last executing test programs: 4.295763017s ago: executing program 1 (id=6): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_mnt\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./sys_mnt\x00', &(0x7f00000000c0)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys_mnt/events/tipc/enable\x00', 0x1, 0x0) write(r0, &(0x7f0000000140)='1\x00', 0x1) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200), r1) sendmsg$TIPC_CMD_SET_NODE_ADDR(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)={0x24, r2, 0x1, 0x0, 0x0, {{0x0}, {}, {0x8, 0x1, 0x1000001}}}, 0x24}}, 0x0) sendmsg$TIPC_CMD_ENABLE_BEARER(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x34, r2, 0x1, 0x0, 0x0, {{0x0}, {}, {0x18, 0x1, {0x1, 0x0, @l2={'eth', 0x3a, 'syz_tun\x00'}}}}}, 0x34}}, 0x0) 4.100891869s ago: executing program 0 (id=1): r0 = socket$tipc(0x1e, 0x5, 0x0) connect$tipc(r0, &(0x7f0000000000)=@name={0x1e, 0x2, 0x1, {{0x1, 0x1}}}, 0x10) r1 = socket$tipc(0x1e, 0x5, 0x0) connect$tipc(r1, &(0x7f0000000000)=@name={0x1e, 0x2, 0x1, {{0x1, 0x1}}}, 0x10) r2 = socket$tipc(0x1e, 0x5, 0x0) connect$tipc(r2, &(0x7f0000000000)=@name={0x1e, 0x2, 0x1, {{0x1, 0x1}}}, 0x10) r3 = socket$tipc(0x1e, 0x5, 0x0) connect$tipc(r3, &(0x7f0000000000)=@name={0x1e, 0x2, 0x1, {{0x1, 0x1}}}, 0x10) unshare(0x40000000) r4 = socket$tipc(0x1e, 0x5, 0x0) connect$tipc(r4, &(0x7f0000000000)=@name={0x1e, 0x2, 0x1, {{0x1, 0x1}}}, 0x10) r5 = socket$tipc(0x1e, 0x5, 0x0) connect$tipc(r5, &(0x7f0000000000)=@name={0x1e, 0x2, 0x1, {{0x1, 0x1}}}, 0x10) nanosleep(&(0x7f0000000100)={0x0, 0x2faf080}, 0x0) 3.952855786s ago: executing program 1 (id=7): r0 = socket$inet(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000000)={'lo\x00', 0x1}) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=@newlink={0x5c, 0x10, 0x605, 0x1, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @veth={{0x9}, {0x18, 0x2, 0x0, 0x1, @val=@VETH_INFO_PEER={0x14}}}}, @IFLA_IFNAME={0x14, 0x3, 'veth0\x00'}]}, 0x5c}}, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000a00)={'veth0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000b00)={'veth1\x00', 0x0}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000300)={'veth0\x00', 0x1}) sendmsg$nl_route(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=@ipv6_newaddr={0x48, 0x14, 0x605, 0x1, 0x0, {0xa, 0x40, 0x2, 0x0, r2}, [@IFA_LOCAL={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @IFA_FLAGS={0x8, 0x8, 0x2}]}, 0x48}}, 0x0) unshare(0x40000000) r4 = syz_open_procfs$namespace(0x0, &(0x7f0000000280)='ns/net\x00') r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=@setlink={0x3c, 0x10, 0x1, 0x1, 0x0, {0x0, 0x0, 0x0, r3}, [@IFLA_IFNAME={0x14, 0x3, 'veth1\x00'}, @IFLA_NET_NS_FD={0x8, 0x1c, r4}]}, 0x3c}}, 0x0) nanosleep(&(0x7f0000000500)={0x0, 0x5f5e100}, 0x0) r6 = socket$inet(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r6, 0x8914, &(0x7f0000000400)={'veth1\x00', 0x1}) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000c00)={'veth1\x00', 0x0}) sendmsg$nl_route(r5, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)=@ipv6_newaddr={0x48, 0x14, 0x605, 0x1, 0x0, {0xa, 0x40, 0x2, 0x0, r7}, [@IFA_LOCAL={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @IFA_FLAGS={0x8, 0x8, 0x2}]}, 0x48}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000005c0)=@newneigh={0x3c, 0x1c, 0x605, 0x1, 0x0, {0xa, 0x0, 0x0, r7, 0x80, 0x0, 0x1}, [@NDA_DST_IPV6={0x14, 0x1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NDA_LLADDR={0xa, 0x2, @random="001122334455"}]}, 0x3c}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000680)=@newneigh={0x3c, 0x1c, 0x605, 0x1, 0x0, {0xa, 0x0, 0x0, r2, 0x80, 0x0, 0x1}, [@NDA_DST_IPV6={0x14, 0x1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @NDA_LLADDR={0xa, 0x2, @random="001122334466"}]}, 0x3c}}, 0x0) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r8, &(0x7f0000000700)={0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, 0x1c) connect$inet6(r8, &(0x7f0000000800)={0xa, 0x4001, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, 0x1c) nanosleep(&(0x7f0000000900)={0x0, 0x1dcd6500}, 0x0) 3.462185813s ago: executing program 0 (id=9): r0 = socket$inet_tcp(0x2, 0x1, 0x0) fcntl$setstatus(r0, 0x4, 0x800) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) sendto$inet(r0, &(0x7f0000000900)="2e552f5d9f", 0x5, 0x0, 0x0, 0x0) 3.349571508s ago: executing program 0 (id=11): r0 = socket$inet6_udp(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x1f90, 0x0, @empty}, 0x1c) setsockopt$inet6_udp_encap(r0, 0x11, 0x64, &(0x7f0000000100)=0x2, 0x4) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'syzkaller1\x00', 0x4011}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000400)={'syzkaller1\x00', 0x41}) write$tun(r1, &(0x7f0000000500)={@val, @val={0x2}, @ipv6=@udp={0x0, 0x6, '\x00', 0x18, 0x11, 0x40, @local, @local, {[], {0x4d2, 0x1f90, 0x18, 0x0, @opaque="00000001000000020000000300000004"}}}}, 0x56) 2.843647642s ago: executing program 1 (id=15): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="44000000100001060000000000000000000000000000000000000000000000000e00030076736f636b6d6f6e30000000140012000d00010076736f636b6d6f6e00000000"], 0x44}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="30000000100001000000000000000000000000000000000001000000010000000e00030076736f636b6d6f6e30000000"], 0x30}}, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r1, 0x4001af01, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000300)={@my=0x0}) ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000400)=0x1) r2 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r2, &(0x7f0000000500)={0x28, 0x0, 0x2710, @my=0x0}, 0x10) write(r2, &(0x7f0000000600)='hello vhost vsock world!', 0x20) write$vhost_msg(r1, &(0x7f0000000700)={0x1, {&(0x7f0000000900), 0x1000, &(0x7f0000000a00), 0x1, 0x1}}, 0x48) nanosleep(&(0x7f0000000800)={0x0, 0x5f5e100}, 0x0) 2.793264202s ago: executing program 0 (id=16): syz_usb_connect(0x0, 0x3b, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ff000040b90661400000010203010902290002010080fa0904000001ff000000070581031000010904010001ff00000007058202000201"], 0x0) nanosleep(&(0x7f0000000100)={0x1}, 0x0) r0 = socket(0x8, 0x2, 0x0) setsockopt(r0, 0x108, 0x1, &(0x7f0000000200)="010000000000000000000000000000000002000000000000000000000000000001000000000000000000000000000000000200000000000000000000000000000500000000000000", 0x48) bind(r0, &(0x7f0000000300)=@generic={0x8, '\x00\x00\x00\x00d\x00'}, 0x10) r1 = socket(0x8, 0x2, 0x0) ioctl(r1, 0x400861f2, &(0x7f0000000400)="0000000000000000dc0500006e61733000000000") ioctl(r0, 0x400461f1, &(0x7f0000000500)="020000006e61733000000000000000000100"/32) 2.483976628s ago: executing program 1 (id=18): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @local}, 0x10) listen(r0, 0x5) syz_emit_ethernet(0x37, &(0x7f0000000040)={@local, @remote, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x29, 0x0, 0x0, 0x40, 0x6, 0x0, @remote, @local}, {{0x4e21, 0x4e20, 0x1, 0x0, 0x0, 0x0, 0x2, 0x18, 0x1000}, {'\x00'}}}}}}, 0x0) syz_extract_tcp_res(&(0x7f0000000200)={0x0, 0x0}, 0x0, 0x0) r3 = accept(r0, 0x0, 0x0) setsockopt$inet_tcp_buf(r3, 0x6, 0x1f, &(0x7f0000000080)='espintcp\x00', 0x9) syz_emit_ethernet(0x3c, &(0x7f00000000c0)={@local, @remote, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x2e, 0x0, 0x0, 0x40, 0x6, 0x0, @remote, @local}, {{0x4e21, 0x4e20, r1, r2, 0x0, 0x0, 0x5, 0x18, 0x1000}, {"000600000000"}}}}}}, 0x0) 1.730653724s ago: executing program 3 (id=22): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000200)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) listen(r0, 0x5) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) accept$inet6(r0, 0x0, 0x0) setsockopt$inet6_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f00000002c0), 0x3) setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x1, &(0x7f00000003c0)=@gcm_128={{0x303}, "77b40400", "bb6710bc8150e4a1a117d7b27caf00", "8c76287d", "3d8efa05fdffffff"}, 0x28) setsockopt$inet6_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f0000000080), 0x4) setsockopt$sock_int(r1, 0x1, 0x7, &(0x7f0000000400)=0x1000, 0x4) r2 = dup(r1) close(r1) write(r2, &(0x7f0000001000)='\x00'/100000, 0x186a0) (async) nanosleep(&(0x7f0000000500)={0x0, 0x2faf080}, 0x0) close(r2) 1.537708603s ago: executing program 1 (id=25): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=@newqdisc={0x30, 0x24, 0x405, 0x0, 0x0, {0x0, 0x0, 0x0, 0x1, {0x0, 0xffff}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000500)=@newtfilter={0x3c, 0x2c, 0x405, 0x0, 0x0, {0x0, 0x0, 0x0, 0x1, {0x1}, {0xfff1, 0xffff}, {0x3, 0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0xc, 0x2, [@TCA_BASIC_CLASSID={0x8, 0x1, {0x1}}]}}]}, 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000800)=@deltfilter={0x34, 0x2d, 0x5, 0x0, 0x0, {0x0, 0x0, 0x0, 0x1, {0x1}, {0xfff1, 0xffff}, {0x3, 0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0x4}}]}, 0x34}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000500)=@newtfilter={0x3c, 0x2c, 0x405, 0x0, 0x0, {0x0, 0x0, 0x0, 0x1, {0x2}, {0xfff1, 0xffff}, {0x3, 0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0xc, 0x2, [@TCA_BASIC_CLASSID={0x8, 0x1, {0x2}}]}}]}, 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000800)=@deltfilter={0x34, 0x2d, 0x5, 0x0, 0x0, {0x0, 0x0, 0x0, 0x1, {0x2}, {0xfff1, 0xffff}, {0x3, 0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0x4}}]}, 0x34}}, 0x0) nanosleep(&(0x7f0000000900)={0x1}, 0x0) 1.377436553s ago: executing program 2 (id=27): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000000), r0) sendmsg$TIPC_NL_MON_GET(r0, &(0x7f0000000100)={&(0x7f0000000200), 0xc, &(0x7f0000000300)={&(0x7f0000000400)={0x14, r1, 0x301}, 0x18}}, 0x0) 1.263194451s ago: executing program 2 (id=29): r0 = socket$inet_sctp(0x2, 0x1, 0x84) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) sendto$inet(r0, &(0x7f0000000300)="ab", 0x1, 0x0, &(0x7f0000000380)={0x2, 0x4e22, @local}, 0x10) close(r0) r1 = socket$inet_sctp(0x2, 0x5, 0x84) bind$inet(r1, &(0x7f0000000100)={0x2, 0x4e23, @empty}, 0x10) sendto$inet(r1, &(0x7f0000000300)="ab", 0x1, 0x0, &(0x7f0000000380)={0x2, 0x4e23, @local}, 0x10) close(r1) 1.153267422s ago: executing program 4 (id=30): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r0) sendmsg$TIPC_CMD_SET_NODE_ADDR(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)={0x24, r1, 0x1, 0x0, 0x0, {{}, {}, {0x8, 0x1, 0x1000001}}}, 0x18}}, 0x0) sendmsg$TIPC_CMD_ENABLE_BEARER(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a5f74756e00000000000000"], 0x38}}, 0x0) syz_emit_ethernet(0x50, &(0x7f0000000300)={@random="ffffffffffff", @random="aabbccddeeff", @void, {@generic={0x88ca, "5b500028000000000000000001000001000000000000000001000001010203040000000120000000112233445566000000000000"}}}, 0x0) 1.071807685s ago: executing program 3 (id=31): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/module/sctp/parameters/no_checksums\x00', 0x1, 0x0) write(r0, &(0x7f0000000140)='1\n', 0x2) close(r0) openat(0xffffffffffffff9c, &(0x7f0000000180)='./proc/sys/net/ipv4/conf/all/route_localnet\x00', 0x1, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/sys/net/ipv4/conf/syz_tun/route_localnet\x00', 0x1, 0x0) write(r1, &(0x7f0000000240)='1\n', 0x2) close(r1) r2 = socket$inet_sctp(0x2, 0x5, 0x84) fcntl$setstatus(r2, 0x4, 0x800) bind(r2, &(0x7f0000000280)=@in={0x2, 0x1122, @loopback}, 0x10) listen(r2, 0x5) r3 = socket$inet_sctp(0x2, 0x5, 0x84) bind(r3, &(0x7f00000002c0)=@in={0x2, 0x3344, @loopback}, 0x10) connect(r3, &(0x7f0000000300)=@in={0x2, 0x1122, @loopback}, 0x10) (async) 1.039940086s ago: executing program 2 (id=32): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000440)=@raw={'raw\x00', 0x8, 0x3, 0x358, 0x130, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x288, 0xffffffff, 0xffffffff, 0x288, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@mcast2, @mcast2, [0xffff00, 0xff000000], [], 'veth0_macvtap\x00', 'dvmrp1\x00', {}, {}, 0x88}, 0x0, 0x108, 0x130, 0x0, {}, [@common=@unspec=@statistic={{0x38}, {0x0, 0x0, 0x3096, 0x8000, 0x56e5, {0xd}}}, @common=@ipv6header={{0x28}, {0x4}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [0x0, 0x0, 0x0, 0xff000000], 'erspan0\x00', 'gre0\x00', {}, {}, 0x0, 0x4}, 0x0, 0x128, 0x158, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x18, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff, 0x40}}}, @inet=@rpfilter={{0x28}, {0x1}}]}, @common=@unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1, {0xfffffffe, 0x1}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x0, 0x7}}}}, 0x3b8) setsockopt$inet6_IPV6_RTHDR(r0, 0x29, 0x39, &(0x7f0000000080), 0x8) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2c10", 0x10}], 0x1}, 0x0) 977.164942ms ago: executing program 4 (id=33): r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x1}, 0x10) listen(r0, 0x5) 866.857978ms ago: executing program 2 (id=34): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x48}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWFLOWTABLE={0x4c, 0x16, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_HOOK={0x2c, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_NUM={0x8}, @NFTA_FLOWTABLE_HOOK_PRIORITY={0x8}, @NFTA_FLOWTABLE_HOOK_DEVS={0x18, 0x3, 0x0, 0x1, [{0x14, 0x1, 'lo\x00'}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x74}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWCHAIN={0x54, 0x3, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_HOOK_PRIORITY={0x8}]}, @NFTA_CHAIN_TYPE={0xb, 0x7, 'filter\x00'}, @NFTA_CHAIN_FLAGS={0x8, 0xa, 0x1, 0x0, 0x1}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000740)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWRULE={0x40, 0x6, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x14, 0x4, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, @masq={{0x9}, @void}}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x68}}, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000200)={0x2, 0x115c, @loopback}, 0x10) listen(r1, 0x5) r2 = socket$inet_tcp(0x2, 0x1, 0x0) connect$inet(r2, &(0x7f0000000300)={0x2, 0x115c, @loopback}, 0x10) r3 = accept(r1, 0x0, 0x0) sendto$inet(r3, &(0x7f0000000500)="00112233445566778899", 0xa, 0x0, 0x0, 0x0) 862.282482ms ago: executing program 4 (id=35): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./proc\x00', 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/net/ipv4/ip_forward\x00', 0x1, 0x0) write(r0, &(0x7f0000000100), 0x0) write(0xffffffffffffffff, &(0x7f0000000180)='1', 0x1) ioctl$sock_ifreq(0xffffffffffffffff, 0x8922, 0x0) syz_emit_ethernet(0x3e2, &(0x7f0000000400)={@local, @remote, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x3d4, 0x5678, 0x6000, 0x40, 0x11, 0x0, @rand_addr=0x1020304, @rand_addr=0x8080808}, {0x1234, 0x5678, 0x3c0, 0x0, @opaque='\x00'/952}}}}}, 0x0) syz_emit_ethernet(0x0, 0x0, 0x0) 846.022617ms ago: executing program 3 (id=36): unshare(0x40000000) r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/tcp_syncookies\x00', 0x1, 0x0) write(r0, &(0x7f0000000100)='2', 0x1) close(r0) r1 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000400), r2) r4 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r4, &(0x7f0000000700)={0x2, 0x4e24, @empty}, 0x10) listen(r4, 0x5) r5 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r5, &(0x7f0000000800)={0x2, 0x4e24, @loopback}, 0x10) r6 = accept4(r4, 0x0, 0x0, 0x0) write(r5, &(0x7f0000000900)='hello', 0x5) read(r6, &(0x7f0000000a00), 0x10) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)={0x38, r3, 0x1, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x24, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @empty}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x2}]}]}, 0x38}}, 0x0) write(r5, &(0x7f0000000900)='world', 0x5) 707.322467ms ago: executing program 2 (id=37): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/1/root/var\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./proc/1/root/var/run\x00', 0x1ff) r0 = socket$unix(0x1, 0x1, 0x0) bind$unix(r0, &(0x7f00000001c0)=@file={0x1, './proc/1/root/var/run/gssproxy.sock\x00'}, 0x30) listen(r0, 0x5) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./proc/net/rpc/use-gss-proxy\x00', 0x1, 0x0) write(r1, &(0x7f0000000280)='1\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000300)='./nfsd\x00', &(0x7f0000000340)='nfsd\x00', 0x0, 0x0) r2 = socket$inet(0x2, 0x1, 0x6) bind$inet(r2, &(0x7f0000000380)={0x2, 0x801, @loopback}, 0x10) listen(r2, 0x5) r3 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./nfsd/portlist\x00', 0x1, 0x0) write(r3, &(0x7f0000000400)='3\n\x00', 0x2) write(r3, &(0x7f0000000440)='4\n\x00', 0x2) write(r3, &(0x7f0000000480)='5\n\x00', 0x2) write(r3, &(0x7f00000004c0)='6\n\x00', 0x2) 615.046237ms ago: executing program 4 (id=38): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @local}, 0x10) listen(r0, 0x5) r1 = socket$inet_tcp(0x2, 0x1, 0x0) connect$inet(r1, &(0x7f0000000020)={0x2, 0x4e20, @remote}, 0x10) syz_extract_tcp_res(&(0x7f0000000200)={0x0, 0x0}, 0x0, 0x0) syz_extract_tcp_res(&(0x7f0000000200)={0x0, 0x0}, 0x0, 0x0) syz_extract_tcp_res(&(0x7f0000000200)={0x0, 0x0}, 0x0, 0x0) syz_emit_ethernet(0x3c, &(0x7f0000000040)={@local, @remote, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x2e, 0x0, 0x0, 0x40, 0x6, 0x0, @remote, @local}, {{0x4e21, 0x4e20, r2, r3, 0x0, 0x0, 0x5, 0x18, 0x1000}, {"000600000000"}}}}}}, 0x0) 566.871673ms ago: executing program 1 (id=39): r0 = socket$inet(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000000)={'lo\x00', 0x1}) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=@newlink={0x5c, 0x10, 0x605, 0x1, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @veth={{0x9}, {0x18, 0x2, 0x0, 0x1, @val=@VETH_INFO_PEER={0x14}}}}, @IFLA_IFNAME={0x14, 0x3, 'veth0\x00'}]}, 0x5c}}, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000a00)={'veth0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000b00)={'veth1\x00', 0x0}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000300)={'veth0\x00', 0x1}) sendmsg$nl_route(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=@ipv6_newaddr={0x34, 0x14, 0x605, 0x1, 0x0, {0xa, 0x40, 0x2, 0x0, r2}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @IFA_FLAGS={0x8, 0x8, 0x2}]}, 0x34}}, 0x0) unshare(0x40000000) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=@setlink={0x28, 0x10, 0x605, 0x1, 0x0, {0x0, 0x0, 0x0, r3}, [@IFLA_NET_NS_PID={0x8}]}, 0x28}}, 0x0) r5 = socket$inet(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r5, 0x8914, &(0x7f0000000400)={'veth1\x00', 0x1}) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000c00)={'veth1\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000003c0)=@ipv6_newaddr={0x34, 0x14, 0x605, 0x1, 0x0, {0xa, 0x40, 0x2, 0x0, r6}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @IFA_FLAGS={0x8, 0x8, 0x2}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000004c0)=@newneigh={0x3c, 0x1c, 0x605, 0x1, 0x0, {0xa, 0x0, 0x0, r6, 0x80, 0x0, 0x1}, [@NDA_DST_IPV6={0x14, 0x1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @NDA_LLADDR={0xa, 0x2, @random="001122334455"}]}, 0x3c}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000580)=@newneigh={0x3c, 0x1c, 0x605, 0x1, 0x0, {0xa, 0x0, 0x0, r2, 0x80, 0x0, 0x1}, [@NDA_DST_IPV6={0x14, 0x1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @NDA_LLADDR={0xa, 0x2, @random="001122334466"}]}, 0x3c}}, 0x0) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r7, &(0x7f0000000700)={0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, 0x1c) connect$inet6(r7, &(0x7f0000000800)={0xa, 0x4001, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, 0x1c) nanosleep(&(0x7f0000000900)={0x0, 0x1dcd6500}, 0x0) 471.898761ms ago: executing program 4 (id=40): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000180)=@newtaction={0x60, 0x30, 0x400, 0x0, 0x0, {}, [{0x4c, 0x1, [@m_gact={0x48, 0x1, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x1, {0x1, 0x0, 0x2}}]}}}]}]}, 0x8c}, 0x1, 0x0, 0x0, 0x8890}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000180)=@gettaction={0x34, 0x32, 0x1, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x20, 0x1, [{0x10, 0x1, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'gact\x00'}}, {0xc, 0x2, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x5, 0x1}}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x8890}, 0x0) 407.398226ms ago: executing program 2 (id=41): unshare(0x40000000) r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/tcp_syncookies\x00', 0x1, 0x0) write(r0, &(0x7f0000000100)='2\n', 0x2) close(r0) r1 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000400), r2) sendmsg$MPTCP_PM_CMD_SET_LIMITS(r2, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r4 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r4, &(0x7f0000000700)={0x2, 0x4e24, @empty}, 0x10) listen(r4, 0x5) r5 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r5, &(0x7f0000000800)={0x2, 0x4e24, @loopback}, 0x10) accept4(r4, 0x0, 0x0, 0x0) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)={0x38, r3, 0x1, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x24, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @empty}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x2}]}]}, 0x38}}, 0x0) 363.204016ms ago: executing program 4 (id=42): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x1a85, @loopback}, 0x10) listen(r0, 0x5) r1 = fsopen(&(0x7f0000000100)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000140)='source\x00', &(0x7f0000000180)='127.0.0.1:6789:/\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) (async) r2 = accept$inet(r0, &(0x7f0000000200), &(0x7f0000000210)=0x10) nanosleep(&(0x7f0000000400)={0x0, 0x989680}, 0x0) write(r2, &(0x7f0000000300)='ceph v027\x00'/278, 0x119) nanosleep(&(0x7f0000000400)={0x0, 0x1312d00}, 0x0) write(r2, &(0x7f0000000800)="01ffffffffffffffff00"/27, 0x1a) nanosleep(&(0x7f0000000400)={0x0, 0x1312d00}, 0x0) write(r2, &(0x7f0000000c00)="070100000000000000000000000000000030000000000000000000000000000000000000000100000000000000000000000000000028d7b3ad00"/74, 0x48) nanosleep(&(0x7f0000000400)={0x0, 0x2faf080}, 0x0) 276.375161ms ago: executing program 3 (id=43): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_ACCT_NEW(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)={0x20, 0x0, 0x7, 0x1, 0x0, 0x0, {0x2}, [@NFACCT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}}, 0x0) 170.943516ms ago: executing program 3 (id=44): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x8008, @empty}, 0x10) listen(r0, 0x5) r1 = add_key$user(&(0x7f0000000100), &(0x7f0000000200)={'syz', 0x0}, &(0x7f0000000300)='\x00\x00', 0x2, 0xfffffffffffffffc) r2 = add_key$user(&(0x7f0000000400), &(0x7f0000000500)={'syz', 0x1}, &(0x7f0000000600)='\x00\x00', 0x2, 0xfffffffffffffffc) r3 = fsopen(&(0x7f0000000700)='nfs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r3, 0x1, &(0x7f0000000800)='source\x00', &(0x7f0000000900)='127.0.0.1:/export\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r3, 0x1, &(0x7f0000000a00)='addr\x00', &(0x7f0000000b00)='127.0.0.1\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r3, 0x1, &(0x7f0000000c00)='port\x00', &(0x7f0000000d00)='2049\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r3, 0x1, &(0x7f0000000e00)='vers\x00', &(0x7f0000000f00)='4.2\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r3, 0x1, &(0x7f0000001000)='xprtsec\x00', &(0x7f0000001100)='mtls\x00', 0x0) fsconfig$FSCONFIG_SET_FD(r3, 0x5, &(0x7f0000001200)='cert_serial\x00', 0x0, r1) fsconfig$FSCONFIG_SET_FD(r3, 0x5, &(0x7f0000001300)='privkey_serial\x00', 0x0, r2) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) 166.83375ms ago: executing program 0 (id=45): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e24, @loopback}, 0x10) listen(r0, 0x5) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x7, &(0x7f0000000040)=0x1000, 0x4) connect$inet(r1, &(0x7f0000000080)={0x2, 0x4e24, @loopback}, 0x10) accept$inet(r0, 0x0, 0x0) setsockopt$inet_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f00000000c0), 0x4) 111.066901ms ago: executing program 0 (id=46): r0 = socket$inet(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x1a85, @empty}, 0x10) listen(r0, 0xa) r1 = fsopen(&(0x7f0000000100)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000200)='mon_addr\x00', &(0x7f0000000300)='127.0.0.1:6789\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000400)='source\x00', &(0x7f0000000500)='127.0.0.1:6789:/\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000600)='mount_timeout\x00', &(0x7f0000000700)='1\x00', 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = accept$inet(r0, 0x0, 0x0) write(r2, &(0x7f0000000800)="6365706820763032370a000000000000000000021a857f00000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000021a857f0000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001ffffffffffffffff010000000100"/418, 0x134) 0s ago: executing program 3 (id=47): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x601, 0x0, 0x0, {0x2}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWFLOWTABLE={0x58, 0x16, 0xa, 0x601, 0x0, 0x0, {0x2}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_FLOWTABLE_HOOK={0x2c, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_NUM={0x8}, @NFTA_FLOWTABLE_HOOK_PRIORITY={0x8}, @NFTA_FLOWTABLE_HOOK_DEVS={0x18, 0x3, 0x0, 0x1, [{0x14, 0x1, 'lo\x00'}]}]}]}, @NFT_MSG_NEWCHAIN={0x40, 0x3, 0xa, 0x601, 0x0, 0x0, {0x2}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_HOOK_PRIORITY={0x8}]}]}, @NFT_MSG_NEWRULE={0x58, 0x6, 0xa, 0x601, 0x0, 0x0, {0x2}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x2c, 0x4, 0x0, 0x1, [{0x28, 0x1, 0x0, 0x1, @flow_offload={{0x11}, @val={0x10, 0x2, 0x0, 0x1, [@NFTA_FLOW_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}}}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x138}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./proc/sys/net/ipv4/ip_forward\x00', 0x1, 0x0) write(r1, &(0x7f0000000380)='1\n', 0x2) r2 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCADDRT(r2, 0x890b, &(0x7f0000000100)={0x0, {0x2, 0x0, @private=0xa010101}, {0x2, 0x0, @empty}, {0x2, 0x0, @broadcast}, 0x5, 0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)='lo\x00'}) ioctl$sock_inet_SIOCADDRT(r2, 0x890b, &(0x7f0000000180)={0x0, {0x2, 0x0, @private=0xa010102}, {0x2, 0x0, @empty}, {0x2, 0x0, @broadcast}, 0x5, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)='lo\x00'}) syz_emit_ethernet(0x2f, &(0x7f0000000300)={@local, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x21, 0x64, 0x0, 0x40, 0x11, 0x0, @private=0xa010101, @private=0xa010102}, {0x3030, 0x3030, 0xd, 0x0, @opaque="1234567890"}}}}}, 0x0) syz_emit_ethernet(0x2f, &(0x7f0000000500)={@local, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x21, 0x64, 0x0, 0x40, 0x11, 0x0, @private=0xa010102, @private=0xa010101}, {0x3030, 0x3030, 0xd, 0x0, @opaque="1234567890"}}}}}, 0x0) syz_emit_ethernet(0x2f, &(0x7f0000000700)={@local, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x21, 0x64, 0x0, 0x40, 0x11, 0x0, @private=0xa010101, @private=0xa010102}, {0x3030, 0x3030, 0xd, 0x0, @opaque="1234567890"}}}}}, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.57' (ED25519) to the list of known hosts. [ 72.788952][ T29] kauditd_printk_skb: 9 callbacks suppressed [ 72.788968][ T29] audit: type=1400 audit(1785768826.305:129): avc: denied { mounton } for pid=5594 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 72.818722][ T29] audit: type=1400 audit(1785768826.335:130): avc: denied { mount } for pid=5594 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 72.821977][ T5594] cgroup: Unknown subsys name 'net' [ 72.847944][ T29] audit: type=1400 audit(1785768826.365:131): avc: denied { unmount } for pid=5594 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 72.965247][ T5594] cgroup: Unknown subsys name 'cpuset' [ 72.975461][ T5594] cgroup: Unknown subsys name 'rlimit' [ 73.103546][ T29] audit: type=1400 audit(1785768826.625:132): avc: denied { setattr } for pid=5594 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=821 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 73.138775][ T29] audit: type=1400 audit(1785768826.625:133): avc: denied { create } for pid=5594 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 73.171436][ T29] audit: type=1400 audit(1785768826.625:134): avc: denied { write } for pid=5594 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 73.192666][ T29] audit: type=1400 audit(1785768826.625:135): avc: denied { read } for pid=5594 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 73.213272][ T29] audit: type=1400 audit(1785768826.635:136): avc: denied { mounton } for pid=5594 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 73.226738][ T5596] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 73.238452][ T29] audit: type=1400 audit(1785768826.635:137): avc: denied { mount } for pid=5594 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 73.270144][ T29] audit: type=1400 audit(1785768826.775:138): avc: denied { relabelto } for pid=5596 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 74.215682][ T5594] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 78.223380][ T29] kauditd_printk_skb: 4 callbacks suppressed [ 78.223396][ T29] audit: type=1400 audit(1785768831.735:143): avc: denied { create } for pid=5608 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 78.251308][ T29] audit: type=1400 audit(1785768831.735:144): avc: denied { read write } for pid=5608 comm="syz-executor" name="vhci" dev="devtmpfs" ino=1269 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 78.280937][ T29] audit: type=1400 audit(1785768831.735:145): avc: denied { open } for pid=5608 comm="syz-executor" path="/dev/vhci" dev="devtmpfs" ino=1269 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 78.311064][ T29] audit: type=1400 audit(1785768831.785:146): avc: denied { ioctl } for pid=5609 comm="syz-executor" path="socket:[4780]" dev="sockfs" ino=4780 ioctlcmd=0x48c9 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 78.356351][ T5625] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 78.366289][ T5629] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 78.380723][ T5627] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 78.381158][ T5625] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 78.395405][ T5628] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 78.396585][ T5629] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 78.404701][ T5628] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 78.411015][ T5629] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 78.419955][ T5628] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 78.426499][ T5629] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 78.431538][ T5628] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 78.438775][ T5629] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 78.445705][ T5628] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 78.453111][ T5629] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 78.459333][ T5628] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 78.466611][ T5629] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 78.473215][ T5628] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 78.490163][ T5629] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 78.490227][ T5621] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 78.491394][ T5628] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 78.505790][ T5628] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 78.520893][ T5629] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 78.522388][ T5628] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 78.535140][ T5629] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 78.542719][ T5629] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 78.552997][ T29] audit: type=1400 audit(1785768832.035:147): avc: denied { read } for pid=5611 comm="syz-executor" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 78.665343][ T29] audit: type=1400 audit(1785768832.035:148): avc: denied { open } for pid=5611 comm="syz-executor" path="net:[4026531833]" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 78.718282][ T29] audit: type=1400 audit(1785768832.035:149): avc: denied { mounton } for pid=5611 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 78.742814][ T29] audit: type=1400 audit(1785768832.055:150): avc: denied { module_request } for pid=5611 comm="syz-executor" kmod="netdev-nr1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 78.812116][ T29] audit: type=1400 audit(1785768832.155:151): avc: denied { sys_module } for pid=5611 comm="syz-executor" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 80.042457][ T5611] bridge0: port 1(bridge_slave_0) entered blocking state [ 80.050797][ T5611] bridge0: port 1(bridge_slave_0) entered disabled state [ 80.058410][ T5611] bridge_slave_0: entered allmulticast mode [ 80.065398][ T5611] bridge_slave_0: entered promiscuous mode [ 80.100219][ T5611] bridge0: port 2(bridge_slave_1) entered blocking state [ 80.107564][ T5611] bridge0: port 2(bridge_slave_1) entered disabled state [ 80.114938][ T5611] bridge_slave_1: entered allmulticast mode [ 80.121713][ T5611] bridge_slave_1: entered promiscuous mode [ 80.128662][ T5608] bridge0: port 1(bridge_slave_0) entered blocking state [ 80.135770][ T5608] bridge0: port 1(bridge_slave_0) entered disabled state [ 80.143007][ T5608] bridge_slave_0: entered allmulticast mode [ 80.149846][ T5608] bridge_slave_0: entered promiscuous mode [ 80.173968][ T5620] bridge0: port 1(bridge_slave_0) entered blocking state [ 80.181074][ T5620] bridge0: port 1(bridge_slave_0) entered disabled state [ 80.188286][ T5620] bridge_slave_0: entered allmulticast mode [ 80.195134][ T5620] bridge_slave_0: entered promiscuous mode [ 80.209238][ T5608] bridge0: port 2(bridge_slave_1) entered blocking state [ 80.216361][ T5608] bridge0: port 2(bridge_slave_1) entered disabled state [ 80.223578][ T5608] bridge_slave_1: entered allmulticast mode [ 80.230324][ T5608] bridge_slave_1: entered promiscuous mode [ 80.255551][ T5620] bridge0: port 2(bridge_slave_1) entered blocking state [ 80.262728][ T5620] bridge0: port 2(bridge_slave_1) entered disabled state [ 80.269956][ T5620] bridge_slave_1: entered allmulticast mode [ 80.276890][ T5620] bridge_slave_1: entered promiscuous mode [ 80.320151][ T5611] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 80.359615][ T5611] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 80.371309][ T5608] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 80.380573][ T5610] bridge0: port 1(bridge_slave_0) entered blocking state [ 80.388054][ T5610] bridge0: port 1(bridge_slave_0) entered disabled state [ 80.395469][ T5610] bridge_slave_0: entered allmulticast mode [ 80.402353][ T5610] bridge_slave_0: entered promiscuous mode [ 80.415736][ T5620] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 80.434796][ T5608] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 80.450734][ T5610] bridge0: port 2(bridge_slave_1) entered blocking state [ 80.457988][ T5610] bridge0: port 2(bridge_slave_1) entered disabled state [ 80.465247][ T5610] bridge_slave_1: entered allmulticast mode [ 80.471976][ T5610] bridge_slave_1: entered promiscuous mode [ 80.487060][ T5620] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 80.513224][ T5615] Bluetooth: hci3: command tx timeout [ 80.542550][ T5611] team0: Port device team_slave_0 added [ 80.550083][ T5608] team0: Port device team_slave_0 added [ 80.562968][ T5609] bridge0: port 1(bridge_slave_0) entered blocking state [ 80.570154][ T5609] bridge0: port 1(bridge_slave_0) entered disabled state [ 80.577365][ T5609] bridge_slave_0: entered allmulticast mode [ 80.584660][ T5609] bridge_slave_0: entered promiscuous mode [ 80.592170][ T5615] Bluetooth: hci0: command tx timeout [ 80.592265][ T5629] Bluetooth: hci1: command tx timeout [ 80.611776][ T5611] team0: Port device team_slave_1 added [ 80.627677][ T5608] team0: Port device team_slave_1 added [ 80.635424][ T5610] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 80.644835][ T5609] bridge0: port 2(bridge_slave_1) entered blocking state [ 80.652140][ T5609] bridge0: port 2(bridge_slave_1) entered disabled state [ 80.659300][ T5609] bridge_slave_1: entered allmulticast mode [ 80.666313][ T5609] bridge_slave_1: entered promiscuous mode [ 80.672231][ T5629] Bluetooth: hci4: command tx timeout [ 80.672246][ T4926] Bluetooth: hci2: command tx timeout [ 80.689240][ T5620] team0: Port device team_slave_0 added [ 80.711329][ T5610] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 80.729354][ T5620] team0: Port device team_slave_1 added [ 80.735901][ T5611] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 80.742932][ T5611] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 80.769009][ T5611] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 80.798067][ T5609] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 80.816505][ T5611] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 80.823578][ T5611] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 80.849555][ T5611] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 80.860956][ T5608] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 80.868150][ T5608] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 80.894360][ T5608] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 80.915160][ T5609] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 80.947315][ T5608] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 80.954417][ T5608] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 80.980522][ T5608] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 80.993126][ T5610] team0: Port device team_slave_0 added [ 81.007263][ T5620] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 81.014413][ T5620] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 81.040343][ T5620] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 81.059803][ T5610] team0: Port device team_slave_1 added [ 81.067085][ T5609] team0: Port device team_slave_0 added [ 81.080412][ T5620] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 81.087429][ T5620] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 81.113548][ T5620] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 81.135192][ T5609] team0: Port device team_slave_1 added [ 81.184281][ T5611] hsr_slave_0: entered promiscuous mode [ 81.190738][ T5611] hsr_slave_1: entered promiscuous mode [ 81.207251][ T5610] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 81.214365][ T5610] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 81.240467][ T5610] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 81.259477][ T5609] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 81.266736][ T5609] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 81.292631][ T5609] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 81.317504][ T5608] hsr_slave_0: entered promiscuous mode [ 81.324486][ T5608] hsr_slave_1: entered promiscuous mode [ 81.330646][ T5608] debugfs: 'hsr0' already exists in 'hsr' [ 81.337248][ T5608] Cannot create hsr debugfs directory [ 81.344630][ T5610] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 81.351725][ T5610] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 81.377862][ T5610] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 81.401256][ T5609] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 81.409057][ T5609] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 81.435347][ T5609] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 81.522458][ T5620] hsr_slave_0: entered promiscuous mode [ 81.528947][ T5620] hsr_slave_1: entered promiscuous mode [ 81.535295][ T5620] debugfs: 'hsr0' already exists in 'hsr' [ 81.541019][ T5620] Cannot create hsr debugfs directory [ 81.616732][ T5609] hsr_slave_0: entered promiscuous mode [ 81.622907][ T5609] hsr_slave_1: entered promiscuous mode [ 81.628831][ T5609] debugfs: 'hsr0' already exists in 'hsr' [ 81.634913][ T5609] Cannot create hsr debugfs directory [ 81.692952][ T5610] hsr_slave_0: entered promiscuous mode [ 81.699078][ T5610] hsr_slave_1: entered promiscuous mode [ 81.705207][ T5610] debugfs: 'hsr0' already exists in 'hsr' [ 81.710940][ T5610] Cannot create hsr debugfs directory [ 82.031654][ T5611] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 82.043398][ T5611] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 82.051395][ T5611] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 82.060608][ T5611] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 82.080712][ T5611] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 82.089610][ T5611] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 82.110705][ T5611] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 82.120135][ T5611] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 82.177418][ T5608] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 82.187130][ T5608] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 82.199354][ T5608] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 82.209264][ T5608] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 82.217980][ T5608] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 82.227823][ T5608] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 82.235599][ T5608] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 82.244880][ T5608] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 82.335090][ T5620] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 82.345440][ T5620] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 82.353642][ T5620] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 82.362854][ T5620] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 82.371256][ T5620] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 82.380232][ T5620] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 82.395278][ T5620] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 82.404264][ T5620] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 82.463440][ T5611] 8021q: adding VLAN 0 to HW filter on device bond0 [ 82.488836][ T5609] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 82.499509][ T5609] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 82.507670][ T5609] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 82.517214][ T5609] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 82.525463][ T5609] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 82.534700][ T5609] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 82.542990][ T5609] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 82.551359][ T5609] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 82.577342][ T5611] 8021q: adding VLAN 0 to HW filter on device team0 [ 82.593369][ T5629] Bluetooth: hci3: command tx timeout [ 82.617616][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 82.624985][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 82.663217][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 82.670313][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 82.672474][ T5629] Bluetooth: hci1: command tx timeout [ 82.678377][ T5615] Bluetooth: hci0: command tx timeout [ 82.736751][ T5610] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 82.745819][ T5610] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 82.753372][ T5629] Bluetooth: hci4: command tx timeout [ 82.761529][ T5610] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 82.768490][ T5629] Bluetooth: hci2: command tx timeout [ 82.778101][ T5610] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 82.795203][ T5610] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 82.804200][ T5610] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 82.814123][ T5608] 8021q: adding VLAN 0 to HW filter on device bond0 [ 82.832229][ T5610] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 82.841156][ T5610] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 82.887440][ T5608] 8021q: adding VLAN 0 to HW filter on device team0 [ 82.905122][ T115] bridge0: port 1(bridge_slave_0) entered blocking state [ 82.912257][ T115] bridge0: port 1(bridge_slave_0) entered forwarding state [ 82.938250][ T115] bridge0: port 2(bridge_slave_1) entered blocking state [ 82.945347][ T115] bridge0: port 2(bridge_slave_1) entered forwarding state [ 82.988748][ T5609] 8021q: adding VLAN 0 to HW filter on device bond0 [ 83.005037][ T5620] 8021q: adding VLAN 0 to HW filter on device bond0 [ 83.058064][ T5609] 8021q: adding VLAN 0 to HW filter on device team0 [ 83.076657][ T5620] 8021q: adding VLAN 0 to HW filter on device team0 [ 83.097559][ T35] bridge0: port 1(bridge_slave_0) entered blocking state [ 83.104715][ T35] bridge0: port 1(bridge_slave_0) entered forwarding state [ 83.126303][ T35] bridge0: port 1(bridge_slave_0) entered blocking state [ 83.133462][ T35] bridge0: port 1(bridge_slave_0) entered forwarding state [ 83.159916][ T35] bridge0: port 2(bridge_slave_1) entered blocking state [ 83.167076][ T35] bridge0: port 2(bridge_slave_1) entered forwarding state [ 83.179097][ T35] bridge0: port 2(bridge_slave_1) entered blocking state [ 83.186242][ T35] bridge0: port 2(bridge_slave_1) entered forwarding state [ 83.315745][ T5610] 8021q: adding VLAN 0 to HW filter on device bond0 [ 83.379129][ T5610] 8021q: adding VLAN 0 to HW filter on device team0 [ 83.430989][ T806] bridge0: port 1(bridge_slave_0) entered blocking state [ 83.438142][ T806] bridge0: port 1(bridge_slave_0) entered forwarding state [ 83.473476][ T806] bridge0: port 2(bridge_slave_1) entered blocking state [ 83.480621][ T806] bridge0: port 2(bridge_slave_1) entered forwarding state [ 83.765735][ T5611] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 83.913988][ T5611] veth0_vlan: entered promiscuous mode [ 83.950031][ T5611] veth1_vlan: entered promiscuous mode [ 84.033446][ T5611] veth0_macvtap: entered promiscuous mode [ 84.085141][ T5611] veth1_macvtap: entered promiscuous mode [ 84.149479][ T5608] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 84.181232][ T5611] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 84.216816][ T5611] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 84.304180][ T35] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.340170][ T5609] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 84.362605][ T35] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.414848][ T5620] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 84.497204][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 84.506568][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 84.512382][ T5608] veth0_vlan: entered promiscuous mode [ 84.540106][ T5610] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 84.582330][ T12] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.591656][ T5608] veth1_vlan: entered promiscuous mode [ 84.629331][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 84.638595][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 84.672336][ T5629] Bluetooth: hci3: command tx timeout [ 84.680573][ T5609] veth0_vlan: entered promiscuous mode [ 84.681332][ T29] audit: type=1400 audit(1785768838.195:152): avc: denied { mounton } for pid=5611 comm="syz-executor" path="/root/syzkaller.6F7efQ/syz-tmp" dev="sda1" ino=2042 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 84.714244][ T29] audit: type=1400 audit(1785768838.235:153): avc: denied { mount } for pid=5611 comm="syz-executor" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 84.739785][ T29] audit: type=1400 audit(1785768838.235:154): avc: denied { mounton } for pid=5611 comm="syz-executor" path="/root/syzkaller.6F7efQ/syz-tmp/newroot/dev" dev="tmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 84.772567][ T29] audit: type=1400 audit(1785768838.235:155): avc: denied { mount } for pid=5611 comm="syz-executor" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 84.772954][ T5629] Bluetooth: hci1: command tx timeout [ 84.794962][ T5615] Bluetooth: hci0: command tx timeout [ 84.806277][ T29] audit: type=1400 audit(1785768838.235:156): avc: denied { mounton } for pid=5611 comm="syz-executor" path="/root/syzkaller.6F7efQ/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 84.809128][ T5609] veth1_vlan: entered promiscuous mode [ 84.845453][ T5615] Bluetooth: hci2: command tx timeout [ 84.851246][ T5615] Bluetooth: hci4: command tx timeout [ 84.859625][ T29] audit: type=1400 audit(1785768838.235:157): avc: denied { mounton } for pid=5611 comm="syz-executor" path="/root/syzkaller.6F7efQ/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=7658 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 84.867765][ T5608] veth0_macvtap: entered promiscuous mode [ 84.887901][ T29] audit: type=1400 audit(1785768838.265:158): avc: denied { unmount } for pid=5611 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 84.906044][ T5610] veth0_vlan: entered promiscuous mode [ 84.914926][ T29] audit: type=1400 audit(1785768838.365:159): avc: denied { mounton } for pid=5611 comm="syz-executor" path="/dev/gadgetfs" dev="devtmpfs" ino=2784 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 84.941443][ T29] audit: type=1400 audit(1785768838.365:160): avc: denied { mount } for pid=5611 comm="syz-executor" name="/" dev="gadgetfs" ino=7673 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 84.964057][ T29] audit: type=1400 audit(1785768838.365:161): avc: denied { mount } for pid=5611 comm="syz-executor" name="/" dev="binder" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 84.967804][ T5608] veth1_macvtap: entered promiscuous mode [ 85.006972][ T5611] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 85.019054][ T5610] veth1_vlan: entered promiscuous mode [ 85.053891][ T13] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.127709][ T5608] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 85.139250][ T5608] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 85.168339][ T5803] hsr_slave_0: left promiscuous mode [ 85.174742][ T5803] hsr_slave_1: left promiscuous mode [ 85.196429][ T5609] veth0_macvtap: entered promiscuous mode [ 85.211569][ T5610] veth0_macvtap: entered promiscuous mode [ 85.224847][ T5609] veth1_macvtap: entered promiscuous mode [ 85.238843][ T5620] veth0_vlan: entered promiscuous mode [ 85.251490][ T5610] veth1_macvtap: entered promiscuous mode [ 85.265760][ T5804] bond0: entered promiscuous mode [ 85.270783][ T5804] bond_slave_0: entered promiscuous mode [ 85.276649][ T5804] bond_slave_1: entered promiscuous mode [ 85.284466][ T5804] gretap0: entered promiscuous mode [ 85.290348][ T5804] dummy0: entered promiscuous mode [ 85.328559][ T5609] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 85.352710][ T115] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.372775][ T5620] veth1_vlan: entered promiscuous mode [ 85.386379][ T5609] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 85.399489][ T5610] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 85.421021][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 85.430892][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 85.431099][ T5610] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 85.514888][ T5620] veth0_macvtap: entered promiscuous mode [ 85.552501][ T115] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.566805][ T115] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 85.575825][ T115] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 85.586584][ T5620] veth1_macvtap: entered promiscuous mode [ 85.606430][ T35] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.644035][ T13] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.725492][ T13] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.747715][ T115] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 85.763190][ T13] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.771931][ T115] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 85.781515][ T5620] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 85.836775][ T5620] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 85.877264][ T115] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 85.886385][ T13] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.896391][ T115] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 85.901306][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 85.913891][ T115] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.922653][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 86.014836][ T35] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 86.022789][ T3331] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.034570][ T35] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 86.063662][ T806] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.097428][ T806] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.172189][ T35] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.308149][ T115] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.469948][ T804] cfg80211: failed to load regulatory.db [ 86.725611][ T806] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.752469][ T5615] Bluetooth: hci3: command tx timeout [ 86.831350][ T35] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 86.840405][ T5615] Bluetooth: hci0: command tx timeout [ 86.842304][ T5629] Bluetooth: hci1: command tx timeout [ 86.846353][ T13] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.880348][ T35] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 86.914039][ T5629] Bluetooth: hci4: command tx timeout [ 86.914051][ T5615] Bluetooth: hci2: command tx timeout [ 86.926784][ T3331] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.104619][ T35] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 87.121593][ T35] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 87.185163][ T5847] svc: failed to register lockdv1 RPC service (errno 111). [ 87.194954][ T5847] lockd_up: makesock failed, error=-111 [ 87.344054][ T5801] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 87.529859][ T5847] svc: failed to register nfsdv3 RPC service (errno 111). [ 87.538923][ T5847] svc: failed to register nfsaclv3 RPC service (errno 111). [ 87.548354][ T5847] failed to unregister tcp with rpcbind [ 87.560809][ T5847] svc: failed to register nfsdv3 RPC service (errno 97). [ 87.568145][ T5847] svc: failed to register nfsaclv3 RPC service (errno 97). [ 87.572599][ T5801] usb 1-1: New USB device found, idVendor=06b9, idProduct=4061, bcdDevice= 0.00 [ 87.577155][ T5847] failed to unregister tcp with rpcbind [ 87.586228][ T5801] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 87.600244][ T5801] usb 1-1: Product: syz [ 87.604639][ T5801] usb 1-1: Manufacturer: syz [ 87.609634][ T5801] usb 1-1: SerialNumber: syz [ 87.705865][ T5860] svc: failed to register lockdv1 RPC service (errno 111). [ 87.915898][ T5860] svc: failed to register nfsdv3 RPC service (errno 111). [ 87.925313][ T5860] svc: failed to register nfsaclv3 RPC service (errno 111). [ 87.932724][ T5860] failed to unregister tcp with rpcbind [ 87.938414][ T5860] svc: failed to register nfsdv3 RPC service (errno 97). [ 87.945536][ T5860] svc: failed to register nfsaclv3 RPC service (errno 97). [ 87.955459][ T5860] failed to unregister tcp with rpcbind [ 88.018376][ T5873] NFSD: Failed to start, no listeners configured. [ 88.054360][ T5878] Zero length message leads to an empty skb [ 88.151922][ T5880] x_tables: ip_tables: TCPMSS target: only valid for protocol 6 [ 88.396344][ T5891] netlink: 28 bytes leftover after parsing attributes in process `syz.4.26'. [ 88.406105][ T5891] netlink: 28 bytes leftover after parsing attributes in process `syz.4.26'. [ 88.738542][ T5899] tipc: Started in network mode [ 88.755233][ T5899] tipc: Node identity aaaaaaaaaaaa, cluster identity 4711 [ 88.770713][ T5899] tipc: Enabled bearer , priority 0 [ 88.902706][ T5801] usb 1-1: selecting invalid altsetting 1 [ 88.940956][ T5801] speedtch 1-1:1.0: speedtch_bind: setting interface to 1 failed (-22)! [ 88.975717][ T5801] speedtch 1-1:1.0: usbatm_usb_probe: bind failed: -22! [ 89.001669][ T5801] speedtch 1-1:1.0: probe with driver speedtch failed with error -22 [ 89.034046][ T5801] usb 1-1: selecting invalid altsetting 1 [ 89.040543][ T5801] speedtch 1-1:1.1: speedtch_bind: setting interface to 1 failed (-22)! [ 89.051673][ T5801] speedtch 1-1:1.1: usbatm_usb_probe: bind failed: -22! [ 89.060044][ T5801] speedtch 1-1:1.1: probe with driver speedtch failed with error -22 [ 89.084146][ T5801] usb 1-1: USB disconnect, device number 2 [ 89.910725][ T9] tipc: Node number set to 43690 [ 89.940989][ C1] ------------[ cut here ]------------ [ 89.946914][ C1] (skb->_skb_refdst & ~(1UL)) && !(skb->_skb_refdst & 1UL) [ 89.946931][ C1] WARNING: ./include/linux/skbuff.h:1170 at nf_flow_offload_ip_hook+0xf6c/0x2b60, CPU#1: syz.3.47/5949 [ 89.965243][ C1] Modules linked in: [ 89.968043][ T5945] ceph: No mds server is up or the cluster is laggy [ 89.969215][ C1] CPU: 1 UID: 0 PID: 5949 Comm: syz.3.47 Not tainted syzkaller #0 PREEMPT(full) [ 89.985016][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 89.995111][ C1] RIP: 0010:nf_flow_offload_ip_hook+0xf6c/0x2b60 [ 90.001464][ C1] Code: 89 ee e8 87 4b 14 f8 48 83 fd 01 76 20 e8 dc 50 14 f8 83 e5 01 31 ff 48 89 ee e8 6f 4b 14 f8 48 85 ed 75 09 e8 c5 50 14 f8 90 <0f> 0b 90 e8 bc 50 14 f8 e8 e7 73 f7 f7 31 ff 89 c5 89 c6 e8 1c 4b [ 90.021126][ C1] RSP: 0018:ffffc90000a08798 EFLAGS: 00010246 [ 90.027235][ C1] RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff89f61151 [ 90.035264][ C1] RDX: ffff88807e6da540 RSI: ffffffff89f6115b RDI: ffff88807e6da540 [ 90.043272][ C1] RBP: 0000000000000000 R08: 0000000000000007 R09: 0000000000000000 [ 90.051251][ C1] R10: 0000000000000000 R11: 0000000000000000 R12: ffff888075c33cd8 [ 90.059265][ C1] R13: ffff8880574d6900 R14: ffff8880356609c0 R15: ffff8880574d6900 [ 90.067268][ C1] FS: 00007fbb2a7f66c0(0000) GS:ffff888123ed8000(0000) knlGS:0000000000000000 [ 90.076243][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 90.082855][ C1] CR2: 0000001b3360aff8 CR3: 0000000033d9d000 CR4: 00000000003526f0 [ 90.090840][ C1] Call Trace: [ 90.094161][ C1] [ 90.097014][ C1] ? __pfx_ipv4_dst_check+0x10/0x10 [ 90.102262][ C1] ? __pfx_nf_flow_offload_ip_hook+0x10/0x10 [ 90.108250][ C1] ? __lock_acquire+0x49f/0x1a40 [ 90.113222][ C1] ? __pfx_ip_dst_mtu_maybe_forward+0x10/0x10 [ 90.119314][ C1] ? lock_acquire+0x1b9/0x370 [ 90.124041][ C1] nf_hook_slow+0xbf/0x220 [ 90.128467][ C1] __netif_receive_skb_core.constprop.0+0x1689/0x3530 [ 90.135261][ C1] ? find_held_lock+0x2b/0x80 [ 90.139940][ C1] ? __pfx_ip_output+0x10/0x10 [ 90.144730][ C1] ? ip_forward_finish+0x1b4/0x320 [ 90.149850][ C1] ? __pfx___netif_receive_skb_core.constprop.0+0x10/0x10 [ 90.157005][ C1] ? ip_forward+0xfa2/0x2690 [ 90.161627][ C1] ? __lock_acquire+0x49f/0x1a40 [ 90.166634][ C1] ? process_backlog+0x32a/0x1580 [ 90.171666][ C1] __netif_receive_skb_one_core+0xb0/0x1e0 [ 90.177502][ C1] ? __pfx___netif_receive_skb_one_core+0x10/0x10 [ 90.183947][ C1] ? lock_acquire+0x1b9/0x370 [ 90.188637][ C1] ? process_backlog+0x32a/0x1580 [ 90.193694][ C1] ? process_backlog+0x32a/0x1580 [ 90.198723][ C1] __netif_receive_skb+0x1f/0x120 [ 90.203774][ C1] process_backlog+0x37a/0x1580 [ 90.208641][ C1] __napi_poll.constprop.0+0xaf/0x450 [ 90.214039][ C1] net_rx_action+0xa40/0xf20 [ 90.218645][ C1] ? __pfx_net_rx_action+0x10/0x10 [ 90.223796][ C1] ? hrtimer_bases_first+0x1a0/0x210 [ 90.229110][ C1] ? kvm_sched_clock_read+0x11/0x20 [ 90.234360][ C1] ? sched_clock+0x38/0x60 [ 90.238786][ C1] ? sched_clock_cpu+0x6c/0x570 [ 90.243682][ C1] ? rcu_is_watching+0x12/0xc0 [ 90.248469][ C1] handle_softirqs+0x1ea/0x9b0 [ 90.253272][ C1] ? __pfx_handle_softirqs+0x10/0x10 [ 90.258569][ C1] ? irqtime_account_delta+0x9a/0x110 [ 90.263967][ C1] ? tun_rx_batched.isra.0+0x402/0x750 [ 90.269445][ C1] do_softirq+0xac/0xe0 [ 90.273640][ C1] [ 90.276566][ C1] [ 90.279492][ C1] __local_bh_enable_ip+0xf8/0x120 [ 90.284641][ C1] tun_rx_batched.isra.0+0x407/0x750 [ 90.289951][ C1] ? __pfx_tun_rx_batched.isra.0+0x10/0x10 [ 90.295814][ C1] ? tun_get_user+0x1cc8/0x3c20 [ 90.300689][ C1] tun_get_user+0x1e31/0x3c20 [ 90.305424][ C1] ? __pfx_tun_get_user+0x10/0x10 [ 90.310478][ C1] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 90.316007][ C1] ? find_held_lock+0x2b/0x80 [ 90.320685][ C1] ? tun_get+0x191/0x370 [ 90.324978][ C1] ? tun_get+0x191/0x370 [ 90.329237][ C1] tun_chr_write_iter+0xdc/0x200 [ 90.334224][ C1] vfs_write+0x6ac/0x1050 [ 90.338578][ C1] ? __pfx_tun_chr_write_iter+0x10/0x10 [ 90.340302][ T121] libceph: mon0 (1)127.0.0.1:6789 socket closed (con state V1_BANNER) [ 90.344184][ C1] ? __pfx_vfs_write+0x10/0x10 [ 90.344214][ C1] ? find_held_lock+0x2b/0x80 [ 90.344243][ C1] ksys_write+0x12a/0x250 [ 90.344268][ C1] ? __pfx_ksys_write+0x10/0x10 [ 90.344299][ C1] do_syscall_64+0x115/0x870 [ 90.344319][ C1] ? clear_bhb_loop+0x40/0x90 [ 90.344340][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 90.344357][ C1] RIP: 0033:0x7fbb2995e84e [ 90.344372][ C1] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 90.344389][ C1] RSP: 002b:00007fbb2a7f5fb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 90.344406][ C1] RAX: ffffffffffffffda RBX: 00007fbb2a7f66c0 RCX: 00007fbb2995e84e [ 90.344417][ C1] RDX: 000000000000002f RSI: 0000200000000300 RDI: 00000000000000c8 [ 90.344428][ C1] RBP: 00007fbb29a3500c R08: 0000000000000000 R09: 0000000000000000 [ 90.344438][ C1] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 90.344449][ C1] R13: 00007fbb29c26038 R14: 00007fbb29c25fa0 R15: 00007ffd460285e8 [ 90.344471][ C1] [ 90.344487][ C1] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 90.344500][ C1] CPU: 1 UID: 0 PID: 5949 Comm: syz.3.47 Not tainted syzkaller #0 PREEMPT(full) [ 90.344519][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 90.344530][ C1] Call Trace: [ 90.344535][ C1] [ 90.344542][ C1] dump_stack_lvl+0x100/0x190 [ 90.344565][ C1] vpanic+0x552/0x970 [ 90.344583][ C1] ? __pfx_vpanic+0x10/0x10 [ 90.344606][ C1] panic+0xd1/0xe0 [ 90.344623][ C1] ? __pfx_panic+0x10/0x10 [ 90.344646][ C1] ? check_panic_on_warn+0x1f/0x90 [ 90.344668][ C1] check_panic_on_warn.cold+0x19/0x34 [ 90.344689][ C1] ? nf_flow_offload_ip_hook+0xf6c/0x2b60 [ 90.344719][ C1] __warn.cold+0x191/0x318 [ 90.344737][ C1] __report_bug+0x30f/0x440 [ 90.344756][ C1] ? nf_flow_offload_ip_hook+0xf6c/0x2b60 [ 90.344786][ C1] ? __pfx___report_bug+0x10/0x10 [ 90.344808][ C1] ? __pfx_flow_offload_lookup+0x10/0x10 [ 90.344831][ C1] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 90.344861][ C1] ? nf_flow_tuple_encap+0x33e/0xaf0 [ 90.344891][ C1] ? __lock_acquire+0x49f/0x1a40 [ 90.344921][ C1] ? nf_flow_offload_ip_hook+0xf6c/0x2b60 [ 90.344955][ C1] report_bug+0xb2/0x220 [ 90.344982][ C1] ? nf_flow_offload_ip_hook+0xf6c/0x2b60 [ 90.345014][ C1] handle_bug+0x16a/0x2a0 [ 90.345046][ C1] exc_invalid_op+0x17/0x50 [ 90.345077][ C1] asm_exc_invalid_op+0x1a/0x20 [ 90.345098][ C1] RIP: 0010:nf_flow_offload_ip_hook+0xf6c/0x2b60 [ 90.345134][ C1] Code: 89 ee e8 87 4b 14 f8 48 83 fd 01 76 20 e8 dc 50 14 f8 83 e5 01 31 ff 48 89 ee e8 6f 4b 14 f8 48 85 ed 75 09 e8 c5 50 14 f8 90 <0f> 0b 90 e8 bc 50 14 f8 e8 e7 73 f7 f7 31 ff 89 c5 89 c6 e8 1c 4b [ 90.345161][ C1] RSP: 0018:ffffc90000a08798 EFLAGS: 00010246 [ 90.345179][ C1] RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff89f61151 [ 90.345194][ C1] RDX: ffff88807e6da540 RSI: ffffffff89f6115b RDI: ffff88807e6da540 [ 90.345209][ C1] RBP: 0000000000000000 R08: 0000000000000007 R09: 0000000000000000 [ 90.345222][ C1] R10: 0000000000000000 R11: 0000000000000000 R12: ffff888075c33cd8 [ 90.345237][ C1] R13: ffff8880574d6900 R14: ffff8880356609c0 R15: ffff8880574d6900 [ 90.345258][ C1] ? nf_flow_offload_ip_hook+0xf61/0x2b60 [ 90.345292][ C1] ? nf_flow_offload_ip_hook+0xf6b/0x2b60 [ 90.345329][ C1] ? nf_flow_offload_ip_hook+0xf6b/0x2b60 [ 90.345370][ C1] ? __pfx_ipv4_dst_check+0x10/0x10 [ 90.345405][ C1] ? __pfx_nf_flow_offload_ip_hook+0x10/0x10 [ 90.345437][ C1] ? __lock_acquire+0x49f/0x1a40 [ 90.345467][ C1] ? __pfx_ip_dst_mtu_maybe_forward+0x10/0x10 [ 90.345499][ C1] ? lock_acquire+0x1b9/0x370 [ 90.345531][ C1] nf_hook_slow+0xbf/0x220 [ 90.345556][ C1] __netif_receive_skb_core.constprop.0+0x1689/0x3530 [ 90.345591][ C1] ? find_held_lock+0x2b/0x80 [ 90.345611][ C1] ? __pfx_ip_output+0x10/0x10 [ 90.345638][ C1] ? ip_forward_finish+0x1b4/0x320 [ 90.345661][ C1] ? __pfx___netif_receive_skb_core.constprop.0+0x10/0x10 [ 90.345689][ C1] ? ip_forward+0xfa2/0x2690 [ 90.345730][ C1] ? __lock_acquire+0x49f/0x1a40 [ 90.345761][ C1] ? process_backlog+0x32a/0x1580 [ 90.345784][ C1] __netif_receive_skb_one_core+0xb0/0x1e0 [ 90.345811][ C1] ? __pfx___netif_receive_skb_one_core+0x10/0x10 [ 90.345839][ C1] ? lock_acquire+0x1b9/0x370 [ 90.345868][ C1] ? process_backlog+0x32a/0x1580 [ 90.345894][ C1] ? process_backlog+0x32a/0x1580 [ 90.345916][ C1] __netif_receive_skb+0x1f/0x120 [ 90.345942][ C1] process_backlog+0x37a/0x1580 [ 90.345973][ C1] __napi_poll.constprop.0+0xaf/0x450 [ 90.346001][ C1] net_rx_action+0xa40/0xf20 [ 90.346034][ C1] ? __pfx_net_rx_action+0x10/0x10 [ 90.346061][ C1] ? hrtimer_bases_first+0x1a0/0x210 [ 90.346095][ C1] ? kvm_sched_clock_read+0x11/0x20 [ 90.346120][ C1] ? sched_clock+0x38/0x60 [ 90.346147][ C1] ? sched_clock_cpu+0x6c/0x570 [ 90.346188][ C1] ? rcu_is_watching+0x12/0xc0 [ 90.346224][ C1] handle_softirqs+0x1ea/0x9b0 [ 90.346258][ C1] ? __pfx_handle_softirqs+0x10/0x10 [ 90.346286][ C1] ? irqtime_account_delta+0x9a/0x110 [ 90.346311][ C1] ? tun_rx_batched.isra.0+0x402/0x750 [ 90.346347][ C1] do_softirq+0xac/0xe0 [ 90.346375][ C1] [ 90.346382][ C1] [ 90.346390][ C1] __local_bh_enable_ip+0xf8/0x120 [ 90.346420][ C1] tun_rx_batched.isra.0+0x407/0x750 [ 90.346459][ C1] ? __pfx_tun_rx_batched.isra.0+0x10/0x10 [ 90.346501][ C1] ? tun_get_user+0x1cc8/0x3c20 [ 90.346530][ C1] tun_get_user+0x1e31/0x3c20 [ 90.346565][ C1] ? __pfx_tun_get_user+0x10/0x10 [ 90.346590][ C1] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 90.346633][ C1] ? find_held_lock+0x2b/0x80 [ 90.346652][ C1] ? tun_get+0x191/0x370 [ 90.346672][ C1] ? tun_get+0x191/0x370 [ 90.346701][ C1] tun_chr_write_iter+0xdc/0x200 [ 90.346726][ C1] vfs_write+0x6ac/0x1050 [ 90.346762][ C1] ? __pfx_tun_chr_write_iter+0x10/0x10 [ 90.346789][ C1] ? __pfx_vfs_write+0x10/0x10 [ 90.346820][ C1] ? find_held_lock+0x2b/0x80 [ 90.346858][ C1] ksys_write+0x12a/0x250 [ 90.346891][ C1] ? __pfx_ksys_write+0x10/0x10 [ 90.346933][ C1] do_syscall_64+0x115/0x870 [ 90.346960][ C1] ? clear_bhb_loop+0x40/0x90 [ 90.346986][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 90.347008][ C1] RIP: 0033:0x7fbb2995e84e [ 90.347026][ C1] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 90.347047][ C1] RSP: 002b:00007fbb2a7f5fb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 90.347066][ C1] RAX: ffffffffffffffda RBX: 00007fbb2a7f66c0 RCX: 00007fbb2995e84e [ 90.347081][ C1] RDX: 000000000000002f RSI: 0000200000000300 RDI: 00000000000000c8 [ 90.347095][ C1] RBP: 00007fbb29a3500c R08: 0000000000000000 R09: 0000000000000000 [ 90.347109][ C1] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 90.347122][ C1] R13: 00007fbb29c26038 R14: 00007fbb29c25fa0 R15: 00007ffd460285e8 [ 90.347156][ C1] [ 90.353195][ C1] Kernel Offset: disabled