Comm: syz.0.5587 Not tainted syzkaller #0 PREEMPT(full) [ 937.396412][T28808] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 937.396425][T28808] Call Trace: [ 937.396434][T28808] [ 937.396442][T28808] dump_stack_lvl+0xe8/0x150 [ 937.396476][T28808] should_fail_ex+0x410/0x560 [ 937.396502][T28808] _copy_to_user+0x31/0xb0 [ 937.396529][T28808] bpf_verifier_vlog+0x496/0x900 [ 937.396570][T28808] verbose+0x11d/0x1a0 [ 937.396587][T28808] ? __pfx_snprintf+0x10/0x10 [ 937.396618][T28808] ? __pfx_verbose+0x10/0x10 [ 937.396636][T28808] ? lock_acquire+0x115/0x350 [ 937.396660][T28808] ? __func_imm_name+0xab/0xc0 [ 937.396686][T28808] print_bpf_insn+0x1a01/0x2930 [ 937.396711][T28808] ? __pfx_verbose+0x10/0x10 [ 937.396730][T28808] ? __pfx_print_bpf_insn+0x10/0x10 [ 937.396758][T28808] ? bpf_verifier_vlog+0x58d/0x900 [ 937.396797][T28808] ? bpf_verifier_log_write+0x11d/0x1a0 [ 937.396819][T28808] bpf_verbose_insn+0xcb/0x130 [ 937.396838][T28808] ? __pfx_bpf_verbose_insn+0x10/0x10 [ 937.396856][T28808] ? __pfx_verbose+0x10/0x10 [ 937.396872][T28808] ? __pfx_bpf_disasm_kfunc_name+0x10/0x10 [ 937.396892][T28808] ? record_arg_access+0x148/0x970 [ 937.396923][T28808] analyze_subprog+0x5d89/0x9e00 [ 937.396945][T28808] ? probe_event_enable+0x6df/0xae0 [ 937.397019][T28808] ? __pfx_analyze_subprog+0x10/0x10 [ 937.397041][T28808] ? __x64_sys_bpf+0xba/0xd0 [ 937.397058][T28808] ? rsc_parse+0xc2/0xd00 [ 937.397081][T28808] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 937.397138][T28808] ? call_instance+0x263/0x560 [ 937.397160][T28808] ? rcu_is_watching+0x16/0xb0 [ 937.397186][T28808] ? call_instance+0x263/0x560 [ 937.397209][T28808] ? trace_kmalloc+0x2a/0xf0 [ 937.397239][T28808] ? call_instance+0x263/0x560 [ 937.397259][T28808] ? __kvmalloc_node_noprof+0x52f/0x820 [ 937.397280][T28808] ? __kvmalloc_node_noprof+0x345/0x820 [ 937.397299][T28808] ? call_instance+0x263/0x560 [ 937.397318][T28808] ? call_instance+0x263/0x560 [ 937.397353][T28808] bpf_compute_subprog_arg_access+0x2c9/0x14d0 [ 937.397377][T28808] ? bpf_tracing_func_proto+0x72/0x180 [ 937.397430][T28808] ? __pfx_bpf_compute_subprog_arg_access+0x10/0x10 [ 937.397462][T28808] ? __kvmalloc_node_noprof+0x345/0x820 [ 937.397487][T28808] ? bpf_compute_live_registers+0x14f/0x1ff0 [ 937.397512][T28808] ? bpf_compute_live_registers+0x14f/0x1ff0 [ 937.397548][T28808] bpf_compute_live_registers+0x8d3/0x1ff0 [ 937.397597][T28808] ? __pfx_bpf_compute_live_registers+0x10/0x10 [ 937.397638][T28808] bpf_check+0x25ed/0x2e10 [ 937.397678][T28808] ? ktime_get_with_offset+0x93/0x2d0 [ 937.397708][T28808] ? __pfx_bpf_check+0x10/0x10 [ 937.397737][T28808] ? bpf_obj_name_cpy+0x194/0x1e0 [ 937.397776][T28808] bpf_prog_load+0x14d6/0x1c20 [ 937.397837][T28808] ? __pfx_bpf_prog_load+0x10/0x10 [ 937.397895][T28808] __sys_bpf+0xd0d/0xd90 [ 937.397931][T28808] ? __pfx___sys_bpf+0x10/0x10 [ 937.397969][T28808] ? __fget_files+0x2a/0x420 [ 937.398021][T28808] ? ksys_write+0x242/0x270 [ 937.398053][T28808] ? __pfx_ksys_write+0x10/0x10 [ 937.398087][T28808] __x64_sys_bpf+0xba/0xd0 [ 937.398113][T28808] do_syscall_64+0x166/0x520 [ 937.398137][T28808] ? trace_irq_disable+0x3b/0x140 [ 937.398160][T28808] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 937.398185][T28808] ? clear_bhb_loop+0x70/0xc0 [ 937.398215][T28808] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 937.398239][T28808] RIP: 0033:0x7f266eb9e159 [ 937.398261][T28808] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 937.398282][T28808] RSP: 002b:00007f266fa75028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 937.398308][T28808] RAX: ffffffffffffffda RBX: 00007f266ee25fa0 RCX: 00007f266eb9e159 [ 937.398326][T28808] RDX: 0000000000000094 RSI: 0000200000000100 RDI: 0000000000000005 [ 937.398342][T28808] RBP: 00007f266fa75090 R08: 0000000000000000 R09: 0000000000000000 [ 937.398358][T28808] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 937.398372][T28808] R13: 00007f266ee26038 R14: 00007f266ee25fa0 R15: 00007ffe2863f718 [ 937.398410][T28808] [ 937.888951][T28801] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 937.970924][T28815] netlink: 'syz.1.5590': attribute type 1 has an invalid length. [ 937.970949][T28815] netlink: 16150 bytes leftover after parsing attributes in process `syz.1.5590'. [ 937.977502][T28815] netlink: 16186 bytes leftover after parsing attributes in process `syz.1.5590'. [ 938.138922][T28820] netlink: 844 bytes leftover after parsing attributes in process `syz.1.5592'. [ 938.714100][T28830] syz_tun: entered promiscuous mode [ 938.715800][T28830] syz_tun: entered allmulticast mode [ 938.735083][T28830] team0: Port device syz_tun added [ 939.372847][T28843] wg2 speed is unknown, defaulting to 1000 [ 939.580470][T28853] netlink: 'syz.3.5602': attribute type 6 has an invalid length. [ 939.623803][T22372] netdevsim netdevsim3 netdevsim0: entered promiscuous mode [ 940.124104][T28843] Cannot find add_set index 0 as target [ 940.494585][T28880] xt_LOG: level 115 >= 8 [ 940.741436][T28893] net_ratelimit: 13 callbacks suppressed [ 940.741462][T28893] netlink: Conntrack attr type has unexpected length (type=0, length=8, expected=0) [ 940.741500][T28893] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 940.906312][T28899] batman_adv: batadv0: Adding interface: veth0 [ 940.906333][T28899] batman_adv: batadv0: The MTU of interface veth0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 940.906367][T28899] batman_adv: batadv0: Interface activated: veth0 [ 940.957575][T28899] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 940.957605][T28899] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 940.993953][T28899] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 940.993982][T28899] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 941.009722][T28899] batman_adv: batadv0: Interface deactivated: ip6gretap2 [ 941.009748][T28899] batman_adv: batadv0: Removing interface: ip6gretap2 [ 941.014118][T28899] batman_adv: batadv0: Interface deactivated: veth0 [ 941.014141][T28899] batman_adv: batadv0: Removing interface: veth0 [ 941.107384][T28899] batadv0 (unregistering): left allmulticast mode [ 941.355049][T28906] __nla_validate_parse: 7 callbacks suppressed [ 941.355076][T28906] netlink: 44 bytes leftover after parsing attributes in process `syz.2.5614'. [ 941.542480][T28911] bridge0: port 3(macsec0) entered blocking state [ 941.542648][T28911] bridge0: port 3(macsec0) entered disabled state [ 941.542789][T28911] macsec0: entered allmulticast mode [ 941.542820][T28911] bridge0: entered promiscuous mode [ 941.545033][T28911] macsec0: left allmulticast mode [ 941.639985][T28920] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 941.640126][T28920] syzkaller1: linktype set to 773 [ 941.642233][T14175] bridge0: left promiscuous mode [ 942.002293][ C0] ip6_tunnel: ip6gretap3 xmit: Local address not yet configured! [ 942.765646][T28906] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 942.801654][T28906] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 943.692909][T28917] netdevsim netdevsim3 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 943.692954][T28917] netdevsim netdevsim3 netdevsim3 (unregistering): unset [0, 1] type 1 family 0 port 256 - 0 [ 943.692985][T28917] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 943.792333][T21417] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 943.794206][T21418] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 943.794256][T21418] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 943.794294][T21418] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 943.903461][T28955] wg2 speed is unknown, defaulting to 1000 [ 944.091294][T28917] netdevsim netdevsim3 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 944.091334][T28917] netdevsim netdevsim3 netdevsim2 (unregistering): unset [0, 1] type 1 family 0 port 256 - 0 [ 944.091365][T28917] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 944.141060][T28964] netlink: 844 bytes leftover after parsing attributes in process `syz.2.5627'. [ 944.141090][T28964] netlink: 844 bytes leftover after parsing attributes in process `syz.2.5627'. [ 944.186050][T28962] netlink: 20 bytes leftover after parsing attributes in process `syz.1.5628'. [ 944.186121][T28962] openvswitch: netlink: Missing key (keys=c0, expected=20080) [ 944.313985][T28917] netdevsim netdevsim3 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 944.315570][T28917] netdevsim netdevsim3 netdevsim1 (unregistering): unset [0, 1] type 1 family 0 port 256 - 0 [ 944.315601][T28917] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 944.627936][T28971] netlink: 'syz.1.5629': attribute type 39 has an invalid length. [ 945.257123][T21418] netdevsim netdevsim3 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 945.257158][T21418] netdevsim netdevsim3 eth1: set [0, 1] type 1 family 0 port 256 - 0 [ 945.257183][T21418] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 945.379972][T28976] ip_tables: iptables: counters copy to user failed while replacing table [ 945.491080][T21905] netdevsim netdevsim3 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 945.491144][T21905] netdevsim netdevsim3 eth3: set [0, 1] type 1 family 0 port 256 - 0 [ 945.491207][T21905] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 945.491370][T21905] netdevsim netdevsim3 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 945.491435][T21905] netdevsim netdevsim3 eth2: set [0, 1] type 1 family 0 port 256 - 0 [ 945.491499][T21905] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 945.491594][T21905] netdevsim netdevsim3 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 945.491660][T21905] netdevsim netdevsim3 eth0: set [0, 1] type 1 family 0 port 256 - 0 [ 945.491727][T21905] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 945.596381][T21418] batadv0: left promiscuous mode [ 945.659636][T28988] ip6gre1: entered promiscuous mode [ 945.659662][T28988] ip6gre1: entered allmulticast mode [ 945.877783][T28992] x_tables: duplicate underflow at hook 2 [ 946.089416][T28995] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5636'. [ 946.238322][T28999] .`: (slave syz_tun): Releasing backup interface [ 946.293710][T28999] syz_tun: entered promiscuous mode [ 946.295172][T28999] team0: Port device syz_tun added [ 946.403694][T29007] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5640'. [ 946.533520][T29007] netlink: 28 bytes leftover after parsing attributes in process `syz.0.5640'. [ 946.540822][T29007] netlink: 28 bytes leftover after parsing attributes in process `syz.0.5640'. [ 946.541402][T29007] netlink: 16 bytes leftover after parsing attributes in process `syz.0.5640'. [ 946.816135][T29020] x_tables: ip6_tables: TCPMSS target: only valid for protocol 6 [ 946.849849][T29020] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5645'. [ 946.904815][T29023] FAULT_INJECTION: forcing a failure. [ 946.904815][T29023] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 946.904853][T29023] CPU: 1 UID: 0 PID: 29023 Comm: syz.4.5646 Not tainted syzkaller #0 PREEMPT(full) [ 946.904880][T29023] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 946.904895][T29023] Call Trace: [ 946.904905][T29023] [ 946.904916][T29023] dump_stack_lvl+0xe8/0x150 [ 946.904957][T29023] should_fail_ex+0x410/0x560 [ 946.904990][T29023] _copy_to_user+0x31/0xb0 [ 946.905023][T29023] bpf_verifier_vlog+0x496/0x900 [ 946.905074][T29023] bpf_verifier_log_write+0x11d/0x1a0 [ 946.905105][T29023] ? __pfx_bpf_verifier_log_write+0x10/0x10 [ 946.905127][T29023] ? __kvmalloc_node_noprof+0x52f/0x820 [ 946.905157][T29023] ? record_arg_access+0x148/0x970 [ 946.905195][T29023] analyze_subprog+0x5d7c/0x9e00 [ 946.905222][T29023] ? probe_event_enable+0x6df/0xae0 [ 946.905313][T29023] ? __pfx_analyze_subprog+0x10/0x10 [ 946.905343][T29023] ? __x64_sys_bpf+0xba/0xd0 [ 946.905364][T29023] ? rsc_parse+0xc2/0xd00 [ 946.905392][T29023] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 946.905461][T29023] ? call_instance+0x263/0x560 [ 946.905487][T29023] ? rcu_is_watching+0x16/0xb0 [ 946.905517][T29023] ? call_instance+0x263/0x560 [ 946.905541][T29023] ? trace_kmalloc+0x2a/0xf0 [ 946.905579][T29023] ? call_instance+0x263/0x560 [ 946.905605][T29023] ? __kvmalloc_node_noprof+0x52f/0x820 [ 946.905633][T29023] ? __kvmalloc_node_noprof+0x345/0x820 [ 946.905658][T29023] ? call_instance+0x263/0x560 [ 946.905682][T29023] ? call_instance+0x263/0x560 [ 946.905729][T29023] bpf_compute_subprog_arg_access+0x2c9/0x14d0 [ 946.905757][T29023] ? bpf_tracing_func_proto+0x72/0x180 [ 946.905817][T29023] ? __pfx_bpf_compute_subprog_arg_access+0x10/0x10 [ 946.905854][T29023] ? __kvmalloc_node_noprof+0x345/0x820 [ 946.905879][T29023] ? bpf_compute_live_registers+0x14f/0x1ff0 [ 946.905906][T29023] ? bpf_compute_live_registers+0x14f/0x1ff0 [ 946.905943][T29023] bpf_compute_live_registers+0x8d3/0x1ff0 [ 946.905993][T29023] ? __pfx_bpf_compute_live_registers+0x10/0x10 [ 946.906035][T29023] bpf_check+0x25ed/0x2e10 [ 946.906074][T29023] ? ktime_get_with_offset+0x93/0x2d0 [ 946.906105][T29023] ? __pfx_bpf_check+0x10/0x10 [ 946.906134][T29023] ? bpf_obj_name_cpy+0x194/0x1e0 [ 946.906173][T29023] bpf_prog_load+0x14d6/0x1c20 [ 946.906216][T29023] ? __pfx_bpf_prog_load+0x10/0x10 [ 946.906273][T29023] __sys_bpf+0xd0d/0xd90 [ 946.906317][T29023] ? __pfx___sys_bpf+0x10/0x10 [ 946.906358][T29023] ? __fget_files+0x2a/0x420 [ 946.906411][T29023] ? ksys_write+0x242/0x270 [ 946.906449][T29023] ? __pfx_ksys_write+0x10/0x10 [ 946.906492][T29023] __x64_sys_bpf+0xba/0xd0 [ 946.906519][T29023] do_syscall_64+0x166/0x520 [ 946.906545][T29023] ? trace_irq_disable+0x3b/0x140 [ 946.906569][T29023] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 946.906594][T29023] ? clear_bhb_loop+0x70/0xc0 [ 946.906623][T29023] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 946.906647][T29023] RIP: 0033:0x7f87aa59e159 [ 946.906670][T29023] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 946.906692][T29023] RSP: 002b:00007f87ab4b4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 946.906717][T29023] RAX: ffffffffffffffda RBX: 00007f87aa825fa0 RCX: 00007f87aa59e159 [ 946.906735][T29023] RDX: 0000000000000094 RSI: 0000200000000100 RDI: 0000000000000005 [ 946.906752][T29023] RBP: 00007f87ab4b4090 R08: 0000000000000000 R09: 0000000000000000 [ 946.906767][T29023] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 946.906782][T29023] R13: 00007f87aa826038 R14: 00007f87aa825fa0 R15: 00007ffc7fa1bd68 [ 946.906819][T29023] [ 947.131661][ C1] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 947.487502][T29020] netlink: 20 bytes leftover after parsing attributes in process `syz.3.5645'. [ 947.599627][T29038] netlink: 172 bytes leftover after parsing attributes in process `syz.4.5647'. [ 947.802253][T29043] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5650'. [ 948.075022][T29047] syz_tun: left promiscuous mode [ 948.075210][T29047] syz_tun: left allmulticast mode [ 948.145954][T29047] team0: Port device syz_tun removed [ 948.147600][T29047] team0: left allmulticast mode [ 948.147623][T29047] team_slave_1: left allmulticast mode [ 948.147874][T29047] team0: left promiscuous mode [ 948.147891][T29047] team_slave_0: left promiscuous mode [ 948.148093][T29047] team_slave_1: left promiscuous mode [ 948.148817][T29047] bridge0: port 4(team0) entered disabled state [ 948.203481][T29050] netlink: 'syz.4.5652': attribute type 1 has an invalid length. [ 948.301822][T29047] bridge_slave_0: left promiscuous mode [ 948.302102][T29047] bridge0: port 1(bridge_slave_0) entered disabled state [ 948.325384][T28155] udevd[28155]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 948.400985][T29047] bridge_slave_1: left allmulticast mode [ 948.401016][T29047] bridge_slave_1: left promiscuous mode [ 948.401216][T29047] bridge0: port 2(bridge_slave_1) entered disabled state [ 948.492089][T29047] team0: Port device team_slave_0 removed [ 948.530201][T29047] team0: Port device team_slave_1 removed [ 948.533517][T29047] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 948.614479][T29070] netlink: 'syz.2.5657': attribute type 4 has an invalid length. [ 948.627982][T29071] netlink: 'syz.2.5657': attribute type 4 has an invalid length. [ 948.820007][T29069] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5657'. [ 948.820069][T29069] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5657'. [ 949.055321][T29079] ip6t_rt: `--rt-type 0' required before `--rt-0-*' [ 949.144846][T29079] mac80211_hwsim hwsim47 syzkaller0: left promiscuous mode [ 949.144915][T29079] mac80211_hwsim hwsim47 syzkaller0: left allmulticast mode [ 949.737732][T29097] tipc: Enabling of bearer rejected, already enabled [ 949.747489][T29097] mac80211_hwsim hwsim47 syzkaller0: entered promiscuous mode [ 949.747517][T29097] mac80211_hwsim hwsim47 syzkaller0: entered allmulticast mode [ 949.872768][T29102] netlink: 'syz.1.5667': attribute type 3 has an invalid length. [ 949.963816][T29106] FAULT_INJECTION: forcing a failure. [ 949.963816][T29106] name failslab, interval 1, probability 0, space 0, times 0 [ 949.963854][T29106] CPU: 1 UID: 0 PID: 29106 Comm: syz.1.5669 Not tainted syzkaller #0 PREEMPT(full) [ 949.963881][T29106] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 949.963896][T29106] Call Trace: [ 949.963906][T29106] [ 949.963917][T29106] dump_stack_lvl+0xe8/0x150 [ 949.963956][T29106] should_fail_ex+0x410/0x560 [ 949.963988][T29106] should_failslab+0xa8/0x100 [ 949.964020][T29106] __kvmalloc_node_noprof+0x176/0x820 [ 949.964049][T29106] ? __kvmalloc_node_noprof+0x345/0x820 [ 949.964074][T29106] ? bpf_compute_scc+0xa26/0xb10 [ 949.964096][T29106] ? bpf_compute_scc+0xa26/0xb10 [ 949.964127][T29106] bpf_compute_scc+0xa26/0xb10 [ 949.964174][T29106] bpf_check+0x25c9/0x2e10 [ 949.964217][T29106] ? ktime_get_with_offset+0x93/0x2d0 [ 949.964245][T29106] ? __pfx_bpf_check+0x10/0x10 [ 949.964274][T29106] ? bpf_obj_name_cpy+0x194/0x1e0 [ 949.964310][T29106] bpf_prog_load+0x14d6/0x1c20 [ 949.964350][T29106] ? __pfx_bpf_prog_load+0x10/0x10 [ 949.964409][T29106] __sys_bpf+0xd0d/0xd90 [ 949.964445][T29106] ? __pfx___sys_bpf+0x10/0x10 [ 949.964483][T29106] ? __fget_files+0x2a/0x420 [ 949.964533][T29106] ? ksys_write+0x242/0x270 [ 949.964571][T29106] ? __pfx_ksys_write+0x10/0x10 [ 949.964610][T29106] __x64_sys_bpf+0xba/0xd0 [ 949.964636][T29106] do_syscall_64+0x166/0x520 [ 949.964661][T29106] ? trace_irq_disable+0x3b/0x140 [ 949.964684][T29106] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 949.964708][T29106] ? clear_bhb_loop+0x70/0xc0 [ 949.964738][T29106] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 949.964762][T29106] RIP: 0033:0x7fe700d9e159 [ 949.964784][T29106] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 949.964805][T29106] RSP: 002b:00007fe701bf0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 949.964831][T29106] RAX: ffffffffffffffda RBX: 00007fe701025fa0 RCX: 00007fe700d9e159 [ 949.964850][T29106] RDX: 0000000000000094 RSI: 0000200000000240 RDI: 0000000000000005 [ 949.964866][T29106] RBP: 00007fe701bf0090 R08: 0000000000000000 R09: 0000000000000000 [ 949.964881][T29106] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 949.964896][T29106] R13: 00007fe701026038 R14: 00007fe701025fa0 R15: 00007ffdcd2d4438 [ 949.964933][T29106] [ 950.832899][T29131] tap0: tun_chr_ioctl cmd 1074025677 [ 950.833032][T29131] tap0: linktype set to 805 [ 950.923272][T29131] netlink: 'syz.3.5676': attribute type 1 has an invalid length. [ 951.063762][T29139] team0: Port device syz_tun added [ 951.461571][T29146] FAULT_INJECTION: forcing a failure. [ 951.461571][T29146] name failslab, interval 1, probability 0, space 0, times 0 [ 951.461612][T29146] CPU: 1 UID: 0 PID: 29146 Comm: syz.3.5680 Not tainted syzkaller #0 PREEMPT(full) [ 951.461639][T29146] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 951.461654][T29146] Call Trace: [ 951.461664][T29146] [ 951.461675][T29146] dump_stack_lvl+0xe8/0x150 [ 951.461715][T29146] should_fail_ex+0x410/0x560 [ 951.461748][T29146] should_failslab+0xa8/0x100 [ 951.461781][T29146] __kvmalloc_node_noprof+0x176/0x820 [ 951.461811][T29146] ? __kvmalloc_node_noprof+0x345/0x820 [ 951.461837][T29146] ? bpf_compute_subprog_arg_access+0x187/0x14d0 [ 951.461865][T29146] ? bpf_compute_subprog_arg_access+0x187/0x14d0 [ 951.461906][T29146] bpf_compute_subprog_arg_access+0x187/0x14d0 [ 951.461936][T29146] ? __pfx_lwt_seg6local_func_proto+0x10/0x10 [ 951.461967][T29146] ? bpf_get_trace_printk_proto+0x48/0x60 [ 951.462028][T29146] ? __pfx_bpf_compute_subprog_arg_access+0x10/0x10 [ 951.462064][T29146] ? __kvmalloc_node_noprof+0x345/0x820 [ 951.462090][T29146] ? bpf_compute_live_registers+0x14f/0x1ff0 [ 951.462116][T29146] ? bpf_compute_live_registers+0x14f/0x1ff0 [ 951.462153][T29146] bpf_compute_live_registers+0x8d3/0x1ff0 [ 951.462204][T29146] ? __pfx_bpf_compute_live_registers+0x10/0x10 [ 951.462245][T29146] bpf_check+0x25ed/0x2e10 [ 951.462284][T29146] ? ktime_get_with_offset+0x93/0x2d0 [ 951.462316][T29146] ? __pfx_bpf_check+0x10/0x10 [ 951.462352][T29146] ? bpf_obj_name_cpy+0x194/0x1e0 [ 951.462392][T29146] bpf_prog_load+0x14d6/0x1c20 [ 951.462434][T29146] ? __pfx_bpf_prog_load+0x10/0x10 [ 951.462491][T29146] __sys_bpf+0xd0d/0xd90 [ 951.462528][T29146] ? __pfx___sys_bpf+0x10/0x10 [ 951.462569][T29146] ? __fget_files+0x2a/0x420 [ 951.462623][T29146] ? ksys_write+0x242/0x270 [ 951.462662][T29146] ? __pfx_ksys_write+0x10/0x10 [ 951.462703][T29146] __x64_sys_bpf+0xba/0xd0 [ 951.462732][T29146] do_syscall_64+0x166/0x520 [ 951.462757][T29146] ? trace_irq_disable+0x3b/0x140 [ 951.462781][T29146] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 951.462807][T29146] ? clear_bhb_loop+0x70/0xc0 [ 951.462836][T29146] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 951.462861][T29146] RIP: 0033:0x7fe76c79e159 [ 951.462883][T29146] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 951.462904][T29146] RSP: 002b:00007fe76d660028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 951.462931][T29146] RAX: ffffffffffffffda RBX: 00007fe76ca25fa0 RCX: 00007fe76c79e159 [ 951.462949][T29146] RDX: 0000000000000094 RSI: 0000200000000240 RDI: 0000000000000005 [ 951.462965][T29146] RBP: 00007fe76d660090 R08: 0000000000000000 R09: 0000000000000000 [ 951.462980][T29146] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 951.462995][T29146] R13: 00007fe76ca26038 R14: 00007fe76ca25fa0 R15: 00007ffcdaf7a868 [ 951.463033][T29146] [ 951.888945][T29150] x_tables: duplicate underflow at hook 1 [ 951.983834][T29150] __nla_validate_parse: 5 callbacks suppressed [ 951.983860][T29150] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5681'. [ 952.077475][T29158] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5685'. [ 952.118945][T29164] netlink: 'syz.3.5681': attribute type 1 has an invalid length. [ 952.436751][T29171] ip6tnl0: entered allmulticast mode [ 952.655732][T29176] pim6reg: entered allmulticast mode [ 952.683426][T29176] pim6reg: left allmulticast mode [ 953.310409][T29196] netlink: 36 bytes leftover after parsing attributes in process `syz.1.5695'. [ 953.360643][T29192] netlink: 32 bytes leftover after parsing attributes in process `syz.4.5694'. [ 953.612186][T29209] netlink: 'syz.0.5699': attribute type 8 has an invalid length. [ 953.612212][T29209] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5699'. [ 953.642581][T29209] veth1_to_team: entered promiscuous mode [ 953.646688][T29209] gretap0: entered promiscuous mode [ 953.762739][T29209] veth1_to_team: left promiscuous mode [ 953.764328][T29209] gretap0: left promiscuous mode [ 953.924304][T29213] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5701'. [ 954.036362][T29218] FAULT_INJECTION: forcing a failure. [ 954.036362][T29218] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 954.036399][T29218] CPU: 1 UID: 0 PID: 29218 Comm: syz.0.5702 Not tainted syzkaller #0 PREEMPT(full) [ 954.036425][T29218] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 954.036440][T29218] Call Trace: [ 954.036448][T29218] [ 954.036458][T29218] dump_stack_lvl+0xe8/0x150 [ 954.036497][T29218] should_fail_ex+0x410/0x560 [ 954.036528][T29218] _copy_to_user+0x31/0xb0 [ 954.036580][T29218] bpf_verifier_vlog+0x496/0x900 [ 954.036631][T29218] bpf_verifier_log_write+0x11d/0x1a0 [ 954.036661][T29218] ? __pfx_bpf_verifier_log_write+0x10/0x10 [ 954.036682][T29218] ? __kvmalloc_node_noprof+0x52f/0x820 [ 954.036707][T29218] ? record_arg_access+0x148/0x970 [ 954.036736][T29218] analyze_subprog+0x5d98/0x9e00 [ 954.036757][T29218] ? probe_event_enable+0x6df/0xae0 [ 954.036819][T29218] ? __pfx_analyze_subprog+0x10/0x10 [ 954.036839][T29218] ? __x64_sys_bpf+0xba/0xd0 [ 954.036855][T29218] ? rsc_parse+0xc2/0xd00 [ 954.036877][T29218] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 954.036928][T29218] ? call_instance+0x263/0x560 [ 954.036948][T29218] ? rcu_is_watching+0x16/0xb0 [ 954.036970][T29218] ? call_instance+0x263/0x560 [ 954.036989][T29218] ? trace_kmalloc+0x2a/0xf0 [ 954.037019][T29218] ? call_instance+0x263/0x560 [ 954.037038][T29218] ? __kvmalloc_node_noprof+0x52f/0x820 [ 954.037059][T29218] ? __kvmalloc_node_noprof+0x345/0x820 [ 954.037078][T29218] ? call_instance+0x263/0x560 [ 954.037097][T29218] ? call_instance+0x263/0x560 [ 954.037138][T29218] bpf_compute_subprog_arg_access+0x2c9/0x14d0 [ 954.037160][T29218] ? bpf_tracing_func_proto+0x72/0x180 [ 954.037206][T29218] ? __pfx_bpf_compute_subprog_arg_access+0x10/0x10 [ 954.037234][T29218] ? __kvmalloc_node_noprof+0x345/0x820 [ 954.037253][T29218] ? bpf_compute_live_registers+0x14f/0x1ff0 [ 954.037273][T29218] ? bpf_compute_live_registers+0x14f/0x1ff0 [ 954.037302][T29218] bpf_compute_live_registers+0x8d3/0x1ff0 [ 954.037340][T29218] ? __pfx_bpf_compute_live_registers+0x10/0x10 [ 954.037372][T29218] bpf_check+0x25ed/0x2e10 [ 954.037401][T29218] ? ktime_get_with_offset+0x93/0x2d0 [ 954.037424][T29218] ? __pfx_bpf_check+0x10/0x10 [ 954.037447][T29218] ? bpf_obj_name_cpy+0x194/0x1e0 [ 954.037477][T29218] bpf_prog_load+0x14d6/0x1c20 [ 954.037508][T29218] ? __pfx_bpf_prog_load+0x10/0x10 [ 954.037552][T29218] __sys_bpf+0xd0d/0xd90 [ 954.037579][T29218] ? __pfx___sys_bpf+0x10/0x10 [ 954.037612][T29218] ? __fget_files+0x2a/0x420 [ 954.037653][T29218] ? ksys_write+0x242/0x270 [ 954.037683][T29218] ? __pfx_ksys_write+0x10/0x10 [ 954.037716][T29218] __x64_sys_bpf+0xba/0xd0 [ 954.037737][T29218] do_syscall_64+0x166/0x520 [ 954.037756][T29218] ? trace_irq_disable+0x3b/0x140 [ 954.037774][T29218] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 954.037793][T29218] ? clear_bhb_loop+0x70/0xc0 [ 954.037816][T29218] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 954.037835][T29218] RIP: 0033:0x7f266eb9e159 [ 954.037852][T29218] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 954.037868][T29218] RSP: 002b:00007f266fa75028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 954.037889][T29218] RAX: ffffffffffffffda RBX: 00007f266ee25fa0 RCX: 00007f266eb9e159 [ 954.037903][T29218] RDX: 0000000000000094 RSI: 0000200000000100 RDI: 0000000000000005 [ 954.037915][T29218] RBP: 00007f266fa75090 R08: 0000000000000000 R09: 0000000000000000 [ 954.037927][T29218] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 954.037939][T29218] R13: 00007f266ee26038 R14: 00007f266ee25fa0 R15: 00007ffe2863f718 [ 954.037967][T29218] [ 954.546560][T29224] veth0: entered promiscuous mode [ 954.557763][T29223] veth0: left promiscuous mode [ 954.644885][T29230] openvswitch: netlink: Multiple metadata blocks provided [ 954.686087][T29230] bond9: Removing last arp target with arp_interval on [ 955.111032][T29242] netlink: 32 bytes leftover after parsing attributes in process `syz.4.5711'. [ 955.111106][T29242] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5711'. [ 955.293344][T29254] siw: device registration error -23 [ 955.338928][T29255] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5715'. [ 955.365987][T29259] netlink: 28 bytes leftover after parsing attributes in process `syz.4.5714'. [ 955.835955][T29284] IPVS: set_ctl: invalid protocol: 12037 0.0.0.0:0 [ 955.848763][T29284] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 955.869968][T29284] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 957.257335][T29337] gre1: entered promiscuous mode [ 957.335373][T29345] FAULT_INJECTION: forcing a failure. [ 957.335373][T29345] name failslab, interval 1, probability 0, space 0, times 0 [ 957.335411][T29345] CPU: 1 UID: 0 PID: 29345 Comm: syz.4.5739 Not tainted syzkaller #0 PREEMPT(full) [ 957.335438][T29345] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 957.335452][T29345] Call Trace: [ 957.335462][T29345] [ 957.335473][T29345] dump_stack_lvl+0xe8/0x150 [ 957.335513][T29345] should_fail_ex+0x410/0x560 [ 957.335545][T29345] should_failslab+0xa8/0x100 [ 957.335577][T29345] __kvmalloc_node_noprof+0x176/0x820 [ 957.335605][T29345] ? __kvmalloc_node_noprof+0x345/0x820 [ 957.335630][T29345] ? analyze_subprog+0x8ac/0x9e00 [ 957.335656][T29345] ? analyze_subprog+0x8ac/0x9e00 [ 957.335694][T29345] analyze_subprog+0x8ac/0x9e00 [ 957.335721][T29345] ? is_bpf_text_address+0x292/0x2b0 [ 957.335755][T29345] ? kernel_text_address+0xa5/0xe0 [ 957.335812][T29345] ? __pfx_stack_trace_save+0x10/0x10 [ 957.335865][T29345] ? call_instance+0x263/0x560 [ 957.335889][T29345] ? bpf_compute_subprog_arg_access+0x2a3/0x14d0 [ 957.335915][T29345] ? bpf_compute_live_registers+0x8d3/0x1ff0 [ 957.335944][T29345] ? __pfx_analyze_subprog+0x10/0x10 [ 957.335968][T29345] ? __x64_sys_bpf+0xba/0xd0 [ 957.335990][T29345] ? do_syscall_64+0x166/0x520 [ 957.336013][T29345] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 957.336081][T29345] ? call_instance+0x263/0x560 [ 957.336107][T29345] ? rcu_is_watching+0x16/0xb0 [ 957.336134][T29345] ? call_instance+0x263/0x560 [ 957.336158][T29345] ? trace_kmalloc+0x2a/0xf0 [ 957.336195][T29345] ? call_instance+0x263/0x560 [ 957.336220][T29345] ? __kvmalloc_node_noprof+0x52f/0x820 [ 957.336247][T29345] ? __kvmalloc_node_noprof+0x345/0x820 [ 957.336271][T29345] ? call_instance+0x263/0x560 [ 957.336314][T29345] ? call_instance+0x263/0x560 [ 957.336348][T29345] ? call_instance+0x42e/0x560 [ 957.336383][T29345] bpf_compute_subprog_arg_access+0x2c9/0x14d0 [ 957.336412][T29345] ? __pfx_lwt_seg6local_func_proto+0x10/0x10 [ 957.336443][T29345] ? bpf_get_trace_printk_proto+0x48/0x60 [ 957.336501][T29345] ? __pfx_bpf_compute_subprog_arg_access+0x10/0x10 [ 957.336536][T29345] ? __kvmalloc_node_noprof+0x345/0x820 [ 957.336561][T29345] ? bpf_compute_live_registers+0x14f/0x1ff0 [ 957.336587][T29345] ? bpf_compute_live_registers+0x14f/0x1ff0 [ 957.336623][T29345] bpf_compute_live_registers+0x8d3/0x1ff0 [ 957.336673][T29345] ? __pfx_bpf_compute_live_registers+0x10/0x10 [ 957.336713][T29345] bpf_check+0x25ed/0x2e10 [ 957.336752][T29345] ? ktime_get_with_offset+0x93/0x2d0 [ 957.336783][T29345] ? __pfx_bpf_check+0x10/0x10 [ 957.336818][T29345] ? bpf_obj_name_cpy+0x194/0x1e0 [ 957.336862][T29345] bpf_prog_load+0x14d6/0x1c20 [ 957.336903][T29345] ? __pfx_bpf_prog_load+0x10/0x10 [ 957.336959][T29345] __sys_bpf+0xd0d/0xd90 [ 957.336994][T29345] ? __pfx___sys_bpf+0x10/0x10 [ 957.337033][T29345] ? __fget_files+0x2a/0x420 [ 957.337085][T29345] ? ksys_write+0x242/0x270 [ 957.337123][T29345] ? __pfx_ksys_write+0x10/0x10 [ 957.337163][T29345] __x64_sys_bpf+0xba/0xd0 [ 957.337189][T29345] do_syscall_64+0x166/0x520 [ 957.337213][T29345] ? trace_irq_disable+0x3b/0x140 [ 957.337236][T29345] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 957.337259][T29345] ? clear_bhb_loop+0x70/0xc0 [ 957.337288][T29345] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 957.337311][T29345] RIP: 0033:0x7f87aa59e159 [ 957.337333][T29345] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 957.337354][T29345] RSP: 002b:00007f87ab4b4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 957.337380][T29345] RAX: ffffffffffffffda RBX: 00007f87aa825fa0 RCX: 00007f87aa59e159 [ 957.337398][T29345] RDX: 0000000000000094 RSI: 0000200000000240 RDI: 0000000000000005 [ 957.337413][T29345] RBP: 00007f87ab4b4090 R08: 0000000000000000 R09: 0000000000000000 [ 957.337428][T29345] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 957.337442][T29345] R13: 00007f87aa826038 R14: 00007f87aa825fa0 R15: 00007ffc7fa1bd68 [ 957.337480][T29345] [ 957.372360][ C1] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 957.617165][T29341] __nla_validate_parse: 4 callbacks suppressed [ 957.617230][T29341] netlink: 20 bytes leftover after parsing attributes in process `syz.0.5737'. [ 957.617282][T29341] netlink: 24 bytes leftover after parsing attributes in process `syz.0.5737'. [ 958.025548][T29358] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5742'. [ 958.307586][T29368] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5744'. [ 958.764067][T29382] netlink: 36 bytes leftover after parsing attributes in process `syz.4.5748'. [ 959.652423][T29418] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5754'. [ 959.652522][T29418] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5754'. [ 959.795715][T29422] openvswitch: netlink: Flow actions attr not present in new flow. [ 960.019452][T21906] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 960.019525][T21906] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 960.019565][T21906] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 960.019604][T21906] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 960.154965][T29436] netlink: 56 bytes leftover after parsing attributes in process `syz.2.5759'. [ 961.285761][T29489] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5771'. [ 961.901125][T29502] netlink: 65039 bytes leftover after parsing attributes in process `syz.0.5776'. [ 962.095973][T29511] FAULT_INJECTION: forcing a failure. [ 962.095973][T29511] name failslab, interval 1, probability 0, space 0, times 0 [ 962.096018][T29511] CPU: 1 UID: 0 PID: 29511 Comm: syz.1.5779 Not tainted syzkaller #0 PREEMPT(full) [ 962.096047][T29511] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 962.096064][T29511] Call Trace: [ 962.096075][T29511] [ 962.096086][T29511] dump_stack_lvl+0xe8/0x150 [ 962.096132][T29511] should_fail_ex+0x410/0x560 [ 962.096167][T29511] should_failslab+0xa8/0x100 [ 962.096204][T29511] __kvmalloc_node_noprof+0x176/0x820 [ 962.096236][T29511] ? __kvmalloc_node_noprof+0x345/0x820 [ 962.096264][T29511] ? analyze_subprog+0x8ac/0x9e00 [ 962.096293][T29511] ? analyze_subprog+0x8ac/0x9e00 [ 962.096332][T29511] analyze_subprog+0x8ac/0x9e00 [ 962.096361][T29511] ? is_bpf_text_address+0x292/0x2b0 [ 962.096401][T29511] ? kernel_text_address+0xa5/0xe0 [ 962.096468][T29511] ? __pfx_stack_trace_save+0x10/0x10 [ 962.096529][T29511] ? call_instance+0x263/0x560 [ 962.096557][T29511] ? bpf_compute_subprog_arg_access+0x2a3/0x14d0 [ 962.096587][T29511] ? bpf_compute_live_registers+0x8d3/0x1ff0 [ 962.096619][T29511] ? __pfx_analyze_subprog+0x10/0x10 [ 962.096648][T29511] ? __x64_sys_bpf+0xba/0xd0 [ 962.096671][T29511] ? do_syscall_64+0x166/0x520 [ 962.096699][T29511] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 962.096775][T29511] ? call_instance+0x263/0x560 [ 962.096804][T29511] ? rcu_is_watching+0x16/0xb0 [ 962.096835][T29511] ? call_instance+0x263/0x560 [ 962.096862][T29511] ? trace_kmalloc+0x2a/0xf0 [ 962.096904][T29511] ? call_instance+0x263/0x560 [ 962.096933][T29511] ? __kvmalloc_node_noprof+0x52f/0x820 [ 962.096964][T29511] ? __kvmalloc_node_noprof+0x345/0x820 [ 962.096992][T29511] ? call_instance+0x263/0x560 [ 962.097020][T29511] ? call_instance+0x263/0x560 [ 962.097058][T29511] ? call_instance+0x42e/0x560 [ 962.097097][T29511] bpf_compute_subprog_arg_access+0x2c9/0x14d0 [ 962.097130][T29511] ? __pfx_lwt_seg6local_func_proto+0x10/0x10 [ 962.097163][T29511] ? bpf_get_trace_printk_proto+0x48/0x60 [ 962.097234][T29511] ? __pfx_bpf_compute_subprog_arg_access+0x10/0x10 [ 962.097274][T29511] ? __kvmalloc_node_noprof+0x345/0x820 [ 962.097302][T29511] ? bpf_compute_live_registers+0x14f/0x1ff0 [ 962.097332][T29511] ? bpf_compute_live_registers+0x14f/0x1ff0 [ 962.097372][T29511] bpf_compute_live_registers+0x8d3/0x1ff0 [ 962.097428][T29511] ? __pfx_bpf_compute_live_registers+0x10/0x10 [ 962.097481][T29511] bpf_check+0x25ed/0x2e10 [ 962.097524][T29511] ? ktime_get_with_offset+0x93/0x2d0 [ 962.097558][T29511] ? __pfx_bpf_check+0x10/0x10 [ 962.097591][T29511] ? bpf_obj_name_cpy+0x194/0x1e0 [ 962.097633][T29511] bpf_prog_load+0x14d6/0x1c20 [ 962.097680][T29511] ? __pfx_bpf_prog_load+0x10/0x10 [ 962.097743][T29511] __sys_bpf+0xd0d/0xd90 [ 962.097784][T29511] ? __pfx___sys_bpf+0x10/0x10 [ 962.097828][T29511] ? __fget_files+0x2a/0x420 [ 962.097888][T29511] ? ksys_write+0x242/0x270 [ 962.097930][T29511] ? __pfx_ksys_write+0x10/0x10 [ 962.097977][T29511] __x64_sys_bpf+0xba/0xd0 [ 962.098008][T29511] do_syscall_64+0x166/0x520 [ 962.098035][T29511] ? trace_irq_disable+0x3b/0x140 [ 962.098062][T29511] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 962.098089][T29511] ? clear_bhb_loop+0x70/0xc0 [ 962.098122][T29511] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 962.098149][T29511] RIP: 0033:0x7fe700d9e159 [ 962.098174][T29511] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 962.098197][T29511] RSP: 002b:00007fe701bf0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 962.098226][T29511] RAX: ffffffffffffffda RBX: 00007fe701025fa0 RCX: 00007fe700d9e159 [ 962.098246][T29511] RDX: 0000000000000094 RSI: 0000200000000240 RDI: 0000000000000005 [ 962.098263][T29511] RBP: 00007fe701bf0090 R08: 0000000000000000 R09: 0000000000000000 [ 962.098280][T29511] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 962.098297][T29511] R13: 00007fe701026038 R14: 00007fe701025fa0 R15: 00007ffdcd2d4438 [ 962.098339][T29511] [ 962.667109][T29509] team0: Port device syz_tun removed [ 962.782523][T29513] llcp: llcp_sock_recvmsg: Recv datagram failed state 4 -107 0 [ 962.785017][T29509] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 962.828209][T29513] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5781'. [ 962.899636][T29518] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5781'. [ 963.549804][T29545] FAULT_INJECTION: forcing a failure. [ 963.549804][T29545] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 963.549843][T29545] CPU: 1 UID: 0 PID: 29545 Comm: syz.1.5788 Not tainted syzkaller #0 PREEMPT(full) [ 963.549870][T29545] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 963.549885][T29545] Call Trace: [ 963.549895][T29545] [ 963.549907][T29545] dump_stack_lvl+0xe8/0x150 [ 963.549947][T29545] should_fail_ex+0x410/0x560 [ 963.549980][T29545] _copy_to_user+0x31/0xb0 [ 963.550013][T29545] bpf_verifier_vlog+0x496/0x900 [ 963.550065][T29545] bpf_verifier_log_write+0x11d/0x1a0 [ 963.550098][T29545] ? __pfx_bpf_verifier_log_write+0x10/0x10 [ 963.550125][T29545] ? record_arg_access+0x148/0x970 [ 963.550164][T29545] analyze_subprog+0x5d98/0x9e00 [ 963.550191][T29545] ? probe_event_enable+0x6df/0xae0 [ 963.550276][T29545] ? __pfx_analyze_subprog+0x10/0x10 [ 963.550301][T29545] ? __x64_sys_bpf+0xba/0xd0 [ 963.550321][T29545] ? rsc_parse+0xc2/0xd00 [ 963.550348][T29545] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 963.550423][T29545] ? call_instance+0x263/0x560 [ 963.550449][T29545] ? rcu_is_watching+0x16/0xb0 [ 963.550478][T29545] ? call_instance+0x263/0x560 [ 963.550502][T29545] ? trace_kmalloc+0x2a/0xf0 [ 963.550541][T29545] ? call_instance+0x263/0x560 [ 963.550566][T29545] ? __kvmalloc_node_noprof+0x52f/0x820 [ 963.550595][T29545] ? __kvmalloc_node_noprof+0x345/0x820 [ 963.550621][T29545] ? call_instance+0x263/0x560 [ 963.550649][T29545] ? call_instance+0x263/0x560 [ 963.550694][T29545] bpf_compute_subprog_arg_access+0x2c9/0x14d0 [ 963.550724][T29545] ? bpf_tracing_func_proto+0x72/0x180 [ 963.550784][T29545] ? __pfx_bpf_compute_subprog_arg_access+0x10/0x10 [ 963.550820][T29545] ? __kvmalloc_node_noprof+0x345/0x820 [ 963.550845][T29545] ? bpf_compute_live_registers+0x14f/0x1ff0 [ 963.550871][T29545] ? bpf_compute_live_registers+0x14f/0x1ff0 [ 963.550908][T29545] bpf_compute_live_registers+0x8d3/0x1ff0 [ 963.550956][T29545] ? __pfx_bpf_compute_live_registers+0x10/0x10 [ 963.550998][T29545] bpf_check+0x25ed/0x2e10 [ 963.551036][T29545] ? ktime_get_with_offset+0x93/0x2d0 [ 963.551067][T29545] ? __pfx_bpf_check+0x10/0x10 [ 963.551095][T29545] ? bpf_obj_name_cpy+0x194/0x1e0 [ 963.551133][T29545] bpf_prog_load+0x14d6/0x1c20 [ 963.551174][T29545] ? __pfx_bpf_prog_load+0x10/0x10 [ 963.551228][T29545] __sys_bpf+0xd0d/0xd90 [ 963.551265][T29545] ? __pfx___sys_bpf+0x10/0x10 [ 963.551304][T29545] ? __fget_files+0x2a/0x420 [ 963.551355][T29545] ? ksys_write+0x242/0x270 [ 963.551401][T29545] ? __pfx_ksys_write+0x10/0x10 [ 963.551441][T29545] __x64_sys_bpf+0xba/0xd0 [ 963.551469][T29545] do_syscall_64+0x166/0x520 [ 963.551493][T29545] ? trace_irq_disable+0x3b/0x140 [ 963.551516][T29545] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 963.551540][T29545] ? clear_bhb_loop+0x70/0xc0 [ 963.551569][T29545] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 963.551594][T29545] RIP: 0033:0x7fe700d9e159 [ 963.551616][T29545] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 963.551637][T29545] RSP: 002b:00007fe701bf0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 963.551664][T29545] RAX: ffffffffffffffda RBX: 00007fe701025fa0 RCX: 00007fe700d9e159 [ 963.551682][T29545] RDX: 0000000000000094 RSI: 0000200000000100 RDI: 0000000000000005 [ 963.551698][T29545] RBP: 00007fe701bf0090 R08: 0000000000000000 R09: 0000000000000000 [ 963.551713][T29545] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 963.551728][T29545] R13: 00007fe701026038 R14: 00007fe701025fa0 R15: 00007ffdcd2d4438 [ 963.551766][T29545] [ 963.943744][T29547] netlink: 20 bytes leftover after parsing attributes in process `syz.4.5787'. [ 964.045094][T29517] xt_connbytes: Forcing CT accounting to be enabled [ 964.165384][T29552] netlink: 20 bytes leftover after parsing attributes in process `syz.4.5787'. [ 964.165421][T29552] nbd: device at index 64 is going down [ 964.664988][T29563] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5791'. [ 964.705073][T29558] udevd[29558]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 964.746981][T29557] udevd[29557]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 964.786631][T29569] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 965.133719][T29569] xt_CT: No such helper "netbios-ns" [ 965.242639][T29583] netlink: 32 bytes leftover after parsing attributes in process `syz.3.5795'. [ 965.496731][T29586] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5795'. [ 965.497437][T29586] netlink: 'syz.3.5795': attribute type 13 has an invalid length. [ 965.983745][T29601] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5800'. [ 965.983772][T29601] netlink: 24 bytes leftover after parsing attributes in process `syz.3.5800'. [ 967.659698][T29653] netlink: 56 bytes leftover after parsing attributes in process `syz.3.5816'. [ 968.053830][T29676] __nla_validate_parse: 1 callbacks suppressed [ 968.053857][T29676] netlink: 36 bytes leftover after parsing attributes in process `syz.4.5822'. [ 968.120149][T29676] netlink: 'syz.4.5822': attribute type 1 has an invalid length. [ 968.301707][T29685] dvmrp0: left allmulticast mode [ 968.576626][T29692] tipc: Enabling of bearer rejected, failed to enable media [ 968.601695][T29692] netdevsim netdevsim4 netdevsim0: entered allmulticast mode [ 968.619333][T29692] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 968.650445][T29696] tipc: Enabling of bearer rejected, failed to enable media [ 968.651814][T29692] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 968.706170][T29699] netlink: 'syz.3.5828': attribute type 9 has an invalid length. [ 968.706198][T29699] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5828'. [ 968.886607][T29701] netlink: 'syz.1.5829': attribute type 49 has an invalid length. [ 968.909162][T29704] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5830'. [ 969.159087][T29710] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5829'. [ 969.159133][T29710] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 969.413944][T29717] netlink: 'syz.0.5832': attribute type 32 has an invalid length. [ 969.870170][T29730] netlink: 'syz.4.5838': attribute type 21 has an invalid length. [ 969.870200][T29730] netlink: 128 bytes leftover after parsing attributes in process `syz.4.5838'. [ 969.926602][T29730] netlink: 'syz.4.5838': attribute type 5 has an invalid length. [ 969.926629][T29730] netlink: 3 bytes leftover after parsing attributes in process `syz.4.5838'. [ 969.953505][T29730] netlink: 16 bytes leftover after parsing attributes in process `syz.4.5838'. [ 970.107976][T29741] mac80211_hwsim hwsim47 syzkaller0: left promiscuous mode [ 970.108006][T29741] mac80211_hwsim hwsim47 syzkaller0: left allmulticast mode [ 970.133245][T29741] tipc: Enabling of bearer rejected, already enabled [ 970.313519][T29750] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 970.345951][T29749] netlink: 'syz.1.5841': attribute type 7 has an invalid length. [ 970.592311][T29758] sctp: [Deprecated]: syz.4.5844 (pid 29758) Use of struct sctp_assoc_value in delayed_ack socket option. [ 970.592311][T29758] Use struct sctp_sack_info instead [ 970.823608][T29773] netlink: 'syz.3.5849': attribute type 1 has an invalid length. [ 971.412508][T29782] wg2 speed is unknown, defaulting to 1000 [ 972.400940][T29807] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5859'. [ 972.441166][T29783] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5852'. [ 972.541888][T29785] bond0 (unregistering): left promiscuous mode [ 972.541919][T29785] bond_slave_0: left promiscuous mode [ 972.542196][T29785] bond_slave_1: left promiscuous mode [ 972.576421][T29806] netlink: 176 bytes leftover after parsing attributes in process `syz.2.5853'. [ 972.593000][ T8520] smbdirect: ib_dev[syz1] removed [ 972.609830][T29785] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 972.719212][ C1] ip6_tunnel: ip6tnl5 xmit: Local address not yet configured! [ 972.752926][T29785] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 972.773556][T29785] bond0 (unregistering): Released all slaves [ 972.975405][T22366] infiniband syz1: ib_query_port failed (-19) [ 974.261149][T29859] __nla_validate_parse: 1 callbacks suppressed [ 974.261176][T29859] netlink: 16 bytes leftover after parsing attributes in process `syz.1.5870'. [ 974.300077][T29855] netlink: 'syz.3.5868': attribute type 1 has an invalid length. [ 974.695550][T23480] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 974.700024][T23480] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 974.700120][T29855] 8021q: adding VLAN 0 to HW filter on device bond10 [ 974.703026][T23480] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 974.749709][T23480] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 974.752057][T23480] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 974.845298][ T5621] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 974.855751][ T5621] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 974.886092][T29858] veth7: entered allmulticast mode [ 974.889707][T29858] bond10: (slave veth7): Enslaving as an active interface with an up link [ 974.893930][ T5621] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 974.900459][ T5621] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 974.901224][ T5621] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 975.403059][T29878] syzkaller0: entered promiscuous mode [ 975.403089][T29878] syzkaller0: entered allmulticast mode [ 975.424107][T29877] tipc: Enabled bearer , priority 0 [ 975.507696][T21906] tipc: Resetting bearer [ 975.583919][T17540] team0: Port device syz_tun removed [ 975.675621][T29868] tipc: Resetting bearer [ 977.039156][ T5621] Bluetooth: hci0: command tx timeout [ 979.122670][ T5621] Bluetooth: hci0: command tx timeout [ 980.776497][T29868] tipc: Disabling bearer [ 980.846816][T22366] tipc: Node number set to 3595307163 [ 980.994521][T29917] FAULT_INJECTION: forcing a failure. [ 980.994521][T29917] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 980.994559][T29917] CPU: 1 UID: 0 PID: 29917 Comm: syz.0.5880 Not tainted syzkaller #0 PREEMPT(full) [ 980.994584][T29917] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 980.994599][T29917] Call Trace: [ 980.994609][T29917] [ 980.994620][T29917] dump_stack_lvl+0xe8/0x150 [ 980.994659][T29917] should_fail_ex+0x410/0x560 [ 980.994692][T29917] _copy_to_user+0x31/0xb0 [ 980.994725][T29917] bpf_verifier_vlog+0x496/0x900 [ 980.994780][T29917] verbose+0x11d/0x1a0 [ 980.994810][T29917] ? __pfx_verbose+0x10/0x10 [ 980.994834][T29917] ? lock_acquire+0x115/0x350 [ 980.994861][T29917] ? print_bpf_insn+0xdf6/0x2930 [ 980.994888][T29917] ? __func_get_name+0x90/0x260 [ 980.994918][T29917] print_bpf_insn+0xe78/0x2930 [ 980.994948][T29917] ? __pfx_verbose+0x10/0x10 [ 980.994972][T29917] ? __pfx_print_bpf_insn+0x10/0x10 [ 980.995002][T29917] ? _copy_to_user+0x8a/0xb0 [ 980.995033][T29917] ? bpf_verifier_vlog+0x58d/0x900 [ 980.995082][T29917] ? bpf_verifier_log_write+0x11d/0x1a0 [ 980.995110][T29917] bpf_verbose_insn+0xcb/0x130 [ 980.995133][T29917] ? __pfx_bpf_verbose_insn+0x10/0x10 [ 980.995154][T29917] ? __kvmalloc_node_noprof+0x52f/0x820 [ 980.995179][T29917] ? __pfx_verbose+0x10/0x10 [ 980.995199][T29917] ? __pfx_bpf_disasm_kfunc_name+0x10/0x10 [ 980.995231][T29917] ? record_arg_access+0x148/0x970 [ 980.995268][T29917] analyze_subprog+0x5d89/0x9e00 [ 980.995294][T29917] ? probe_event_enable+0x6df/0xae0 [ 980.995376][T29917] ? __pfx_analyze_subprog+0x10/0x10 [ 980.995402][T29917] ? __x64_sys_bpf+0xba/0xd0 [ 980.995423][T29917] ? rsc_parse+0xc2/0xd00 [ 980.995451][T29917] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 980.995519][T29917] ? call_instance+0x263/0x560 [ 980.995557][T29917] ? rcu_is_watching+0x16/0xb0 [ 980.995585][T29917] ? call_instance+0x263/0x560 [ 980.995610][T29917] ? trace_kmalloc+0x2a/0xf0 [ 980.995648][T29917] ? call_instance+0x263/0x560 [ 980.995673][T29917] ? __kvmalloc_node_noprof+0x52f/0x820 [ 980.995701][T29917] ? __kvmalloc_node_noprof+0x345/0x820 [ 980.995726][T29917] ? call_instance+0x263/0x560 [ 980.995751][T29917] ? call_instance+0x263/0x560 [ 980.995796][T29917] bpf_compute_subprog_arg_access+0x2c9/0x14d0 [ 980.995825][T29917] ? bpf_tracing_func_proto+0x72/0x180 [ 980.995885][T29917] ? __pfx_bpf_compute_subprog_arg_access+0x10/0x10 [ 980.995921][T29917] ? __kvmalloc_node_noprof+0x345/0x820 [ 980.995946][T29917] ? bpf_compute_live_registers+0x14f/0x1ff0 [ 980.995973][T29917] ? bpf_compute_live_registers+0x14f/0x1ff0 [ 980.996009][T29917] bpf_compute_live_registers+0x8d3/0x1ff0 [ 980.996059][T29917] ? __pfx_bpf_compute_live_registers+0x10/0x10 [ 980.996100][T29917] bpf_check+0x25ed/0x2e10 [ 980.996138][T29917] ? ktime_get_with_offset+0x93/0x2d0 [ 980.996168][T29917] ? __pfx_bpf_check+0x10/0x10 [ 980.996198][T29917] ? bpf_obj_name_cpy+0x194/0x1e0 [ 980.996242][T29917] bpf_prog_load+0x14d6/0x1c20 [ 980.996284][T29917] ? __pfx_bpf_prog_load+0x10/0x10 [ 980.996341][T29917] __sys_bpf+0xd0d/0xd90 [ 980.996378][T29917] ? __pfx___sys_bpf+0x10/0x10 [ 980.996417][T29917] ? __fget_files+0x2a/0x420 [ 980.996470][T29917] ? ksys_write+0x242/0x270 [ 980.996508][T29917] ? __pfx_ksys_write+0x10/0x10 [ 980.996549][T29917] __x64_sys_bpf+0xba/0xd0 [ 980.996577][T29917] do_syscall_64+0x166/0x520 [ 980.996601][T29917] ? trace_irq_disable+0x3b/0x140 [ 980.996624][T29917] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 980.996649][T29917] ? clear_bhb_loop+0x70/0xc0 [ 980.996678][T29917] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 980.996701][T29917] RIP: 0033:0x7f266eb9e159 [ 980.996725][T29917] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 980.996745][T29917] RSP: 002b:00007f266fa75028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 980.996771][T29917] RAX: ffffffffffffffda RBX: 00007f266ee25fa0 RCX: 00007f266eb9e159 [ 980.996788][T29917] RDX: 0000000000000094 RSI: 0000200000000100 RDI: 0000000000000005 [ 980.996803][T29917] RBP: 00007f266fa75090 R08: 0000000000000000 R09: 0000000000000000 [ 980.996819][T29917] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 980.996833][T29917] R13: 00007f266ee26038 R14: 00007f266ee25fa0 R15: 00007ffe2863f718 [ 980.996872][T29917] [ 981.209168][ T5621] Bluetooth: hci0: command tx timeout [ 981.860779][T29931] team0: Port device syz_tun added [ 981.980777][T29874] wg2 speed is unknown, defaulting to 1000 [ 982.087073][T29941] netlink: 20 bytes leftover after parsing attributes in process `syz.2.5887'. [ 982.675192][T29959] FAULT_INJECTION: forcing a failure. [ 982.675192][T29959] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 982.675229][T29959] CPU: 0 UID: 0 PID: 29959 Comm: syz.2.5892 Not tainted syzkaller #0 PREEMPT(full) [ 982.675254][T29959] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 982.675269][T29959] Call Trace: [ 982.675278][T29959] [ 982.675289][T29959] dump_stack_lvl+0xe8/0x150 [ 982.675327][T29959] should_fail_ex+0x410/0x560 [ 982.675359][T29959] _copy_to_user+0x31/0xb0 [ 982.675392][T29959] bpf_verifier_vlog+0x496/0x900 [ 982.675443][T29959] verbose+0x11d/0x1a0 [ 982.675473][T29959] ? __pfx_verbose+0x10/0x10 [ 982.675496][T29959] ? lock_acquire+0x115/0x350 [ 982.675523][T29959] ? print_bpf_insn+0xdf6/0x2930 [ 982.675550][T29959] ? __func_get_name+0x90/0x260 [ 982.675582][T29959] print_bpf_insn+0xe78/0x2930 [ 982.675612][T29959] ? __pfx_verbose+0x10/0x10 [ 982.675635][T29959] ? __pfx_print_bpf_insn+0x10/0x10 [ 982.675664][T29959] ? _copy_to_user+0x8a/0xb0 [ 982.675695][T29959] ? bpf_verifier_vlog+0x58d/0x900 [ 982.675744][T29959] ? bpf_verifier_log_write+0x11d/0x1a0 [ 982.675772][T29959] bpf_verbose_insn+0xcb/0x130 [ 982.675796][T29959] ? __pfx_bpf_verbose_insn+0x10/0x10 [ 982.675817][T29959] ? __kvmalloc_node_noprof+0x52f/0x820 [ 982.675842][T29959] ? __pfx_verbose+0x10/0x10 [ 982.675862][T29959] ? __pfx_bpf_disasm_kfunc_name+0x10/0x10 [ 982.675886][T29959] ? record_arg_access+0x148/0x970 [ 982.675924][T29959] analyze_subprog+0x5d89/0x9e00 [ 982.675951][T29959] ? probe_event_enable+0x6df/0xae0 [ 982.676038][T29959] ? __pfx_analyze_subprog+0x10/0x10 [ 982.676065][T29959] ? __x64_sys_bpf+0xba/0xd0 [ 982.676084][T29959] ? rsc_parse+0xc2/0xd00 [ 982.676112][T29959] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 982.676178][T29959] ? call_instance+0x263/0x560 [ 982.676204][T29959] ? rcu_is_watching+0x16/0xb0 [ 982.676231][T29959] ? call_instance+0x263/0x560 [ 982.676255][T29959] ? trace_kmalloc+0x2a/0xf0 [ 982.676292][T29959] ? call_instance+0x263/0x560 [ 982.676318][T29959] ? __kvmalloc_node_noprof+0x52f/0x820 [ 982.676346][T29959] ? __kvmalloc_node_noprof+0x345/0x820 [ 982.676370][T29959] ? call_instance+0x263/0x560 [ 982.676394][T29959] ? call_instance+0x263/0x560 [ 982.676438][T29959] bpf_compute_subprog_arg_access+0x2c9/0x14d0 [ 982.676466][T29959] ? bpf_tracing_func_proto+0x72/0x180 [ 982.676521][T29959] ? __pfx_bpf_compute_subprog_arg_access+0x10/0x10 [ 982.676556][T29959] ? __kvmalloc_node_noprof+0x345/0x820 [ 982.676581][T29959] ? bpf_compute_live_registers+0x14f/0x1ff0 [ 982.676607][T29959] ? bpf_compute_live_registers+0x14f/0x1ff0 [ 982.676641][T29959] bpf_compute_live_registers+0x8d3/0x1ff0 [ 982.676690][T29959] ? __pfx_bpf_compute_live_registers+0x10/0x10 [ 982.676730][T29959] bpf_check+0x25ed/0x2e10 [ 982.676769][T29959] ? ktime_get_with_offset+0x93/0x2d0 [ 982.676799][T29959] ? __pfx_bpf_check+0x10/0x10 [ 982.676828][T29959] ? bpf_obj_name_cpy+0x194/0x1e0 [ 982.676866][T29959] bpf_prog_load+0x14d6/0x1c20 [ 982.676907][T29959] ? __pfx_bpf_prog_load+0x10/0x10 [ 982.676960][T29959] __sys_bpf+0xd0d/0xd90 [ 982.677004][T29959] ? __pfx___sys_bpf+0x10/0x10 [ 982.677044][T29959] ? __fget_files+0x2a/0x420 [ 982.677097][T29959] ? ksys_write+0x242/0x270 [ 982.677136][T29959] ? __pfx_ksys_write+0x10/0x10 [ 982.677177][T29959] __x64_sys_bpf+0xba/0xd0 [ 982.677204][T29959] do_syscall_64+0x166/0x520 [ 982.677229][T29959] ? trace_irq_disable+0x3b/0x140 [ 982.677252][T29959] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 982.677277][T29959] ? clear_bhb_loop+0x70/0xc0 [ 982.677306][T29959] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 982.677330][T29959] RIP: 0033:0x7f303e59e159 [ 982.677353][T29959] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 982.677373][T29959] RSP: 002b:00007f303f549028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 982.677399][T29959] RAX: ffffffffffffffda RBX: 00007f303e825fa0 RCX: 00007f303e59e159 [ 982.677417][T29959] RDX: 0000000000000094 RSI: 0000200000000100 RDI: 0000000000000005 [ 982.677433][T29959] RBP: 00007f303f549090 R08: 0000000000000000 R09: 0000000000000000 [ 982.677448][T29959] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 982.677462][T29959] R13: 00007f303e826038 R14: 00007f303e825fa0 R15: 00007ffd598660b8 [ 982.677500][T29959] [ 983.158162][T29914] udevd[29914]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 983.232962][T29952] udevd[29952]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 983.278925][ T5621] Bluetooth: hci0: command tx timeout [ 983.437125][T29969] ip_tables: iptables: counters copy to user failed while replacing table [ 983.582201][T29976] netlink: 'syz.3.5894': attribute type 16 has an invalid length. [ 983.582231][T29976] netlink: 'syz.3.5894': attribute type 17 has an invalid length. [ 983.687389][T29976] 8021q: adding VLAN 0 to HW filter on device .` [ 983.806227][T29976] 0·: left allmulticast mode [ 983.806257][T29976] hsr_slave_0: left allmulticast mode [ 983.806276][T29976] hsr_slave_1: left allmulticast mode [ 983.855295][T29976] veth1_macvtap: entered promiscuous mode [ 983.898027][T29976] A link change request failed with some changes committed already. Interface geneve2 may have been left with an inconsistent configuration, please check. [ 983.979458][T21906] bridge0: port 1(team0) entered blocking state [ 983.979595][T21906] bridge0: port 1(team0) entered forwarding state [ 984.547121][T30004] FAULT_INJECTION: forcing a failure. [ 984.547121][T30004] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 984.547160][T30004] CPU: 0 UID: 0 PID: 30004 Comm: syz.3.5902 Not tainted syzkaller #0 PREEMPT(full) [ 984.547187][T30004] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 984.547201][T30004] Call Trace: [ 984.547211][T30004] [ 984.547222][T30004] dump_stack_lvl+0xe8/0x150 [ 984.547261][T30004] should_fail_ex+0x410/0x560 [ 984.547293][T30004] _copy_to_user+0x31/0xb0 [ 984.547326][T30004] bpf_verifier_vlog+0x496/0x900 [ 984.547377][T30004] verbose+0x11d/0x1a0 [ 984.547406][T30004] ? __pfx_verbose+0x10/0x10 [ 984.547428][T30004] ? lock_acquire+0x115/0x350 [ 984.547454][T30004] ? print_bpf_insn+0xdf6/0x2930 [ 984.547480][T30004] ? __func_get_name+0x90/0x260 [ 984.547510][T30004] print_bpf_insn+0xe78/0x2930 [ 984.547539][T30004] ? __pfx_verbose+0x10/0x10 [ 984.547562][T30004] ? __pfx_print_bpf_insn+0x10/0x10 [ 984.547592][T30004] ? _copy_to_user+0x8a/0xb0 [ 984.547623][T30004] ? bpf_verifier_vlog+0x58d/0x900 [ 984.547672][T30004] ? bpf_verifier_log_write+0x11d/0x1a0 [ 984.547700][T30004] bpf_verbose_insn+0xcb/0x130 [ 984.547723][T30004] ? __pfx_bpf_verbose_insn+0x10/0x10 [ 984.547744][T30004] ? __kvmalloc_node_noprof+0x52f/0x820 [ 984.547769][T30004] ? __pfx_verbose+0x10/0x10 [ 984.547789][T30004] ? __pfx_bpf_disasm_kfunc_name+0x10/0x10 [ 984.547814][T30004] ? record_arg_access+0x148/0x970 [ 984.547853][T30004] analyze_subprog+0x5d89/0x9e00 [ 984.547880][T30004] ? probe_event_enable+0x6df/0xae0 [ 984.547970][T30004] ? __pfx_analyze_subprog+0x10/0x10 [ 984.547995][T30004] ? __x64_sys_bpf+0xba/0xd0 [ 984.548016][T30004] ? rsc_parse+0xc2/0xd00 [ 984.548044][T30004] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 984.548108][T30004] ? call_instance+0x263/0x560 [ 984.548132][T30004] ? rcu_is_watching+0x16/0xb0 [ 984.548159][T30004] ? call_instance+0x263/0x560 [ 984.548183][T30004] ? trace_kmalloc+0x2a/0xf0 [ 984.548221][T30004] ? call_instance+0x263/0x560 [ 984.548245][T30004] ? __kvmalloc_node_noprof+0x52f/0x820 [ 984.548273][T30004] ? __kvmalloc_node_noprof+0x345/0x820 [ 984.548298][T30004] ? call_instance+0x263/0x560 [ 984.548321][T30004] ? call_instance+0x263/0x560 [ 984.548366][T30004] bpf_compute_subprog_arg_access+0x2c9/0x14d0 [ 984.548396][T30004] ? bpf_tracing_func_proto+0x72/0x180 [ 984.548455][T30004] ? __pfx_bpf_compute_subprog_arg_access+0x10/0x10 [ 984.548490][T30004] ? __kvmalloc_node_noprof+0x345/0x820 [ 984.548515][T30004] ? bpf_compute_live_registers+0x14f/0x1ff0 [ 984.548542][T30004] ? bpf_compute_live_registers+0x14f/0x1ff0 [ 984.548578][T30004] bpf_compute_live_registers+0x8d3/0x1ff0 [ 984.548629][T30004] ? __pfx_bpf_compute_live_registers+0x10/0x10 [ 984.548670][T30004] bpf_check+0x25ed/0x2e10 [ 984.548709][T30004] ? ktime_get_with_offset+0x93/0x2d0 [ 984.548739][T30004] ? __pfx_bpf_check+0x10/0x10 [ 984.548768][T30004] ? bpf_obj_name_cpy+0x194/0x1e0 [ 984.548806][T30004] bpf_prog_load+0x14d6/0x1c20 [ 984.548848][T30004] ? __pfx_bpf_prog_load+0x10/0x10 [ 984.548903][T30004] __sys_bpf+0xd0d/0xd90 [ 984.548938][T30004] ? __pfx___sys_bpf+0x10/0x10 [ 984.548985][T30004] ? __fget_files+0x2a/0x420 [ 984.549036][T30004] ? ksys_write+0x242/0x270 [ 984.549075][T30004] ? __pfx_ksys_write+0x10/0x10 [ 984.549115][T30004] __x64_sys_bpf+0xba/0xd0 [ 984.549143][T30004] do_syscall_64+0x166/0x520 [ 984.549168][T30004] ? trace_irq_disable+0x3b/0x140 [ 984.549191][T30004] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 984.549215][T30004] ? clear_bhb_loop+0x70/0xc0 [ 984.549242][T30004] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 984.549265][T30004] RIP: 0033:0x7fe76c79e159 [ 984.549287][T30004] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 984.549307][T30004] RSP: 002b:00007fe76d660028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 984.549333][T30004] RAX: ffffffffffffffda RBX: 00007fe76ca25fa0 RCX: 00007fe76c79e159 [ 984.549351][T30004] RDX: 0000000000000094 RSI: 0000200000000100 RDI: 0000000000000005 [ 984.549367][T30004] RBP: 00007fe76d660090 R08: 0000000000000000 R09: 0000000000000000 [ 984.549383][T30004] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 984.549397][T30004] R13: 00007fe76ca26038 R14: 00007fe76ca25fa0 R15: 00007ffcdaf7a868 [ 984.549435][T30004] [ 985.412692][T29874] bridge0: port 1(bridge_slave_0) entered blocking state [ 985.412811][T29874] bridge0: port 1(bridge_slave_0) entered disabled state [ 985.412996][T29874] bridge_slave_0: entered allmulticast mode [ 985.443299][T29874] bridge_slave_0: entered promiscuous mode [ 985.455791][T29874] bridge0: port 2(bridge_slave_1) entered blocking state [ 985.457586][T29874] bridge0: port 2(bridge_slave_1) entered disabled state [ 985.457780][T29874] bridge_slave_1: entered allmulticast mode [ 985.483539][T29874] bridge_slave_1: entered promiscuous mode [ 985.560877][T29874] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 985.643345][T30037] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5908'. [ 985.698315][T29874] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 985.739395][T30037] bond11: entered allmulticast mode [ 985.750807][T30044] SET target dimension over the limit! [ 985.941352][T30051] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5911'. [ 985.943538][T30048] netlink: 260 bytes leftover after parsing attributes in process `syz.0.5911'. [ 986.050031][T29874] team0: Port device team_slave_0 added [ 986.053077][T29874] team0: Port device team_slave_1 added [ 986.115992][T30050] netlink: 24 bytes leftover after parsing attributes in process `syz.2.5913'. [ 986.175117][T29874] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 986.175139][T29874] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 986.175170][T29874] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 986.177781][T29874] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 986.177800][T29874] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 986.177839][T29874] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 986.323225][T30049] netlink: 28 bytes leftover after parsing attributes in process `syz.1.5912'. [ 986.402165][T29874] hsr_slave_0: entered promiscuous mode [ 986.403822][T29874] hsr_slave_1: entered promiscuous mode [ 986.404552][T29874] debugfs: 'hsr0' already exists in 'hsr' [ 986.404571][T29874] Cannot create hsr debugfs directory [ 986.821943][T30071] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5916'. [ 986.923938][T29874] netdevsim netdevsim4 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 986.923981][T29874] netdevsim netdevsim4 netdevsim3 (unregistering): unset [0, 1] type 1 family 0 port 32779 - 0 [ 986.924012][T29874] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 986.924041][T29874] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 987.261544][T30082] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5917'. [ 987.261815][T30085] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5917'. [ 987.413259][T30084] smc: net device vlan1 applied user defined pnetid SYZ2 [ 987.429282][T30093] netlink: 24 bytes leftover after parsing attributes in process `syz.2.5919'. [ 987.430062][T30092] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5919'. [ 987.430101][T30092] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5919'. [ 987.430165][T30092] netlink: 'syz.2.5919': attribute type 14 has an invalid length. [ 987.430201][T30092] netlink: 'syz.2.5919': attribute type 13 has an invalid length. [ 987.430861][T30093] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5919'. [ 987.430917][T30093] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5919'. [ 987.430958][T30093] netlink: 'syz.2.5919': attribute type 14 has an invalid length. [ 987.430993][T30093] netlink: 'syz.2.5919': attribute type 13 has an invalid length. [ 987.557397][T29874] netdevsim netdevsim4 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 987.557428][T29874] netdevsim netdevsim4 netdevsim2 (unregistering): unset [0, 1] type 1 family 0 port 32779 - 0 [ 987.557449][T29874] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 987.557469][T29874] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 987.770965][T30095] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5920'. [ 987.913425][T29874] netdevsim netdevsim4 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 987.913465][T29874] netdevsim netdevsim4 netdevsim1 (unregistering): unset [0, 1] type 1 family 0 port 32779 - 0 [ 987.913496][T29874] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 987.913526][T29874] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 988.252155][T30120] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5926'. [ 988.282608][T30123] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5924'. [ 989.341778][T29874] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 989.377234][T29874] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 989.394634][T29874] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 989.431367][T29874] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 989.432411][T29874] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 989.461117][T29874] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 989.462207][T29874] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 989.501782][T29874] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 989.726451][T30131] IPVS: fo: FWM 3 0x00000003 - no destination available [ 990.004838][T29874] 8021q: adding VLAN 0 to HW filter on device bond0 [ 990.102682][T29874] 8021q: adding VLAN 0 to HW filter on device team0 [ 990.200796][ T8518] bridge0: port 1(bridge_slave_0) entered blocking state [ 990.200912][ T8518] bridge0: port 1(bridge_slave_0) entered forwarding state [ 990.427791][T21418] bridge0: port 2(bridge_slave_1) entered blocking state [ 990.427913][T21418] bridge0: port 2(bridge_slave_1) entered forwarding state [ 990.693878][T30187] veth9: entered allmulticast mode [ 991.490018][T29874] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 991.931771][T29874] veth0_vlan: entered promiscuous mode [ 991.954542][T29874] veth1_vlan: entered promiscuous mode [ 992.074452][T29874] veth0_macvtap: entered promiscuous mode [ 992.113443][T29874] veth1_macvtap: entered promiscuous mode [ 992.175760][T29874] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 992.201225][T29874] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 992.259298][ T8527] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 992.260022][ T38] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 992.260120][ T38] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 992.302349][T21432] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 992.394409][T30149] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 992.415792][T30163] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 992.415823][T30163] Bluetooth: hci0: Error when powering off device on rfkill (-4) [ 992.480192][ C1] ------------[ cut here ]------------ [ 992.480211][ C1] workqueue: cannot queue hci_cmd_timeout on wq hci0 [ 992.480257][ C1] WARNING: kernel/workqueue.c:2353 at __queue_work+0xd83/0x10d0, CPU#1: syz.2.5936/30173 [ 992.502325][ C1] Modules linked in: [ 992.506273][ C1] CPU: 1 UID: 0 PID: 30173 Comm: syz.2.5936 Not tainted syzkaller #0 PREEMPT(full) [ 992.515693][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 992.525881][ C1] RIP: 0010:__queue_work+0xd9f/0x10d0 [ 992.531678][ C1] Code: 49 81 c7 70 01 00 00 4c 8d 35 2d ca ee 0e 48 89 f8 48 c1 e8 03 80 3c 18 00 74 05 e8 6b 8f a9 00 49 8b 75 18 4c 89 f7 4c 89 fa <67> 48 0f b9 3a 4c 89 e8 48 c1 e8 03 80 3c 18 00 74 08 4c 89 ef e8 [ 992.539099][T30225] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 992.560385][ C1] RSP: 0018:ffffc90000a18bc0 EFLAGS: 00010046 [ 992.566611][ C1] RAX: 1ffff110098ab94e RBX: dffffc0000000000 RCX: ffff888050fc9f40 [ 992.574631][ C1] RDX: ffff888076181970 RSI: ffffffff8ad5df20 RDI: ffffffff907d0570 [ 992.583177][ C1] RBP: 0000000000010000 R08: 0000000000000100 R09: 1ffffffff20f460f [ 992.591286][ C1] R10: dffffc0000000000 R11: ffffffff818e4260 R12: 0000000000000008 [ 992.599305][ C1] R13: ffff88804c55ca58 R14: ffffffff907d0570 R15: ffff888076181970 [ 992.607588][ C1] FS: 0000000000000000(0000) GS:ffff888124dd1000(0000) knlGS:0000000000000000 [ 992.616669][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 992.623381][ C1] CR2: 00007f266fa74ff8 CR3: 0000000047d66000 CR4: 00000000003526f0 [ 992.631674][ C1] Call Trace: [ 992.635000][ C1] [ 992.637979][ C1] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 992.643441][ C1] call_timer_fn+0x18d/0x5f0 [ 992.648168][ C1] ? __pfx_delayed_work_timer_fn+0x10/0x10 [ 992.654029][ C1] ? call_timer_fn+0xd5/0x5f0 [ 992.658769][ C1] ? __pfx_call_timer_fn+0x10/0x10 [ 992.663971][ C1] ? do_raw_spin_unlock+0xf5/0x200 [ 992.669145][ C1] ? __pfx_delayed_work_timer_fn+0x10/0x10 [ 992.675109][ C1] __run_timer_base+0x67e/0x8b0 [ 992.680163][ C1] ? __pfx___run_timer_base+0x10/0x10 [ 992.685592][ C1] ? ktime_get+0x1f5/0x220 [ 992.690158][ C1] ? lapic_next_event+0x11/0x20 [ 992.695515][ C1] run_timer_softirq+0xb7/0x170 [ 992.700664][ C1] handle_softirqs+0x226/0x860 [ 992.705598][ C1] ? __irq_exit_rcu+0xcb/0x220 [ 992.710518][ C1] __irq_exit_rcu+0xcb/0x220 [ 992.715272][ C1] irq_exit_rcu+0x9/0x30 [ 992.719653][ C1] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 992.725340][ C1] [ 992.728418][ C1] [ 992.731489][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 992.737516][ C1] RIP: 0010:kernel_text_address+0x44/0xe0 [ 992.743632][ C1] Code: 92 c1 bd 01 00 00 00 84 c8 75 0c 48 89 fb e8 63 93 a2 ff 85 c0 74 0c 89 e8 5b 41 5e 5d e9 c4 69 57 0a cc 48 c7 c0 80 e6 79 90 <48> c1 e8 03 48 b9 00 00 00 00 00 fc ff df 0f b6 04 08 84 c0 75 5d [ 992.763305][ C1] RSP: 0018:ffffc90002e5f338 EFLAGS: 00000246 [ 992.769596][ C1] RAX: ffffffff9079e680 RBX: 00007f303e55e98e RCX: ffff888050fc9f40 [ 992.778572][ C1] RDX: 0000000000000000 RSI: 00007f303e55e000 RDI: ffffffffff600000 [ 992.788244][ C1] RBP: 0000000000000001 R08: ffffc90002e5ff48 R09: 0000000000000000 [ 992.797569][ C1] R10: ffffc90002e5f3d8 R11: ffffffff81b285f0 R12: ffff888050fc9f40 [ 992.807644][ C1] R13: ffff888077151400 R14: dffffc0000000000 R15: 1ffff920005cbe7a [ 992.817624][ C1] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 992.827082][ C1] ? 0xffffffffff600000 [ 992.832167][ C1] ? kernel_text_address+0x2d/0xe0 [ 992.838033][ C1] __kernel_text_address+0xd/0x30 [ 992.843194][ C1] unwind_get_return_address+0x4d/0x90 [ 992.849167][ C1] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 992.855550][ C1] arch_stack_walk+0xfb/0x150 [ 992.860307][ C1] stack_trace_save+0xa9/0x100 [ 992.866315][ C1] ? __pfx_stack_trace_save+0x10/0x10 [ 992.872279][ C1] ? do_raw_spin_lock+0x12b/0x2f0 [ 992.877469][ C1] kasan_save_track+0x3e/0x80 [ 992.882819][ C1] ? kasan_save_track+0x3e/0x80 [ 992.887712][ C1] ? __kasan_kmalloc+0x93/0xb0 [ 992.892699][ C1] ? __kmalloc_cache_noprof+0x321/0x600 [ 992.898291][ C1] ? kmem_cache_free+0x156/0x650 [ 992.903450][ C1] ? __sk_destruct+0x742/0x9d0 [ 992.908379][ C1] ? inet_release+0x143/0x190 [ 992.913122][ C1] ? sock_release+0x85/0x150 [ 992.917775][ C1] ? smc_clcsock_release+0xc9/0xf0 [ 992.923070][ C1] ? __smc_release+0x64e/0x7c0 [ 992.927907][ C1] ? smc_release+0x2c5/0x550 [ 992.932578][ C1] ? __sock_release+0xa0/0x1f0 [ 992.937396][ C1] ? sock_close+0x1c/0x30 [ 992.941758][ C1] ? __fput+0x418/0xa50 [ 992.945939][ C1] ? task_work_run+0x1d9/0x270 [ 992.950731][ C1] ? do_exit+0x73a/0x2360 [ 992.955098][ C1] ? do_group_exit+0x22d/0x2f0 [ 992.959897][ C1] ? get_signal+0x121b/0x12c0 [ 992.964600][ C1] ? arch_do_signal_or_restart+0xbb/0x860 [ 992.970348][ C1] ? exit_to_user_mode_loop+0x10e/0x770 [ 992.975923][ C1] ? do_syscall_64+0x328/0x520 [ 992.981350][ C1] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 992.987502][ C1] ? rcu_is_watching+0x16/0xb0 [ 992.992765][ C1] __kasan_kmalloc+0x93/0xb0 [ 992.997407][ C1] __kmalloc_cache_noprof+0x321/0x600 [ 993.002812][ C1] ? __kmalloc_cache_noprof+0x14d/0x600 [ 993.008410][ C1] ? kmem_cache_free+0x156/0x650 [ 993.013498][ C1] ? kmem_cache_free+0x156/0x650 [ 993.018494][ C1] ? __sk_destruct+0x742/0x9d0 [ 993.023294][ C1] kmem_cache_free+0x156/0x650 [ 993.028114][ C1] __sk_destruct+0x742/0x9d0 [ 993.032777][ C1] inet_release+0x143/0x190 [ 993.037332][ C1] sock_release+0x85/0x150 [ 993.041801][ C1] smc_clcsock_release+0xc9/0xf0 [ 993.046800][ C1] __smc_release+0x64e/0x7c0 [ 993.051588][ C1] smc_release+0x2c5/0x550 [ 993.056107][ C1] __sock_release+0xa0/0x1f0 [ 993.060765][ C1] ? __pfx_sock_close+0x10/0x10 [ 993.065692][ C1] sock_close+0x1c/0x30 [ 993.069930][ C1] __fput+0x418/0xa50 [ 993.073962][ C1] task_work_run+0x1d9/0x270 [ 993.078728][ C1] ? __pfx_task_work_run+0x10/0x10 [ 993.083993][ C1] ? do_raw_spin_unlock+0xf5/0x200 [ 993.089184][ C1] do_exit+0x73a/0x2360 [ 993.093416][ C1] ? __pfx_do_exit+0x10/0x10 [ 993.098125][ C1] ? cgroup1_freezing+0x20/0x350 [ 993.103113][ C1] ? cgroup1_freezing+0x20/0x350 [ 993.108133][ C1] do_group_exit+0x22d/0x2f0 [ 993.112769][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 993.118034][ C1] get_signal+0x121b/0x12c0 [ 993.122590][ C1] arch_do_signal_or_restart+0xbb/0x860 [ 993.128181][ C1] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 993.134408][ C1] exit_to_user_mode_loop+0x10e/0x770 [ 993.139843][ C1] ? rcu_is_watching+0x16/0xb0 [ 993.144645][ C1] do_syscall_64+0x328/0x520 [ 993.149700][ C1] ? trace_irq_disable+0x3b/0x140 [ 993.154849][ C1] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 993.161022][ C1] ? clear_bhb_loop+0x70/0xc0 [ 993.165828][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 993.171834][ C1] RIP: 0033:0x7f303e55e98e [ 993.176272][ C1] Code: Unable to access opcode bytes at 0x7f303e55e964. [ 993.183327][ C1] RSP: 002b:00007f303f547e88 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 993.191802][ C1] RAX: 0000000000000020 RBX: 00007f303f5496c0 RCX: 00007f303e55e98e [ 993.199814][ C1] RDX: 0000000000000020 RSI: 00007f303f548000 RDI: 0000000000000027 [ 993.207814][ C1] RBP: 0000000000000000 R08: 00007f303f547f04 R09: 000000000000000c [ 993.215857][ C1] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000027 [ 993.223875][ C1] R13: 00007f303f547f58 R14: 00007f303f548000 R15: 0000000000000000 [ 993.232079][ C1] [ 993.235145][ C1] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 993.242550][ C1] CPU: 1 UID: 0 PID: 30173 Comm: syz.2.5936 Not tainted syzkaller #0 PREEMPT(full) [ 993.251943][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 993.262885][ C1] Call Trace: [ 993.266389][ C1] [ 993.269453][ C1] vpanic+0x56d/0xa60 [ 993.274267][ C1] ? __pfx__printk+0x10/0x10 [ 993.279502][ C1] ? __pfx_vpanic+0x10/0x10 [ 993.284581][ C1] ? is_bpf_text_address+0x292/0x2b0 [ 993.291664][ C1] ? is_bpf_text_address+0x26/0x2b0 [ 993.297685][ C1] panic+0xc5/0xd0 [ 993.302173][ C1] ? __pfx_panic+0x10/0x10 [ 993.309702][ C1] __warn+0x315/0x4c0 [ 993.314622][ C1] ? __queue_work+0xd83/0x10d0 [ 993.320450][ C1] ? __queue_work+0xd83/0x10d0 [ 993.326041][ C1] __report_bug+0x276/0x570 [ 993.331766][ C1] ? __queue_work+0xd83/0x10d0 [ 993.338071][ C1] ? __pfx___report_bug+0x10/0x10 [ 993.344732][ C1] ? __pfx_hci_cmd_timeout+0x10/0x10 [ 993.350682][ C1] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 993.356628][ C1] ? look_up_lock_class+0x57/0x110 [ 993.362035][ C1] ? register_lock_class+0x31/0x2e0 [ 993.368329][ C1] ? cma_netevent_callback+0x623/0x6e0 [ 993.374199][ C1] report_bug_entry+0x19b/0x290 [ 993.379419][ C1] ? __queue_work+0xd9f/0x10d0 [ 993.384346][ C1] ? __queue_work+0xda4/0x10d0 [ 993.389510][ C1] handle_bug+0xce/0x200 [ 993.394065][ C1] exc_invalid_op+0x1a/0x50 [ 993.398693][ C1] asm_exc_invalid_op+0x1a/0x20 [ 993.404270][ C1] RIP: 0010:__queue_work+0xd9f/0x10d0 [ 993.411124][ C1] Code: 49 81 c7 70 01 00 00 4c 8d 35 2d ca ee 0e 48 89 f8 48 c1 e8 03 80 3c 18 00 74 05 e8 6b 8f a9 00 49 8b 75 18 4c 89 f7 4c 89 fa <67> 48 0f b9 3a 4c 89 e8 48 c1 e8 03 80 3c 18 00 74 08 4c 89 ef e8 [ 993.430766][ C1] RSP: 0018:ffffc90000a18bc0 EFLAGS: 00010046 [ 993.436864][ C1] RAX: 1ffff110098ab94e RBX: dffffc0000000000 RCX: ffff888050fc9f40 [ 993.444869][ C1] RDX: ffff888076181970 RSI: ffffffff8ad5df20 RDI: ffffffff907d0570 [ 993.452904][ C1] RBP: 0000000000010000 R08: 0000000000000100 R09: 1ffffffff20f460f [ 993.460904][ C1] R10: dffffc0000000000 R11: ffffffff818e4260 R12: 0000000000000008 [ 993.468912][ C1] R13: ffff88804c55ca58 R14: ffffffff907d0570 R15: ffff888076181970 [ 993.476916][ C1] ? __pfx_delayed_work_timer_fn+0x10/0x10 [ 993.482773][ C1] ? __pfx_hci_cmd_timeout+0x10/0x10 [ 993.488108][ C1] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 993.493577][ C1] call_timer_fn+0x18d/0x5f0 [ 993.498216][ C1] ? __pfx_delayed_work_timer_fn+0x10/0x10 [ 993.504051][ C1] ? call_timer_fn+0xd5/0x5f0 [ 993.508752][ C1] ? __pfx_call_timer_fn+0x10/0x10 [ 993.513914][ C1] ? do_raw_spin_unlock+0xf5/0x200 [ 993.519098][ C1] ? __pfx_delayed_work_timer_fn+0x10/0x10 [ 993.525114][ C1] __run_timer_base+0x67e/0x8b0 [ 993.530013][ C1] ? __pfx___run_timer_base+0x10/0x10 [ 993.535675][ C1] ? ktime_get+0x1f5/0x220 [ 993.540136][ C1] ? lapic_next_event+0x11/0x20 [ 993.545033][ C1] run_timer_softirq+0xb7/0x170 [ 993.549928][ C1] handle_softirqs+0x226/0x860 [ 993.554759][ C1] ? __irq_exit_rcu+0xcb/0x220 [ 993.559577][ C1] __irq_exit_rcu+0xcb/0x220 [ 993.564219][ C1] irq_exit_rcu+0x9/0x30 [ 993.568584][ C1] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 993.574285][ C1] [ 993.577353][ C1] [ 993.580320][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 993.586361][ C1] RIP: 0010:kernel_text_address+0x44/0xe0 [ 993.592565][ C1] Code: 92 c1 bd 01 00 00 00 84 c8 75 0c 48 89 fb e8 63 93 a2 ff 85 c0 74 0c 89 e8 5b 41 5e 5d e9 c4 69 57 0a cc 48 c7 c0 80 e6 79 90 <48> c1 e8 03 48 b9 00 00 00 00 00 fc ff df 0f b6 04 08 84 c0 75 5d [ 993.612298][ C1] RSP: 0018:ffffc90002e5f338 EFLAGS: 00000246 [ 993.618411][ C1] RAX: ffffffff9079e680 RBX: 00007f303e55e98e RCX: ffff888050fc9f40 [ 993.626424][ C1] RDX: 0000000000000000 RSI: 00007f303e55e000 RDI: ffffffffff600000 [ 993.634603][ C1] RBP: 0000000000000001 R08: ffffc90002e5ff48 R09: 0000000000000000 [ 993.643201][ C1] R10: ffffc90002e5f3d8 R11: ffffffff81b285f0 R12: ffff888050fc9f40 [ 993.651208][ C1] R13: ffff888077151400 R14: dffffc0000000000 R15: 1ffff920005cbe7a [ 993.659212][ C1] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 993.665411][ C1] ? 0xffffffffff600000 [ 993.669608][ C1] ? kernel_text_address+0x2d/0xe0 [ 993.674760][ C1] __kernel_text_address+0xd/0x30 [ 993.679815][ C1] unwind_get_return_address+0x4d/0x90 [ 993.685303][ C1] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 993.691484][ C1] arch_stack_walk+0xfb/0x150 [ 993.696215][ C1] stack_trace_save+0xa9/0x100 [ 993.701020][ C1] ? __pfx_stack_trace_save+0x10/0x10 [ 993.706425][ C1] ? do_raw_spin_lock+0x12b/0x2f0 [ 993.711482][ C1] kasan_save_track+0x3e/0x80 [ 993.716184][ C1] ? kasan_save_track+0x3e/0x80 [ 993.721071][ C1] ? __kasan_kmalloc+0x93/0xb0 [ 993.725869][ C1] ? __kmalloc_cache_noprof+0x321/0x600 [ 993.731438][ C1] ? kmem_cache_free+0x156/0x650 [ 993.736407][ C1] ? __sk_destruct+0x742/0x9d0 [ 993.741200][ C1] ? inet_release+0x143/0x190 [ 993.745930][ C1] ? sock_release+0x85/0x150 [ 993.750549][ C1] ? smc_clcsock_release+0xc9/0xf0 [ 993.755692][ C1] ? __smc_release+0x64e/0x7c0 [ 993.760519][ C1] ? smc_release+0x2c5/0x550 [ 993.765229][ C1] ? __sock_release+0xa0/0x1f0 [ 993.770071][ C1] ? sock_close+0x1c/0x30 [ 993.774446][ C1] ? __fput+0x418/0xa50 [ 993.778655][ C1] ? task_work_run+0x1d9/0x270 [ 993.783444][ C1] ? do_exit+0x73a/0x2360 [ 993.787792][ C1] ? do_group_exit+0x22d/0x2f0 [ 993.792580][ C1] ? get_signal+0x121b/0x12c0 [ 993.797297][ C1] ? arch_do_signal_or_restart+0xbb/0x860 [ 993.803046][ C1] ? exit_to_user_mode_loop+0x10e/0x770 [ 993.808614][ C1] ? do_syscall_64+0x328/0x520 [ 993.813398][ C1] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 993.819526][ C1] ? rcu_is_watching+0x16/0xb0 [ 993.824336][ C1] __kasan_kmalloc+0x93/0xb0 [ 993.828952][ C1] __kmalloc_cache_noprof+0x321/0x600 [ 993.834349][ C1] ? __kmalloc_cache_noprof+0x14d/0x600 [ 993.839917][ C1] ? kmem_cache_free+0x156/0x650 [ 993.844891][ C1] ? kmem_cache_free+0x156/0x650 [ 993.849870][ C1] ? __sk_destruct+0x742/0x9d0 [ 993.854663][ C1] kmem_cache_free+0x156/0x650 [ 993.859458][ C1] __sk_destruct+0x742/0x9d0 [ 993.864778][ C1] inet_release+0x143/0x190 [ 993.869343][ C1] sock_release+0x85/0x150 [ 993.873807][ C1] smc_clcsock_release+0xc9/0xf0 [ 993.878772][ C1] __smc_release+0x64e/0x7c0 [ 993.883405][ C1] smc_release+0x2c5/0x550 [ 993.887855][ C1] __sock_release+0xa0/0x1f0 [ 993.892486][ C1] ? __pfx_sock_close+0x10/0x10 [ 993.897381][ C1] sock_close+0x1c/0x30 [ 993.901751][ C1] __fput+0x418/0xa50 [ 993.905786][ C1] task_work_run+0x1d9/0x270 [ 993.910411][ C1] ? __pfx_task_work_run+0x10/0x10 [ 993.915544][ C1] ? do_raw_spin_unlock+0xf5/0x200 [ 993.920716][ C1] do_exit+0x73a/0x2360 [ 993.924956][ C1] ? __pfx_do_exit+0x10/0x10 [ 993.929574][ C1] ? cgroup1_freezing+0x20/0x350 [ 993.934542][ C1] ? cgroup1_freezing+0x20/0x350 [ 993.939509][ C1] do_group_exit+0x22d/0x2f0 [ 993.944115][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 993.949368][ C1] get_signal+0x121b/0x12c0 [ 993.953923][ C1] arch_do_signal_or_restart+0xbb/0x860 [ 993.959502][ C1] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 993.965707][ C1] exit_to_user_mode_loop+0x10e/0x770 [ 993.971118][ C1] ? rcu_is_watching+0x16/0xb0 [ 993.975929][ C1] do_syscall_64+0x328/0x520 [ 993.980543][ C1] ? trace_irq_disable+0x3b/0x140 [ 993.985591][ C1] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 993.991777][ C1] ? clear_bhb_loop+0x70/0xc0 [ 993.996530][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 994.002495][ C1] RIP: 0033:0x7f303e55e98e [ 994.006929][ C1] Code: Unable to access opcode bytes at 0x7f303e55e964. [ 994.013987][ C1] RSP: 002b:00007f303f547e88 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 994.023465][ C1] RAX: 0000000000000020 RBX: 00007f303f5496c0 RCX: 00007f303e55e98e [ 994.031468][ C1] RDX: 0000000000000020 RSI: 00007f303f548000 RDI: 0000000000000027 [ 994.039465][ C1] RBP: 0000000000000000 R08: 00007f303f547f04 R09: 000000000000000c [ 994.047454][ C1] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000027 [ 994.055460][ C1] R13: 00007f303f547f58 R14: 00007f303f548000 R15: 0000000000000000 [ 994.063473][ C1] [ 994.067141][ C1] Kernel Offset: disabled [ 994.071477][ C1] Rebooting in 86400 seconds..