last executing test programs: 6.577649284s ago: executing program 1 (id=8770): mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x32, 0xffffffffffffffff, 0x0) unshare(0x40400) r0 = socket$l2tp6(0xa, 0x2, 0x73) connect$l2tp6(r0, &(0x7f0000000300)={0xa, 0x0, 0x0, @mcast1, 0x200, 0x3}, 0x20) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x54, 0x10, 0xc3b, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x34, 0x12, 0x0, 0x1, @ip6gretap={{0xe}, {0x20, 0x2, 0x0, 0x1, [@IFLA_GRE_LOCAL={0x14, 0x6, @loopback}, @IFLA_GRE_OKEY={0x8, 0x5, 0x8}]}}}]}, 0x54}}, 0x0) 6.435867815s ago: executing program 1 (id=8773): bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x3, 0x6, &(0x7f0000000000)=@framed={{0xffffffb4, 0x6, 0x0, 0x0, 0x0, 0x71, 0x11, 0x31}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @call={0x85, 0x0, 0x0, 0x7}, @exit]}, &(0x7f0000000080)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0xe}, 0x70) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x800005, 0x32, 0xffffffffffffffff, 0x852ac000) r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x14, &(0x7f0000000580)=ANY=[@ANYBLOB="180000008f000000000000000b00020018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000000700008500000086000000bf0900000000000055090100000000009500000000000000bd0a060000000000a500f4fffcfffcff180000000600000000000000090000004d90f8ff00000000bf91000000000000b702000003000000850000002a000000b70000000000000095"], &(0x7f0000000080)='GPL\x00', 0x9, 0x1000, &(0x7f0000000cc0)=""/4096, 0x41100, 0x3}, 0x94) 6.387265082s ago: executing program 1 (id=8775): syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socketpair(0x25, 0x1, 0xbfffb5df, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r0) 6.261276201s ago: executing program 1 (id=8776): r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'bridge_slave_1\x00'}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000b40)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r1, 0x8b04, &(0x7f0000000000)={'wlan1\x00', @random="0200"}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, 0x0) r2 = socket(0x10, 0x80002, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$unix(r3, &(0x7f0000000d80)={0x0, 0x0, &(0x7f0000000940)=[{&(0x7f0000000440)="ea", 0x1}], 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB="14000000000000000100000001"], 0x18}, 0xc800) setsockopt$sock_int(r4, 0x1, 0x2a, &(0x7f0000000000), 0x4) recvmmsg(r4, &(0x7f0000001140), 0x74e, 0x0, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)={0x1c, 0x2e, 0x9, 0x70bd27, 0x0, {0x4}, [@typed={0x4, 0x1d, 0x0, 0x0, @binary}, @typed={0x4, 0x1e}]}, 0x1c}, 0x1, 0x0, 0x0, 0x42804}, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x16, 0x13, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r6, 0x18000000000002a0, 0x0, 0x0, 0x0, 0x0, 0xff, 0x60000009, 0x0, 0x0, 0x0, 0x0}, 0x50) sendmsg$nl_route(r2, &(0x7f0000000540)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[], 0x44}}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000000c0)=@newlink={0x48, 0x10, 0x403, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @ip6gre={{0xb}, {0x18, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}, @IFLA_GRE_FLAGS={0x8, 0xd, 0x3}, @IFLA_GRE_FWMARK={0x8, 0x14, 0x4}]}}}]}, 0x48}, 0x1, 0xba01, 0x0, 0x40000080}, 0x0) r7 = socket(0x10, 0x803, 0x0) r8 = socket(0x1, 0x803, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@ipv6_newaddr={0x34, 0x14, 0x9535393fea6295b5, 0x70bd28, 0x0, {0xa, 0x40, 0x0, 0x0, r9}, [@IFA_LOCAL={0x14, 0x2, @ipv4}, @IFA_FLAGS={0x8, 0x8, 0x100}]}, 0x34}}, 0x0) r10 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r10, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)=@ipv6_newaddr={0x2c, 0x14, 0x9535393fea6295b5, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r9}, [@IFA_LOCAL={0x14, 0x2, @ipv4}]}, 0x2c}}, 0x0) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000080), 0x4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0x0, 0x0, &(0x7f0000000080)='GPL\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socket$inet_sctp(0x2, 0x5, 0x84) r11 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(r11, 0x84, 0xc, &(0x7f0000000040)=@assoc_value, &(0x7f0000000000)=0x8) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, 0x0, &(0x7f0000000280)) 6.044736705s ago: executing program 1 (id=8780): socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, 0x0) unshare(0x6a040000) socket(0x8, 0x3, 0x0) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000100)={'wpan0\x00'}) socket$inet6(0xa, 0x1, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x800) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000b40)={'veth1\x00', &(0x7f0000000200)=@ethtool_per_queue_op={0x4b, 0xf, [0xa, 0x1, 0x7fff, 0x1, 0x4, 0x9, 0xa4, 0xffb, 0x7, 0xb69, 0xc1, 0x4, 0x1, 0x3, 0x5, 0x101, 0x1000, 0x9, 0x3, 0x3, 0x1, 0xfffffffa, 0x0, 0x6, 0x9, 0x4, 0x7, 0x5, 0x100000, 0x722, 0x3, 0xd, 0xe, 0x2b12, 0x100, 0x6, 0x1c00, 0xb, 0x7, 0xbed4, 0x8, 0x8000100, 0x3, 0x0, 0x11000, 0x8, 0x81, 0x79b, 0x2, 0x1, 0x7b, 0x4, 0xa, 0x7, 0xf, 0x101, 0xd7, 0x1fa0860a, 0x7, 0xba, 0x81, 0x2, 0x9, 0x4007, 0x8b, 0x5, 0x2af, 0xf7, 0x5, 0x2, 0x6, 0x9, 0x4, 0x7, 0x4009, 0x0, 0x4, 0x100002, 0x5, 0x20000752, 0xffffffff, 0x3, 0x0, 0x10001, 0x2, 0xffffffff, 0x6, 0x6, 0x9, 0x80000000, 0xfdffffff, 0x2, 0x2, 0x84, 0x100, 0x5, 0x252, 0x81, 0xb, 0x5, 0x20006, 0x5, 0x2, 0xb, 0x2, 0x3, 0xd, 0x2a2, 0xfffffffd, 0x3, 0x2, 0x5, 0x8, 0x0, 0x4, 0x2, 0x40, 0x8, 0x5, 0x4, 0x401, 0x66cd, 0x8, 0xa, 0x7, 0x1fc, 0xc5c, 0xffffffff]}}) poll(&(0x7f0000000000), 0x20000000000000b5, 0x9) 5.509173614s ago: executing program 1 (id=8787): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="0b00000005000000020000000100000005"], 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000010400)={0x11, 0xd, &(0x7f0000000280)=@framed={{}, [@call={0x85, 0x0, 0x0, 0x50}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r1}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1000}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = socket$phonet(0x23, 0x2, 0x1) ioctl$FS_IOC_GETFSLABEL(r3, 0x81009431, &(0x7f00000006c0)) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000080)={r2}, 0xc) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{0x6, 0xfa, 0x0, 0xe4}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='bbr', 0x3) sendmmsg$inet(r0, &(0x7f0000001240)=[{{0x0, 0x0, &(0x7f0000001dc0)=[{&(0x7f0000000140)="91f8a9849519def28691bbc4173c3d6f357d0272b7319130feaab952ac4703cad04be68907e50e997fc26e4c91ea4feb931647fc5393de25000000000000000000", 0x41}, {&(0x7f0000000e80)="44900000000056ee66c372f3105eb186dd8062fad2d5b5bfb0ba06f274a8d026bd209da8ffa6a26e3b3f8075704a9d0ef9aff7f1e7db24609f02d34e76992c9df9fe6888c6c9a4825c6223be6ac54536025af1dea54e527c68b0ff250261953f2da79a78104c2d9e7b16ed86b124945aa9ab7581ebd385fb61d442035db81e18c2d2462d0bb25fff9d3b1ce90b597992b2a4d541611ce77f58dce7c9500118229e7cdf4ca7f6adca92c73d97ce54164c1942b2568635bec8e020b41fb2f8000000000000000000000000000000001c8a9f7956583e26f6f0edc415851d0b8305fe66c2b7c114e3712d87744938848f24a13cb604000000000000000000000000000000c7aa5035897b20a6c23f1fc4af2990c07f784b985a3de7740bd338487029", 0x121}, {&(0x7f00000003c0)="641a6a2b863c0dd898013a3f97a834ebb75a925ab48c844221841a232932fc2e37e327de21450df098", 0x29}, {&(0x7f00000001c0)="985e44efeabe001cabcf3d8673c3a254a9a2d3197970cb347b70a243bf77139a94bc3ae91684aaf7b7dff691deb8f8aef2d915fb3a0794a9a9b431a819bca6122c350637808dde804a048fd8696e524b2934126c443ce93d82e931eb9918e6c0827686e59209d2e02c9210fd8048f04ad6c48b3072092c483271361816bf21afb8473a064f1988536d4b5888807b3aaafaf59f531217", 0x96}], 0x4}}, {{0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000d00)="31cef842d9c50636f60fc0cfdac56c75f1687f0c56287423f5eed69f117e766bdbad0c2171ad6227e1173ab6efa2fcb1c420a51a0917861009000000f049c606ccab7cda1f0e3490fbe385ea382294882839a22674037b8910bd8a1420e33eb1be6f10cfb24eb7cccdf1528ef33b34ab07cdb0909a9ba9547e1e343b451d9025c4e153612d4674b9411fb4de295599abbcb388d291aa839ab0954e6a8dfc19c3c1533a11d81e03a4879bd736f1caacc2bbf1194598a652677efb930a5b6ee292c574", 0xc2}, {&(0x7f0000001300)="e0cda6472d1ccfb4d1d46bf348a3b7ff9e5b6b3e30ef2266c8", 0x19}], 0x2}}, {{0x0, 0x0, &(0x7f0000000a00)=[{&(0x7f0000000640)="42e013913edbeb683c44e18a52b5a2462064ddd92caaba941de80d06047dedb7eeeff3a27eacf4c416b6979d6c918608807c44d01535dbaab3b390086e4fd43c6b5931187023646d6beac2340fdc7a0d81214ac76a818f64d287311e8828dfd3e3dd67efdb129a6e", 0x68}], 0x1}}], 0x3, 0x2090) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000600)=0xdfa, 0x4) sendto$inet(r0, &(0x7f0000000580)="17", 0x59a, 0x10008095, 0x0, 0x0) 2.962249282s ago: executing program 3 (id=8824): r0 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'veth0_to_hsr\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=@newqdisc={0x40, 0x24, 0xd0f, 0x70bd2b, 0x0, {0x60, 0x0, 0x0, r1, {0x0, 0x8}, {0xffff, 0xffff}, {0xa, 0xc}}, [@qdisc_kind_options=@q_etf={{0x8}, {0x14, 0x2, @TCA_ETF_PARMS={0x10, 0x1, {0x3, 0xb}}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x4000000}, 0xbc3df81b5c9a142d) (async) socket$netlink(0x10, 0x3, 0xe) (async) setsockopt$IPT_SO_SET_ADD_COUNTERS(0xffffffffffffffff, 0x0, 0x41, &(0x7f0000000000)=ANY=[@ANYBLOB="66696c746572000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000200"/72], 0x48) (async) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) (async) close(0x3) (async) r3 = socket$inet6_sctp(0xa, 0x801, 0x84) (async) sendmmsg$inet(r0, &(0x7f0000000d00)=[{{&(0x7f0000000240)={0x2, 0x4e21, @rand_addr=0x64010101}, 0x10, &(0x7f0000000300)=[{&(0x7f00000002c0)='e', 0x1}], 0x1}}], 0x1, 0x4000) shutdown(r3, 0x1) (async) setsockopt$packet_fanout_data(0xffffffffffffffff, 0x107, 0x16, &(0x7f0000000100)={0x3, &(0x7f00000000c0)=[{0x80, 0x9, 0x51, 0x5}, {0x4, 0x0, 0x1, 0x4}, {0x2, 0xfb, 0x1, 0x10}]}, 0x10) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0xc0041, 0x0) (async) r5 = accept4$ax25(0xffffffffffffffff, 0x0, &(0x7f0000000180), 0x800) ioctl$SIOCAX25NOUID(r5, 0x89e3, &(0x7f00000001c0)) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) unshare(0xc040480) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0xc, 0x4, 0x4, 0x9}, 0x48) (async) ioctl$TUNSETVNETHDRSZ(r4, 0x400454d8, &(0x7f0000000140)=0x90) (async) write$tun(r4, &(0x7f0000000280)=ANY=[@ANYBLOB="6ab964ac4223"], 0xfdef) (async) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r2, 0x84, 0x85, &(0x7f0000000000)={0x0, @in6={{0xa, 0x4e21, 0x4, @empty, 0x4c7}}, 0x67c0}, 0x90) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB='$\x00\x00\x00v\x00\t\x00'/20, @ANYRES32=0x0, @ANYBLOB="04000d80080001"], 0x24}, 0x1, 0x5502000000000000}, 0x0) 2.960103621s ago: executing program 2 (id=8825): r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0xc, 0x32, 0x0, 0xffffd000) getsockopt(r0, 0x400000000000003a, 0x1, 0x0, &(0x7f0000000040)) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x2000004, 0x3b071, 0xffffffffffffffff, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="b8000000190001002dbd700000000000e0000010dea95a5917927000000000000000000000000000000000000a00000087000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000fcffffffffffffff00000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000200"/112], 0xb8}}, 0x2c000010) sendmsg$nl_xfrm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000005c0)=ANY=[@ANYBLOB="b8000000150001000000000000000000e00000020000000000000000000000000000000000000000000000000000000000000000ff2dbe4292603d000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000ff00000000000000af010000000000000000000000000000000000000000000000000000000000000000000000000000b56b6e00"/112], 0xb8}, 0x1, 0x0, 0x0, 0x810}, 0x0) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x13, &(0x7f0000000080)=ANY=[@ANYBLOB="18080000000000000000000040010000851000000600000018020000", @ANYRES32, @ANYBLOB="00000000000010006600020000000000180000000000000000000000000000009500040000000000360a020000000000180100002020782500000000002020207b1a00fe00000000bfa100000000000007010000f8ffffffb702000008000000b50af8ffffff000085000000060000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0x2, 0xff5c, &(0x7f0000000340)=""/222}, 0x78) r3 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000500)={0x6, 0x4, &(0x7f0000000680)=ANY=[@ANYBLOB="18490000fdffffff000000000000000018230000", @ANYRES32, @ANYBLOB='\x00\x00\x00\b\t\x00\x00\x00'], &(0x7f0000000180)='syzkaller\x00', 0x8, 0x87, &(0x7f00000001c0)=""/135, 0x41000, 0x2e, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, &(0x7f0000000280)={0xfffffffe, 0x4}, 0x8, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[0xffffffffffffffff], 0x0, 0x10, 0xfffffffd}, 0x94) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newtfilter={0xfc, 0x2c, 0xd27, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0xffe0, 0xf}, {}, {0x7}}, [@filter_kind_options=@f_matchall={{0xd}, {0xc8, 0x2, [@TCA_MATCHALL_CLASSID={0x8, 0x1, {0xb, 0xe}}, @TCA_MATCHALL_FLAGS={0x8, 0x3, 0x4}, @TCA_MATCHALL_FLAGS={0x8, 0x3, 0x4}, @TCA_MATCHALL_CLASSID={0x8, 0x1, {0x9, 0x4}}, @TCA_MATCHALL_ACT={0xa4, 0x2, [@m_skbedit={0xa0, 0xe, 0x0, 0x0, {{0xc}, {0x44, 0x2, 0x0, 0x1, [@TCA_SKBEDIT_PARMS={0x18, 0x2, {0x80000000, 0xfffffffd, 0xffffffffffffffff, 0x3, 0x9}}, @TCA_SKBEDIT_PRIORITY={0x8, 0x3, {0x5, 0xfff3}}, @TCA_SKBEDIT_PRIORITY={0x8, 0x3, {0x4, 0xfff3}}, @TCA_SKBEDIT_PTYPE={0x6, 0x7, 0x5}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x7ff}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x50e}]}, {0x34, 0x6, "4451f677e1feba51f0ca936c35676af75510a35c3d1e76db91483b29378a9cfebc4ed602044c88674ebdcbd0ed1f7310"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x2, 0x2}}}}]}]}}]}, 0xfc}, 0x1, 0x0, 0x0, 0x15}, 0x0) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f00000007c0)={0xffffffffffffffff, 0x20, &(0x7f0000000780)={&(0x7f0000000580)=""/211, 0xd3, 0x0, &(0x7f00000006c0)=""/140, 0x8c}}, 0x10) r5 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000c00)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x8, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x0, 0x4}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x8, 0xf, &(0x7f0000000100)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5a77}, {}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000180)='GPL\x00', 0x81, 0x78, &(0x7f00000001c0)=""/120, 0x40f00, 0x44, '\x00', 0x0, @cgroup_skb, 0xffffffffffffffff, 0x8, &(0x7f00000004c0)={0x6, 0x1}, 0x8, 0x10, &(0x7f0000000540)={0x3, 0xe, 0x8, 0x3}, 0x10, r4, 0xffffffffffffffff, 0x0, &(0x7f0000000880)=[r5, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0xa5}, 0x94) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="010000000f0000000500000007"], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300), &(0x7f0000000100), 0x3f, r6}, 0x38) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f00000001c0)={r6, &(0x7f0000000340), &(0x7f0000000300)=""/177}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f0000000d00)={0x1f, 0x14, &(0x7f0000000840)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x5}, {}, {}, [@alu={0x0, 0x0, 0xc, 0x8, 0x56d1c6dda9ab7010, 0x80, 0xfffffffffffffff9}, @map_fd={0x18, 0x2}, @btf_id={0x18, 0x6, 0x3, 0x0, 0x3}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000900)='syzkaller\x00', 0x84, 0x3d, &(0x7f0000000940)=""/61, 0x41100, 0x40, '\x00', 0x0, @fallback=0x2d, 0xffffffffffffffff, 0x8, &(0x7f00000009c0)={0x4, 0x3}, 0x8, 0x10, &(0x7f0000000a00)={0x3, 0x4, 0x8000, 0x6}, 0x10, r4, r3, 0xa, &(0x7f0000000a40)=[0x1, r6], &(0x7f0000000a80)=[{0x1, 0x3, 0x2, 0xc}, {0x0, 0x4, 0x1, 0xb}, {0x3, 0x1, 0x4, 0x4}, {0x4, 0x1, 0x2, 0x6}, {0x170b, 0x4, 0x1}, {0x3, 0x2, 0x1, 0x6}, {0x3, 0x3, 0x5, 0xc}, {0x2, 0x2}, {0x4, 0x1, 0xc, 0x2}, {0x5, 0x5, 0xd, 0xc}], 0x10, 0x7}, 0x94) r7 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="02000000040000000400000008"], 0x50) unshare(0x8040480) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000c80)=ANY=[@ANYBLOB="b321633641bf702faf6c917f1a7d1db603713b2fda7f8a7c7367db116d09a217c0bd40c4b8f7c8242f83202f9261e8d6176b2353997ade0b9b2dcd2312c055718a269856088ea718309d", @ANYRES32=r7], 0x48) r9 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=ANY=[@ANYBLOB="380000001800dd8d00000000000000000200000000000006000000000600150004000000140016"], 0x38}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, &(0x7f0000000040)=0x20) sendmmsg(r9, &(0x7f0000000000), 0x4000000000001f2, 0x0) close(0x3) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) socket$inet_icmp(0x2, 0x2, 0x1) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000200)={{r8}, &(0x7f0000000180), &(0x7f00000001c0)=r7}, 0x20) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000800)=ANY=[@ANYRES32=r2, @ANYRES32=r2, @ANYBLOB="ca059e600000000000000000", @ANYRES32=r3, @ANYBLOB="aa9d621d4cdda802d6b81707a3a647000000000000", @ANYRES64=0x0], 0x20) 2.749115723s ago: executing program 3 (id=8827): r0 = socket$key(0xf, 0x3, 0x2) socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$inet6(0xa, 0x3, 0x5) sendmmsg(r1, &(0x7f0000001500)=[{{&(0x7f0000000040)=@l2tp6={0xa, 0x0, 0x7080000, @dev={0xfe, 0x80, '\x00', 0x3d}, 0x2, 0x1}, 0x80, 0x0, 0x0, &(0x7f00000005c0)=[{0x10, 0x29, 0x32}], 0x10}}], 0x1, 0x4000000) sendmsg$key(r0, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000140)=ANY=[@ANYBLOB="0203fe001000000000000000fedbdf2505000600330000000a0000000000000000000000000000000000000000000001000000000000000002000100000000000000fc0c0200006005000500000000000a004e2200000000000000000000000000000000000000018000000000000000020013"], 0x80}, 0x1, 0x7}, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{0x1, 0xffffffffffffffff}, &(0x7f0000000000), &(0x7f0000000080)}, 0x20) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) getsockopt$inet6_mreq(r3, 0x29, 0x1c, 0x0, 0x0) socket$inet_smc(0x2b, 0x1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) bind$unix(r4, &(0x7f0000003040)=@abs={0x0, 0x0, 0x4e24}, 0x6e) r5 = socket$inet_mptcp(0x2, 0x1, 0x106) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000380)={r2, &(0x7f0000000100)="a16f38bf4a84982d4034fbce6076b2b19150e03ed5e5be1aca48c9dfd33819a701d40011924c91d1d4fcca", &(0x7f0000000300)=@tcp=r5, 0x2}, 0x20) syz_emit_ethernet(0x11e, &(0x7f00000003c0)={@link_local, @empty, @void, {@ipv4={0x800, @icmp={{0x2d, 0x4, 0x0, 0x0, 0x110, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local, {[@ssrr={0x89, 0xf, 0x6a, [@private=0xa010100, @private=0xa010102, @broadcast]}, @timestamp_addr={0x44, 0x1c, 0x15, 0x1, 0x2, [{@loopback, 0x3}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x7}, {@rand_addr=0x64010100, 0x4}]}, @timestamp_addr={0x44, 0x24, 0xdf, 0x1, 0x9, [{@empty}, {@rand_addr=0x64010102}, {@local, 0x4}, {@private=0xa010100, 0x1}]}, @ssrr={0x89, 0x13, 0xa2, [@multicast2, @empty, @multicast1, @dev={0xac, 0x14, 0x14, 0x3a}]}, @timestamp_prespec={0x44, 0x1c, 0x81, 0x3, 0x6, [{@rand_addr=0x64010100, 0xee5}, {@rand_addr=0x64010102, 0x1200000}, {@private=0xa010102, 0x9}]}, @timestamp={0x44, 0x20, 0x6a, 0x0, 0x1, [0x2e, 0x200, 0x0, 0x2, 0x401, 0x8, 0x4]}]}}, @parameter_prob={0xc, 0x0, 0x0, 0x0, 0x0, 0x0, {0x15, 0x4, 0x0, 0x22, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @empty, @dev, {[@timestamp_addr={0x44, 0x3c, 0x0, 0x1, 0x0, [{@initdev={0xac, 0x1e, 0x0, 0x0}}, {}, {@local}, {@empty}, {@dev}, {@broadcast}, {@dev}]}, @end]}}}}}}}, 0x0) 2.576970996s ago: executing program 3 (id=8829): unshare(0x2c060000) unshare(0x2c020400) r0 = socket$unix(0x1, 0x5, 0x0) bind$unix(r0, &(0x7f0000000300)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) listen(r0, 0x0) r1 = socket$unix(0x1, 0x5, 0x0) connect$unix(r1, &(0x7f0000000280)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) connect$unix(r1, &(0x7f00000000c0)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r2, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_rx_ring(r2, 0x107, 0x5, &(0x7f0000000040)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x770, 0x0, 0xbabd}, 0x1c) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r4 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r4, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r4, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0x0, 0x0, 0xc}, 0x80, &(0x7f0000000000)=[{&(0x7f0000000180)="27030200590214000600002fb96dbcf706e10500000086ddffff1144ee163cd4b8bf", 0x22}, {&(0x7f0000000c00)="4307ed2e", 0x4}], 0x2}, 0x4) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r5, &(0x7f0000000200), 0x806000) ioctl$FS_IOC_RESVSP(r5, 0x40305829, &(0x7f0000000380)={0x0, 0x0, 0x4000, 0x9ffffc}) bpf$MAP_CREATE(0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="1e00000009000000090000000200000002080400", @ANYRES32, @ANYBLOB="0000008000"/20, @ANYRES32=0x0, @ANYRES32=r5, @ANYBLOB="0100000001320000050000000600"/28], 0x50) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r6) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) getsockopt$inet_buf(r5, 0x0, 0x20, &(0x7f0000000440)=""/218, &(0x7f0000000540)=0xda) sendto$packet(0xffffffffffffffff, &(0x7f0000000240)="800000800000210ee7decd7a000000", 0xf, 0x40, &(0x7f00000001c0)={0x11, 0x8100, r8, 0x1, 0xd8, 0x6, @broadcast}, 0x14) accept4$unix(r0, 0x0, 0x0, 0x80800) socket$netlink(0x10, 0x3, 0x5495bc811e6c91b) 2.401938236s ago: executing program 0 (id=8831): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket$packet(0x11, 0x3, 0x300) socket(0x2a, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$netlink(0x10, 0x3, 0x0) setsockopt$packet_int(r0, 0x107, 0x14, &(0x7f0000000080)=0xfff, 0x4) socketpair(0x1, 0x100000005, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) getpeername$packet(r1, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) sendmmsg(r0, &(0x7f0000000440)=[{{&(0x7f0000000700)=@xdp={0x2c, 0x0, r2}, 0x80, &(0x7f00000004c0)=[{&(0x7f0000000180)='O', 0x36}], 0x1}}], 0x1, 0x0) 2.351347071s ago: executing program 0 (id=8832): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x2, 0x3032, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB="9feb01001800000000000000200000002000000005000000000000000000000d0a0000000000000001000006000000000300000009000000005f305f00"], &(0x7f0000000f40)=""/4089, 0x3d, 0xff9, 0x8, 0x1}, 0x28) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x8, &(0x7f00000026c0)=ANY=[@ANYBLOB="620af8ff0c200021bfa100000000000007010000f8ffffffb702000003000000bd1200000000000085000000d0000000b70000000000000095000000000000003fba6a7d36d9b18ed812a2e2c49e8020a6f4e0e4a9446ca2b5f1cc1a100a9af698393aa0f3881f9c24aa56f15199fad0093c59d66b5ece9f36c70d0f010c5077da80fb982c1e9400c603146cea484a415b76966118b64f751a0f241b072e90080008002d75593a280000c93e64c227c95aa0b784625704f07a72c2918451ebdcf4cef7f9606056fe5c34665c0af9360a1f7a5e6b607130c89f18c0c1089d8b85880000c29c48b45ef4adf634be763288d01aa27ae8b09e13e79ab20b0b8ed8fb7a68af2ad0000000000000006f803c6468082089b302d7bff8f06f7f918d65eae391cb41336023cdcedb5e0125ebbccbddcf10cb2364149215108355ee570f8078be5cab389cd65e7133719acd97cfa107d40224edc5465a932b77e74e712a0d42bc6099ad23000000803a90bce6dc3a13871765df961c2ed3b1006ef6c1ff0900000000000010c63a949e8b7955394ffa82b8e942c89112f40cab87b1586602d985430cea0162ab3fcf4591c926abfb076719237c8d0e60b0eea24492a660583eecdbf5bcd3de3a83209da17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c9f081d6a08000000ea2b1a52496dfcaf99431412fd13f4cec49669e443dcb924cfe5f3185418d60532be9c4d2ec7c32f2095e63c8cdc28f74d043ef8dba2f23b01a9ae44cf945b7632f32030916f89c6dad7603f2ba2a790d62d6faec2fed44da4928b30142bdda5e6c5d50b83bae616b5054d1e7c13b1355d6f4a8245eaa4997da9c77af40000000000000005f58351d599e9b61e8caab9c70764b0a8a7583c90b3433b809bdb9fbd48bc873495cbff8a41326eea31ae4e0f75057df3c9d13330ca006bce1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223a0eb4fa39f6b5c02e6d6d90756ff57902a8f57010000009700ce0b4b8bc22941330000000000000000000300000000000000000000000010008bc0d955f2a83366b99711e6e8861c46495ba585a4b2d02edc3e28dd279a896249ed85b9806f0b6c4a000000002b43dcacc413b48dafb7a2c8cb482bac0ac502d9ba96ffffff7f00000000df73be83bb7d5ad883ef07000000000000006da21b40216e14ba2d6af8656bfff17addaedab25b30002abbba7fa725f38400be7c1f001b2cd317902f19e385be9e48dccff72943327d830689da6b53ffffffff631c7771429d1200000033ed846197fcff5e1c7c3d1d6e3a52872baef9753fffffffffffffe09fec2271fe010cd7bb2366fde4a59429738fcc917a57f94f6c453cea623cc5ee0c2a5ff870ce5dfd3467decb05cfd9fcd41df54cdbd9d10a64c108285e71b5565b1768ee58969c41595229df17bcad70fb4021428ce978275d5bc8955778567bc79e13b78249788f11f708008b75d4fe32b561d46ea3abe0fa4d30dc94ef241875f3b4b6ab7929a57affe7d7fa29822aea68a660e717a04becff0f719107000000000000002d7e927123d8ecbbc55bf404571be54c72d978cf2804107f0238abccd32368e57040906df0042e19000000000000002c06f815312e086dd022c074eb8a322fb0bf47c0a8d154b405a07feaf3dd95f6ef44cd1fe582786105c7df8be4877084d4173731efe895efc71f665c4d75cf2458e35d2c9062ece84c99e061887a20639b41c8c12ee86c50804042b3eac1f879b136345cf67ca3fb2b5e518a75f9e7d7101d5e186c489b3a06fb99e0aa7f23a054de2f4d92d6bd72ee2c9fdc75aaaf1e3e483b4ad055e4af403269b4a39ce40293947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f54c2d3335457ac0eaaa99bf0bdc14ae358c3b377327ac9ecc34f24c9ae153ec60ac0694da85bff9f5f4df9b3fdf242b985bf16b99c9cc0ad1857036f1a985f369191ae954febb3df464bfe0f773ee9afe72f32a2befb89d3777399f5874c553a2ebe9061fe86e669642e09c0e5a3bb6d163118e4cbe024fd452277c3887d6116c6cc9d8046c216c1f8a9778cb26e22a2a998de5eaeadea10d3cfb41b92ecbb422a40da8daccf080842a486721737390cbf3a74cb2003efb9a101b51ab63e9600040000b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde6e4a4304e50c349f4f9ecee27defd83871c5191e10096e7e60fc3541a2c905a1a95e9571bf38aebd15172f94e3245c582909e2a3bce109b6000000000000000000d6d5210d7560eb92d6a97a27602b81f7636df1535bef1497f90100000000000000abf9010000007740890200d627e87306703be8672dc84eeadba6a41891c170d1ab57075228a9f46ed9bd1f08fb8191bbab2dc51de3a61f0868afc4294859323e7a45319f18101288a0268893373750d10a3fc22dd704e4214de5946912d6c98cd1a9fbe1e7ef8c08acaf30235b920500d2eca55f74a23641f61f2d5b308cf0d031b0c7f0ced69b93e9960ff5f74562adae283d9756237badf4e7965bbe2777e808fcba821aa8e8c5c39609ff85000000000000c1fee30a3f7a85d1b29e58c77685efc0ceb1c8e5729c66018d169fc03aa188546b3ad2a182068e1e3a0e2505bc7f41019645466a31c72ad53bc19faa5401120000793ac48c1b539c75ab40743b00020000a1f68df75cf43f8ecc8d3726602111b40e761fd210a1920382f14d12ca3c3431ee97471c781d0d1280fb00818654a53b6df4b2c97cc1c98d85fda8f80fe908b65550b4412331d73062197655b7f0469250a5989cef0e10773920ed3ccee42d2c3eb80159da5c002511e6eb93842054cfce2ac306cb6e472db3fd67a49b6855a694a8d359add43907003223a47a7fae4f3748d5a432825bc40a03aaef1c8488d86dc211dd2a3ba71e0f45492ef1f8b65ccb3dcd251a61b152d02c29ca0a3328fa7753a5cddea1acaae55ae8263fb284b7a6ab2a8826c1b948207c498cf4824ab1ea3225a53072423b907c6682f8999e0311da5b8378bc841e1787e3a8128dda381a26cb2b365702ff8a27831375b2ddaa2f56e21169f7ca4fd9655ccd4a584acd244e965a0afedaff7c415ff682a4044b3381cc2df28278c9a6824c52048a7cfabda294925cc0956bffa8e950ff5e49f41ae600d830207bf728cd9807933c3c16d80bbea611a18becc2dc38ca0a6f5740f340b76edcd100fcffff007231dcef58c7b88b5aeedaf9626cb51ce1737c10ab37d4f98a934b0f900e0eb639878a1200629f5503cf679154d27681d7a3744cbcd42af59407c9c8e39c5271868917954e604352ba26171d004f1cb2976fab3fa19c7d3ef9678bff79f5155524f061378f94fb453786c3a6f78b10d383b49e31d1568bd43ee34ce6e6be235aa6207285665c2fba773671da41959f51610963b48930658e2d6125a26085001345b0473240b7e5e91811312c43663e76f711c6529ecdec75c7ea1cf0f8f8fff40247d59bbde2ebb8659197e0f37a71be1b12a182ed7de3acba28561a04b807f7a4647e2ea6d8fb92541d07c3d5e4ba077d3cad9f8ba1919592014c00c8eccb2ca5d48ba7b1c3fb185a4bb79700cf51f818b0c701c8de47d12281a67bdaf4b0c50bee9e8f5936250df2e15c1172e7ea6619f7db330700d1e9e42a035e6fd532f61fbfed9c4a7124a1e38eee50a6bbcd1d4e3f68c3f27dd9a70f1a7c6046237ddfb0b26e197322226367d998010458cd4df10af249ce717f6f45e5176e0ddae3054d7289d4e13ab0912703ee39ce264572b89194fdf7acecc35cf8309d4b680a08eed367dad855fce210f1a7c7222dd360eafb4bef7d58bf83362930af6e3f3f851abdc0003bdf9401b533019e90feb069189100007a82df8d9b5f44ebf9355e7b1b01c9470608d4f306d21004730396a4d6c6d46e1ffac97aa93c36123532a36186575266be4981c847160079421d0137801e553069f8d025c40f287378810defc7f2ed4e15f6af17b21153394f8bcfa6a23a77c8d61c9bbc127a57b8d631f36558d9093dee08bc53d97a8003363421738650a22c8fd87b13026799caf58e59951b125e7f161ca34e2c0dd65a23d01a3cb191e743de07247c7f993cf01166fa2ac1ba02f60550e63a7f50422e478c6b5d87f9bd0567a279a9d85a380db25c43bd0529ad783b9d64aaac1b793afb44b7126e17d2b7c0d6be650de7eeef3f3605af344015d03c3e7819145cb9fe1978c98bf9cf10773db59505ae33708c728844c872dfd2cb0b29008000000000000005ca18cb72f0944d0e4fea0a0abd0285bdaf1b000000c089d640c2facb0d1e6243873ac4b1e1068c45c715b68effb7d58d1f9e726dbf6bd910ca4ce0e075658ede42192cf393a50dcc197b03402fed75083628e5dd38213d353b9049e71f037064b05e73ec00c710f1ffc5737d397d555d1cf8859cc030ea8dc3c6a5b3b6fa1c81707479db1833d593a271253aa11efd936b74784f2fc286814848e92d8ee541bc179813297a0a4cc3c8f80c28701185bea091f32475e859479b734727afc110e1abcff460172fd1b42e3c0e2a4bf94a060069000010000087c7572a1e7596f89e5c3d5e70640c90815f77b7b13d0000000085a1e1e84900000000000000000000000000b422fc160a458ee5a91a2471e6e56fdabec6c73ce8983fc68f0b7cdcdde632e6f54a07620e8aa116ce9e84fc3cd5e8288a333dcebb233da9186796995ba69487d8f77d2f8800f02d690fc70a08b231cad1bdcf3740a95d4dd1cfe0f417f275493cf33b19ffff93dfdaf7eb00b8ad87cdf7c21bab5af8e2bac54ee5597e6508c1158124a538c36f9bb11fea7d8b8c7e954b1bc7811654a6636b33f271d0923e9ecd1b724b8feffadfc23c07000000f0785fb722f346d6a5dffe1884d4d0cd8f00000092c85ed44db68ab800001f00000000406e6ed9b219ad07125381087298e75965d1cc5932ddf9e66351b9332a34bee3e3d562c914c629933f0b8724cf680889ade72558d191d9890c69a718f9018586c5131c8dc8e0379bafda1a0fd2997ff115215ce23dca8db7236c1554cdaaadcce2f31834c1bd1908d8e1b361034db56be76acb7654a195bc3e98df3a5dffd5b0783883ef7da3433110e37f7c7cb7f3800de7f99abf910d6949e062747a9c87dcfcc716d6a9c0ec53b9cffe3cfd1df69a76f373d7f997edb9b80bdea1a99c2a6fbb25e035deadaadd7917ebfedd6304a19491769476208684e343f86b4d55a7dbbb07283cb1e35a138d24ebc5b4f8e35a82d3a7f84cb1e02a5a92b53567088be0b1ca023ccd518c0e0715b1c8760801a419ebd2e26440ff7493019bdb655cc88d72d6d7b6bca5a2e19b63ec52fce43d8c53a8031e64026e0d36b6401064c49a729f11ab377f7132c5232bb80195dd5d43d29646a9378eea0761b7ed9d2172e33ed87c7413c843b180cc00000000006bedf2ed716ca43a941119b96d82b26d9061de240d85ec2cfa462bd52104489bb7a7548d7cc53627031e909c69cb824233975a1ea645de63522407c3a240a37e946f30ebf075ea97846a0a8d2286f3f446b1b99ab83a12ddf8a1c06294eadc3eb3e339591afd5c00000000000000000000000000000000000000000000000000579dad8347a3d16976bb7483840b32db0158fb6c809349333325a7866ca5d3133e33ef1a183cefdb65a79fa71800988c8445029e024822dbcfcab49c3a0aec9bd43e6e14078b260700d849a2aa14c9b593f6dcb1de334c065ecfd65031606e55949c185bcda9fde4f9b46a76b8a24bbcd31b22373eb0473248150cd179405ee1af1183b0c0ce3483dc1d9bf732b0751b78fb211d6706b55960c6431afbc02b3c7e08086573939290bb9e590a3875f02a828b07f1dc7df9c8e5da22dfb9dacbf5529e4e994128d835f85465173ea7bbcc519a0c9798ce8b1b07567e3e07169c8c3e4da8bf725c050000000000000000000000000000000000000000004775abdf0c62728eb55a9e2849a1ce05bed60dfe4cc9fa43f9684297c02382c0a35829be7a86305792a9d2e80ca9e8fc50f31f6e0fa810303da03d8b74b42c1ebaf16bb343256405a3a07229a54de09a97b269cd29e8b2f0b0d46c51a6a93eec37f4bc6e29a8e19120ae050ab682662e9b2cc3263a4aba62b63ca9123a53c0f4bf3c4463b8144c89bf058a0af0ae9fc2b7cdfc4817703e267cddc193637d7fd97646090da37093657643daae3840c7f5c10f93524f7ae4791ec6e9d9722e5f670ccb358e051a"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x5a}, 0x48) bpf$BPF_PROG_DETACH(0x1c, &(0x7f0000000300)=ANY=[@ANYRES32=r1, @ANYRES32=r1, @ANYRES32=r1, @ANYRES32, @ANYBLOB="abacda358e19694f9eed50e13a5d0a949d0d0daaa4f8d81809cb1c17606205742d74b864881be7cdc9215dc6385c5fd95a68e5c4ef8e8296edc7201f8945fa34ae1ed86bcd576382e4dcbaea3d301f323e17", @ANYRES64=0x0], 0x20) close(r1) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x3, 0x0, 0x0, &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x1e00, 0x0, '\x00', 0x0, @sched_cls=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$netlink(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000040)={0x10, 0x26, 0x100, 0x70bd28, 0x25dfdbfe}, 0x10}], 0x1, &(0x7f0000000480)=[@cred={{0x1c, 0x1, 0x2, {0x0, 0xee00, 0xee01}}}], 0x20, 0x40801}, 0x40) setsockopt$inet6_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000100)=0x1, 0x4) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000020, &(0x7f0000000040)=0xa, 0x1959cc36) connect$inet6(r0, &(0x7f00000001c0)={0xa, 0x4000, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000000), 0x4) 2.222234202s ago: executing program 2 (id=8834): r0 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000004c0)=@bpf_lsm={0x6, 0x3, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000240)={r0, 0xf, 0x25, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20048054}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000040)={&(0x7f0000000840)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x24, 0x24, 0x2, [@func_proto={0x0, 0x3, 0x0, 0xd, 0xa, [{0x2, 0x1}, {0x9, 0x1}, {0x0, 0x1}]}]}}, &(0x7f0000000f40)=""/4073, 0x3e, 0xfe9, 0x9}, 0x28) socket$packet(0x11, 0x2, 0x300) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) getsockopt$PNPIPE_IFINDEX(r1, 0x113, 0x2, &(0x7f0000000000)=0x0, &(0x7f0000000080)=0x4) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000001c0)=@newtclass={0x48, 0x28, 0x200, 0x70bd26, 0x25dfdbff, {0x0, 0x0, 0x0, r2, {0x8, 0xf}, {0x8, 0xffff}, {0x1e, 0x5}}, [@tclass_kind_options=@c_cake={0x9}, @tclass_kind_options=@c_prio={0x9}, @tclass_kind_options=@c_cake={0x9}]}, 0x48}}, 0x0) socket(0x2a, 0x2, 0x0) socket$netlink(0x10, 0x3, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r4, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r4, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000380)=@mgmt_frame=@beacon={{{}, {}, @device_b}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @val={0x25, 0x3, {0x0, 0x1, 0x2}}, @void, @void, @void, @void, @void, @val={0x76, 0x6, {0x0, 0x6, 0x35, 0x7}}}, 0x43) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={{{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) socket$nl_route(0x10, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$netlink(0x10, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r6 = socket$netlink(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), r6) 2.209719751s ago: executing program 3 (id=8835): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000a80)={0x3, 0x1c, &(0x7f0000000d80)=ANY=[@ANYBLOB="1808000000000000000000000000800018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70200001400c300b7030000000000008500000005000000bf0900000000000035090100000600009500000000000000b7020000000000007b9af8ff00000000d509000013ffffff7baaf0ff00000000bf9700000000000007080000fffdffffbfa400000000000007040000f0ffffff740200000800000018220000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7050000080000004608f0ff760000007d9800000000000056080000010000008500000005000000b70000000000000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x69, '\x00', 0x0, @sched_cls=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 1.961783621s ago: executing program 4 (id=8836): mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x66960000) r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x12, &(0x7f0000000580)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8f, 0x0, 0x0, 0x0, 0xffffffff}, {{0x18, 0x1, 0x1, 0x0, r0}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x700}, {0x85, 0x0, 0x0, 0x86}}, {{0x5, 0x0, 0x5, 0x9, 0x0, 0x1, 0x102}}, [@jmp={0x5, 0x0, 0xc, 0x0, 0x0, 0xfffffffffffffffe, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x9f}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x3}, {0x85, 0x0, 0x0, 0x2a}}}, &(0x7f0000000080)='GPL\x00', 0x1, 0x1000, &(0x7f0000000cc0)=""/4096, 0x40f00, 0x3, '\x00', 0x0, 0xc000000}, 0x94) 1.869379928s ago: executing program 3 (id=8837): unshare(0x400) r0 = socket(0x40000000015, 0x5, 0x0) ppoll(0x0, 0x0, &(0x7f0000000180)={0x0, 0x3938700}, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, &(0x7f00000bd000), 0x378, 0x0) recvmmsg(r0, &(0x7f0000006fc0)=[{{&(0x7f0000000600)=@phonet, 0x80, &(0x7f0000000780), 0x1, &(0x7f00000007c0)=""/137, 0x89}, 0x8}, {{0x0, 0x0, &(0x7f0000003700)=[{&(0x7f0000000680)=""/115}, {&(0x7f0000000700)=""/16}, {&(0x7f0000001680)=""/4096}, {&(0x7f00000008c0)=""/253, 0x1}, {&(0x7f0000000740)=""/125}, {&(0x7f00000009c0)=""/202}, {&(0x7f0000000ac0)=""/134}, {&(0x7f0000000b80)=""/66}, {&(0x7f0000007180)=""/117}, {&(0x7f0000002680)=""/4096}], 0x0, &(0x7f00000037c0)=""/238}, 0xffffffff}, {{&(0x7f00000038c0)=@pppol2tp, 0x0, &(0x7f0000003a00)=[{&(0x7f0000003940)=""/74}, {&(0x7f00000039c0)=""/31}], 0x0, &(0x7f0000003a40)=""/4096}, 0x10}, {{&(0x7f0000004a40)=@nfc, 0x0, &(0x7f0000004fc0)=[{&(0x7f0000004ac0)=""/208}, {&(0x7f0000004bc0)=""/129}, {&(0x7f0000004c80)=""/198}, {&(0x7f0000004d80)=""/156}, {&(0x7f0000004e40)=""/158}, {&(0x7f0000004f00)=""/132}], 0x0, &(0x7f0000005040)=""/175}, 0x7}, {{0x0, 0x0, &(0x7f0000005480)=[{&(0x7f0000005300)=""/125}, {&(0x7f0000005200)=""/196}, {&(0x7f0000005100)=""/255}, {&(0x7f0000005440)=""/5}], 0x0, &(0x7f00000054c0)=""/183}, 0x60}, {{0x0, 0x0, &(0x7f0000005900)=[{&(0x7f0000005580)=""/23}, {&(0x7f00000055c0)=""/250}, {&(0x7f00000056c0)=""/127}, {&(0x7f0000005740)=""/160}, {&(0x7f0000005800)=""/19}, {&(0x7f0000005840)=""/138}], 0x0, &(0x7f0000005980)=""/4096}, 0x7}, {{&(0x7f0000006980)=@l2tp={0x2, 0x0, @initdev}, 0x0, &(0x7f0000006e80)=[{&(0x7f0000006a00)=""/109}, {&(0x7f0000006a80)=""/54}, {&(0x7f0000006ac0)=""/13}, {&(0x7f0000006b00)=""/212}, {&(0x7f0000006c00)=""/178}, {&(0x7f0000006cc0)=""/201}, {&(0x7f0000006dc0)=""/98}, {&(0x7f0000006e40)=""/34}], 0x0, &(0x7f0000006f00)=""/182}, 0x8}], 0x1, 0x0, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=0xffffffffffffffff, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=ANY=[@ANYRES32=r2, @ANYRESHEX=r1, @ANYRESOCT=r3, @ANYRESOCT=r3], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r5, &(0x7f0000000f80)={0x0, 0x0, &(0x7f0000000500)=[{0x0}, {&(0x7f00000002c0)="794ab6f0", 0x4}], 0x2}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000d80)={0x18, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="1801000021"], 0x0, 0x40, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000005380)={0x6, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r4], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x59, '\x00', 0x0, @fallback=0xd, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x3, '\x00', 0x0, @fallback=0x7, 0xffffffffffffffff, 0x0, 0x0, 0x13, 0x0, 0x0, 0x0, 0x0, 0x0, 0x44, 0x0, 0x0, 0x0, 0x10}, 0x94) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x3, 0xe, &(0x7f0000000c00)=ANY=[@ANYBLOB="b7020000c3000000bf230000000000002703000000fefeff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400011000000404000001007d60b7030000000000006a0a00fe800000008500000026000000b7000000000000009500001000000000acaa8e53a53cb864c300094c07000000000000d94cf0987b00a749a8e53b5c9491cd1f2b94a64f1de23d03a8f0362ebfc44c77511e60070e25510070f7778d3e77ad85319f0113abbac795f8c24abca246150226eb93fe39233add8f68f87699162334343befce832cb8075c5f0ae30cde221371ff00000067e4b75da95370ae6fd2b99ac18f98403494d4a94e95fb8dcd813487b2bdb006c6465c15f04485a9f8c8e49d00000097184c8e9d34b1e382b25e9614634e8e09194f7b83138f5275d9ab463797a2f6dcb45d5f278cd4fb74559575da3560c01cdf1eaa3fc7a3fb4f1689dfd5b626174770e4dfd1c82a694efc62f9ef9c8c0ea1efa5b949ce22827f6fd1dfc69d03482d8ec264e3d96ad19a0c99a234b4b71b0bc22573f8594b91781cd8ff7f000000000000299ebf94588e60abe9a565c5bbdc0358226f8580dc1a83c6a44408de23475a74ef0deda8da4089269ccb4e728dee6320444576c87cc576291e5367a5f1a5d5a12f8313ffff0b7f73335279aa2b68c9f045831119881764c71bb65b5138c50e06024e80fd9656bc077e4e259695748989335ba9eeef288de73815f20fefd4acfb6813ffff00000b971aec1a3e618a08a94ecbd401c8109c87ee3f5c0501857538d2a766bfcf4128fbe726903aca577aa8943af747760718dee5a21396dce6f61c6f3c7e000000cb0868b48719e47296f2299df3ecfb5f3f0e42f6f1eb1dc64dcc8e397366d12033f6288edbda3b838100000000000000000000800000edd4e1266dc9d73223fe614f025a7f284de76b3b676a13c57a0ed24f6270c4cbbf93472eb8093d8296c68dfbb03ddedc3e029b08959b145a7b110068ba071e75d75716243052ad24b624fddc2f0f3a018c0085c2319c248d643cd09fa855b20a6d453f2e954ff0e55c010000008547c5a0ecefcc44cc9532f729167f215937357a4bb9746193c1ec000000000000dd43c108c2109d221b7b26b7c9c209000005b7918a6cd856b8fa806c85480443159c6bed51a0e021f05f7caa1b99cdb4d08d9031210ac00e67d8c40a18503cb7aabcc066dfbfd7f87abe1122f00e5454bec3563a19582e0000000000000000000000000084b27fc6a3f95bf02b4eb5f1599dd46edcad432cc216316fe07afe27649c89cf022a90d895a2d70fcde7a9c37ede0c47c27f44595ab4b1fb1ed5b1d91314b2d50f94a768fb605679485041a6376b8344a39af68aed2be39794dd86ae82f9660cf4f935255d71f9fab2e430ac42bba1f54141cf39d4d50c4ded504beacb0de210d7a3716dca7362c134b91cef3efc514fbcb4747e6814ac16449ac02a43d9d4151697b4b7890ec6b481c5f0ca8c52a6322f34a796fa5941d23409ecf73458223baaffb94a89ee2884df000000000000"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x36}, 0x48) r7 = socket(0xa, 0x1, 0x0) bind$inet6(r7, &(0x7f0000000000)={0xa, 0xe64, 0x3, @local, 0x2}, 0x18) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r6, 0x2000000, 0xe, 0x0, &(0x7f00000004c0)="630b008646dc3f0adf33c9f7b986", 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x20}, 0x50) r8 = socket$l2tp(0x2, 0x2, 0x73) r9 = socket$packet(0x11, 0x2, 0x300) setsockopt$SO_ATTACH_FILTER(r9, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000140)=[{0x20, 0x1, 0x0, 0xfffff034}, {0x6, 0x0, 0x0, 0x4}]}, 0x10) r10 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000d00)=ANY=[@ANYBLOB="b702000007000000bfa30000000000000703000000feffff7a0af0ff0100000079a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b70000000000000095000000000000005ecefab8f2e85c6c1ca711fcd0cdfa146ec561750379585e5a076d839240d29c034055b67dafe6c8dc3d5d78c07fa1f7e655ce34e4d5b3185fec0e07004e60c08dc8b8dbf11e6e94d75938321a3aa502cd2424a66e6d2ef831ab7ea0c34f17e3946e06bb622003b538dfd8e012e79578e51bc53099e90f4580d760551b5b341a29f31e3106d1ddd6152f7cbdb9cd38bdb2209c67deca8eeb9c15ab3a14817ac61e4dd11183a13477bf7e860e3670ef0e789f65f1328d6704902cbe7bc04b82d2789cb132b8667c2147661df28d9961b63e1a9cf6c2a660a1fe3c184b751c51160fb20b1c581e7be6ba0dc001c4110555850915148ba532e6ea09c346dfebd38608b3280080005d9a9500000000000000334d83239dd27080851dcac3c12233f9a1fb9c2aec61ce63a38d2fd50117b89a9ab359b4eea0c6e95767d42b4e54861d0227dbfd2e6d7f715a7f3deadd7130856f756436303767d2e24f29e5dad9796edb697aeea0182babd18cac1bd4f4390af9a9ceafd0002cab154ad029a1090000002780870014f51c3c975d5aec84222fd3a0ec4be3e563112b0b39501aafe234870072858dc06e7c337642d3e5a815232f5e16c1b30c3a6a71bc85018e5ff2c91018afc9ffc2cc788bee1b47683db01ac69398685211dfbbae3e2ed0a50e7313bff5d4c391ddece00fc772dd6b4d4de2a41990f05ca3bdfc92c88c5b8dcd36e7487afa447e2edfae4f390a8337841cef386e22cc22ee17476d738952229682e24b92533ac2a9f5a699593f084419cae0b4532bcc97d3ae486aca54183fb01c73f979ca9857399537f5dc2a2d0e0000000000000578673f8b6e74ce23877a6b24db0e067345560942fa629fbef2461c96a088a22e8b15c3e233db7ab22e30d46a9d24d37cef099ece729aa218f9f44a3210223fdae7ed04935c3c90d3add8eebc8619d73415cda2130f5011e48455b5a8b90dfae158b94f50adab988dd8e12baf5cc9398fff00404d5d99f82e20ef6a8c88e18c2977aab37d9ac4cfc1c7b400000000000007ff57c39495c826b956ba859ac8e3c177b91bd7d5e41ff868f7ca1664fe2f3ced846891180604b6dd2499d16d7d9158ffffffff00000000ef069dc42749a89f854797f29d0000002d8c38a967c1bbe09315c29877a308bcc87dc3addb08141bdee5d27874b27663ddeef0005b3d96c7aabf4df517d90bdc01e73835d5a3e1a90800c66ee2b1ad76dff9f9000071414c99d4894ee7f8249dc1e3428d2129369ee1b85af6eb2eea0d0df414b315f651c8412392191fa83ee830548f11e1036a8debd64cbe359454a3f2239cfe35f81b7a490f167e6d5c1109000000000000000042b8ff8c21ad702ccacad5b39eef213d1ca296d2a27798c8ce2a305c0c7d35cf4b22549a4bd92052188bd1f285f653b6214912a517810200e2ff08644fb94c06006eff1be2f633c1d987591ec3db58a7bb3042ec3f771f7a1338a5c3800000000000000009c58e273cd905deb28c13c1ed1c0d9cae846bcbfa8cce7b893e578af7dc7d5e87d44ff828de453f34c2b18660b080efc707e676e1fb4d5825c0ca177a4c7fbb4eda0545c00f576b2b5cc7f819abd0f885cc4806f40300966fcf1e54f5a2d38708294cd6f496e5dee734fe7da3770845cf442d488a0200000000000000000000000000000000000000000000000000000000005205000000dc1c56d59f35d367632952a93466ae595c6a8cda690d192a070886df42b27098773b45198b4a34ac977ebd4450e121d01342703f5bf030e935878a6d169c80aa4252d4ea6b8f6216ff202b5b5a182cb5e838b307632d03a7ca6f6d0339f9953c3093c3690d10ecb65dc5b47481edbf1f000000000000004d16d29c28eb5167e9936ed327fb237a56224e49d9ea955a5f0dec1b3ccd35364600000000000000000000000000000000000000000000000000000000000026ded4dd6fe1518cc7802043ecfe69f743f1213bf8179ecd9e4a59414329a7c7f2fad6bc871f5a225d67521dc728eac7d80a5656ac2cbde21d3ebfbf69ff861f4394836ddf128d6d19079e64336e7c676505c78ad67548f4b192be1827fcd95cf107753cb0a6a979d3db0c407081c6281e2d8429a863903ca75f4c7df3ea8fc2018d07af1491ef060cd4403a099f32468f65bd06b4082d43e121861b5cc03f1a1561fe589e0d12969bc982ff3f0000006c0c6c747d9a1cc500bb89283a16ff10feea20bdac0000000000000000ca06f256a55591019465f037b21f3289f86a6826c69fa35ba5cbc3f2db1516ffc5c6e3fa618b24a6ce16d6c7010bb37b61fa0a2d8974e69115d33394e86e4b838297ba20f96936b7e4746e92dea6c5d1d33d84d96b50fb000000ae07c65b71088dd7d5d1e1bab9000000000000000000000000b5ace293bec833c13e3229432ad71d646218b5229dd88137fc7c59aa242af3bb4efb82055a3b61227ad40f52c9f2500579aca11033ec14bb9cc16bd83a00840e31d828ec78e116ae46c4897e2795b6ff92e9a1e24b0b855c02f2b7add58ffb25f339297729a7a51810134d3dfbf71f6516737be55c06d9cdcfb1e2bb10b50000eb4acff90756dba1ecf9f58afd3c19b5c4558ba9af6b7333c894a1fb29ade9ad75c9c022e8d03fe28bc358684492aa771dbfe80745fe89ad349ffaad76ff9dd643796caffdf67af5dd476c37e7e9a84e2e5da2696e285a59b53f2fb0e16d8262c080c159ce40c14089c82759106f422582b42e3e8484ea5a6ad9aa52106eafe0e0caea1ad4cb23f3c2b8a0f455ba69ea284c268d54b43158a8b1d128d02af263b3dc1cab794c9ac57a2a7332f4d8764c302ccd5aac114482b619fc575aa0dd2777e881e29a854380e2f1e49db5a1517ee40bb3fa44f9959bad67ccaba76408da35c9f1534c8bd48bbd61627a2e0a74b5e6aefb7eee403502734837ff47257f164391c673b6079e65d7295eed164ca63e4ea26dce0fb3ce0f6591d80dfb8f386bb74b5589829b6b0679b5d65a6d072034cecc457776c5fa1f33b0203c07052c6bc314b0ac5c63bc2083c9cda0b7480e0b17854ffcc76176ce266bc698f7921b8afe798a7a5ed33ab0374455ee368fda99a0e681bf9426831b193395cb01a7332a50aac841cb7d48a1768a7640a9820631ba775a3dc4e97f7fda840bcdd3afaa0d7c3c229de4f0f4ac4d04f1a4e52e38325ca2e5f1f9caaa7234053eca09ec3c8c16940bc3edfb2e016f355391c0e7"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r10, 0x18000000000002a0, 0xe2c, 0x60000000, &(0x7f0000000100)="b9ff03076844268cb89e14f008004be0ffff00124000632177fbac141416ac14141689089f034d2f87e5940c04ab845013f2325f1a39014402038da1880b25181aa59d943be3f4aed50ea5a6b8686731cb89ef77123c899b699eeaa8eaa0073461119663906400f30c0600000000000059b6d3296e8ca31bce1d8392078b72f24996ae17dffc2e43c8174b54b620636894aaacf28ff62616363c70a440aec4014caf28c0adc043084617d7ecf41e9d134589d46e5dfc4ca5780d38cae870b9a1df48b238190da450296b0ac01496ace23eefc9d4246dd14afbf79a2283a0bb7e1d235f3df126c3acc240d75a058f6efa6d1f5f7ff4000000000000000000", 0x0, 0xfe, 0x60000000}, 0x2c) setsockopt$inet_group_source_req(r8, 0x0, 0x2f, &(0x7f0000000280)={0x9, {{0x2, 0x4e21, @multicast2}}, {{0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, 0x108) 1.868483098s ago: executing program 0 (id=8838): r0 = socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x10, 0xc, &(0x7f0000000c00)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006b000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb70200"], &(0x7f0000000040)='syzkaller\x00', 0x8, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x102}, 0x94) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r2 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000600), 0xffffffffffffffff) sendmsg$WG_CMD_SET_DEVICE(r3, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000000640)={0x178, r4, 0x1, 0x4, 0x0, {}, [@WGDEVICE_A_IFNAME={0x14, 0x2, 'wg1\x00'}, @WGDEVICE_A_PRIVATE_KEY={0x24, 0x3, @c}, @WGDEVICE_A_FLAGS={0x8}, @WGDEVICE_A_PEERS={0x124, 0x8, 0x0, 0x1, [{0xf0, 0x0, 0x0, 0x1, [@WGPEER_A_PUBLIC_KEY={0x24, 0x1, @a_g}, @WGPEER_A_ALLOWEDIPS={0xa4, 0x9, 0x0, 0x1, [{0x28, 0x0, 0x0, 0x1, [@ipv6={{0x6}, {0x14, 0x2, @loopback}, {0x5}}]}, {0x28, 0x0, 0x0, 0x1, [@ipv6={{0x6}, {0x14, 0x2, @empty}, {0x5, 0x3, 0x1}}]}, {0x28, 0x0, 0x0, 0x1, [@ipv6={{0x6}, {0x14, 0x2, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, {0x5, 0x3, 0x3}}]}, {0x28, 0x0, 0x0, 0x1, [@ipv6={{0x6}, {0x14, 0x2, @private2}, {0x5, 0x3, 0x1}}]}]}, @WGPEER_A_PUBLIC_KEY={0x24, 0x1, @b_g}]}, {0xfffffffffffffd61, 0x0, 0x0, 0x1, [@WGPEER_A_FLAGS={0x8, 0x3, 0x1}, @WGPEER_A_PUBLIC_KEY={0x24, 0x1, @a_g}]}]}]}, 0x178}, 0x1, 0x0, 0x0, 0x4084}, 0x20000010) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r2, 0x8914, &(0x7f0000000000)) r5 = syz_init_net_socket$rose(0xb, 0x5, 0x0) ioctl$sock_rose_SIOCADDRT(r5, 0x890b, &(0x7f0000000380)={@remote={0xcc, 0xcc, 0xcc, 0xcc, 0x0}, 0x6, @null, @bpq0, 0x0, [@bcast, @bcast, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]}) syz_init_net_socket$rose(0xb, 0x5, 0x0) r6 = syz_init_net_socket$rose(0xb, 0x5, 0x0) ioctl$sock_rose_SIOCADDRT(r6, 0x890b, &(0x7f0000000380)={@remote={0xcc, 0xcc, 0xcc, 0xcc, 0x0}, 0x6, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bpq0, 0x0, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @default, @bcast, @null]}) ioctl$sock_rose_SIOCDELRT(r6, 0x890c, &(0x7f00000000c0)={@remote={0xcc, 0xcc, 0xcc, 0xcc, 0x1}, 0x6, @null, @bpq0, 0x1, [@bcast, @default, @default, @default, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @default]}) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000780)=ANY=[@ANYBLOB="740000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000540012800b000100697036746e6c000044000280050006000800000004001300060011004e22000014000300fc0000000000000008000700070000000600100001000000060012004e2000"/92], 0x74}, 0x1, 0xba01, 0x0, 0x4004001}, 0x4000000) 1.838353934s ago: executing program 4 (id=8839): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$inet6(0xa, 0x3, 0x88) sendmmsg$inet6(r1, &(0x7f00000007c0)=[{{&(0x7f00000001c0)={0xa, 0x4e23, 0x6, @local}, 0x1c, 0x0}}], 0x1, 0x2000c081) setsockopt$inet6_IPV6_ADDRFORM(r1, 0x29, 0x1, &(0x7f0000000080), 0x4) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) getsockopt$inet_sctp6_SCTP_MAX_BURST(r3, 0x84, 0x83, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f00000010c0)=0x8) socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, &(0x7f00000001c0)={r4, 0x2}, 0x8) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)={0x20, 0x2e, 0x9, 0x70bd27, 0x0, {0x5}, [@typed={0x4, 0x1d, 0x0, 0x0, @binary}, @typed={0x8, 0x17, 0x0, 0x0, @u32=0x2}]}, 0x20}, 0x1, 0x0, 0x0, 0x42804}, 0x4000000) 1.545259733s ago: executing program 2 (id=8840): epoll_create1(0x80000) r0 = syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000100)='ns/user\x00') ioctl$NS_GET_USERNS(r0, 0xb701, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$kcm(0x2d, 0x2, 0x0) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, 0x0}, 0x100) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a1d010000000000000000020000000900010073797a3000000000080002400000000098000000030a01020000000000000000020000000900010073797a30000000000900030073797a32000000006b00030091abc12404cf378042f2", @ANYRES8=r1, @ANYRESDEC], 0xfc}}, 0x4080800) epoll_create1(0x80000) (async) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000100)='ns/user\x00') (async) ioctl$NS_GET_USERNS(r0, 0xb701, 0x0) (async) socket$nl_netfilter(0x10, 0x3, 0xc) (async) socket$kcm(0x2d, 0x2, 0x0) (async) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, 0x0}, 0x100) (async) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a1d010000000000000000020000000900010073797a3000000000080002400000000098000000030a01020000000000000000020000000900010073797a30000000000900030073797a32000000006b00030091abc12404cf378042f2", @ANYRES8=r1, @ANYRESDEC], 0xfc}}, 0x4080800) (async) 1.465982549s ago: executing program 2 (id=8841): mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0xc020) (async) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0xc020) syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), r0) (async) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), r0) sendmsg$ETHTOOL_MSG_DEBUG_SET(r0, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000001500)={&(0x7f0000000140)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0100000000000000000008000000180001801400020073797a5f74756e00000000000000000018000280080002000a00000004000100080003"], 0x44}}, 0x0) socket$inet(0x2, 0x3, 0x2) (async) r2 = socket$inet(0x2, 0x3, 0x2) setsockopt$MRT_FLUSH(r2, 0x0, 0xd0, 0x0, 0x0) readv(r2, &(0x7f0000000100), 0x1000000000000193) bpf$PROG_LOAD(0x5, &(0x7f0000000940)={0x1e, 0x5, &(0x7f0000000340)=ANY=[@ANYBLOB="18000200004000000000000009000000850000008b000000850000000700000095"], &(0x7f0000000000)='syzkaller\x00', 0x6, 0x0, 0x0, 0x40f00, 0x28, '\x00', 0x0, @sk_lookup=0x24, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000940)={0x1e, 0x5, &(0x7f0000000340)=ANY=[@ANYBLOB="18000200004000000000000009000000850000008b000000850000000700000095"], &(0x7f0000000000)='syzkaller\x00', 0x6, 0x0, 0x0, 0x40f00, 0x28, '\x00', 0x0, @sk_lookup=0x24, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0xc, &(0x7f0000000140)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000756c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b7030000000000008500000072000000850000005000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0xc, &(0x7f0000000140)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000756c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b7030000000000008500000072000000850000005000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0xc, &(0x7f0000000140)=ANY=[], &(0x7f0000000340)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r3, 0x5, 0xe, 0x0, &(0x7f00000001c0)="0101000871a7832e6b7303c3cd59", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x3}, 0x50) (async) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r3, 0x5, 0xe, 0x0, &(0x7f00000001c0)="0101000871a7832e6b7303c3cd59", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x3}, 0x50) epoll_create(0x3) r4 = socket(0x1d, 0x2, 0x6) setsockopt$ALG_SET_AEAD_AUTHSIZE(r4, 0x6a, 0x5, 0x20000000, 0x9) r5 = socket(0x2a, 0x2, 0x0) getsockopt$WPAN_WANTLQI(r5, 0x0, 0x3, &(0x7f0000000000), &(0x7f0000000040)=0x4) getsockname$packet(r5, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) 884.480821ms ago: executing program 3 (id=8842): r0 = socket(0x10, 0x803, 0x0) r1 = socket(0x1, 0x803, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0xc, &(0x7f00000000c0)=@framed={{}, [@ringbuf_output]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) socket$inet_icmp_raw(0x2, 0x3, 0x1) (async) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) (async) close(0x4) (async) syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/ipc\x00') (async) unshare(0x6a040000) (async) r3 = socket(0x8, 0x3, 0x0) setsockopt$bt_hci_HCI_DATA_DIR(r2, 0x0, 0x1, 0x0, 0x0) (async) unshare(0x20400) connect$inet6(r3, 0x0, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@ipv6_newaddr={0x2c, 0x14, 0x9535393fea6295b5, 0x0, 0x0, {0xa, 0x40, 0x0, 0x0, r4}, [@IFA_LOCAL={0x14, 0x2, @ipv4}]}, 0x2c}}, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000400)=@ipv6_newaddr={0x34, 0x14, 0x9535393fea6295b5, 0x0, 0x400000, {0xa, 0x0, 0x0, 0x0, r4}, [@IFA_LOCAL={0x14, 0x2, @ipv4}, @IFA_RT_PRIORITY={0x8, 0x9, 0x7ff}]}, 0x34}}, 0x0) r6 = socket$alg(0x26, 0x5, 0x0) bind$alg(r6, &(0x7f00000001c0)={0x26, 'hash\x00', 0x0, 0x0, 'sha3-256\x00'}, 0x58) r7 = accept4(r6, 0x0, 0x0, 0x0) sendmmsg$alg(r7, &(0x7f0000000240)=[{0x0, 0x0, &(0x7f0000000780)=[{&(0x7f0000000280)="961933", 0x3}, {&(0x7f0000000340)="f2119d5ede", 0x5}], 0x2, 0x0, 0x0, 0x8010}], 0x1, 0x4) 878.828531ms ago: executing program 0 (id=8843): r0 = socket$nl_route(0x10, 0x3, 0x0) syz_emit_ethernet(0x32b, &(0x7f0000000140)=ANY=[@ANYBLOB="ffffffffffffaaaaaaaaaa2886dd6af0e44902f50001fc010000000000000000000000000001fc010000000000000000000000000001160a010500000000fc"], 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="400000001000030400000000ffdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="00000000000000001400128009000100626f6e640000000004000280090001000000000000000000c342a0b2318a6f47d730181cb966cfdbda9840874ea1590081ecc94f0c0ad0f3c0766251166b84bd0b0b5d79b4b45c12e84185ed881f2076a6bdc0ee10bc7920424551"], 0x40}}, 0x0) 858.303858ms ago: executing program 4 (id=8844): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@rand_addr=' \x01\x00', @in=@local, 0x0, 0x5, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa9, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa00, 0x40800000000000, 0x800000000000000}}}, 0xb8}}, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000a00)=ANY=[@ANYBLOB="b00100002100010000000000fefffffffc020000000000000000000000000000fc020000000000000000000000000001fffc0000000000000a00e080", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="020800000000040034011100fe80000000000000000000000000001164010102000000000001000100000000001414aa000000000000000000000000fe8000000000000000000000000000bb3c000000000000000000000000000001e0000002000000000000000000000000fe88000000000000000000000000ea0120010000000000003500000a0002000a010102000000000000000000000000fc00000000000000000000000000be"], 0x1b0}, 0x1, 0x0, 0x0, 0x800}, 0x0) 782.105948ms ago: executing program 2 (id=8845): r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, 0x0, &(0x7f0000001640)) ioctl$sock_TIOCINQ(r0, 0x541b, &(0x7f0000000040)) 753.51699ms ago: executing program 0 (id=8846): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x4, '\x00', 0x0, 0x0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x1c, &(0x7f0000000d80)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0xb0, 0x0, 0x0, 0x0, 0x1}, {{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {0x85, 0x0, 0x0, 0x5}, {0x4, 0x1, 0xb, 0x9, 0xa}}, {{0x5, 0x0, 0x3}}, [@snprintf={{0x5, 0x0, 0xb, 0x9, 0x0, 0x2, 0x2}, {0x3, 0x2, 0x3, 0xa, 0x9, 0xfe00}, {0x5, 0x0, 0xb, 0x9, 0x0, 0xffff, 0x4}, {0x3, 0x0, 0x6, 0xa, 0x9, 0xfe04, 0x41}, {0x7, 0x1, 0xb, 0x7, 0x8}, {0x7, 0x0, 0x0, 0x8}, {}, {}, {}, {0x18, 0x2}, {}, {0x46, 0x8, 0xfff0, 0x76}}], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0x2, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x13, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 651.976717ms ago: executing program 4 (id=8847): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000a80)={0x3, 0x1c, &(0x7f0000000d80)=ANY=[@ANYBLOB="1808000000000000000000000000800018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70200001400d000b7030000000000008500000005000000bf0900000000000035090100000600009500000000000000b7020000000000007b9af8ff00000000d509000013ffffff7baaf0ff00000000bf9700000000000007080000fffdffffbfa400000000000007040000f0ffffff740200000800000018220000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7050000080000004608f0ff760000007d9800000000000056080000010000008500000005000000b70000000000000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x69, '\x00', 0x0, @sched_cls=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 599.20684ms ago: executing program 2 (id=8848): r0 = socket$l2tp(0x2, 0x2, 0x73) setsockopt$inet_int(r0, 0x0, 0x2, &(0x7f0000000000)=0x1, 0x4) (async) bind$inet(r0, &(0x7f00000002c0)={0x2, 0x4e20, @empty}, 0x10) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @local}, 0x10) (async) r1 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="01000000040000000800000010"], 0x50) (async) bpf$PROG_LOAD(0x5, 0x0, 0x0) (async) close(0x3) (async) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000040)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000010b704000000000000850000000100000095"], &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000080)={r4}, 0xc) bind$can_j1939(r1, &(0x7f00000000c0)={0x1d, r2}, 0x18) connect$can_j1939(r1, &(0x7f0000000140)={0x1d, r2}, 0x18) (async) sendmmsg(r1, &(0x7f0000003e40)=[{{0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000200)="e9422a6a768799a219", 0x9}], 0x1}}], 0x1, 0x0) (async) recvmmsg(r1, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000180)=""/3, 0x3}], 0x1}}], 0x1, 0x0, 0x0) sendto$inet(r0, 0x0, 0x0, 0x240008c4, 0x0, 0x0) 555.866675ms ago: executing program 0 (id=8849): r0 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000004c0)=@bpf_lsm={0x6, 0x3, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) ioctl$int_in(r1, 0x5452, &(0x7f0000000180)=0xf51) readv(r1, &(0x7f0000000340)=[{&(0x7f0000000080)=""/107, 0x6b}], 0x1) setsockopt$sock_int(r1, 0x1, 0x20, &(0x7f00000000c0)=0xf6, 0x4) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000240)={r0, 0xf, 0x25, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20048054}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$packet(0x11, 0x2, 0x300) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000005c0)=@newqdisc={0x24, 0x24, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x0, 0xfff2}}}, 0x24}}, 0x0) socket(0x2a, 0x2, 0x0) socket$netlink(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$netlink(0x10, 0x3, 0x0) r4 = socket(0x10, 0x80002, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(serpent)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, 0x0, 0x0) r6 = accept4(r5, 0x0, 0x0, 0x0) sendmmsg(r6, &(0x7f0000009640)=[{{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000180)="1073eedab59a32", 0x7}, {&(0x7f0000000240)="02a2f97a177137003d9b418698b97c81bf1bde7a9b76365fd7b1bbae5f5e09cb9b4432ed011564c718321c92affddb69470547b1baefcdb5445c31a7d34e0b20bddd0e2357b50d72", 0x48}, {&(0x7f00000038c0)="f9db6d4e6ca7d40c978d37d3ea23d92438e15c1b6ce255bbee36e2dd57ae11821c1af092de99be476596eb92bc722e1b34a6ef9d82e4d70fcf379419bfdb759f54b461633cc8099c9cf1a921921f65a149e1bc3789ee998403a87f2f59f5b66b2627741662f5c1ebc1c63385e103734c8639f135f74b6660a0006033de0760b4a70fb6dfb36ad9374cf7f623cbd748fc8b593c521a8e7c790287ce4968ec6fb36c2cac4d2fbd2a408595579e23489649d76df75d416d79057fd7faf3d6a6b8b7f6387c6e0c421d663e3e1585307ad01149f5829b3499748a4c2202db18148844f1cdf7544b7b8c7eae685bd678cdf88eb6443b24035ab0fd678e8a2c79983fb568f57979f7a31293067caf5be041fd38cab2088e5400110024c9b9e5c985ac7472b7991ad56d78bedea9285ad4f9f7b04c3888c33f15ced41146d833770ae6ca503aff03170d8c2cf31ae0578afd708860936241cd7ae3bdb46ec3041b4ac9a2fb158d35bb9f743a8857dfbabc6df23e37a685743760a43da3a2d48be814d0070550f21b71435f7fc2e2c8d4872f1a2ba607cd257f5bce59c453070dc3fe710ffd41c815bbd9a760e70056b9767f17b0084f8c532b504b95550ca445b7c2ccb14250bc66af4dd9cd86bb91d40cd54da79240a457905c892151cbc8cddcdf39ca1b5117043cf0d35127ff44529c6dc6892749d44baa10e4dd7b78b647a65e5c099a8ba6bf790a6b24eb4144255f154b8cb80beff39069da12d0a1be35f39abd7ff8e591822aca3670d8d5846844288e780f", 0x231}], 0x3}}], 0x1, 0x8810) recvmsg$unix(r6, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000001f00)=""/4096, 0x1000}], 0x1}, 0x12060) sendmsg$nl_route(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000240)=ANY=[], 0x48}, 0x1, 0x0, 0x0, 0x20000000}, 0x4008000) sendmmsg$alg(r4, &(0x7f00000000c0), 0x492492492492627, 0x0) socket$unix(0x1, 0x1, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$netlink(0x10, 0x3, 0x0) 229.747354ms ago: executing program 4 (id=8850): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r1) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0xe, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="850000002e00000016000000000000005c800000000000009500000000000000"], &(0x7f0000000040)='syzkaller\x00', 0x4, 0x99, 0xffffffffffffffff, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0xfffffffffffffed8, 0x0, 0xffffffffffffffff, 0xfe8e}, 0x3f) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc080003400000001408000c4000000e45400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d103000014000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-twofish-3way\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r4 = accept4(r3, 0x0, 0x0, 0x80800) setsockopt$sock_int(r4, 0x1, 0x7, &(0x7f00000014c0)=0x10000b, 0x4) sendmsg$IPCTNL_MSG_CT_NEW(r4, &(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000880)={0x0}, 0x1, 0x0, 0x0, 0x4040080}, 0x8000) sendmmsg$alg(r4, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000640)=""/88, 0x58}, {&(0x7f0000000740)=""/105, 0xfffffe0b}], 0x2}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000018000000000000000000500000a480000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a31000000001c000380180000800c0001c006000100d9030000080003400000000114000000110001"], 0x70}, 0x1, 0x0, 0x0, 0x40008d0}, 0x40) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)=ANY=[], 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r5 = socket$rds(0x15, 0x5, 0x0) ioctl$SIOCGSTAMP(r5, 0x8906, &(0x7f00000001c0)) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0e00000004000000080000000700000000000000", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\b\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0xc, 0xd, &(0x7f0000000440)=ANY=[@ANYBLOB="18fc000000040000000000000099aa000018150000", @ANYRES32=r6, @ANYBLOB="0000000000000000b7080000ffffff7f7b5af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000002000000850000001500000085000000a00000009500000000000000"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYRES64=r1], 0x50) close(0x3) 0s ago: executing program 4 (id=8851): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000000100)={'batadv0\x00', 0x0}) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000900)={&(0x7f0000000040)=ANY=[@ANYBLOB="3800000040000701feffffff00000000017c0000040042801c00018006000600050a0000100004002524298d275c232f262d2b00040002"], 0x38}, 0x1, 0x0, 0x0, 0x48815}, 0xc000) sendmsg$BATADV_CMD_GET_MESH(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000300)={0x1c, r2, 0x1, 0x70bd2c, 0x25dfdbfb, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20004080}, 0x8010) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000880)='blkio.bfq.io_queued_recursive\x00', 0x275a, 0x0) writev(r5, &(0x7f0000000040)=[{&(0x7f00000001c0)="3e98021422576e1f8f1d2ac6dd60fa7599eba67979a399e581581834335637dd5d84389402a09f581c09118cfd9d9c3310605ef0e1a48220cccc8f2366439a2c1b7086783e30fcbb6e7ef1659a", 0x4d}], 0x1) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r5, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000080)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x10, 0x10, 0x4, [@var={0x2, 0x300, 0x0, 0x11, 0x4, 0xffffffff}]}, {0x0, [0x0, 0x61]}}, 0x0, 0x2c}, 0x28) kernel console output (not intermixed with test programs): 00 R11: 0000000000000246 R12: 0000000000000001 [ 719.468667][T31875] R13: 00007fad77816038 R14: 00007fad77815fa0 R15: 00007fffe46c4c48 [ 719.468696][T31875] [ 719.468927][T31875] page_pool_create_percpu() gave up with errno -12 [ 719.502721][T31873] netlink: 'syz.3.7371': attribute type 1 has an invalid length. [ 719.867301][T31886] netlink: 20 bytes leftover after parsing attributes in process `syz.4.7375'. [ 719.880620][T31886] openvswitch: netlink: Flow actions attr not present in new flow. [ 720.042802][T31897] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7378'. [ 720.473456][T31930] FAULT_INJECTION: forcing a failure. [ 720.473456][T31930] name failslab, interval 1, probability 0, space 0, times 0 [ 720.514927][T31928] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7387'. [ 720.524112][T31930] CPU: 0 UID: 0 PID: 31930 Comm: syz.4.7386 Not tainted syzkaller #0 PREEMPT(full) [ 720.524137][T31930] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 720.524148][T31930] Call Trace: [ 720.524156][T31930] [ 720.524164][T31930] dump_stack_lvl+0xe8/0x150 [ 720.524193][T31930] should_fail_ex+0x412/0x560 [ 720.524219][T31930] should_failslab+0xa8/0x100 [ 720.524242][T31930] __kmalloc_cache_noprof+0x88/0x660 [ 720.524260][T31930] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 720.524285][T31930] ? __xdp_reg_mem_model+0x1e3/0x5d0 [ 720.524314][T31930] __xdp_reg_mem_model+0x1e3/0x5d0 [ 720.524344][T31930] ? __pfx___xdp_reg_mem_model+0x10/0x10 [ 720.524370][T31930] ? page_pool_create_percpu+0x7f9/0xb80 [ 720.524401][T31930] xdp_reg_mem_model+0x22/0x40 [ 720.524424][T31930] bpf_test_run_xdp_live+0x295/0x1cf0 [ 720.524450][T31930] ? bpf_dispatcher_change_prog+0xae0/0xd70 [ 720.524485][T31930] ? __pfx_wait_rcu_exp_gp+0x10/0x10 [ 720.524512][T31930] ? __pfx_autoremove_wake_function+0x10/0x10 [ 720.524534][T31930] ? __pfx_bpf_test_run_xdp_live+0x10/0x10 [ 720.524572][T31930] ? 0xffffffffa02019d4 [ 720.524588][T31930] ? 0xffffffffa0201a14 [ 720.524602][T31930] ? 0xffffffffa0201a48 [ 720.524616][T31930] ? 0xffffffffa0203110 [ 720.524631][T31930] ? 0xffffffffa0203238 [ 720.524645][T31930] ? 0xffffffffa0203948 [ 720.524660][T31930] ? 0xffffffffa0206f2c [ 720.524702][T31930] ? __pfx_xdp_test_run_init_page+0x10/0x10 [ 720.524734][T31930] ? _copy_from_user+0x94/0xb0 [ 720.524756][T31930] ? bpf_test_init+0x113/0x150 [ 720.524773][T31930] ? xdp_convert_md_to_buff+0x5b/0x330 [ 720.524794][T31930] bpf_prog_test_run_xdp+0x81c/0x1160 [ 720.524828][T31930] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 720.524854][T31930] ? __fget_files+0x2a/0x420 [ 720.524882][T31930] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 720.524904][T31930] bpf_prog_test_run+0x2c7/0x340 [ 720.524926][T31930] __sys_bpf+0x643/0x950 [ 720.524953][T31930] ? __pfx___sys_bpf+0x10/0x10 [ 720.524993][T31930] ? ksys_write+0x242/0x270 [ 720.525014][T31930] ? __pfx_ksys_write+0x10/0x10 [ 720.525039][T31930] __x64_sys_bpf+0x7c/0x90 [ 720.525063][T31930] do_syscall_64+0x14d/0xf80 [ 720.525085][T31930] ? trace_irq_disable+0x3b/0x150 [ 720.525109][T31930] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 720.525127][T31930] ? clear_bhb_loop+0x40/0x90 [ 720.525149][T31930] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 720.525167][T31930] RIP: 0033:0x7fb29219c799 [ 720.525184][T31930] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 720.525198][T31930] RSP: 002b:00007fb292fec028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 720.525218][T31930] RAX: ffffffffffffffda RBX: 00007fb292415fa0 RCX: 00007fb29219c799 [ 720.525231][T31930] RDX: 0000000000000050 RSI: 0000200000000680 RDI: 000000000000000a [ 720.525243][T31930] RBP: 00007fb292fec090 R08: 0000000000000000 R09: 0000000000000000 [ 720.525254][T31930] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 720.525265][T31930] R13: 00007fb292416038 R14: 00007fb292415fa0 R15: 00007ffd62cb8e98 [ 720.525295][T31930] [ 720.531307][T31928] netlink: 12 bytes leftover after parsing attributes in process `syz.0.7387'. [ 720.885618][T31949] netlink: 44 bytes leftover after parsing attributes in process `syz.4.7392'. [ 721.045109][T31956] netlink: 'syz.4.7395': attribute type 1 has an invalid length. [ 721.098575][T31956] bond6: entered promiscuous mode [ 721.105227][T31956] 8021q: adding VLAN 0 to HW filter on device bond6 [ 721.218494][T31956] bond6: (slave bridge5): making interface the new active one [ 721.226419][T31956] bridge5: entered promiscuous mode [ 721.242975][T31956] bridge5: left promiscuous mode [ 721.748831][T31983] wg1 speed is unknown, defaulting to 1000 [ 721.777455][T31983] ªªªªª9 speed is unknown, defaulting to 1000 [ 721.868835][T31989] netlink: 'syz.4.7405': attribute type 1 has an invalid length. [ 722.356352][T32018] netlink: 52 bytes leftover after parsing attributes in process `syz.1.7414'. [ 722.403358][T32018] netlink: 76 bytes leftover after parsing attributes in process `syz.1.7414'. [ 722.450098][T32018] bridge0: left promiscuous mode [ 722.475236][T32018] netlink: 52 bytes leftover after parsing attributes in process `syz.1.7414'. [ 722.602731][T32027] netlink: 'syz.2.7418': attribute type 46 has an invalid length. [ 722.812601][T32036] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7421'. [ 723.345091][T32043] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 723.391859][T32053] tipc: Enabling of bearer rejected, failed to enable media [ 723.532116][T32064] FAULT_INJECTION: forcing a failure. [ 723.532116][T32064] name failslab, interval 1, probability 0, space 0, times 0 [ 723.536148][T32063] netlink: 428 bytes leftover after parsing attributes in process `syz.3.7428'. [ 723.558407][T32064] CPU: 1 UID: 0 PID: 32064 Comm: syz.2.7429 Not tainted syzkaller #0 PREEMPT(full) [ 723.558433][T32064] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 723.558445][T32064] Call Trace: [ 723.558459][T32064] [ 723.558468][T32064] dump_stack_lvl+0xe8/0x150 [ 723.558499][T32064] should_fail_ex+0x412/0x560 [ 723.558525][T32064] should_failslab+0xa8/0x100 [ 723.558548][T32064] __kmalloc_cache_noprof+0x88/0x660 [ 723.558566][T32064] ? __pfx_stack_trace_save+0x10/0x10 [ 723.558586][T32064] ? rtnl_newlink+0x136/0x1be0 [ 723.558612][T32064] rtnl_newlink+0x136/0x1be0 [ 723.558634][T32064] ? kasan_save_track+0x4f/0x80 [ 723.558650][T32064] ? kasan_save_track+0x3e/0x80 [ 723.558666][T32064] ? kasan_save_free_info+0x46/0x50 [ 723.558687][T32064] ? __kasan_slab_free+0x5c/0x80 [ 723.558704][T32064] ? kmem_cache_free+0x187/0x630 [ 723.558723][T32064] ? __dev_queue_xmit+0x168f/0x38a0 [ 723.558747][T32064] ? __netlink_deliver_tap+0x5ad/0x850 [ 723.558765][T32064] ? netlink_deliver_tap+0x19c/0x1b0 [ 723.558783][T32064] ? netlink_unicast+0x7e3/0x9b0 [ 723.558799][T32064] ? netlink_sendmsg+0x813/0xb40 [ 723.558819][T32064] ? __pfx_rtnl_newlink+0x10/0x10 [ 723.558838][T32064] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 723.558890][T32064] ? kasan_quarantine_put+0xbb/0x1f0 [ 723.558906][T32064] ? lockdep_hardirqs_on+0x7a/0x110 [ 723.558933][T32064] ? kmem_cache_free+0x187/0x630 [ 723.558950][T32064] ? nlmon_xmit+0xb0/0x100 [ 723.558985][T32064] ? __lock_acquire+0x6b5/0x2cf0 [ 723.559013][T32064] ? __local_bh_enable_ip+0xd0/0x130 [ 723.559035][T32064] ? lockdep_hardirqs_on+0x7a/0x110 [ 723.559055][T32064] ? __dev_queue_xmit+0x274/0x38a0 [ 723.559078][T32064] ? __local_bh_enable_ip+0xd0/0x130 [ 723.559097][T32064] ? __dev_queue_xmit+0x274/0x38a0 [ 723.559150][T32064] ? __pfx_rtnl_newlink+0x10/0x10 [ 723.559171][T32064] rtnetlink_rcv_msg+0x7d5/0xbe0 [ 723.559196][T32064] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 723.559215][T32064] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 723.559235][T32064] ? ref_tracker_free+0x693/0x840 [ 723.559254][T32064] ? __copy_skb_header+0xa3/0x4a0 [ 723.559280][T32064] ? __pfx_ref_tracker_free+0x10/0x10 [ 723.559311][T32064] netlink_rcv_skb+0x232/0x4b0 [ 723.559332][T32064] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 723.559355][T32064] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 723.559393][T32064] ? netlink_deliver_tap+0x2e/0x1b0 [ 723.559422][T32064] netlink_unicast+0x80f/0x9b0 [ 723.559454][T32064] ? __pfx_netlink_unicast+0x10/0x10 [ 723.559475][T32064] ? netlink_sendmsg+0x650/0xb40 [ 723.559492][T32064] ? skb_put+0x11b/0x210 [ 723.559518][T32064] netlink_sendmsg+0x813/0xb40 [ 723.559547][T32064] ? __pfx_netlink_sendmsg+0x10/0x10 [ 723.559571][T32064] ? aa_sock_msg_perm+0xf1/0x1b0 [ 723.559593][T32064] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 723.559614][T32064] ? __pfx_netlink_sendmsg+0x10/0x10 [ 723.559633][T32064] ____sys_sendmsg+0xa68/0xad0 [ 723.559665][T32064] ? __pfx_____sys_sendmsg+0x10/0x10 [ 723.559699][T32064] ? import_iovec+0x73/0xa0 [ 723.559725][T32064] ___sys_sendmsg+0x2a5/0x360 [ 723.559756][T32064] ? __pfx____sys_sendmsg+0x10/0x10 [ 723.559814][T32064] ? __fget_files+0x2a/0x420 [ 723.559838][T32064] ? __fget_files+0x3a0/0x420 [ 723.559871][T32064] __x64_sys_sendmsg+0x1bd/0x2a0 [ 723.559899][T32064] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 723.559932][T32064] ? __pfx_ksys_write+0x10/0x10 [ 723.559962][T32064] do_syscall_64+0x14d/0xf80 [ 723.559983][T32064] ? trace_irq_disable+0x3b/0x150 [ 723.560006][T32064] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 723.560023][T32064] ? clear_bhb_loop+0x40/0x90 [ 723.560046][T32064] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 723.560063][T32064] RIP: 0033:0x7fb68eb9c799 [ 723.560082][T32064] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 723.560097][T32064] RSP: 002b:00007fb68fa78028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 723.560117][T32064] RAX: ffffffffffffffda RBX: 00007fb68ee15fa0 RCX: 00007fb68eb9c799 [ 723.560130][T32064] RDX: 0000000000000000 RSI: 0000200000000140 RDI: 0000000000000003 [ 723.560142][T32064] RBP: 00007fb68fa78090 R08: 0000000000000000 R09: 0000000000000000 [ 723.560153][T32064] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 723.560164][T32064] R13: 00007fb68ee16038 R14: 00007fb68ee15fa0 R15: 00007ffed3127958 [ 723.560195][T32064] [ 723.574140][T32063] netlink: 'syz.3.7428': attribute type 1 has an invalid length. [ 724.251112][T32076] hsr0: entered promiscuous mode [ 724.276676][T32082] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 724.294734][T32076] macvlan5: entered allmulticast mode [ 724.300150][T32076] hsr0: entered allmulticast mode [ 724.337167][T32076] hsr_slave_0: entered allmulticast mode [ 724.342855][T32076] hsr_slave_1: entered allmulticast mode [ 724.771262][T32100] sctp: [Deprecated]: syz.4.7440 (pid 32100) Use of int in max_burst socket option deprecated. [ 724.771262][T32100] Use struct sctp_assoc_value instead [ 725.484949][T32122] __nla_validate_parse: 11 callbacks suppressed [ 725.484969][T32122] netlink: 4 bytes leftover after parsing attributes in process `syz.1.7447'. [ 725.576730][T32124] netlink: 32 bytes leftover after parsing attributes in process `syz.4.7451'. [ 725.579684][T32122] netlink: 12 bytes leftover after parsing attributes in process `syz.1.7447'. [ 725.615883][T32127] netlink: 40 bytes leftover after parsing attributes in process `syz.2.7450'. [ 725.711506][T32129] bond5: Unable to set down delay as MII monitoring is disabled [ 725.748388][T32129] bond5 (unregistering): Released all slaves [ 726.409579][T32172] netlink: 'syz.1.7464': attribute type 10 has an invalid length. [ 726.601845][T32178] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7467'. [ 726.614968][T32175] Cannot find add_set index 2 as target [ 726.617625][T32178] netlink: 12 bytes leftover after parsing attributes in process `syz.2.7467'. [ 726.837636][T32194] netlink: 80 bytes leftover after parsing attributes in process `syz.4.7469'. [ 726.875589][T32194] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7469'. [ 726.906792][T32192] FAULT_INJECTION: forcing a failure. [ 726.906792][T32192] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 726.961158][T32192] CPU: 1 UID: 0 PID: 32192 Comm: syz.1.7470 Not tainted syzkaller #0 PREEMPT(full) [ 726.961185][T32192] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 726.961196][T32192] Call Trace: [ 726.961204][T32192] [ 726.961213][T32192] dump_stack_lvl+0xe8/0x150 [ 726.961243][T32192] should_fail_ex+0x412/0x560 [ 726.961268][T32192] _copy_to_user+0x31/0xb0 [ 726.961295][T32192] simple_read_from_buffer+0xe1/0x170 [ 726.961324][T32192] proc_fail_nth_read+0x1bb/0x230 [ 726.961351][T32192] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 726.961377][T32192] ? rw_verify_area+0x2a6/0x4d0 [ 726.961394][T32192] ? __fget_files+0x2a/0x420 [ 726.961415][T32192] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 726.961439][T32192] vfs_read+0x20c/0xa70 [ 726.961455][T32192] ? fdget_pos+0x246/0x320 [ 726.961483][T32192] ? __pfx___mutex_lock+0x10/0x10 [ 726.961507][T32192] ? __pfx_vfs_read+0x10/0x10 [ 726.961526][T32192] ? __fget_files+0x2a/0x420 [ 726.961553][T32192] ? __fget_files+0x3a0/0x420 [ 726.961574][T32192] ? __fget_files+0x2a/0x420 [ 726.961603][T32192] ksys_read+0x150/0x270 [ 726.961623][T32192] ? __pfx_ksys_read+0x10/0x10 [ 726.961652][T32192] do_syscall_64+0x14d/0xf80 [ 726.961673][T32192] ? trace_irq_disable+0x3b/0x150 [ 726.961697][T32192] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 726.961715][T32192] ? clear_bhb_loop+0x40/0x90 [ 726.961737][T32192] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 726.961754][T32192] RIP: 0033:0x7fad7755cfce [ 726.961771][T32192] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 726.961785][T32192] RSP: 002b:00007fad784cafe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 726.961804][T32192] RAX: ffffffffffffffda RBX: 00007fad784cb6c0 RCX: 00007fad7755cfce [ 726.961817][T32192] RDX: 000000000000000f RSI: 00007fad784cb0a0 RDI: 0000000000000004 [ 726.961828][T32192] RBP: 00007fad784cb090 R08: 0000000000000000 R09: 0000000000000000 [ 726.961839][T32192] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 726.961850][T32192] R13: 00007fad77816038 R14: 00007fad77815fa0 R15: 00007fffe46c4c48 [ 726.961882][T32192] [ 727.227129][T32200] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 727.264413][T32203] netlink: 7 bytes leftover after parsing attributes in process `syz.3.7475'. [ 727.284180][T32203] gretap2: entered promiscuous mode [ 727.469702][T32211] syzkaller1: entered promiscuous mode [ 727.484021][T32211] syzkaller1: entered allmulticast mode [ 727.640914][T32220] A link change request failed with some changes committed already. Interface bridge_slave_1 may have been left with an inconsistent configuration, please check. [ 727.732712][T32228] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7484'. [ 727.949912][T17787] ªªªªª9 speed is unknown, defaulting to 1000 [ 728.032904][T32244] xt_limit: Overflow, try lower: 271964/0 [ 728.530344][T32265] wg1 speed is unknown, defaulting to 1000 [ 728.565685][T32265] ªªªªª9 speed is unknown, defaulting to 1000 [ 728.595861][T32274] netlink: 'syz.2.7497': attribute type 15 has an invalid length. [ 728.610510][T32274] bond0: option resend_igmp: invalid value (196616) [ 728.618012][T32274] bond0: option resend_igmp: allowed values 0 - 255 [ 728.745955][ T49] bond0: (slave bond_slave_0): link status definitely down, disabling slave [ 728.761429][ T49] bond0: (slave bond_slave_1): link status definitely down, disabling slave [ 728.774341][ T49] bond0: now running without any active interface! [ 728.792675][T32278] wg1 speed is unknown, defaulting to 1000 [ 728.826322][T32285] netlink: 'syz.1.7501': attribute type 1 has an invalid length. [ 728.831750][T32287] netlink: 'syz.1.7501': attribute type 1 has an invalid length. [ 728.834506][T32285] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 728.851473][T32287] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 728.948358][T32278] ªªªªª9 speed is unknown, defaulting to 1000 [ 728.970990][T32294] netlink: 'syz.1.7503': attribute type 12 has an invalid length. [ 728.982542][T32282] wg1 speed is unknown, defaulting to 1000 [ 729.086580][T32282] ªªªªª9 speed is unknown, defaulting to 1000 [ 729.509150][T32305] sit2: entered promiscuous mode [ 729.516827][T32303] wg1 speed is unknown, defaulting to 1000 [ 729.587582][T32303] ªªªªª9 speed is unknown, defaulting to 1000 [ 729.629206][T32313] netlink: 'syz.4.7511': attribute type 5 has an invalid length. [ 729.893286][T32324] syzkaller1: tun_chr_ioctl cmd 21731 [ 731.045318][T32388] wg1 speed is unknown, defaulting to 1000 [ 731.086265][T32388] ªªªªª9 speed is unknown, defaulting to 1000 [ 731.125414][T32389] __nla_validate_parse: 10 callbacks suppressed [ 731.125433][T32389] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7534'. [ 731.421660][T32400] netlink: 12 bytes leftover after parsing attributes in process `syz.0.7537'. [ 731.594643][T32412] netlink: 'syz.0.7541': attribute type 10 has an invalid length. [ 731.605394][T32412] openvswitch: netlink: IP tunnel dst address not specified [ 732.028418][T32425] netlink: 24 bytes leftover after parsing attributes in process `syz.3.7544'. [ 732.091598][T32429] netlink: 24 bytes leftover after parsing attributes in process `syz.3.7544'. [ 732.158153][T32425] pim6reg: entered allmulticast mode [ 732.340705][T32436] netlink: 44 bytes leftover after parsing attributes in process `syz.3.7548'. [ 732.560681][T32465] netlink: 'syz.2.7557': attribute type 3 has an invalid length. [ 732.610311][T32454] bond5: option ad_actor_sys_prio: mode dependency failed, not supported in mode balance-rr(0) [ 732.687563][T32454] bond5 (unregistering): Released all slaves [ 732.894456][T32463] syzkaller0: entered promiscuous mode [ 732.900131][T32463] syzkaller0: entered allmulticast mode [ 734.679529][T32486] syzkaller0: entered promiscuous mode [ 734.685142][T32486] syzkaller0: entered allmulticast mode [ 734.759643][T32492] bond0: (slave rose0): Releasing backup interface [ 735.073439][T32529] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7575'. [ 735.237944][T32535] netlink: 228 bytes leftover after parsing attributes in process `syz.2.7577'. [ 735.249164][T32535] netlink: 228 bytes leftover after parsing attributes in process `syz.2.7577'. [ 735.288425][T32535] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7577'. [ 735.290966][T32545] netlink: 16 bytes leftover after parsing attributes in process `syz.4.7581'. [ 735.325039][T32535] netlink: 'syz.2.7577': attribute type 22 has an invalid length. [ 735.420159][T32549] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 735.700671][T32570] netlink: 'syz.0.7589': attribute type 6 has an invalid length. [ 735.716245][T32570] netlink: 'syz.0.7589': attribute type 1 has an invalid length. [ 735.724743][T32571] netlink: 'syz.0.7589': attribute type 1 has an invalid length. [ 735.764935][T32568] netlink: 'syz.1.7588': attribute type 18 has an invalid length. [ 736.160732][T32599] bond6: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 736.175347][T32602] __nla_validate_parse: 5 callbacks suppressed [ 736.175365][T32602] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7596'. [ 736.191690][T32602] netlink: 12 bytes leftover after parsing attributes in process `syz.0.7596'. [ 736.244651][T32599] bond6 (unregistering): Released all slaves [ 736.299653][T32611] netlink: 24 bytes leftover after parsing attributes in process `syz.1.7597'. [ 736.309020][T32611] nbd: illegal input index 38656 [ 736.368789][T32610] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 736.441112][T32608] netlink: 24 bytes leftover after parsing attributes in process `syz.3.7600'. [ 736.507184][T32604] netlink: 44 bytes leftover after parsing attributes in process `syz.2.7599'. [ 736.518033][T32604] netlink: 252 bytes leftover after parsing attributes in process `syz.2.7599'. [ 736.527854][T32604] openvswitch: netlink: Flow key attr not present in new flow. [ 736.681699][T32624] netem: change failed [ 736.718650][T32624] netem: change failed [ 736.799713][T32634] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7607'. [ 736.847922][T32634] netlink: 12 bytes leftover after parsing attributes in process `syz.2.7607'. [ 737.087045][T32651] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7613'. [ 737.106586][T32651] netlink: 12 bytes leftover after parsing attributes in process `syz.0.7613'. [ 737.446239][T32679] macvlan0: entered promiscuous mode [ 737.454423][T32677] macvlan0: left promiscuous mode [ 737.564184][T32675] netlink: 'syz.0.7618': attribute type 2 has an invalid length. [ 737.582648][T32675] !©9: entered promiscuous mode [ 737.806770][T32699] 8021q: adding VLAN 0 to HW filter on device bond6 [ 737.815689][T32699] bond0: (slave bond6): Enslaving as an active interface with an up link [ 737.925333][T32699] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 737.947466][T32699] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 738.014753][T32699] bond0 (unregistering): (slave bond6): Releasing backup interface [ 738.084951][T32699] bond0 (unregistering): Released all slaves [ 738.369021][T32726] netlink: 'syz.1.7632': attribute type 21 has an invalid length. [ 738.530161][T32735] syzkaller0: entered promiscuous mode [ 738.535961][T32735] syzkaller0: entered allmulticast mode [ 738.859846][T32762] wg1 speed is unknown, defaulting to 1000 [ 738.888404][T32762] ªªªªª9 speed is unknown, defaulting to 1000 [ 739.490324][ T326] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 739.601791][ T328] IPv6: NLM_F_CREATE should be specified when creating new route [ 739.615968][ T328] netlink: 'syz.4.7656': attribute type 1 has an invalid length. [ 740.280183][ T377] syzkaller0: entered promiscuous mode [ 740.290589][ T377] syzkaller0: entered allmulticast mode [ 740.768289][ T413] openvswitch: netlink: Flow actions attr not present in new flow. [ 740.823958][ T417] geneve3: entered promiscuous mode [ 740.829285][ T417] geneve3: entered allmulticast mode [ 740.866225][ T415] ip6gretap2: entered promiscuous mode [ 740.871724][ T415] ip6gretap2: entered allmulticast mode [ 741.016563][ T428] netlink: 'syz.0.7687': attribute type 1 has an invalid length. [ 741.054533][ T428] workqueue: Failed to create a rescuer kthread for wq "bond0": -EINTR [ 741.173187][ T439] x_tables: duplicate underflow at hook 1 [ 741.214210][ T444] __nla_validate_parse: 17 callbacks suppressed [ 741.214229][ T444] netlink: 4 bytes leftover after parsing attributes in process `syz.1.7691'. [ 741.241828][ T434] syzkaller0: entered promiscuous mode [ 741.248956][ T446] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7695'. [ 741.270029][ T434] syzkaller0: entered allmulticast mode [ 741.301371][ T446] netlink: 12 bytes leftover after parsing attributes in process `syz.4.7695'. [ 741.361095][ T456] netlink: 104 bytes leftover after parsing attributes in process `syz.3.7698'. [ 741.401133][ T459] netlink: 'syz.0.7699': attribute type 1 has an invalid length. [ 741.409469][ T459] netlink: 224 bytes leftover after parsing attributes in process `syz.0.7699'. [ 741.420346][ T459] NCSI netlink: No device for ifindex 0 [ 742.902023][ T489] netlink: 144 bytes leftover after parsing attributes in process `syz.3.7705'. [ 742.924699][ T489] netlink: 28 bytes leftover after parsing attributes in process `syz.3.7705'. [ 743.095903][ T493] netlink: 'syz.3.7705': attribute type 1 has an invalid length. [ 743.412997][ T496] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7706'. [ 743.459663][ T502] netlink: 40 bytes leftover after parsing attributes in process `syz.2.7707'. [ 743.495429][ T502] netlink: 40 bytes leftover after parsing attributes in process `syz.2.7707'. [ 743.981663][ T542] xt_hashlimit: size too large, truncated to 1048576 [ 743.991294][ T543] bridge_slave_0 (unregistering): left allmulticast mode [ 744.004881][ T543] bridge_slave_0 (unregistering): left promiscuous mode [ 744.012035][ T543] bridge0: port 1(bridge_slave_0) entered disabled state [ 744.395883][ T568] tipc: Enabling of bearer rejected, failed to enable media [ 744.420420][ T569] batman_adv: batadv0: Adding interface: vlan2 [ 744.430691][ T569] batman_adv: batadv0: The MTU of interface vlan2 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 744.456963][ T569] batman_adv: batadv0: Not using interface vlan2 (retrying later): interface not active [ 744.672833][ T590] syzkaller0: entered promiscuous mode [ 744.678789][ T590] syzkaller0: entered allmulticast mode [ 745.026810][ T608] set match dimension is over the limit! [ 745.070137][ T614] netlink: 'syz.3.7746': attribute type 1 has an invalid length. [ 745.101253][ T614] bond5: entered promiscuous mode [ 745.107550][ T614] 8021q: adding VLAN 0 to HW filter on device bond5 [ 745.142073][ T614] bond5: (slave bridge8): making interface the new active one [ 745.150204][ T614] bridge8: entered promiscuous mode [ 745.157985][ T614] bridge8: left promiscuous mode [ 745.391752][ T626] 8021q: adding VLAN 0 to HW filter on device bond4 [ 745.399254][ T627] syzkaller0: entered promiscuous mode [ 745.406622][ T627] syzkaller0: entered allmulticast mode [ 745.413129][ T625] tipc: Enabled bearer , priority 0 [ 745.559198][ T641] erspan0: entered promiscuous mode [ 745.693474][ T651] ip6_vti0: MTU too low for tipc bearer [ 745.700965][ T651] tipc: Enabling of bearer rejected, failed to enable media [ 745.865356][ T662] æÿîÿ: entered promiscuous mode [ 746.965926][ T711] __nla_validate_parse: 12 callbacks suppressed [ 746.965945][ T711] netlink: 40 bytes leftover after parsing attributes in process `syz.1.7771'. [ 747.023931][ T715] netlink: 36 bytes leftover after parsing attributes in process `syz.2.7770'. [ 747.091751][ T718] netlink: 40 bytes leftover after parsing attributes in process `syz.0.7773'. [ 747.104610][ T718] netlink: 40 bytes leftover after parsing attributes in process `syz.0.7773'. [ 747.279250][ T728] netlink: 28 bytes leftover after parsing attributes in process `syz.0.7777'. [ 747.288638][ T728] netlink: 28 bytes leftover after parsing attributes in process `syz.0.7777'. [ 747.309935][ T1301] clip:clip_start_xmit: skb_dst(skb) == NULL [ 747.315725][ T728] netlink: 20 bytes leftover after parsing attributes in process `syz.0.7777'. [ 747.326809][ T728] netlink: 24 bytes leftover after parsing attributes in process `syz.0.7777'. [ 747.770444][ T745] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7783'. [ 747.817179][ T745] netlink: 12 bytes leftover after parsing attributes in process `syz.4.7783'. [ 747.907413][ T752] pimreg: entered allmulticast mode [ 748.136438][ T758] wg1 speed is unknown, defaulting to 1000 [ 748.146524][ T758] ªªªªª9 speed is unknown, defaulting to 1000 [ 748.491117][ T795] tipc: Enabled bearer , priority 0 [ 748.525032][ T794] tipc: Disabling bearer [ 748.625421][ T805] bridge_slave_1: default FDB implementation only supports local addresses [ 748.700189][ T806] wg1 speed is unknown, defaulting to 1000 [ 748.708488][ T806] ªªªªª9 speed is unknown, defaulting to 1000 [ 749.026215][ T824] geneve2: entered promiscuous mode [ 749.032638][ T824] geneve2: entered allmulticast mode [ 749.391506][ T839] wg1 speed is unknown, defaulting to 1000 [ 749.411731][ T839] ªªªªª9 speed is unknown, defaulting to 1000 [ 749.413473][ T849] wg1: entered promiscuous mode [ 749.426739][ T849] wg1: entered allmulticast mode [ 749.668576][ T865] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 749.678712][ T858] wg1 speed is unknown, defaulting to 1000 [ 749.745187][ T858] ªªªªª9 speed is unknown, defaulting to 1000 [ 750.353881][ T904] netlink: 'syz.1.7833': attribute type 3 has an invalid length. [ 750.527809][ T916] IPVS: length: 47 != 24 [ 751.095262][ T958] wg1 speed is unknown, defaulting to 1000 [ 751.106946][ T958] ªªªªª9 speed is unknown, defaulting to 1000 [ 751.677729][ T989] geneve2: entered promiscuous mode [ 751.682981][ T989] geneve2: entered allmulticast mode [ 751.712957][ T996] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 751.787501][ T992] Cannot find add_set index 2 as target [ 752.092794][ T1025] x_tables: duplicate underflow at hook 1 [ 752.221167][ T1022] tipc: Started in network mode [ 752.249910][ T1022] tipc: Node identity ea0fc6c9e64d, cluster identity 4711 [ 752.257667][ T1022] tipc: Enabled bearer , priority 0 [ 752.267239][ T1026] syzkaller0: entered promiscuous mode [ 752.275451][ T1026] syzkaller0: entered allmulticast mode [ 752.407589][ T1043] netdevsim netdevsim2 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 752.444079][ T1022] __nla_validate_parse: 25 callbacks suppressed [ 752.444099][ T1022] netlink: 4 bytes leftover after parsing attributes in process `syz.1.7862'. [ 752.466355][ T1052] syzkaller0: entered promiscuous mode [ 752.471858][ T1052] syzkaller0: entered allmulticast mode [ 752.497776][ T1043] netdevsim netdevsim2 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 752.520995][ T1022] tipc: Resetting bearer [ 752.563433][ T1018] tipc: Resetting bearer [ 752.579689][ T1018] tipc: Disabling bearer [ 752.619891][ T1043] netdevsim netdevsim2 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 752.651614][ T1057] wg1 speed is unknown, defaulting to 1000 [ 752.662703][ T1061] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 752.671834][ T1057] ªªªªª9 speed is unknown, defaulting to 1000 [ 752.680553][ T1061] netlink: 48 bytes leftover after parsing attributes in process `syz.0.7872'. [ 752.748325][ T1043] netdevsim netdevsim2 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 752.877073][ T13] netdevsim netdevsim2 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 752.909913][ T13] netdevsim netdevsim2 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 752.942550][ T13] netdevsim netdevsim2 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 752.970161][ T1083] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7877'. [ 752.987344][ T13] netdevsim netdevsim2 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 753.007973][ T1083] netlink: 12 bytes leftover after parsing attributes in process `syz.4.7877'. [ 753.178093][ T1098] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7880'. [ 753.180039][ T1093] syzkaller0: entered promiscuous mode [ 753.208799][ T1093] syzkaller0: entered allmulticast mode [ 754.123799][ T1137] netlink: 28 bytes leftover after parsing attributes in process `syz.3.7891'. [ 754.133083][ T1137] netlink: 28 bytes leftover after parsing attributes in process `syz.3.7891'. [ 755.173515][ T1130] netlink: 44 bytes leftover after parsing attributes in process `syz.1.7890'. [ 755.183820][ T1130] macvlan1: Caught tx_queue_len zero misconfig [ 755.384355][ T1141] erspan1: entered promiscuous mode [ 755.391550][ T1141] erspan1: entered allmulticast mode [ 755.406326][ T1132] wg1 speed is unknown, defaulting to 1000 [ 755.429275][ T1150] netlink: 52 bytes leftover after parsing attributes in process `syz.3.7895'. [ 755.485940][ T1132] ªªªªª9 speed is unknown, defaulting to 1000 [ 755.486770][ T1148] netlink: 240 bytes leftover after parsing attributes in process `syz.3.7895'. [ 755.547677][ T1156] netlink: 'syz.0.7898': attribute type 1 has an invalid length. [ 755.665936][ T1156] 8021q: adding VLAN 0 to HW filter on device bond0 [ 755.685857][ T1160] bond0: entered allmulticast mode [ 755.719374][ T1169] openvswitch: netlink: IP tunnel attribute has 4 unknown bytes. [ 755.728948][ T1165] bond0: (slave ip6gretap2): making interface the new active one [ 755.736962][ T1165] ip6gretap2: entered allmulticast mode [ 755.743996][ T1165] bond0: (slave ip6gretap2): Enslaving as an active interface with an up link [ 756.018162][ T1192] 8021q: adding VLAN 0 to HW filter on device ipvlan4 [ 756.032628][ T1192] bond0: (slave ipvlan4): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 756.682846][ T1220] openvswitch: netlink: Flow key attr not present in new flow. [ 757.165558][ T1252] netlink: 'syz.1.7924': attribute type 1 has an invalid length. [ 757.474479][ T1277] FAULT_INJECTION: forcing a failure. [ 757.474479][ T1277] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 757.511390][ T1277] CPU: 0 UID: 0 PID: 1277 Comm: syz.2.7929 Not tainted syzkaller #0 PREEMPT(full) [ 757.511417][ T1277] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 757.511428][ T1277] Call Trace: [ 757.511436][ T1277] [ 757.511443][ T1277] dump_stack_lvl+0xe8/0x150 [ 757.511474][ T1277] should_fail_ex+0x412/0x560 [ 757.511500][ T1277] _copy_from_user+0x2d/0xb0 [ 757.511525][ T1277] ___sys_sendmsg+0x1c6/0x360 [ 757.511554][ T1277] ? __pfx____sys_sendmsg+0x10/0x10 [ 757.511584][ T1277] ? kstrtouint+0x6e/0xe0 [ 757.511628][ T1277] ? __fget_files+0x2a/0x420 [ 757.511651][ T1277] ? __fget_files+0x3a0/0x420 [ 757.511684][ T1277] __sys_sendmmsg+0x27c/0x4e0 [ 757.511713][ T1277] ? __pfx___sys_sendmmsg+0x10/0x10 [ 757.511735][ T1277] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 757.511783][ T1277] ? ksys_write+0x242/0x270 [ 757.511804][ T1277] ? __pfx_ksys_write+0x10/0x10 [ 757.511829][ T1277] __x64_sys_sendmmsg+0xa0/0xc0 [ 757.511856][ T1277] do_syscall_64+0x14d/0xf80 [ 757.511885][ T1277] ? trace_irq_disable+0x3b/0x150 [ 757.511909][ T1277] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 757.511927][ T1277] ? clear_bhb_loop+0x40/0x90 [ 757.511950][ T1277] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 757.511967][ T1277] RIP: 0033:0x7fb68eb9c799 [ 757.511985][ T1277] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 757.512000][ T1277] RSP: 002b:00007fb68fa78028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 757.512020][ T1277] RAX: ffffffffffffffda RBX: 00007fb68ee15fa0 RCX: 00007fb68eb9c799 [ 757.512033][ T1277] RDX: 040000000000009f RSI: 00002000000002c0 RDI: 000000000000000c [ 757.512044][ T1277] RBP: 00007fb68fa78090 R08: 0000000000000000 R09: 0000000000000000 [ 757.512056][ T1277] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 757.512068][ T1277] R13: 00007fb68ee16038 R14: 00007fb68ee15fa0 R15: 00007ffed3127958 [ 757.512098][ T1277] [ 757.758470][ T1288] netlink: 'syz.1.7933': attribute type 22 has an invalid length. [ 757.780677][ T1289] xt_TCPMSS: Only works on TCP SYN packets [ 757.791740][ T1288] __nla_validate_parse: 12 callbacks suppressed [ 757.791760][ T1288] netlink: 4 bytes leftover after parsing attributes in process `syz.1.7933'. [ 757.871760][ T13] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 757.889960][ T13] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 757.907076][ T13] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 757.926390][ T13] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 758.244974][ T1333] A link change request failed with some changes committed already. Interface ip_vti0 may have been left with an inconsistent configuration, please check. [ 758.282125][ T1337] netlink: 156 bytes leftover after parsing attributes in process `syz.2.7942'. [ 758.293215][ T1329] syzkaller0: mtu less than device minimum [ 758.300453][ T1337] netlink: 20 bytes leftover after parsing attributes in process `syz.2.7942'. [ 758.406824][ T1341] syzkaller0: entered promiscuous mode [ 758.412342][ T1341] syzkaller0: entered allmulticast mode [ 758.492435][ T1349] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7946'. [ 758.561702][ T1352] netlink: 12 bytes leftover after parsing attributes in process `syz.0.7946'. [ 758.575392][ T1354] FAULT_INJECTION: forcing a failure. [ 758.575392][ T1354] name failslab, interval 1, probability 0, space 0, times 0 [ 758.603712][ T1354] CPU: 1 UID: 0 PID: 1354 Comm: syz.1.7944 Not tainted syzkaller #0 PREEMPT(full) [ 758.603738][ T1354] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 758.603750][ T1354] Call Trace: [ 758.603758][ T1354] [ 758.603766][ T1354] dump_stack_lvl+0xe8/0x150 [ 758.603795][ T1354] should_fail_ex+0x412/0x560 [ 758.603820][ T1354] should_failslab+0xa8/0x100 [ 758.603844][ T1354] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 758.603876][ T1354] ? __alloc_skb+0x186/0x7d0 [ 758.603897][ T1354] ? __alloc_skb+0x1d0/0x7d0 [ 758.603916][ T1354] ? __local_bh_enable_ip+0xd0/0x130 [ 758.603943][ T1354] __alloc_skb+0x1d0/0x7d0 [ 758.603970][ T1354] netlink_sendmsg+0x5d4/0xb40 [ 758.604000][ T1354] ? __pfx_netlink_sendmsg+0x10/0x10 [ 758.604024][ T1354] ? aa_sock_msg_perm+0xf1/0x1b0 [ 758.604047][ T1354] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 758.604068][ T1354] ? __pfx_netlink_sendmsg+0x10/0x10 [ 758.604086][ T1354] ____sys_sendmsg+0xa68/0xad0 [ 758.604115][ T1354] ? __lock_acquire+0x6b5/0x2cf0 [ 758.604144][ T1354] ? __pfx_____sys_sendmsg+0x10/0x10 [ 758.604180][ T1354] ? import_iovec+0x73/0xa0 [ 758.604206][ T1354] ___sys_sendmsg+0x2a5/0x360 [ 758.604236][ T1354] ? __pfx____sys_sendmsg+0x10/0x10 [ 758.604265][ T1354] ? kstrtouint+0x6e/0xe0 [ 758.604310][ T1354] ? __fget_files+0x2a/0x420 [ 758.604332][ T1354] ? __fget_files+0x3a0/0x420 [ 758.604364][ T1354] __sys_sendmmsg+0x27c/0x4e0 [ 758.604394][ T1354] ? __pfx___sys_sendmmsg+0x10/0x10 [ 758.604416][ T1354] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 758.604464][ T1354] ? ksys_write+0x242/0x270 [ 758.604485][ T1354] ? __pfx_ksys_write+0x10/0x10 [ 758.604508][ T1354] __x64_sys_sendmmsg+0xa0/0xc0 [ 758.604535][ T1354] do_syscall_64+0x14d/0xf80 [ 758.604556][ T1354] ? trace_irq_disable+0x3b/0x150 [ 758.604579][ T1354] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 758.604597][ T1354] ? clear_bhb_loop+0x40/0x90 [ 758.604618][ T1354] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 758.604636][ T1354] RIP: 0033:0x7fad7759c799 [ 758.604653][ T1354] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 758.604668][ T1354] RSP: 002b:00007fad78489028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 758.604688][ T1354] RAX: ffffffffffffffda RBX: 00007fad77816180 RCX: 00007fad7759c799 [ 758.604701][ T1354] RDX: 040000000000009f RSI: 00002000000002c0 RDI: 000000000000000c [ 758.604713][ T1354] RBP: 00007fad78489090 R08: 0000000000000000 R09: 0000000000000000 [ 758.604724][ T1354] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 758.604735][ T1354] R13: 00007fad77816218 R14: 00007fad77816180 R15: 00007fffe46c4c48 [ 758.604764][ T1354] [ 759.095134][ T1367] netlink: 40 bytes leftover after parsing attributes in process `syz.0.7950'. [ 759.115787][ T1367] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7950'. [ 759.141540][ T1371] IPVS: set_ctl: invalid protocol: 51 172.30.1.5:20002 [ 759.182555][ T1367] 8021q: adding VLAN 0 to HW filter on device ipvlan3 [ 759.196334][ T1374] netlink: 'syz.3.7952': attribute type 10 has an invalid length. [ 759.196624][ T1376] netlink: 'syz.4.7953': attribute type 1 has an invalid length. [ 759.219245][ T1367] team0: Device ipvlan3 is already an upper device of the team interface [ 759.292894][ T1376] vlan3: entered promiscuous mode [ 759.299172][ T1376] vlan3: entered allmulticast mode [ 759.304791][ T1376] gretap0: entered allmulticast mode [ 759.490839][ T1394] netlink: 12 bytes leftover after parsing attributes in process `syz.2.7958'. [ 759.511454][ T1394] netlink: 12 bytes leftover after parsing attributes in process `syz.2.7958'. [ 759.555021][ T1397] netlink: 16 bytes leftover after parsing attributes in process `syz.3.7959'. [ 759.916270][ T1414] netlink: 'syz.3.7962': attribute type 2 has an invalid length. [ 759.965879][ T1414] !©9: entered promiscuous mode [ 759.977937][ T1416] netlink: 'syz.3.7962': attribute type 2 has an invalid length. [ 759.990734][ T1416] !©9: left promiscuous mode [ 760.320650][ T1423] syz_tun: entered allmulticast mode [ 760.447186][ T1423] syz_tun (unregistering): left allmulticast mode [ 760.463504][ T1431] netlink: 'syz.3.7967': attribute type 5 has an invalid length. [ 760.535301][ T1436] netlink: 'syz.3.7967': attribute type 5 has an invalid length. [ 760.551898][ T1439] netlink: 'syz.1.7970': attribute type 3 has an invalid length. [ 760.696589][ T1450] bond0: (slave bond_slave_1): Releasing backup interface [ 760.719978][ T1450] bond_slave_1: left promiscuous mode [ 760.750920][ T1451] FAULT_INJECTION: forcing a failure. [ 760.750920][ T1451] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 760.774910][ T1451] CPU: 1 UID: 0 PID: 1451 Comm: syz.1.7971 Not tainted syzkaller #0 PREEMPT(full) [ 760.774941][ T1451] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 760.774952][ T1451] Call Trace: [ 760.774960][ T1451] [ 760.774968][ T1451] dump_stack_lvl+0xe8/0x150 [ 760.774997][ T1451] should_fail_ex+0x412/0x560 [ 760.775023][ T1451] _copy_from_iter+0x1d3/0x1670 [ 760.775048][ T1451] ? rcu_is_watching+0x15/0xb0 [ 760.775077][ T1451] ? __pfx__copy_from_iter+0x10/0x10 [ 760.775106][ T1451] ? netlink_sendmsg+0x650/0xb40 [ 760.775125][ T1451] ? skb_put+0x11b/0x210 [ 760.775151][ T1451] netlink_sendmsg+0x6c0/0xb40 [ 760.775180][ T1451] ? __pfx_netlink_sendmsg+0x10/0x10 [ 760.775202][ T1451] ? aa_sock_msg_perm+0xf1/0x1b0 [ 760.775223][ T1451] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 760.775244][ T1451] ? __pfx_netlink_sendmsg+0x10/0x10 [ 760.775263][ T1451] ____sys_sendmsg+0xa68/0xad0 [ 760.775285][ T1451] ? __lock_acquire+0x6b5/0x2cf0 [ 760.775315][ T1451] ? __pfx_____sys_sendmsg+0x10/0x10 [ 760.775348][ T1451] ? import_iovec+0x73/0xa0 [ 760.775374][ T1451] ___sys_sendmsg+0x2a5/0x360 [ 760.775403][ T1451] ? __pfx____sys_sendmsg+0x10/0x10 [ 760.775432][ T1451] ? kstrtouint+0x6e/0xe0 [ 760.775475][ T1451] ? __fget_files+0x2a/0x420 [ 760.775496][ T1451] ? __fget_files+0x3a0/0x420 [ 760.775529][ T1451] __sys_sendmmsg+0x27c/0x4e0 [ 760.775558][ T1451] ? __pfx___sys_sendmmsg+0x10/0x10 [ 760.775579][ T1451] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 760.775628][ T1451] ? ksys_write+0x242/0x270 [ 760.775647][ T1451] ? __pfx_ksys_write+0x10/0x10 [ 760.775672][ T1451] __x64_sys_sendmmsg+0xa0/0xc0 [ 760.775697][ T1451] do_syscall_64+0x14d/0xf80 [ 760.775718][ T1451] ? trace_irq_disable+0x3b/0x150 [ 760.775741][ T1451] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 760.775758][ T1451] ? clear_bhb_loop+0x40/0x90 [ 760.775779][ T1451] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 760.775797][ T1451] RIP: 0033:0x7fad7759c799 [ 760.775814][ T1451] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 760.775828][ T1451] RSP: 002b:00007fad784aa028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 760.775847][ T1451] RAX: ffffffffffffffda RBX: 00007fad77816090 RCX: 00007fad7759c799 [ 760.775862][ T1451] RDX: 040000000000009f RSI: 00002000000002c0 RDI: 000000000000000c [ 760.775874][ T1451] RBP: 00007fad784aa090 R08: 0000000000000000 R09: 0000000000000000 [ 760.775885][ T1451] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 760.775899][ T1451] R13: 00007fad77816128 R14: 00007fad77816090 R15: 00007fffe46c4c48 [ 760.775929][ T1451] [ 761.596342][ T1474] veth9: entered promiscuous mode [ 761.629658][ T1496] FAULT_INJECTION: forcing a failure. [ 761.629658][ T1496] name failslab, interval 1, probability 0, space 0, times 0 [ 761.673968][ T1496] CPU: 1 UID: 0 PID: 1496 Comm: syz.0.7987 Not tainted syzkaller #0 PREEMPT(full) [ 761.673994][ T1496] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 761.674005][ T1496] Call Trace: [ 761.674013][ T1496] [ 761.674022][ T1496] dump_stack_lvl+0xe8/0x150 [ 761.674052][ T1496] should_fail_ex+0x412/0x560 [ 761.674078][ T1496] should_failslab+0xa8/0x100 [ 761.674098][ T1496] ? skb_clone+0x212/0x3a0 [ 761.674123][ T1496] kmem_cache_alloc_noprof+0x87/0x650 [ 761.674148][ T1496] ? __netlink_lookup+0xc6/0x8b0 [ 761.674176][ T1496] skb_clone+0x212/0x3a0 [ 761.674203][ T1496] __netlink_deliver_tap+0x404/0x850 [ 761.674236][ T1496] ? netlink_deliver_tap+0x2e/0x1b0 [ 761.674258][ T1496] netlink_deliver_tap+0x19c/0x1b0 [ 761.674280][ T1496] netlink_unicast+0x7e3/0x9b0 [ 761.674306][ T1496] ? __pfx_netlink_unicast+0x10/0x10 [ 761.674325][ T1496] ? netlink_sendmsg+0x650/0xb40 [ 761.674342][ T1496] ? skb_put+0x11b/0x210 [ 761.674367][ T1496] netlink_sendmsg+0x813/0xb40 [ 761.674395][ T1496] ? __pfx_netlink_sendmsg+0x10/0x10 [ 761.674416][ T1496] ? aa_sock_msg_perm+0xf1/0x1b0 [ 761.674438][ T1496] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 761.674458][ T1496] ? __pfx_netlink_sendmsg+0x10/0x10 [ 761.674475][ T1496] ____sys_sendmsg+0xa68/0xad0 [ 761.674498][ T1496] ? __lock_acquire+0x6b5/0x2cf0 [ 761.674525][ T1496] ? __pfx_____sys_sendmsg+0x10/0x10 [ 761.674558][ T1496] ? import_iovec+0x73/0xa0 [ 761.674584][ T1496] ___sys_sendmsg+0x2a5/0x360 [ 761.674612][ T1496] ? __pfx____sys_sendmsg+0x10/0x10 [ 761.674640][ T1496] ? kstrtouint+0x6e/0xe0 [ 761.674682][ T1496] ? __fget_files+0x2a/0x420 [ 761.674704][ T1496] ? __fget_files+0x3a0/0x420 [ 761.674737][ T1496] __sys_sendmmsg+0x27c/0x4e0 [ 761.674767][ T1496] ? __pfx___sys_sendmmsg+0x10/0x10 [ 761.674788][ T1496] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 761.674835][ T1496] ? ksys_write+0x242/0x270 [ 761.674863][ T1496] ? __pfx_ksys_write+0x10/0x10 [ 761.674887][ T1496] __x64_sys_sendmmsg+0xa0/0xc0 [ 761.674913][ T1496] do_syscall_64+0x14d/0xf80 [ 761.674934][ T1496] ? trace_irq_disable+0x3b/0x150 [ 761.674959][ T1496] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 761.674977][ T1496] ? clear_bhb_loop+0x40/0x90 [ 761.674999][ T1496] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 761.675017][ T1496] RIP: 0033:0x7fbe82d9c799 [ 761.675034][ T1496] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 761.675047][ T1496] RSP: 002b:00007fbe83c43028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 761.675066][ T1496] RAX: ffffffffffffffda RBX: 00007fbe83016090 RCX: 00007fbe82d9c799 [ 761.675079][ T1496] RDX: 040000000000009f RSI: 00002000000002c0 RDI: 000000000000000c [ 761.675091][ T1496] RBP: 00007fbe83c43090 R08: 0000000000000000 R09: 0000000000000000 [ 761.675102][ T1496] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 761.675112][ T1496] R13: 00007fbe83016128 R14: 00007fbe83016090 R15: 00007ffe48112cc8 [ 761.675137][ T1496] [ 762.097854][ T1509] netlink: 'syz.1.7990': attribute type 1 has an invalid length. [ 762.142719][ T1512] syzkaller0: entered promiscuous mode [ 762.158889][ T1512] syzkaller0: entered allmulticast mode [ 762.277116][ T1519] IPv6: sit2: Disabled Multicast RS [ 762.283391][ T1519] sit2: entered allmulticast mode [ 762.290855][ T1515] netlink: 'syz.3.7994': attribute type 4 has an invalid length. [ 762.315481][ T1515] netlink: 'syz.3.7994': attribute type 4 has an invalid length. [ 762.554682][ T1519] bridge0: port 2(bridge_slave_1) entered disabled state [ 762.562040][ T1519] bridge0: port 1(bridge_slave_0) entered disabled state [ 765.771389][ T1519] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 765.799001][ T1519] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 766.265709][ T1526] __nla_validate_parse: 20 callbacks suppressed [ 766.265730][ T1526] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7995'. [ 766.298065][ T1526] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7995'. [ 766.311151][ T1553] FAULT_INJECTION: forcing a failure. [ 766.311151][ T1553] name failslab, interval 1, probability 0, space 0, times 0 [ 766.312565][ T6593] netdevsim netdevsim3 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 766.325006][ T1553] CPU: 1 UID: 0 PID: 1553 Comm: syz.2.8001 Not tainted syzkaller #0 PREEMPT(full) [ 766.325028][ T1553] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 766.325039][ T1553] Call Trace: [ 766.325046][ T1553] [ 766.325054][ T1553] dump_stack_lvl+0xe8/0x150 [ 766.325082][ T1553] should_fail_ex+0x412/0x560 [ 766.325107][ T1553] should_failslab+0xa8/0x100 [ 766.325129][ T1553] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 766.325154][ T1553] ? __alloc_skb+0x186/0x7d0 [ 766.325174][ T1553] ? __alloc_skb+0x1d0/0x7d0 [ 766.325192][ T1553] ? __local_bh_enable_ip+0xd0/0x130 [ 766.325219][ T1553] __alloc_skb+0x1d0/0x7d0 [ 766.325238][ T1553] ? netlink_ack_tlv_len+0x6c/0x210 [ 766.325260][ T1553] netlink_ack+0x146/0xa50 [ 766.325276][ T1553] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 766.325295][ T1553] ? ref_tracker_free+0x693/0x840 [ 766.325314][ T1553] ? __copy_skb_header+0xa3/0x4a0 [ 766.325337][ T1553] ? __pfx_ref_tracker_free+0x10/0x10 [ 766.325367][ T1553] netlink_rcv_skb+0x2b6/0x4b0 [ 766.325387][ T1553] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 766.325409][ T1553] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 766.325438][ T1553] ? netlink_deliver_tap+0x2e/0x1b0 [ 766.325465][ T1553] netlink_unicast+0x80f/0x9b0 [ 766.325491][ T1553] ? __pfx_netlink_unicast+0x10/0x10 [ 766.325511][ T1553] ? netlink_sendmsg+0x650/0xb40 [ 766.325528][ T1553] ? skb_put+0x11b/0x210 [ 766.325553][ T1553] netlink_sendmsg+0x813/0xb40 [ 766.325581][ T1553] ? __pfx_netlink_sendmsg+0x10/0x10 [ 766.325610][ T1553] ? aa_sock_msg_perm+0xf1/0x1b0 [ 766.325632][ T1553] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 766.325652][ T1553] ? __pfx_netlink_sendmsg+0x10/0x10 [ 766.325671][ T1553] ____sys_sendmsg+0xa68/0xad0 [ 766.325692][ T1553] ? __lock_acquire+0x6b5/0x2cf0 [ 766.325722][ T1553] ? __pfx_____sys_sendmsg+0x10/0x10 [ 766.325752][ T1553] ? import_iovec+0x73/0xa0 [ 766.325778][ T1553] ___sys_sendmsg+0x2a5/0x360 [ 766.325807][ T1553] ? __pfx____sys_sendmsg+0x10/0x10 [ 766.325834][ T1553] ? kstrtouint+0x6e/0xe0 [ 766.325877][ T1553] ? __fget_files+0x2a/0x420 [ 766.325898][ T1553] ? __fget_files+0x3a0/0x420 [ 766.325935][ T1553] __sys_sendmmsg+0x27c/0x4e0 [ 766.325963][ T1553] ? __pfx___sys_sendmmsg+0x10/0x10 [ 766.325984][ T1553] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 766.326037][ T1553] ? ksys_write+0x242/0x270 [ 766.326057][ T1553] ? __pfx_ksys_write+0x10/0x10 [ 766.326080][ T1553] __x64_sys_sendmmsg+0xa0/0xc0 [ 766.326105][ T1553] do_syscall_64+0x14d/0xf80 [ 766.326125][ T1553] ? trace_irq_disable+0x3b/0x150 [ 766.326148][ T1553] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 766.326165][ T1553] ? clear_bhb_loop+0x40/0x90 [ 766.326186][ T1553] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 766.326203][ T1553] RIP: 0033:0x7fb68eb9c799 [ 766.326220][ T1553] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 766.326234][ T1553] RSP: 002b:00007fb68fa36028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 766.326253][ T1553] RAX: ffffffffffffffda RBX: 00007fb68ee16180 RCX: 00007fb68eb9c799 [ 766.326265][ T1553] RDX: 040000000000009f RSI: 00002000000002c0 RDI: 000000000000000c [ 766.326277][ T1553] RBP: 00007fb68fa36090 R08: 0000000000000000 R09: 0000000000000000 [ 766.326288][ T1553] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 766.326298][ T1553] R13: 00007fb68ee16218 R14: 00007fb68ee16180 R15: 00007ffed3127958 [ 766.326326][ T1553] [ 766.670443][ T6593] netdevsim netdevsim3 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 766.699849][ T6593] netdevsim netdevsim3 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 766.714295][ T6593] netdevsim netdevsim3 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 766.733647][ T6593] netdevsim netdevsim3 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 766.742026][ T6593] netdevsim netdevsim3 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 766.786275][ T6593] netdevsim netdevsim3 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 766.797227][ T6593] netdevsim netdevsim3 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 766.810064][ T6593] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 766.827720][ T6593] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 766.854497][ T6593] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 766.875561][ T1571] syzkaller0: entered promiscuous mode [ 766.881073][ T1571] syzkaller0: entered allmulticast mode [ 766.971736][ T6593] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 766.984941][ T1566] netlink: 12 bytes leftover after parsing attributes in process `syz.4.8005'. [ 767.017844][ T1580] netlink: 44 bytes leftover after parsing attributes in process `syz.3.8009'. [ 767.021834][ T1566] netlink: 52 bytes leftover after parsing attributes in process `syz.4.8005'. [ 767.090962][ T1572] netlink: 8 bytes leftover after parsing attributes in process `syz.2.8006'. [ 767.127666][ T1576] wg1 speed is unknown, defaulting to 1000 [ 767.161836][ T1576] ªªªªª9 speed is unknown, defaulting to 1000 [ 767.161976][ T1584] wg1 speed is unknown, defaulting to 1000 [ 767.181708][ T1593] netlink: 4 bytes leftover after parsing attributes in process `syz.3.8012'. [ 767.191506][ T1588] wg1 speed is unknown, defaulting to 1000 [ 767.217493][ T1588] ªªªªª9 speed is unknown, defaulting to 1000 [ 767.235903][ T1595] netlink: 40 bytes leftover after parsing attributes in process `syz.2.8013'. [ 767.271821][ T1597] netlink: 4 bytes leftover after parsing attributes in process `syz.3.8014'. [ 767.289013][ T1584] ªªªªª9 speed is unknown, defaulting to 1000 [ 767.616936][ T1610] openvswitch: netlink: IP tunnel dst address not specified [ 767.637552][ T1610] netlink: 212368 bytes leftover after parsing attributes in process `syz.4.8017'. [ 767.842604][ T1626] xt_nfacct: accounting object `syz0' does not exist [ 768.588829][ T1652] netdevsim netdevsim4 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 768.603793][ T1652] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 768.777831][ T1665] No such timeout policy "syz1" [ 768.814374][ T1652] netdevsim netdevsim4 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 768.837479][ T1652] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 768.917292][ T1672] wg1 speed is unknown, defaulting to 1000 [ 769.009710][ T1652] netdevsim netdevsim4 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 769.020915][ T1652] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 769.048228][ T1672] ªªªªª9 speed is unknown, defaulting to 1000 [ 769.064384][ T1677] wg1 speed is unknown, defaulting to 1000 [ 769.107549][ T1677] ªªªªª9 speed is unknown, defaulting to 1000 [ 769.172306][ T1652] netdevsim netdevsim4 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 769.183264][ T1652] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 769.226376][ T1680] veth9: entered promiscuous mode [ 769.491987][ T6593] netdevsim netdevsim4 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 769.512753][ T6593] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 769.648258][ T6583] netdevsim netdevsim4 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 769.664169][ T6583] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 769.777402][ T6583] netdevsim netdevsim4 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 769.803859][ T6583] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 769.812260][ T6583] netdevsim netdevsim4 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 769.821114][ T6583] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 770.175422][ T1736] netlink: 'syz.2.8054': attribute type 16 has an invalid length. [ 770.183285][ T1736] netlink: 'syz.2.8054': attribute type 17 has an invalid length. [ 770.249147][ T1736] netlink: 'syz.2.8054': attribute type 27 has an invalid length. [ 770.292877][ T1734] veth11: entered promiscuous mode [ 770.301193][ T1725] wg1 speed is unknown, defaulting to 1000 [ 770.387996][ T1733] wg1 speed is unknown, defaulting to 1000 [ 770.435780][ T1725] ªªªªª9 speed is unknown, defaulting to 1000 [ 770.551948][ T1758] wg1 speed is unknown, defaulting to 1000 [ 770.564916][ T1733] ªªªªª9 speed is unknown, defaulting to 1000 [ 770.593169][ T1761] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 770.601133][ T1764] blkio.reset_stats is deprecated [ 770.685839][ T1758] ªªªªª9 speed is unknown, defaulting to 1000 [ 771.362551][ T1793] __nla_validate_parse: 24 callbacks suppressed [ 771.362570][ T1793] netlink: 24 bytes leftover after parsing attributes in process `syz.4.8071'. [ 771.394851][ T1796] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8072'. [ 771.438946][ T1797] Bluetooth: MGMT ver 1.23 [ 771.687950][ T1815] netlink: 'syz.1.8080': attribute type 1 has an invalid length. [ 771.699906][ T1813] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 771.715117][ T1813] syzkaller1: Linktype set failed because interface is up [ 771.749294][T13499] syzkaller1: tun_net_xmit 90 [ 771.781260][ T1815] 8021q: adding VLAN 0 to HW filter on device bond3 [ 771.894779][ T1827] netlink: 4 bytes leftover after parsing attributes in process `syz.4.8084'. [ 771.910612][ T1828] netlink: 14 bytes leftover after parsing attributes in process `syz.1.8080'. [ 771.980467][ T1834] netlink: 12 bytes leftover after parsing attributes in process `syz.4.8084'. [ 772.010990][ T1815] dummy0: left allmulticast mode [ 772.016860][ T1815] bridge0: port 3(dummy0) entered disabled state [ 772.061067][ T1815] bond3: (slave dummy0): making interface the new active one [ 772.078498][ T1815] bond3: (slave dummy0): Enslaving as an active interface with an up link [ 772.099758][ T1828] bond3: (slave dummy0): Releasing active interface [ 772.211714][ T1845] bridge_slave_1: left allmulticast mode [ 772.236609][ T1845] bridge_slave_1: left promiscuous mode [ 772.244365][ T1847] netlink: 8 bytes leftover after parsing attributes in process `syz.4.8090'. [ 772.257812][ T1845] bridge0: port 2(bridge_slave_1) entered disabled state [ 772.285009][ T1847] netlink: 20 bytes leftover after parsing attributes in process `syz.4.8090'. [ 772.439424][ T1860] netlink: 8 bytes leftover after parsing attributes in process `syz.4.8090'. [ 772.449229][ T1859] C: renamed from team_slave_0 [ 772.476042][ T1859] netlink: 'syz.2.8093': attribute type 1 has an invalid length. [ 772.510214][ T1859] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 772.631166][ T1876] netlink: 'syz.1.8099': attribute type 1 has an invalid length. [ 772.708569][ T1876] 8021q: adding VLAN 0 to HW filter on device bond4 [ 772.742938][ T1882] vlan2: entered promiscuous mode [ 772.748991][ T1882] bond4: entered promiscuous mode [ 772.760813][ T1882] vlan2: entered allmulticast mode [ 772.812615][ T1882] bond4: entered allmulticast mode [ 772.895394][ T1876] bond4: (slave bridge11): making interface the new active one [ 772.913874][ T1876] bridge11: entered promiscuous mode [ 772.919461][ T1876] bridge11: entered allmulticast mode [ 772.922029][ T1892] netlink: 12 bytes leftover after parsing attributes in process `syz.2.8106'. [ 772.937500][ T1876] bond4: (slave bridge11): Enslaving as an active interface with an up link [ 772.963939][ T1898] netlink: 32 bytes leftover after parsing attributes in process `syz.0.8107'. [ 773.334400][ T1931] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 773.674509][ T1952] wg1 speed is unknown, defaulting to 1000 [ 773.724510][ T1952] ªªªªª9 speed is unknown, defaulting to 1000 [ 773.945328][ T1971] SET target dimension over the limit! [ 774.698062][ T2017] netlink: 'syz.1.8136': attribute type 11 has an invalid length. [ 775.016564][ T2043] bridge15: entered promiscuous mode [ 775.021989][ T2043] bridge15: entered allmulticast mode [ 775.031756][ T2043] team0: Port device bridge15 added [ 775.077914][ T2047] x_tables: ip6_tables: policy.0 match: invalid size 312 (kernel) != (user) 8 [ 775.138059][ T2052] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 775.146330][ T2052] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 775.156623][ T2052] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 775.170004][ T2052] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 775.190292][ T2052] batman_adv: batadv0: Removing interface: vlan2 [ 775.390856][ T2065] ±ÿ: renamed from team_slave_1 [ 775.463147][ T2065] bond0: entered allmulticast mode [ 775.470332][ T2065] bond_slave_0: entered allmulticast mode [ 775.476784][ T2065] bond_slave_1: entered allmulticast mode [ 775.484709][ T2065] 8021q: adding VLAN 0 to HW filter on device bond0 [ 776.019205][ T2098] bond6: option packets_per_slave: mode dependency failed, not supported in mode balance-tlb(5) [ 776.037629][ T2098] bond6 (unregistering): Released all slaves [ 776.437340][ T2129] __nla_validate_parse: 27 callbacks suppressed [ 776.437359][ T2129] netlink: 24 bytes leftover after parsing attributes in process `syz.4.8170'. [ 776.736590][ T2142] netlink: 44 bytes leftover after parsing attributes in process `syz.4.8175'. [ 776.767916][ T2136] wg1 speed is unknown, defaulting to 1000 [ 776.781238][ T2136] ªªªªª9 speed is unknown, defaulting to 1000 [ 777.026611][ T2159] xt_hashlimit: size too large, truncated to 1048576 [ 777.154187][ T2170] netlink: 8 bytes leftover after parsing attributes in process `syz.4.8182'. [ 777.172218][ T2170] : entered promiscuous mode [ 777.194158][ T2163] netlink: 'syz.2.8180': attribute type 4 has an invalid length. [ 777.213831][ T9] ªªªªª9 speed is unknown, defaulting to 1000 [ 777.219943][ T9] syz2: Port: 1 Link DOWN [ 777.245376][ T2163] netlink: 'syz.2.8180': attribute type 4 has an invalid length. [ 777.356499][ T2176] netdevsim netdevsim1 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 777.403181][ T9] ªªªªª9 speed is unknown, defaulting to 1000 [ 777.412806][ T9] syz2: Port: 1 Link ACTIVE [ 777.588960][ T2176] netdevsim netdevsim1 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 777.687199][ T2136] netlink: 4 bytes leftover after parsing attributes in process `syz.3.8172'. [ 777.721546][ T2136] netlink: 8 bytes leftover after parsing attributes in process `syz.3.8172'. [ 777.773023][ T2176] netdevsim netdevsim1 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 777.825820][ T2202] netlink: 44 bytes leftover after parsing attributes in process `syz.0.8188'. [ 777.904746][ T2176] netdevsim netdevsim1 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 778.192585][ T2228] netlink: 14593 bytes leftover after parsing attributes in process `syz.4.8193'. [ 778.307334][ T2222] netlink: 14593 bytes leftover after parsing attributes in process `syz.4.8193'. [ 778.466066][ T58] netdevsim netdevsim1 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 778.539771][ T12] netdevsim netdevsim1 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 778.550101][ T2241] netlink: 'syz.3.8194': attribute type 5 has an invalid length. [ 778.564679][ T2246] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8197'. [ 778.590995][ T2245] xfrm0: entered promiscuous mode [ 778.608150][ T2239] wg1 speed is unknown, defaulting to 1000 [ 778.623434][ T2245] xfrm0: entered allmulticast mode [ 778.641193][ T12] netdevsim netdevsim1 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 778.688928][ T58] netdevsim netdevsim1 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 778.706495][ T2239] ªªªªª9 speed is unknown, defaulting to 1000 [ 778.934493][ T2274] netlink: 12 bytes leftover after parsing attributes in process `syz.4.8201'. [ 779.078519][ T2283] netlink: 'syz.1.8204': attribute type 32 has an invalid length. [ 779.135585][ T2283] bond5: option coupled_control: invalid value (192) [ 779.227427][ T2283] bond5 (unregistering): Released all slaves [ 780.147881][ T2320] netlink: 'syz.1.8212': attribute type 1 has an invalid length. [ 780.166296][ T2325] tc_dump_action: action bad kind [ 780.614899][ T2353] vlan5: entered promiscuous mode [ 780.620525][ T2353] bridge0: entered promiscuous mode [ 780.857652][ T2370] netlink: 'syz.4.8225': attribute type 6 has an invalid length. [ 780.944276][ T2370] delete_channel: no stack [ 781.125432][ T2391] netlink: 'syz.1.8230': attribute type 1 has an invalid length. [ 781.469505][ T2421] __nla_validate_parse: 9 callbacks suppressed [ 781.469524][ T2421] netlink: 8 bytes leftover after parsing attributes in process `syz.3.8235'. [ 781.717369][ T2433] netlink: 24 bytes leftover after parsing attributes in process `syz.4.8236'. [ 781.754022][ T2433] netlink: 24 bytes leftover after parsing attributes in process `syz.4.8236'. [ 781.969734][ T2452] netlink: 12 bytes leftover after parsing attributes in process `syz.4.8241'. [ 781.997844][ T2452] netlink: 'syz.4.8241': attribute type 39 has an invalid length. [ 782.107417][ T2463] netlink: 4 bytes leftover after parsing attributes in process `syz.0.8245'. [ 782.226017][ T2457] wg1 speed is unknown, defaulting to 1000 [ 782.228326][ T2469] netlink: 16 bytes leftover after parsing attributes in process `syz.1.8247'. [ 782.252223][ T2457] ªªªªª9 speed is unknown, defaulting to 1000 [ 783.097311][ T2518] netlink: 8 bytes leftover after parsing attributes in process `syz.3.8259'. [ 783.169175][ T2523] netlink: 'syz.4.8261': attribute type 30 has an invalid length. [ 783.180610][ T2528] netlink: 44 bytes leftover after parsing attributes in process `syz.2.8263'. [ 783.207567][ T2523] netlink: 16 bytes leftover after parsing attributes in process `syz.4.8261'. [ 783.228112][ T2530] netlink: 32 bytes leftover after parsing attributes in process `syz.4.8261'. [ 783.322126][ T2532] workqueue: Failed to create a rescuer kthread for wq "nfc3_nci_cmd_wq": -EINTR [ 783.566171][ T2547] syzkaller1: entered promiscuous mode [ 783.593718][ T2547] syzkaller1: entered allmulticast mode [ 783.713078][ T2566] netlink: 'syz.0.8269': attribute type 3 has an invalid length. [ 783.755113][ T2566] netlink: 'syz.0.8269': attribute type 3 has an invalid length. [ 783.823339][ T2569] bond7: entered promiscuous mode [ 783.837817][ T2569] 8021q: adding VLAN 0 to HW filter on device bond7 [ 783.870930][ T2580] netlink: 'syz.0.8273': attribute type 4 has an invalid length. [ 783.893429][ T2576] netlink: 'syz.1.8270': attribute type 3 has an invalid length. [ 783.895352][ T2584] netlink: 'syz.3.8274': attribute type 1 has an invalid length. [ 783.979619][ T2582] bridge17: entered promiscuous mode [ 783.989472][ T2582] bond7: (slave bridge17): Enslaving as an active interface with an up link [ 784.057867][ T2598] gtp2: entered allmulticast mode [ 784.080446][ T2597] bond6: (slave ip6gretap1): Enslaving as a backup interface with an up link [ 784.137036][ T2584] bond6 (unregistering): (slave ip6gretap1): Releasing backup interface [ 784.151430][ T2584] bond6 (unregistering): Released all slaves [ 784.332823][ T2614] team0 (unregistering): Port device bridge15 removed [ 784.556626][ T2639] netlink: 'syz.0.8286': attribute type 1 has an invalid length. [ 784.768551][ T2648] ip6gretap0: entered promiscuous mode [ 784.849898][ T2658] wg1 speed is unknown, defaulting to 1000 [ 784.886906][ T2658] ªªªªª9 speed is unknown, defaulting to 1000 [ 785.082568][ T2665] wg1 speed is unknown, defaulting to 1000 [ 785.084457][ T2667] syzkaller0: entered promiscuous mode [ 785.098203][ T2667] syzkaller0: entered allmulticast mode [ 785.119520][ T2666] tipc: Enabled bearer , priority 0 [ 785.146795][ T2665] ªªªªª9 speed is unknown, defaulting to 1000 [ 785.219416][ T2666] tipc: Resetting bearer [ 785.285166][ T2666] tipc: Disabling bearer [ 785.812849][ T2719] wg1 speed is unknown, defaulting to 1000 [ 785.816528][ T2722] bond0: (slave sit0): The slave device specified does not support setting the MAC address [ 785.890311][ T2722] bond0: (slave sit0): Error -95 calling set_mac_address [ 785.930785][ T2722] netlink: zone id is out of range [ 785.936222][ T2722] netlink: zone id is out of range [ 785.941404][ T2722] netlink: zone id is out of range [ 785.951490][ T2722] netlink: zone id is out of range [ 785.962672][ T2722] netlink: zone id is out of range [ 785.973037][ T2730] netlink: 'syz.2.8304': attribute type 4 has an invalid length. [ 785.974658][ T2719] ªªªªª9 speed is unknown, defaulting to 1000 [ 785.981580][ T2730] netlink: 'syz.2.8304': attribute type 8 has an invalid length. [ 785.995835][ T2722] netlink: zone id is out of range [ 786.004177][ T2730] netlink: 'syz.2.8304': attribute type 1 has an invalid length. [ 786.012079][ T2722] netlink: zone id is out of range [ 786.029371][ T2722] netlink: zone id is out of range [ 786.035187][ T2730] NCSI netlink: No device for ifindex 0 [ 786.052247][ T2722] netlink: zone id is out of range [ 786.471734][ T2747] syzkaller0: entered promiscuous mode [ 786.493714][ T2747] syzkaller0: entered allmulticast mode [ 786.762037][ T2784] openvswitch: netlink: ufid size 4235 bytes exceeds the range (1, 16) [ 786.935567][ T2804] __nla_validate_parse: 13 callbacks suppressed [ 786.935586][ T2804] netlink: 44 bytes leftover after parsing attributes in process `syz.0.8322'. [ 787.096794][ T2833] netlink: 16 bytes leftover after parsing attributes in process `syz.0.8326'. [ 787.111980][ T2833] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8326'. [ 787.419135][ T2861] netlink: 12 bytes leftover after parsing attributes in process `syz.1.8330'. [ 787.861917][ T2898] netlink: 44 bytes leftover after parsing attributes in process `syz.1.8336'. [ 788.035429][ T2903] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 788.045250][ T2903] tipc: Enabled bearer , priority 0 [ 788.269624][ T2901] tipc: Disabling bearer [ 788.360218][ T2924] syzkaller1: entered promiscuous mode [ 788.365870][ T2924] syzkaller1: entered allmulticast mode [ 788.377612][ T2927] netlink: 32 bytes leftover after parsing attributes in process `syz.3.8341'. [ 788.511033][ T2937] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8345'. [ 788.612280][ T2940] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8343'. [ 788.638423][ T2944] netlink: 44 bytes leftover after parsing attributes in process `syz.3.8348'. [ 788.716626][ T2950] FAULT_INJECTION: forcing a failure. [ 788.716626][ T2950] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 788.729948][ T2950] CPU: 1 UID: 0 PID: 2950 Comm: syz.3.8350 Not tainted syzkaller #0 PREEMPT(full) [ 788.729973][ T2950] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 788.729984][ T2950] Call Trace: [ 788.729991][ T2950] [ 788.729998][ T2950] dump_stack_lvl+0xe8/0x150 [ 788.730024][ T2950] should_fail_ex+0x412/0x560 [ 788.730047][ T2950] _copy_to_user+0x31/0xb0 [ 788.730072][ T2950] copy_to_sockptr+0x5e/0xa0 [ 788.730092][ T2950] do_tcp_getsockopt+0x175c/0x2950 [ 788.730116][ T2950] ? __pfx_do_tcp_getsockopt+0x10/0x10 [ 788.730133][ T2950] ? sock_recv_errqueue+0x580/0x590 [ 788.730158][ T2950] ? handle_mm_fault+0xee/0x3310 [ 788.730189][ T2950] ? __pfx_handle_mm_fault+0x10/0x10 [ 788.730216][ T2950] ? __up_read+0x291/0x6b0 [ 788.730237][ T2950] ? __pfx___up_read+0x10/0x10 [ 788.730256][ T2950] ? do_user_addr_fault+0xbad/0x1340 [ 788.730284][ T2950] ? do_user_addr_fault+0xc6f/0x1340 [ 788.730308][ T2950] ? irqentry_exit+0x59e/0x620 [ 788.730330][ T2950] ? lockdep_hardirqs_on+0x7a/0x110 [ 788.730351][ T2950] ? irqentry_exit+0x59e/0x620 [ 788.730370][ T2950] ? trace_irq_disable+0x3b/0x150 [ 788.730407][ T2950] tcp_getsockopt+0x83/0x130 [ 788.730424][ T2950] ? sock_recv_errqueue+0x580/0x590 [ 788.730441][ T2950] ? rep_movs_alternative+0xf/0x90 [ 788.730457][ T2950] ? sock_recv_errqueue+0x580/0x590 [ 788.730473][ T2950] ? __pfx_sock_common_getsockopt+0x10/0x10 [ 788.730495][ T2950] do_sock_getsockopt+0x2d3/0x3f0 [ 788.730520][ T2950] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 788.730544][ T2950] ? __fget_files+0x3a0/0x420 [ 788.730565][ T2950] ? __fget_files+0x2a/0x420 [ 788.730595][ T2950] __x64_sys_getsockopt+0x1a4/0x240 [ 788.730623][ T2950] do_syscall_64+0x14d/0xf80 [ 788.730643][ T2950] ? trace_irq_disable+0x3b/0x150 [ 788.730664][ T2950] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 788.730682][ T2950] ? clear_bhb_loop+0x40/0x90 [ 788.730703][ T2950] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 788.730720][ T2950] RIP: 0033:0x7fa0df79c799 [ 788.730737][ T2950] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 788.730761][ T2950] RSP: 002b:00007fa0e0583028 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 788.730780][ T2950] RAX: ffffffffffffffda RBX: 00007fa0dfa15fa0 RCX: 00007fa0df79c799 [ 788.730792][ T2950] RDX: 0000000000000021 RSI: 0000000000000006 RDI: 0000000000000004 [ 788.730803][ T2950] RBP: 00007fa0e0583090 R08: 00002000000009c0 R09: 0000000000000000 [ 788.730814][ T2950] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 788.730824][ T2950] R13: 00007fa0dfa16038 R14: 00007fa0dfa15fa0 R15: 00007ffcc9bf4748 [ 788.730851][ T2950] [ 788.731730][ T2951] validate_nla: 1 callbacks suppressed [ 788.731747][ T2951] netlink: 'syz.2.8349': attribute type 2 has an invalid length. [ 788.795042][ T2955] netlink: 'syz.2.8349': attribute type 2 has an invalid length. [ 789.114955][ T2956] IPVS: length: 132 != 8 [ 789.223432][ T2951] !©9: entered promiscuous mode [ 789.421826][ T2957] pimreg: entered allmulticast mode [ 789.428565][ T2957] pimreg: left allmulticast mode [ 789.457074][ T2966] netlink: 14 bytes leftover after parsing attributes in process `syz.4.8353'. [ 789.524659][ T2954] wg1 speed is unknown, defaulting to 1000 [ 789.534475][ T2969] x_tables: duplicate underflow at hook 1 [ 789.548741][ T2954] ªªªªª9 speed is unknown, defaulting to 1000 [ 790.136796][ T3002] x_tables: unsorted underflow at hook 4 [ 790.161035][ T3004] netlink: 'syz.2.8365': attribute type 32 has an invalid length. [ 790.269352][ T3010] wg1 speed is unknown, defaulting to 1000 [ 790.299184][ T3010] ªªªªª9 speed is unknown, defaulting to 1000 [ 790.628207][ T3025] wg1 speed is unknown, defaulting to 1000 [ 790.637674][ T3025] ªªªªª9 speed is unknown, defaulting to 1000 [ 790.672762][ T3043] netlink: 'syz.1.8377': attribute type 1 has an invalid length. [ 790.691195][ T3034] wg1 speed is unknown, defaulting to 1000 [ 790.700139][ T3034] ªªªªª9 speed is unknown, defaulting to 1000 [ 790.730576][ T3044] IPv6: Can't replace route, no match found [ 790.737009][ T3044] IPv6: Can't replace route, no match found [ 790.821926][ T3043] bond5: entered promiscuous mode [ 790.827907][ T3043] 8021q: adding VLAN 0 to HW filter on device bond5 [ 791.216671][ T3067] netlink: 'syz.2.8386': attribute type 5 has an invalid length. [ 791.587667][ T3069] veth15: entered promiscuous mode [ 791.664756][ T3087] net_ratelimit: 2 callbacks suppressed [ 791.664775][ T3087] openvswitch: netlink: Message has 8 unknown bytes. [ 791.677561][ T3089] openvswitch: netlink: Message has 8 unknown bytes. [ 791.959214][ T3104] __nla_validate_parse: 15 callbacks suppressed [ 791.959234][ T3104] netlink: 12 bytes leftover after parsing attributes in process `syz.2.8399'. [ 792.048866][ T3111] netlink: 4 bytes leftover after parsing attributes in process `syz.0.8401'. [ 792.090153][ T3111] netlink: 12 bytes leftover after parsing attributes in process `syz.0.8401'. [ 792.102107][ T3106] netlink: 24 bytes leftover after parsing attributes in process `syz.1.8398'. [ 792.230670][ T3119] wg1 speed is unknown, defaulting to 1000 [ 792.267264][ T3119] ªªªªª9 speed is unknown, defaulting to 1000 [ 792.276197][ T3125] sch_tbf: burst 0 is lower than device tunl0 mtu (1480) ! [ 792.285217][ T3126] netlink: 192 bytes leftover after parsing attributes in process `syz.2.8402'. [ 792.383169][ T3130] netlink: 44 bytes leftover after parsing attributes in process `syz.0.8405'. [ 792.446849][ T3133] netlink: 16 bytes leftover after parsing attributes in process `syz.1.8406'. [ 792.505212][ T3133] bond6: option broadcast_neighbor: mode dependency failed, not supported in mode balance-rr(0) [ 792.520540][ T3139] netlink: 4 bytes leftover after parsing attributes in process `syz.0.8408'. [ 792.580544][ T3133] bond6 (unregistering): Released all slaves [ 792.692937][ T3156] netlink: 44 bytes leftover after parsing attributes in process `syz.4.8413'. [ 792.879799][ T3163] netlink: 4 bytes leftover after parsing attributes in process `syz.4.8415'. [ 793.123945][ T3173] gretap0: entered promiscuous mode [ 793.184815][ T3173] bond0: left allmulticast mode [ 793.189787][ T3173] bond_slave_0: left allmulticast mode [ 793.195935][ T3173] bond_slave_1: left allmulticast mode [ 793.205160][ T3173] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 793.441500][ T3208] tipc: Enabling of bearer rejected, failed to enable media [ 793.822028][ T3227] wg1 speed is unknown, defaulting to 1000 [ 793.845332][ T3227] ªªªªª9 speed is unknown, defaulting to 1000 [ 793.909383][ T3239] netlink: 'syz.2.8435': attribute type 33 has an invalid length. [ 794.065886][ T3245] xt_hashlimit: size too large, truncated to 1048576 [ 794.819641][ T3286] x_tables: ip6_tables: SNPT target: used from hooks FORWARD, but only usable from INPUT/POSTROUTING [ 794.966820][ T3299] netlink: 'syz.1.8457': attribute type 21 has an invalid length. [ 795.915582][ T3330] wg1 speed is unknown, defaulting to 1000 [ 795.928374][ T3330] ªªªªª9 speed is unknown, defaulting to 1000 [ 796.126542][ T3352] netlink: 'syz.0.8471': attribute type 1 has an invalid length. [ 796.250190][ T3352] bond7: (slave geneve3): making interface the new active one [ 796.278927][ T3352] bond7: (slave geneve3): Enslaving as an active interface with an up link [ 796.345999][ T12] netdevsim netdevsim0 netdevsim0: set [1, 1] type 2 family 0 port 20000 - 0 [ 796.355647][ T12] netdevsim netdevsim0 netdevsim1: set [1, 1] type 2 family 0 port 20000 - 0 [ 796.363370][ T3362] openvswitch: netlink: ufid size 4235 bytes exceeds the range (1, 16) [ 796.366257][ T3360] 8021q: adding VLAN 0 to HW filter on device bond7 [ 796.373364][ T3362] openvswitch: netlink: Message has 8 unknown bytes. [ 796.386250][ T12] netdevsim netdevsim0 netdevsim2: set [1, 1] type 2 family 0 port 20000 - 0 [ 796.406285][ T12] netdevsim netdevsim0 netdevsim3: set [1, 1] type 2 family 0 port 20000 - 0 [ 796.773917][ T3373] 0ªX¹¦À: renamed from caif0 [ 796.801542][ T3373] 0ªX¹¦À: entered allmulticast mode [ 796.809774][ T3373] A link change request failed with some changes committed already. Interface 60ªX¹¦À may have been left with an inconsistent configuration, please check. [ 796.928425][ T3382] wg1 speed is unknown, defaulting to 1000 [ 796.940860][ T3382] ªªªªª9 speed is unknown, defaulting to 1000 [ 797.082425][ T3400] __nla_validate_parse: 20 callbacks suppressed [ 797.082444][ T3400] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8482'. [ 797.186722][ T3393] wg1 speed is unknown, defaulting to 1000 [ 797.187099][ T3400] gre0: entered promiscuous mode [ 797.307170][ T3392] netlink: 76 bytes leftover after parsing attributes in process `syz.1.8484'. [ 797.313901][ T3393] ªªªªª9 speed is unknown, defaulting to 1000 [ 797.648501][ T3430] netlink: 'syz.1.8490': attribute type 10 has an invalid length. [ 797.688299][ T3430] netlink: 'syz.1.8490': attribute type 10 has an invalid length. [ 797.882635][ T3453] netlink: 44 bytes leftover after parsing attributes in process `syz.3.8497'. [ 797.935296][ T3456] IPVS: Error connecting to the multicast addr [ 798.055735][ T3464] netlink: 16 bytes leftover after parsing attributes in process `syz.3.8502'. [ 798.089631][ T3466] netlink: 4 bytes leftover after parsing attributes in process `syz.2.8500'. [ 798.130218][ T3466] netlink: 12 bytes leftover after parsing attributes in process `syz.2.8500'. [ 798.155552][ T3468] netlink: 56 bytes leftover after parsing attributes in process `syz.1.8503'. [ 798.314472][ T3476] netlink: 12 bytes leftover after parsing attributes in process `syz.0.8505'. [ 798.323178][ T3472] wg1 speed is unknown, defaulting to 1000 [ 798.323634][ T3474] xt_l2tp: unknown flags: 51 [ 798.368087][ T3472] ªªªªª9 speed is unknown, defaulting to 1000 [ 798.462644][ T3483] ipvlan2: entered promiscuous mode [ 798.491435][ T3483] 8021q: adding VLAN 0 to HW filter on device ipvlan2 [ 799.149771][ T3511] syzkaller0: entered promiscuous mode [ 799.155650][ T3511] syzkaller0: entered allmulticast mode [ 799.297962][ T3521] netlink: 4 bytes leftover after parsing attributes in process `syz.2.8516'. [ 799.309716][ T3517] netlink: 192 bytes leftover after parsing attributes in process `syz.0.8515'. [ 801.002365][ T3519] wg1 speed is unknown, defaulting to 1000 [ 801.011557][ T3519] ªªªªª9 speed is unknown, defaulting to 1000 [ 801.241071][ T3548] SET target dimension over the limit! [ 801.417895][ T3551] wg1 speed is unknown, defaulting to 1000 [ 801.459286][ T3551] ªªªªª9 speed is unknown, defaulting to 1000 [ 801.529537][ T3554] A link change request failed with some changes committed already. Interface ªªªªª9 may have been left with an inconsistent configuration, please check. [ 801.637624][ T3559] netlink: 'syz.0.8525': attribute type 1 has an invalid length. [ 801.803999][ T3564] syzkaller0: entered promiscuous mode [ 801.814135][ T3564] syzkaller0: entered allmulticast mode [ 802.187917][ T3593] __nla_validate_parse: 5 callbacks suppressed [ 802.187936][ T3593] netlink: 56 bytes leftover after parsing attributes in process `syz.2.8531'. [ 803.090750][ T3600] netlink: 192 bytes leftover after parsing attributes in process `syz.1.8534'. [ 803.744037][ T3598] wg1 speed is unknown, defaulting to 1000 [ 803.758145][ T3598] ªªªªª9 speed is unknown, defaulting to 1000 [ 803.775574][ T3602] netlink: 'syz.4.8535': attribute type 9 has an invalid length. [ 803.825837][ T3605] netlink: 12 bytes leftover after parsing attributes in process `syz.3.8536'. [ 803.872236][ T3605] netlink: 8 bytes leftover after parsing attributes in process `syz.3.8536'. [ 804.176601][ T3630] netlink: 44 bytes leftover after parsing attributes in process `syz.4.8543'. [ 804.185772][ T3630] netlink: 35 bytes leftover after parsing attributes in process `syz.4.8543'. [ 804.195502][ T3630] netlink: 'syz.4.8543': attribute type 5 has an invalid length. [ 804.203333][ T3630] netlink: 'syz.4.8543': attribute type 6 has an invalid length. [ 804.220596][ T3630] netlink: 35 bytes leftover after parsing attributes in process `syz.4.8543'. [ 804.412653][ T3640] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8547'. [ 804.503257][ T3647] netlink: 212368 bytes leftover after parsing attributes in process `syz.4.8546'. [ 804.522114][ T3640] team1: entered promiscuous mode [ 804.530627][ T3640] team1: entered allmulticast mode [ 804.778301][ T3665] tipc: Enabling of bearer rejected, failed to enable media [ 804.864678][ T3667] netlink: 8 bytes leftover after parsing attributes in process `syz.4.8553'. [ 804.886675][ T3667] netlink: 'syz.4.8553': attribute type 5 has an invalid length. [ 804.928938][ T3667] geneve3: entered promiscuous mode [ 804.934785][ T3667] geneve3: entered allmulticast mode [ 804.942450][ T2807] netdevsim netdevsim4 eth0: set [1, 1] type 2 family 0 port 256 - 0 [ 804.961046][ T2807] netdevsim netdevsim4 eth1: set [1, 1] type 2 family 0 port 256 - 0 [ 804.990770][ T2807] netdevsim netdevsim4 eth2: set [1, 1] type 2 family 0 port 256 - 0 [ 805.035414][ T3671] FAULT_INJECTION: forcing a failure. [ 805.035414][ T3671] name failslab, interval 1, probability 0, space 0, times 0 [ 805.049022][ T3671] CPU: 0 UID: 0 PID: 3671 Comm: syz.1.8554 Not tainted syzkaller #0 PREEMPT(full) [ 805.049048][ T3671] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 805.049059][ T3671] Call Trace: [ 805.049068][ T3671] [ 805.049076][ T3671] dump_stack_lvl+0xe8/0x150 [ 805.049106][ T3671] should_fail_ex+0x412/0x560 [ 805.049138][ T3671] should_failslab+0xa8/0x100 [ 805.049161][ T3671] __kmalloc_noprof+0xe8/0x760 [ 805.049180][ T3671] ? genl_family_rcv_msg_attrs_parse+0xa3/0x2a0 [ 805.049212][ T3671] genl_family_rcv_msg_attrs_parse+0xa3/0x2a0 [ 805.049243][ T3671] genl_family_rcv_msg_doit+0xd9/0x330 [ 805.049266][ T3671] ? __asan_memcpy+0x40/0x70 [ 805.049294][ T3671] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 805.049325][ T3671] ? apparmor_capable+0x137/0x1a0 [ 805.049349][ T3671] ? bpf_lsm_capable+0x9/0x20 [ 805.049370][ T3671] ? security_capable+0x7e/0x2c0 [ 805.049395][ T3671] genl_rcv_msg+0x61c/0x7a0 [ 805.049425][ T3671] ? __pfx_genl_rcv_msg+0x10/0x10 [ 805.049447][ T3671] ? __pfx_ethnl_default_set_doit+0x10/0x10 [ 805.049469][ T3671] ? __lock_acquire+0x6b5/0x2cf0 [ 805.049501][ T3671] netlink_rcv_skb+0x232/0x4b0 [ 805.049521][ T3671] ? __pfx_genl_rcv_msg+0x10/0x10 [ 805.049545][ T3671] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 805.049582][ T3671] ? down_read+0x272/0x2e0 [ 805.049603][ T3671] ? genl_rcv+0xd/0x40 [ 805.049627][ T3671] genl_rcv+0x28/0x40 [ 805.049647][ T3671] netlink_unicast+0x80f/0x9b0 [ 805.049681][ T3671] ? __pfx_netlink_unicast+0x10/0x10 [ 805.049701][ T3671] ? netlink_sendmsg+0x650/0xb40 [ 805.049719][ T3671] ? skb_put+0x11b/0x210 [ 805.049744][ T3671] netlink_sendmsg+0x813/0xb40 [ 805.049773][ T3671] ? __pfx_netlink_sendmsg+0x10/0x10 [ 805.049796][ T3671] ? aa_sock_msg_perm+0xf1/0x1b0 [ 805.049818][ T3671] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 805.049838][ T3671] ? __pfx_netlink_sendmsg+0x10/0x10 [ 805.049858][ T3671] ____sys_sendmsg+0xa68/0xad0 [ 805.049891][ T3671] ? __pfx_____sys_sendmsg+0x10/0x10 [ 805.049923][ T3671] ? import_iovec+0x73/0xa0 [ 805.049950][ T3671] ___sys_sendmsg+0x2a5/0x360 [ 805.049979][ T3671] ? __pfx____sys_sendmsg+0x10/0x10 [ 805.050040][ T3671] ? __fget_files+0x2a/0x420 [ 805.050062][ T3671] ? __fget_files+0x3a0/0x420 [ 805.050095][ T3671] __x64_sys_sendmsg+0x1bd/0x2a0 [ 805.050122][ T3671] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 805.050155][ T3671] ? __pfx_ksys_write+0x10/0x10 [ 805.050186][ T3671] do_syscall_64+0x14d/0xf80 [ 805.050207][ T3671] ? trace_irq_disable+0x3b/0x150 [ 805.050230][ T3671] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 805.050247][ T3671] ? clear_bhb_loop+0x40/0x90 [ 805.050269][ T3671] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 805.050285][ T3671] RIP: 0033:0x7fad7759c799 [ 805.050303][ T3671] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 805.050318][ T3671] RSP: 002b:00007fad784cb028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 805.050338][ T3671] RAX: ffffffffffffffda RBX: 00007fad77815fa0 RCX: 00007fad7759c799 [ 805.050351][ T3671] RDX: 0000000000000000 RSI: 0000200000000540 RDI: 0000000000000012 [ 805.050362][ T3671] RBP: 00007fad784cb090 R08: 0000000000000000 R09: 0000000000000000 [ 805.050374][ T3671] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 805.050384][ T3671] R13: 00007fad77816038 R14: 00007fad77815fa0 R15: 00007fffe46c4c48 [ 805.050414][ T3671] [ 805.381075][ T2807] netdevsim netdevsim4 eth3: set [1, 1] type 2 family 0 port 256 - 0 [ 806.033419][ T30] audit: type=1800 audit(1772127904.173:25): pid=3707 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.8566" name="memory.events" dev="tmpfs" ino=2846 res=0 errno=0 [ 806.661508][ T3707] wg1 speed is unknown, defaulting to 1000 [ 806.671143][ T3707] ªªªªª9 speed is unknown, defaulting to 1000 [ 807.041813][ T3724] wg1 speed is unknown, defaulting to 1000 [ 807.072387][ T3724] ªªªªª9 speed is unknown, defaulting to 1000 [ 807.289858][ T3746] __nla_validate_parse: 7 callbacks suppressed [ 807.289879][ T3746] netlink: 8 bytes leftover after parsing attributes in process `syz.2.8575'. [ 807.345606][ T3746] openvswitch: netlink: Flow actions attr not present in new flow. [ 807.432519][ T3755] openvswitch: netlink: Geneve opt len 2 is not a multiple of 4. [ 807.625202][ T3777] netlink: 8 bytes leftover after parsing attributes in process `syz.3.8582'. [ 808.575815][ T3796] netlink: 192 bytes leftover after parsing attributes in process `syz.3.8587'. [ 808.630654][ T3776] hsr0: left allmulticast mode [ 808.643470][ T3776] hsr_slave_0: left allmulticast mode [ 808.649116][ T3776] hsr_slave_1: left allmulticast mode [ 808.750374][ T1301] clip:clip_start_xmit: skb_dst(skb) == NULL [ 808.853189][ T2805] netdevsim netdevsim4 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 808.876179][ T2805] netdevsim netdevsim4 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 808.893947][ T2805] netdevsim netdevsim4 eth0: unset [1, 1] type 2 family 0 port 256 - 0 [ 808.902440][ T2805] netdevsim netdevsim4 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 808.917080][ T2805] netdevsim netdevsim4 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 808.933938][ T2805] netdevsim netdevsim4 eth1: unset [1, 1] type 2 family 0 port 256 - 0 [ 808.977622][ T2805] netdevsim netdevsim4 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 809.004017][ T2805] netdevsim netdevsim4 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 809.012450][ T2805] netdevsim netdevsim4 eth2: unset [1, 1] type 2 family 0 port 256 - 0 [ 809.025826][ T2805] netdevsim netdevsim4 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 809.034745][ T2805] netdevsim netdevsim4 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 809.043772][ T2805] netdevsim netdevsim4 eth3: unset [1, 1] type 2 family 0 port 256 - 0 [ 809.052233][ T3769] wg1 speed is unknown, defaulting to 1000 [ 809.078471][ T3794] wg1 speed is unknown, defaulting to 1000 [ 809.094072][ T3769] ªªªªª9 speed is unknown, defaulting to 1000 [ 809.118402][ T3794] ªªªªª9 speed is unknown, defaulting to 1000 [ 809.860387][ T3853] netlink: 20 bytes leftover after parsing attributes in process `syz.0.8603'. [ 809.918699][ T3848] wg1 speed is unknown, defaulting to 1000 [ 809.977340][ T3848] ªªªªª9 speed is unknown, defaulting to 1000 [ 810.076796][ T3868] netlink: 8 bytes leftover after parsing attributes in process `syz.3.8609'. [ 810.257607][ T3873] netlink: 28 bytes leftover after parsing attributes in process `syz.1.8610'. [ 810.377377][ T3897] netlink: 32 bytes leftover after parsing attributes in process `syz.3.8617'. [ 810.441599][ T3901] netlink: 44 bytes leftover after parsing attributes in process `syz.0.8619'. [ 810.487593][ T3899] netlink: 12 bytes leftover after parsing attributes in process `syz.2.8618'. [ 810.807281][ T3914] netlink: 8 bytes leftover after parsing attributes in process `syz.4.8622'. [ 810.954567][ T3872] delete_channel: no stack [ 811.257190][ T3905] hsr0: left allmulticast mode [ 811.261992][ T3905] hsr_slave_0: left allmulticast mode [ 811.274643][ T3905] hsr_slave_1: left allmulticast mode [ 811.453391][ T3897] tap0: tun_chr_ioctl cmd 1074025676 [ 811.462346][ T3897] tap0: owner set to 0 [ 811.479697][ T49] netdevsim netdevsim0 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 811.504327][ T49] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 811.526341][ T49] netdevsim netdevsim0 netdevsim0: unset [1, 1] type 2 family 0 port 20000 - 0 [ 811.561046][ T49] netdevsim netdevsim0 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 811.570519][ T49] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 811.609684][ T49] netdevsim netdevsim0 netdevsim1: unset [1, 1] type 2 family 0 port 20000 - 0 [ 811.658745][ T49] netdevsim netdevsim0 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 811.687494][ T49] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 811.705383][ T49] netdevsim netdevsim0 netdevsim2: unset [1, 1] type 2 family 0 port 20000 - 0 [ 811.722157][ T49] netdevsim netdevsim0 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 811.732230][ T49] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 811.741712][ T49] netdevsim netdevsim0 netdevsim3: unset [1, 1] type 2 family 0 port 20000 - 0 [ 811.767030][ T3921] wg1 speed is unknown, defaulting to 1000 [ 811.778058][ T3921] ªªªªª9 speed is unknown, defaulting to 1000 [ 812.105543][ T3948] netlink: 'syz.1.8632': attribute type 1 has an invalid length. [ 812.120932][ T3948] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 812.234845][ T3950] wg1 speed is unknown, defaulting to 1000 [ 812.294859][ T3946] __nla_validate_parse: 4 callbacks suppressed [ 812.294879][ T3946] netlink: 192 bytes leftover after parsing attributes in process `syz.2.8631'. [ 812.332297][ T3950] ªªªªª9 speed is unknown, defaulting to 1000 [ 812.392725][ T3957] netlink: 12 bytes leftover after parsing attributes in process `syz.4.8635'. [ 812.510869][ T3964] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8637'. [ 812.520793][ T3964] netlink: 4 bytes leftover after parsing attributes in process `syz.0.8637'. [ 812.529840][ T3964] netlink: 'syz.0.8637': attribute type 15 has an invalid length. [ 812.545333][ T3962] FAULT_INJECTION: forcing a failure. [ 812.545333][ T3962] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 812.563858][ T3962] CPU: 1 UID: 0 PID: 3962 Comm: syz.1.8636 Not tainted syzkaller #0 PREEMPT(full) [ 812.563882][ T3962] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 812.563892][ T3962] Call Trace: [ 812.563901][ T3962] [ 812.563909][ T3962] dump_stack_lvl+0xe8/0x150 [ 812.563938][ T3962] should_fail_ex+0x412/0x560 [ 812.563964][ T3962] _copy_from_user+0x2d/0xb0 [ 812.563988][ T3962] ___sys_sendmsg+0x1c6/0x360 [ 812.564019][ T3962] ? __pfx____sys_sendmsg+0x10/0x10 [ 812.564076][ T3962] ? __fget_files+0x2a/0x420 [ 812.564099][ T3962] ? __fget_files+0x3a0/0x420 [ 812.564144][ T3962] __x64_sys_sendmsg+0x1bd/0x2a0 [ 812.564170][ T3962] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 812.564203][ T3962] ? __pfx_ksys_write+0x10/0x10 [ 812.564232][ T3962] do_syscall_64+0x14d/0xf80 [ 812.564253][ T3962] ? trace_irq_disable+0x3b/0x150 [ 812.564277][ T3962] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 812.564295][ T3962] ? clear_bhb_loop+0x40/0x90 [ 812.564316][ T3962] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 812.564334][ T3962] RIP: 0033:0x7fad7759c799 [ 812.564351][ T3962] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 812.564365][ T3962] RSP: 002b:00007fad784cb028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 812.564385][ T3962] RAX: ffffffffffffffda RBX: 00007fad77815fa0 RCX: 00007fad7759c799 [ 812.564398][ T3962] RDX: 0000000000000000 RSI: 0000200000000300 RDI: 0000000000000003 [ 812.564409][ T3962] RBP: 00007fad784cb090 R08: 0000000000000000 R09: 0000000000000000 [ 812.564420][ T3962] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 812.564430][ T3962] R13: 00007fad77816038 R14: 00007fad77815fa0 R15: 00007fffe46c4c48 [ 812.564460][ T3962] [ 812.973359][ T3977] netlink: 'syz.3.8640': attribute type 1 has an invalid length. [ 813.021791][ T3977] 8021q: adding VLAN 0 to HW filter on device bond6 [ 813.044559][ T3979] netlink: 48 bytes leftover after parsing attributes in process `syz.4.8642'. [ 813.166666][ T3993] netlink: 'syz.1.8645': attribute type 4 has an invalid length. [ 813.202775][ T3993] netlink: 17 bytes leftover after parsing attributes in process `syz.1.8645'. [ 813.299738][ T4002] netlink: 8 bytes leftover after parsing attributes in process `syz.4.8646'. [ 813.425048][ T4012] FAULT_INJECTION: forcing a failure. [ 813.425048][ T4012] name failslab, interval 1, probability 0, space 0, times 0 [ 813.430662][ T4008] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8648'. [ 813.438095][ T4012] CPU: 0 UID: 0 PID: 4012 Comm: syz.4.8650 Not tainted syzkaller #0 PREEMPT(full) [ 813.438118][ T4012] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 813.438130][ T4012] Call Trace: [ 813.438137][ T4012] [ 813.438145][ T4012] dump_stack_lvl+0xe8/0x150 [ 813.438174][ T4012] should_fail_ex+0x412/0x560 [ 813.438198][ T4012] should_failslab+0xa8/0x100 [ 813.438226][ T4012] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 813.438252][ T4012] ? __alloc_skb+0x186/0x7d0 [ 813.438272][ T4012] ? __alloc_skb+0x1d0/0x7d0 [ 813.438290][ T4012] ? __local_bh_enable_ip+0xd0/0x130 [ 813.438319][ T4012] __alloc_skb+0x1d0/0x7d0 [ 813.438349][ T4012] netlink_sendmsg+0x5d4/0xb40 [ 813.438379][ T4012] ? __pfx_netlink_sendmsg+0x10/0x10 [ 813.438402][ T4012] ? aa_sock_msg_perm+0xf1/0x1b0 [ 813.438424][ T4012] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 813.438444][ T4012] ? __pfx_netlink_sendmsg+0x10/0x10 [ 813.438462][ T4012] ____sys_sendmsg+0xa68/0xad0 [ 813.438493][ T4012] ? __pfx_____sys_sendmsg+0x10/0x10 [ 813.438524][ T4012] ? import_iovec+0x73/0xa0 [ 813.438550][ T4012] ___sys_sendmsg+0x2a5/0x360 [ 813.438578][ T4012] ? __pfx____sys_sendmsg+0x10/0x10 [ 813.438633][ T4012] ? __fget_files+0x2a/0x420 [ 813.438654][ T4012] ? __fget_files+0x3a0/0x420 [ 813.438686][ T4012] __x64_sys_sendmsg+0x1bd/0x2a0 [ 813.438711][ T4012] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 813.438744][ T4012] ? __pfx_ksys_write+0x10/0x10 [ 813.438772][ T4012] do_syscall_64+0x14d/0xf80 [ 813.438793][ T4012] ? trace_irq_disable+0x3b/0x150 [ 813.438816][ T4012] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 813.438834][ T4012] ? clear_bhb_loop+0x40/0x90 [ 813.438854][ T4012] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 813.438871][ T4012] RIP: 0033:0x7fb29219c799 [ 813.438888][ T4012] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 813.438902][ T4012] RSP: 002b:00007fb292fec028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 813.438920][ T4012] RAX: ffffffffffffffda RBX: 00007fb292415fa0 RCX: 00007fb29219c799 [ 813.438933][ T4012] RDX: 0000000000000000 RSI: 0000200000000300 RDI: 0000000000000003 [ 813.438944][ T4012] RBP: 00007fb292fec090 R08: 0000000000000000 R09: 0000000000000000 [ 813.438954][ T4012] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 813.438964][ T4012] R13: 00007fb292416038 R14: 00007fb292415fa0 R15: 00007ffd62cb8e98 [ 813.438993][ T4012] [ 813.572123][ T4018] netlink: 4 bytes leftover after parsing attributes in process `syz.4.8653'. [ 813.720256][ T4018] netlink: 'syz.4.8653': attribute type 1 has an invalid length. [ 813.764010][ T4018] netlink: 28 bytes leftover after parsing attributes in process `syz.4.8653'. [ 813.889831][ T4027] netlink: 'syz.3.8656': attribute type 1 has an invalid length. [ 813.981667][ T4027] bond7: entered promiscuous mode [ 813.989294][ T4027] 8021q: adding VLAN 0 to HW filter on device bond7 [ 814.051267][ T4037] bond7: (slave bridge11): making interface the new active one [ 814.079953][ T4037] bridge11: entered promiscuous mode [ 814.089517][ T4037] bond7: (slave bridge11): Enslaving as an active interface with an up link [ 814.150054][ T4041] wg1 speed is unknown, defaulting to 1000 [ 814.190075][ T4041] ªªªªª9 speed is unknown, defaulting to 1000 [ 814.233806][ T4044] wg1 speed is unknown, defaulting to 1000 [ 814.287240][ T4044] ªªªªª9 speed is unknown, defaulting to 1000 [ 814.548265][ T4070] IPv6: sit3: Disabled Multicast RS [ 814.704058][ T4078] batadv0: Device is already in use. [ 815.057698][ T4104] bond8: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 815.076851][ T4104] bond8: (slave lo): Enslaving as an active interface with an up link [ 815.085846][ T4104] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 815.232714][ T4112] team0: Port device team_slave_0 removed [ 815.315725][ T4121] syzkaller1: entered promiscuous mode [ 815.321403][ T4121] syzkaller1: entered allmulticast mode [ 815.542139][ T4129] syzkaller0: entered promiscuous mode [ 815.553275][ T4129] syzkaller0: entered allmulticast mode [ 815.582325][ T4132] wg1 speed is unknown, defaulting to 1000 [ 815.613465][ T4132] ªªªªª9 speed is unknown, defaulting to 1000 [ 816.435471][ T4185] IPVS: set_ctl: invalid protocol: 4 172.20.20.170:21 [ 817.060898][ T4216] wg1 speed is unknown, defaulting to 1000 [ 817.095107][ T4216] ªªªªª9 speed is unknown, defaulting to 1000 [ 817.233507][ T4225] netlink: 'syz.1.8713': attribute type 10 has an invalid length. [ 817.243143][ T4225] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 817.636251][ T4246] __nla_validate_parse: 12 callbacks suppressed [ 817.636275][ T4246] netlink: 352 bytes leftover after parsing attributes in process `syz.2.8720'. [ 817.764379][ T4251] wg1 speed is unknown, defaulting to 1000 [ 817.796120][ T4251] ªªªªª9 speed is unknown, defaulting to 1000 [ 817.839017][ T4248] wg1 speed is unknown, defaulting to 1000 [ 817.864387][ T4254] tipc: Enabling of bearer rejected, failed to enable media [ 817.880724][ T4254] tipc: Enabling of bearer rejected, failed to enable media [ 817.910277][ T4248] ªªªªª9 speed is unknown, defaulting to 1000 [ 817.917024][ T4254] tipc: Enabling of bearer rejected, failed to enable media [ 817.945843][ T4254] tipc: Enabling of bearer rejected, failed to enable media [ 817.971021][ T4254] tipc: Enabling of bearer rejected, failed to enable media [ 817.984856][ T4254] tipc: Enabling of bearer rejected, failed to enable media [ 817.993369][ T4254] tipc: Enabling of bearer rejected, failed to enable media [ 818.006321][ T4254] tipc: Enabling of bearer rejected, failed to enable media [ 818.018351][ T4254] tipc: Enabling of bearer rejected, failed to enable media [ 818.035483][ T4254] tipc: Enabling of bearer rejected, failed to enable media [ 818.048607][ T4254] tipc: Enabling of bearer rejected, failed to enable media [ 818.057491][ T4254] tipc: Enabling of bearer rejected, failed to enable media [ 818.066810][ T4254] tipc: Enabling of bearer rejected, failed to enable media [ 818.129833][ T4254] tipc: Enabling of bearer rejected, failed to enable media [ 818.139834][ T4254] tipc: Enabling of bearer rejected, failed to enable media [ 818.149798][ T4254] tipc: Enabling of bearer rejected, failed to enable media [ 818.158910][ T4254] tipc: Enabling of bearer rejected, failed to enable media [ 818.168834][ T4254] tipc: Enabling of bearer rejected, failed to enable media [ 818.177743][ T4254] tipc: Enabling of bearer rejected, failed to enable media [ 818.187369][ T4254] tipc: Enabling of bearer rejected, failed to enable media [ 818.197018][ T4254] tipc: Enabling of bearer rejected, failed to enable media [ 818.208312][ T4254] tipc: Enabling of bearer rejected, failed to enable media [ 818.216850][ T4254] tipc: Enabling of bearer rejected, failed to enable media [ 818.225526][ T4254] tipc: Enabling of bearer rejected, failed to enable media [ 818.234602][ T4254] tipc: Enabling of bearer rejected, failed to enable media [ 818.243165][ T4254] tipc: Enabling of bearer rejected, failed to enable media [ 818.251738][ T4254] tipc: Enabling of bearer rejected, failed to enable media [ 818.260404][ T4254] tipc: Enabling of bearer rejected, failed to enable media [ 818.269802][ T4254] tipc: Enabling of bearer rejected, failed to enable media [ 818.278436][ T4254] tipc: Enabling of bearer rejected, failed to enable media [ 818.287250][ T4254] tipc: Enabling of bearer rejected, failed to enable media [ 818.295970][ T4254] tipc: Enabling of bearer rejected, failed to enable media [ 818.304756][ T4254] tipc: Enabling of bearer rejected, failed to enable media [ 818.313293][ T4254] tipc: Enabling of bearer rejected, failed to enable media [ 818.321911][ T4254] tipc: Enabling of bearer rejected, failed to enable media [ 818.330602][ T4254] tipc: Enabling of bearer rejected, failed to enable media [ 818.369115][ T4254] tipc: Enabling of bearer rejected, failed to enable media [ 818.393944][ T4254] tipc: Enabling of bearer rejected, failed to enable media [ 818.453540][ T4254] tipc: Enabling of bearer rejected, failed to enable media [ 818.490211][ T4254] tipc: Enabling of bearer rejected, failed to enable media [ 818.522973][ T4254] tipc: Enabling of bearer rejected, failed to enable media [ 818.563786][ T4268] wg1 speed is unknown, defaulting to 1000 [ 818.564655][ T4254] tipc: Enabling of bearer rejected, failed to enable media [ 818.608137][ T4254] tipc: Enabling of bearer rejected, failed to enable media [ 818.674122][ T4268] ªªªªª9 speed is unknown, defaulting to 1000 [ 818.682792][ T4254] tipc: Enabling of bearer rejected, failed to enable media [ 818.775145][ T4286] netlink: 8 bytes leftover after parsing attributes in process `syz.4.8732'. [ 818.790464][ T4279] netlink: 28 bytes leftover after parsing attributes in process `syz.1.8728'. [ 818.810918][ T4288] netlink: 352 bytes leftover after parsing attributes in process `syz.2.8733'. [ 818.980934][ T4298] syzkaller1: entered promiscuous mode [ 818.988203][ T4299] netlink: 'syz.1.8738': attribute type 2 has an invalid length. [ 818.994989][ T4298] syzkaller1: entered allmulticast mode [ 819.025327][ T58] bridge_slave_1: left allmulticast mode [ 819.031011][ T58] bridge_slave_1: left promiscuous mode [ 819.053878][ T58] bridge0: port 2(bridge_slave_1) entered disabled state [ 819.068427][ T58] bridge_slave_0: left allmulticast mode [ 819.085451][ T58] bridge0: port 1(bridge_slave_0) entered disabled state [ 819.642436][ T58] bond5 (unregistering): (slave bridge7): Releasing active interface [ 819.722805][ T58] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 819.733938][ T58] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 819.745044][ T58] bond0 (unregistering): (slave dummy0): Releasing backup interface [ 819.755171][ T58] bond0 (unregistering): Released all slaves [ 819.770366][ T58] bond1 (unregistering): Released all slaves [ 819.789916][ T58] bond2 (unregistering): Released all slaves [ 819.804648][ T58] bond3 (unregistering): Released all slaves [ 819.821547][ T58] bond4 (unregistering): Released all slaves [ 819.842993][ T58] bond5 (unregistering): Released all slaves [ 819.860069][ T58] bond6 (unregistering): Released all slaves [ 819.899396][ T4304] sit1: entered promiscuous mode [ 820.045844][ T58] : left promiscuous mode [ 820.135840][ T4317] syzkaller1: entered promiscuous mode [ 820.141351][ T4317] syzkaller1: entered allmulticast mode [ 820.166169][ T58] m1Ie5nè‹Ò: left promiscuous mode [ 820.179972][ T4317] FAULT_INJECTION: forcing a failure. [ 820.179972][ T4317] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 820.228063][ T4317] CPU: 0 UID: 0 PID: 4317 Comm: syz.2.8744 Not tainted syzkaller #0 PREEMPT(full) [ 820.228089][ T4317] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 820.228100][ T4317] Call Trace: [ 820.228107][ T4317] [ 820.228115][ T4317] dump_stack_lvl+0xe8/0x150 [ 820.228145][ T4317] should_fail_ex+0x412/0x560 [ 820.228170][ T4317] _copy_from_iter+0x1d3/0x1670 [ 820.228193][ T4317] ? unwind_next_frame+0xa5/0x23c0 [ 820.228225][ T4317] ? __lock_acquire+0x6b5/0x2cf0 [ 820.228247][ T4317] ? __pfx__copy_from_iter+0x10/0x10 [ 820.228284][ T4317] tun_get_user+0x275/0x3dd0 [ 820.228319][ T4317] ? aa_file_perm+0x12d/0x1630 [ 820.228342][ T4317] ? aa_file_perm+0x12d/0x1630 [ 820.228362][ T4317] ? aa_file_perm+0x440/0x1630 [ 820.228383][ T4317] ? __pfx_tun_get_user+0x10/0x10 [ 820.228410][ T4317] ? __lock_acquire+0x6b5/0x2cf0 [ 820.228441][ T4317] ? ref_tracker_alloc+0x363/0x4d0 [ 820.228465][ T4317] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 820.228491][ T4317] ? tun_get+0x1c/0x2f0 [ 820.228517][ T4317] ? tun_get+0x1c/0x2f0 [ 820.228538][ T4317] ? tun_get+0x1c/0x2f0 [ 820.228563][ T4317] tun_chr_write_iter+0x113/0x200 [ 820.228588][ T4317] vfs_write+0x61d/0xb90 [ 820.228614][ T4317] ? __pfx_vfs_write+0x10/0x10 [ 820.228642][ T4317] ? __fget_files+0x2a/0x420 [ 820.228681][ T4317] ksys_write+0x150/0x270 [ 820.228702][ T4317] ? __pfx_ksys_write+0x10/0x10 [ 820.228731][ T4317] do_syscall_64+0x14d/0xf80 [ 820.228753][ T4317] ? trace_irq_disable+0x3b/0x150 [ 820.228777][ T4317] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 820.228796][ T4317] ? clear_bhb_loop+0x40/0x90 [ 820.228818][ T4317] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 820.228835][ T4317] RIP: 0033:0x7fb68eb9c799 [ 820.228853][ T4317] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 820.228869][ T4317] RSP: 002b:00007fb68fa78028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 820.228888][ T4317] RAX: ffffffffffffffda RBX: 00007fb68ee15fa0 RCX: 00007fb68eb9c799 [ 820.228901][ T4317] RDX: 000000000000002a RSI: 0000200000000180 RDI: 0000000000000003 [ 820.228912][ T4317] RBP: 00007fb68fa78090 R08: 0000000000000000 R09: 0000000000000000 [ 820.228924][ T4317] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 820.228935][ T4317] R13: 00007fb68ee16038 R14: 00007fb68ee15fa0 R15: 00007ffed3127958 [ 820.228965][ T4317] [ 820.499241][ T4332] netlink: 44 bytes leftover after parsing attributes in process `syz.3.8747'. [ 820.551462][ T58] tipc: Disabling bearer [ 820.564305][ T58] tipc: Disabling bearer [ 820.602472][ T58] tipc: Left network mode [ 820.734931][ T58] IPVS: stopping backup sync thread 24624 ... [ 820.836166][ T4340] bridge13: the hash_elasticity option has been deprecated and is always 16 [ 820.942118][ T4339] netlink: 12 bytes leftover after parsing attributes in process `syz.4.8750'. [ 820.952343][ T4339] IPv6: Can't replace route, no match found [ 820.972950][ T4347] wg1 speed is unknown, defaulting to 1000 [ 820.983001][ T4347] ªªªªª9 speed is unknown, defaulting to 1000 [ 821.515004][ T4400] delete_channel: no stack [ 821.520969][ T4401] netlink: 44 bytes leftover after parsing attributes in process `syz.3.8762'. [ 821.526479][ T4400] delete_channel: no stack [ 821.568104][ T4400] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 821.707793][ T58] team0 (unregistering): Port device team_slave_1 removed [ 821.721746][ T58] team0 (unregistering): Port device team_slave_0 removed [ 821.896505][ T4406] bond8: option ad_select: invalid value (34) [ 821.904814][ T4406] bond8 (unregistering): Released all slaves [ 822.024555][ T4410] syzkaller1: entered promiscuous mode [ 822.030067][ T4410] syzkaller1: entered allmulticast mode [ 822.135977][ T4414] tipc: Enabling of bearer rejected, failed to enable media [ 822.145083][ T4414] FAULT_INJECTION: forcing a failure. [ 822.145083][ T4414] name failslab, interval 1, probability 0, space 0, times 0 [ 822.160175][ T4414] CPU: 0 UID: 0 PID: 4414 Comm: syz.3.8767 Not tainted syzkaller #0 PREEMPT(full) [ 822.160198][ T4414] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 822.160209][ T4414] Call Trace: [ 822.160216][ T4414] [ 822.160224][ T4414] dump_stack_lvl+0xe8/0x150 [ 822.160251][ T4414] should_fail_ex+0x412/0x560 [ 822.160277][ T4414] should_failslab+0xa8/0x100 [ 822.160298][ T4414] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 822.160325][ T4414] ? __alloc_skb+0x1d0/0x7d0 [ 822.160343][ T4414] ? __local_bh_enable_ip+0xd0/0x130 [ 822.160369][ T4414] __alloc_skb+0x1d0/0x7d0 [ 822.160389][ T4414] ? netlink_ack_tlv_len+0x6c/0x210 [ 822.160409][ T4414] netlink_ack+0x146/0xa50 [ 822.160426][ T4414] ? __pfx_genl_rcv_msg+0x10/0x10 [ 822.160453][ T4414] ? __lock_acquire+0x6b5/0x2cf0 [ 822.160485][ T4414] netlink_rcv_skb+0x2b6/0x4b0 [ 822.160505][ T4414] ? __pfx_genl_rcv_msg+0x10/0x10 [ 822.160530][ T4414] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 822.160566][ T4414] ? down_read+0x272/0x2e0 [ 822.160588][ T4414] ? genl_rcv+0xd/0x40 [ 822.160611][ T4414] genl_rcv+0x28/0x40 [ 822.160632][ T4414] netlink_unicast+0x80f/0x9b0 [ 822.160659][ T4414] ? __pfx_netlink_unicast+0x10/0x10 [ 822.160679][ T4414] ? netlink_sendmsg+0x650/0xb40 [ 822.160698][ T4414] ? skb_put+0x11b/0x210 [ 822.160723][ T4414] netlink_sendmsg+0x813/0xb40 [ 822.160758][ T4414] ? __pfx_netlink_sendmsg+0x10/0x10 [ 822.160780][ T4414] ? aa_sock_msg_perm+0xf1/0x1b0 [ 822.160803][ T4414] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 822.160824][ T4414] ? __pfx_netlink_sendmsg+0x10/0x10 [ 822.160843][ T4414] ____sys_sendmsg+0xa68/0xad0 [ 822.160880][ T4414] ? __pfx_____sys_sendmsg+0x10/0x10 [ 822.160911][ T4414] ? import_iovec+0x73/0xa0 [ 822.160936][ T4414] ___sys_sendmsg+0x2a5/0x360 [ 822.160963][ T4414] ? __pfx____sys_sendmsg+0x10/0x10 [ 822.161022][ T4414] ? __fget_files+0x2a/0x420 [ 822.161045][ T4414] ? __fget_files+0x3a0/0x420 [ 822.161078][ T4414] __x64_sys_sendmsg+0x1bd/0x2a0 [ 822.161105][ T4414] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 822.161139][ T4414] ? __pfx_ksys_write+0x10/0x10 [ 822.161169][ T4414] do_syscall_64+0x14d/0xf80 [ 822.161190][ T4414] ? trace_irq_disable+0x3b/0x150 [ 822.161214][ T4414] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 822.161232][ T4414] ? clear_bhb_loop+0x40/0x90 [ 822.161252][ T4414] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 822.161269][ T4414] RIP: 0033:0x7fa0df79c799 [ 822.161287][ T4414] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 822.161302][ T4414] RSP: 002b:00007fa0e0583028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 822.161322][ T4414] RAX: ffffffffffffffda RBX: 00007fa0dfa15fa0 RCX: 00007fa0df79c799 [ 822.161335][ T4414] RDX: 0000000000000000 RSI: 0000200000000300 RDI: 0000000000000003 [ 822.161347][ T4414] RBP: 00007fa0e0583090 R08: 0000000000000000 R09: 0000000000000000 [ 822.161358][ T4414] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 822.161368][ T4414] R13: 00007fa0dfa16038 R14: 00007fa0dfa15fa0 R15: 00007ffcc9bf4748 [ 822.161398][ T4414] [ 822.477032][ T58] IPVS: stop unused estimator thread 0... [ 822.737022][ T4430] netlink: 'syz.3.8772': attribute type 4 has an invalid length. [ 822.756755][ T4431] netlink: 8 bytes leftover after parsing attributes in process `syz.3.8772'. [ 822.954437][ T4446] netlink: 12 bytes leftover after parsing attributes in process `syz.0.8774'. [ 822.986056][ T4446] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8774'. [ 823.029305][ T4448] netlink: 20 bytes leftover after parsing attributes in process `syz.3.8778'. [ 823.043258][ T4449] netlink: 'syz.0.8774': attribute type 9 has an invalid length. [ 823.051864][ T4448] netlink: 4 bytes leftover after parsing attributes in process `syz.3.8778'. [ 823.100053][ T4448] batadv1: entered promiscuous mode [ 823.114772][ T4448] batadv1: entered allmulticast mode [ 823.126858][ T4448] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 823.141693][ T4436] netlink: 44 bytes leftover after parsing attributes in process `syz.0.8774'. [ 823.177911][ T4453] tipc: Started in network mode [ 823.182967][ T4453] tipc: Node identity , cluster identity 4711 [ 823.191827][ T4453] tipc: Failed to set node id, please configure manually [ 823.199103][ T4453] tipc: Enabling of bearer rejected, failed to enable media [ 823.209508][ T4453] FAULT_INJECTION: forcing a failure. [ 823.209508][ T4453] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 823.227626][ T4453] CPU: 0 UID: 0 PID: 4453 Comm: syz.4.8779 Not tainted syzkaller #0 PREEMPT(full) [ 823.227649][ T4453] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 823.227660][ T4453] Call Trace: [ 823.227666][ T4453] [ 823.227674][ T4453] dump_stack_lvl+0xe8/0x150 [ 823.227702][ T4453] should_fail_ex+0x412/0x560 [ 823.227728][ T4453] _copy_to_user+0x31/0xb0 [ 823.227761][ T4453] simple_read_from_buffer+0xe1/0x170 [ 823.227789][ T4453] proc_fail_nth_read+0x1bb/0x230 [ 823.227814][ T4453] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 823.227839][ T4453] ? rw_verify_area+0x2a6/0x4d0 [ 823.227857][ T4453] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 823.227880][ T4453] vfs_read+0x20c/0xa70 [ 823.227895][ T4453] ? fdget_pos+0x246/0x320 [ 823.227926][ T4453] ? __pfx___mutex_lock+0x10/0x10 [ 823.227950][ T4453] ? __pfx_vfs_read+0x10/0x10 [ 823.227970][ T4453] ? __fget_files+0x2a/0x420 [ 823.227996][ T4453] ? __fget_files+0x3a0/0x420 [ 823.228018][ T4453] ? __fget_files+0x2a/0x420 [ 823.228048][ T4453] ksys_read+0x150/0x270 [ 823.228068][ T4453] ? __pfx_ksys_read+0x10/0x10 [ 823.228097][ T4453] do_syscall_64+0x14d/0xf80 [ 823.228118][ T4453] ? trace_irq_disable+0x3b/0x150 [ 823.228140][ T4453] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 823.228157][ T4453] ? clear_bhb_loop+0x40/0x90 [ 823.228178][ T4453] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 823.228194][ T4453] RIP: 0033:0x7fb29215cfce [ 823.228211][ T4453] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 823.228226][ T4453] RSP: 002b:00007fb292febfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 823.228243][ T4453] RAX: ffffffffffffffda RBX: 00007fb292fec6c0 RCX: 00007fb29215cfce [ 823.228256][ T4453] RDX: 000000000000000f RSI: 00007fb292fec0a0 RDI: 0000000000000004 [ 823.228267][ T4453] RBP: 00007fb292fec090 R08: 0000000000000000 R09: 0000000000000000 [ 823.228277][ T4453] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 823.228286][ T4453] R13: 00007fb292416038 R14: 00007fb292415fa0 R15: 00007ffd62cb8e98 [ 823.228316][ T4453] [ 823.248977][ T4452] wg1 speed is unknown, defaulting to 1000 [ 823.340053][ T4460] xt_TCPMSS: Only works on TCP SYN packets [ 823.347280][ T4452] ªªªªª9 speed is unknown, defaulting to 1000 [ 823.396544][ T4456] netlink: 1100 bytes leftover after parsing attributes in process `syz.3.8781'. [ 823.423670][ T4458] netlink: 12 bytes leftover after parsing attributes in process `syz.3.8781'. [ 823.484049][ T4458] netlink: 12 bytes leftover after parsing attributes in process `syz.3.8781'. [ 823.496829][ T4456] tipc: Enabled bearer , priority 0 [ 823.536659][ T4456] tipc: Disabling bearer [ 823.568721][ T4466] netlink: 352 bytes leftover after parsing attributes in process `syz.2.8784'. [ 823.812496][ T4475] vlan6: entered promiscuous mode [ 823.844217][ T4475] geneve1: entered promiscuous mode [ 823.854128][ T4475] vlan6: entered allmulticast mode [ 823.868610][ T4475] geneve1: entered allmulticast mode [ 824.098268][ T4496] netlink: 'syz.4.8794': attribute type 2 has an invalid length. [ 824.211501][ T4501] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 824.224079][ T4501] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 824.234658][ T4501] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 824.243200][ T4501] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 824.251740][ T4501] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 824.348969][ T51] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 824.364115][ T51] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 824.371583][ T51] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 824.380461][ T51] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 824.389809][ T51] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 824.508317][ T4499] wg1 speed is unknown, defaulting to 1000 [ 824.531426][ T4499] ªªªªª9 speed is unknown, defaulting to 1000 [ 825.020380][ T4533] bridge19: the hash_elasticity option has been deprecated and is always 16 [ 825.029480][ T4533] bridge19: entered allmulticast mode [ 825.121442][ T4499] chnl_net:caif_netlink_parms(): no params data found [ 825.250512][ T4499] bridge0: port 1(bridge_slave_0) entered blocking state [ 825.268240][ T4499] bridge0: port 1(bridge_slave_0) entered disabled state [ 825.277774][ T4546] x_tables: duplicate underflow at hook 2 [ 825.292134][ T4499] bridge_slave_0: entered allmulticast mode [ 825.302359][ T4499] bridge_slave_0: entered promiscuous mode [ 825.312574][ T4499] bridge0: port 2(bridge_slave_1) entered blocking state [ 825.320047][ T4499] bridge0: port 2(bridge_slave_1) entered disabled state [ 825.327420][ T4499] bridge_slave_1: entered allmulticast mode [ 825.336715][ T4499] bridge_slave_1: entered promiscuous mode [ 825.401639][ T4499] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 825.431541][ T4499] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 825.529795][ T4562] sock: sock_set_timeout: `syz.0.8810' (pid 4562) tries to set negative timeout [ 825.553394][ T4499] team0: Port device team_slave_0 added [ 825.585283][ T4499] team0: Port device team_slave_1 added [ 825.667569][ T4499] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 825.694080][ T4499] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 825.725368][ T4499] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 825.739749][ T4499] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 825.783737][ T4499] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 825.812933][ T4499] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 825.974263][ T4499] hsr_slave_0: entered promiscuous mode [ 825.985058][ T4499] hsr_slave_1: entered promiscuous mode [ 825.991895][ T4499] debugfs: 'hsr0' already exists in 'hsr' [ 825.998761][ T4499] Cannot create hsr debugfs directory [ 826.189466][ T4593] SET target dimension over the limit! [ 826.423818][ T4501] Bluetooth: hci0: command tx timeout [ 826.509522][ T4499] netdevsim netdevsim1 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 826.647058][ T4499] netdevsim netdevsim1 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 826.737536][ T4618] syzkaller0: entered promiscuous mode [ 826.743042][ T4618] syzkaller0: entered allmulticast mode [ 826.801197][ T4499] netdevsim netdevsim1 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 827.099593][ T4499] netdevsim netdevsim1 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 827.251209][ T2807] bridge_slave_1: left allmulticast mode [ 827.258182][ T2807] bridge_slave_1: left promiscuous mode [ 827.282561][ T2807] bridge0: port 2(bridge_slave_1) entered disabled state [ 827.957897][ T2807] bond4 (unregistering): (slave bridge11): Releasing active interface [ 827.966318][ T2807] bridge11 (unregistering): left promiscuous mode [ 827.972745][ T2807] bridge11 (unregistering): left allmulticast mode [ 828.081335][ T2807] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 828.090381][ T2807] bond_slave_0: left promiscuous mode [ 828.097200][ T2807] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 828.107314][ T2807] bond_slave_1: left promiscuous mode [ 828.113274][ T2807] bond0 (unregistering): Released all slaves [ 828.125496][ T2807] bond1 (unregistering): Released all slaves [ 828.138116][ T2807] bond2 (unregistering): Released all slaves [ 828.150911][ T2807] bond3 (unregistering): Released all slaves [ 828.172261][ T2807] bond4 (unregistering): Released all slaves [ 828.184967][ T2807] bond5 (unregistering): Released all slaves [ 828.404341][ T4669] __nla_validate_parse: 11 callbacks suppressed [ 828.404357][ T4669] netlink: 352 bytes leftover after parsing attributes in process `syz.4.8844'. [ 828.427187][ T2807] tipc: Left network mode [ 828.431455][ T4499] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 828.505752][ T4501] Bluetooth: hci0: command tx timeout [ 828.527839][ T4665] wg1 speed is unknown, defaulting to 1000 [ 828.534372][ T4499] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 828.547147][ T2807] IPVS: stopping backup sync thread 26591 ... [ 828.569463][ T4499] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 828.589544][ T4499] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 828.638079][ T4665] ªªªªª9 speed is unknown, defaulting to 1000 [ 829.030889][ T4499] 8021q: adding VLAN 0 to HW filter on device bond0 [ 829.088725][ T4499] 8021q: adding VLAN 0 to HW filter on device team0 [ 829.108764][ T2805] bridge0: port 1(bridge_slave_0) entered blocking state [ 829.115923][ T2805] bridge0: port 1(bridge_slave_0) entered forwarding state [ 829.171468][ T2805] bridge0: port 2(bridge_slave_1) entered blocking state [ 829.178655][ T2805] bridge0: port 2(bridge_slave_1) entered forwarding state [ 829.223964][ C1] ================================================================== [ 829.232064][ C1] BUG: KASAN: slab-use-after-free in rose_t0timer_expiry+0x1ea/0x560 [ 829.240148][ C1] Read of size 8 at addr ffff88807c780c18 by task kworker/u8:10/2807 [ 829.248226][ C1] [ 829.250550][ C1] CPU: 1 UID: 0 PID: 2807 Comm: kworker/u8:10 Not tainted syzkaller #0 PREEMPT(full) [ 829.250568][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 829.250579][ C1] Workqueue: netns cleanup_net [ 829.250603][ C1] Call Trace: [ 829.250610][ C1] [ 829.250618][ C1] dump_stack_lvl+0xe8/0x150 [ 829.250641][ C1] print_report+0xba/0x230 [ 829.250658][ C1] ? rose_t0timer_expiry+0x1ea/0x560 [ 829.250675][ C1] kasan_report+0x117/0x150 [ 829.250693][ C1] ? rose_t0timer_expiry+0x1ea/0x560 [ 829.250713][ C1] rose_t0timer_expiry+0x1ea/0x560 [ 829.250732][ C1] call_timer_fn+0x192/0x640 [ 829.250750][ C1] ? __pfx_rose_t0timer_expiry+0x10/0x10 [ 829.250767][ C1] ? call_timer_fn+0xd4/0x640 [ 829.250784][ C1] ? __pfx_call_timer_fn+0x10/0x10 [ 829.250806][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 829.250822][ C1] ? __pfx_rose_t0timer_expiry+0x10/0x10 [ 829.250840][ C1] __run_timer_base+0x652/0x8b0 [ 829.250856][ C1] ? ktime_get+0x45/0x200 [ 829.250874][ C1] ? __pfx___run_timer_base+0x10/0x10 [ 829.250893][ C1] ? sched_clock_cpu+0x74/0x440 [ 829.250914][ C1] run_timer_softirq+0xb7/0x170 [ 829.250931][ C1] handle_softirqs+0x22a/0x870 [ 829.250951][ C1] ? __irq_exit_rcu+0x5f/0x150 [ 829.250972][ C1] __irq_exit_rcu+0x5f/0x150 [ 829.250990][ C1] irq_exit_rcu+0x9/0x30 [ 829.251007][ C1] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 829.251032][ C1] [ 829.251037][ C1] [ 829.251043][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 829.251060][ C1] RIP: 0010:batadv_hardif_get_by_netdev+0x15f/0x3d0 [ 829.251081][ C1] Code: f6 4c 8b 3d f3 5b 07 0f 49 81 ff 80 13 7e 9a 0f 84 a8 01 00 00 4c 89 6c 24 10 49 8d 5f 18 48 89 d8 48 c1 e8 03 42 80 3c 20 00 <74> 08 48 89 df e8 c7 fd b8 f6 4c 39 2b 74 0a e8 cd d4 4e f6 e9 fd [ 829.251094][ C1] RSP: 0018:ffffc9000e257240 EFLAGS: 00000246 [ 829.251107][ C1] RAX: 1ffff11004f9ac03 RBX: ffff888027cd6018 RCX: ffff8880546a5ac0 [ 829.251119][ C1] RDX: 0000000000000000 RSI: ffffffff8c27a460 RDI: ffffffff8c27a420 [ 829.251130][ C1] RBP: ffffc9000e2572e8 R08: ffffffff8b76b6c9 R09: ffffffff8e7602e0 [ 829.251141][ C1] R10: dffffc0000000000 R11: ffffffff8b76f6a0 R12: dffffc0000000000 [ 829.251152][ C1] R13: ffff88807341c000 R14: 1ffff92001c4ae4c R15: ffff888027cd6000 [ 829.251165][ C1] ? __pfx_batadv_hard_if_event+0x10/0x10 [ 829.251184][ C1] ? batadv_hardif_get_by_netdev+0x79/0x3d0 [ 829.251207][ C1] ? batadv_hardif_get_by_netdev+0x79/0x3d0 [ 829.251225][ C1] ? __pfx_batadv_hardif_get_by_netdev+0x10/0x10 [ 829.251242][ C1] ? __asan_memset+0x22/0x50 [ 829.251263][ C1] ? lowpan_event+0x122/0x6b0 [ 829.251283][ C1] batadv_hard_if_event+0x82/0x1700 [ 829.251301][ C1] ? dcbnl_netdevice_event+0x268/0x2b0 [ 829.251315][ C1] ? lockdep_rtnl_is_held+0x26/0x40 [ 829.251339][ C1] notifier_call_chain+0x1be/0x400 [ 829.251365][ C1] unregister_netdevice_many_notify+0x1cbf/0x2370 [ 829.251387][ C1] ? __pfx_unregister_netdevice_many_notify+0x10/0x10 [ 829.251411][ C1] unregister_netdevice_queue+0x31f/0x360 [ 829.251435][ C1] ? __pfx_unregister_netdevice_queue+0x10/0x10 [ 829.251461][ C1] _cfg80211_unregister_wdev+0x155/0x570 [ 829.251480][ C1] ieee80211_remove_interfaces+0x49c/0x6d0 [ 829.251496][ C1] ? __pfx_autoremove_wake_function+0x10/0x10 [ 829.251513][ C1] ? __pfx_ieee80211_remove_interfaces+0x10/0x10 [ 829.251533][ C1] ieee80211_unregister_hw+0x5d/0x2c0 [ 829.251556][ C1] mac80211_hwsim_del_radio+0x28a/0x490 [ 829.251581][ C1] ? __pfx_mac80211_hwsim_del_radio+0x10/0x10 [ 829.251602][ C1] ? hwsim_exit_net+0xd11/0xfa0 [ 829.251623][ C1] ? __local_bh_enable_ip+0xd0/0x130 [ 829.251643][ C1] hwsim_exit_net+0xede/0xfa0 [ 829.251664][ C1] ? hwsim_exit_net+0x336/0xfa0 [ 829.251690][ C1] ? __pfx_hwsim_exit_net+0x10/0x10 [ 829.251711][ C1] ? __ip_vs_dev_cleanup_batch+0x238/0x260 [ 829.251727][ C1] ops_undo_list+0x49f/0x940 [ 829.251747][ C1] ? __pfx_ops_undo_list+0x10/0x10 [ 829.251766][ C1] ? idr_destroy+0x218/0x290 [ 829.251781][ C1] ? do_raw_spin_unlock+0xf5/0x210 [ 829.251798][ C1] cleanup_net+0x56b/0x800 [ 829.251816][ C1] ? __pfx_cleanup_net+0x10/0x10 [ 829.251836][ C1] ? process_scheduled_works+0xa25/0x1830 [ 829.251854][ C1] ? process_scheduled_works+0xa25/0x1830 [ 829.251873][ C1] process_scheduled_works+0xb02/0x1830 [ 829.251902][ C1] ? __pfx_process_scheduled_works+0x10/0x10 [ 829.251923][ C1] ? assign_work+0x3d5/0x5e0 [ 829.251942][ C1] worker_thread+0xa50/0xfc0 [ 829.251972][ C1] kthread+0x388/0x470 [ 829.251989][ C1] ? __pfx_worker_thread+0x10/0x10 [ 829.252007][ C1] ? __pfx_kthread+0x10/0x10 [ 829.252025][ C1] ret_from_fork+0x51e/0xb90 [ 829.252045][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 829.252062][ C1] ? __switch_to+0xc7d/0x1450 [ 829.252080][ C1] ? __pfx_kthread+0x10/0x10 [ 829.252093][ C1] ret_from_fork_asm+0x1a/0x30 [ 829.252120][ C1] [ 829.252126][ C1] [ 829.726790][ C1] Allocated by task 28358: [ 829.731188][ C1] kasan_save_track+0x3e/0x80 [ 829.735857][ C1] __kasan_kmalloc+0x93/0xb0 [ 829.740432][ C1] __kmalloc_cache_noprof+0x31c/0x660 [ 829.745790][ C1] rose_add_node+0x23c/0xf00 [ 829.750368][ C1] rose_rt_ioctl+0xd35/0x12a0 [ 829.755030][ C1] rose_ioctl+0x3fb/0x8f0 [ 829.759339][ C1] sock_do_ioctl+0x101/0x320 [ 829.763912][ C1] sock_ioctl+0x5c6/0x7f0 [ 829.768222][ C1] __se_sys_ioctl+0xfc/0x170 [ 829.772796][ C1] do_syscall_64+0x14d/0xf80 [ 829.777375][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 829.783262][ C1] [ 829.785576][ C1] Freed by task 28021: [ 829.789629][ C1] kasan_save_track+0x3e/0x80 [ 829.794300][ C1] kasan_save_free_info+0x46/0x50 [ 829.799317][ C1] __kasan_slab_free+0x5c/0x80 [ 829.804066][ C1] kfree+0x1c1/0x630 [ 829.807948][ C1] rose_timer_expiry+0x4cb/0x600 [ 829.812871][ C1] call_timer_fn+0x192/0x640 [ 829.817447][ C1] __run_timer_base+0x652/0x8b0 [ 829.822283][ C1] run_timer_softirq+0xb7/0x170 [ 829.827117][ C1] handle_softirqs+0x22a/0x870 [ 829.831867][ C1] __irq_exit_rcu+0x5f/0x150 [ 829.836444][ C1] irq_exit_rcu+0x9/0x30 [ 829.840668][ C1] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 829.846286][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 829.852250][ C1] [ 829.854555][ C1] The buggy address belongs to the object at ffff88807c780c00 [ 829.854555][ C1] which belongs to the cache kmalloc-512 of size 512 [ 829.868588][ C1] The buggy address is located 24 bytes inside of [ 829.868588][ C1] freed 512-byte region [ffff88807c780c00, ffff88807c780e00) [ 829.882280][ C1] [ 829.884590][ C1] The buggy address belongs to the physical page: [ 829.890990][ C1] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7c780 [ 829.899740][ C1] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 829.908217][ C1] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 829.915745][ C1] page_type: f5(slab) [ 829.919717][ C1] raw: 00fff00000000040 ffff88813fea3c80 dead000000000100 dead000000000122 [ 829.928283][ C1] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 829.936848][ C1] head: 00fff00000000040 ffff88813fea3c80 dead000000000100 dead000000000122 [ 829.945498][ C1] head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 829.954148][ C1] head: 00fff00000000002 ffffea0001f1e001 00000000ffffffff 00000000ffffffff [ 829.962802][ C1] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 829.971445][ C1] page dumped because: kasan: bad access detected [ 829.977843][ C1] page_owner tracks the page as allocated [ 829.983534][ C1] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5476, tgid 5476 (rcS), ts 48957413404, free_ts 40840880244 [ 830.003335][ C1] post_alloc_hook+0x231/0x280 [ 830.008100][ C1] get_page_from_freelist+0x24dc/0x2580 [ 830.013636][ C1] __alloc_frozen_pages_noprof+0x18d/0x380 [ 830.019427][ C1] allocate_slab+0x77/0x660 [ 830.023918][ C1] refill_objects+0x331/0x3c0 [ 830.028588][ C1] __pcs_replace_empty_main+0x2b9/0x620 [ 830.034124][ C1] __kmalloc_noprof+0x474/0x760 [ 830.038957][ C1] tomoyo_init_log+0x1aae/0x1fb0 [ 830.043883][ C1] tomoyo_supervisor+0x353/0x1570 [ 830.048893][ C1] tomoyo_path_permission+0x25a/0x380 [ 830.054245][ C1] tomoyo_check_open_permission+0x2b2/0x470 [ 830.060119][ C1] security_bprm_check+0x85/0x240 [ 830.065125][ C1] bprm_execve+0x896/0x1460 [ 830.069634][ C1] do_execveat_common+0x50d/0x690 [ 830.074639][ C1] __x64_sys_execve+0x97/0xc0 [ 830.079292][ C1] do_syscall_64+0x14d/0xf80 [ 830.083868][ C1] page last free pid 5206 tgid 5206 stack trace: [ 830.090172][ C1] __free_frozen_pages+0xc2b/0xdb0 [ 830.095269][ C1] __slab_free+0x263/0x2b0 [ 830.099671][ C1] qlist_free_all+0x97/0x100 [ 830.104240][ C1] kasan_quarantine_reduce+0x148/0x160 [ 830.109676][ C1] __kasan_slab_alloc+0x22/0x80 [ 830.114507][ C1] __kmalloc_noprof+0x316/0x760 [ 830.119342][ C1] tomoyo_realpath_from_path+0xe3/0x5d0 [ 830.124874][ C1] tomoyo_path_perm+0x283/0x560 [ 830.129707][ C1] security_inode_getattr+0x12b/0x310 [ 830.135063][ C1] vfs_getattr+0x23/0x70 [ 830.139289][ C1] vfs_statx_path+0x2b/0x230 [ 830.143865][ C1] vfs_statx+0x12e/0x200 [ 830.148094][ C1] vfs_fstatat+0x11b/0x170 [ 830.152494][ C1] __x64_sys_newfstatat+0x151/0x200 [ 830.157675][ C1] do_syscall_64+0x14d/0xf80 [ 830.162253][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 830.168127][ C1] [ 830.170430][ C1] Memory state around the buggy address: [ 830.176040][ C1] ffff88807c780b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 830.184084][ C1] ffff88807c780b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 830.192126][ C1] >ffff88807c780c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 830.200162][ C1] ^ [ 830.204990][ C1] ffff88807c780c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 830.213032][ C1] ffff88807c780d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 830.221070][ C1] ================================================================== [ 830.229235][ C1] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 830.236443][ C1] CPU: 1 UID: 0 PID: 2807 Comm: kworker/u8:10 Not tainted syzkaller #0 PREEMPT(full) [ 830.245993][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 830.256055][ C1] Workqueue: netns cleanup_net [ 830.260844][ C1] Call Trace: [ 830.264120][ C1] [ 830.266970][ C1] vpanic+0x56c/0xa60 [ 830.270961][ C1] ? __pfx_vpanic+0x10/0x10 [ 830.275472][ C1] ? irqentry_exit+0x59e/0x620 [ 830.280246][ C1] panic+0xc5/0xd0 [ 830.283964][ C1] ? __pfx_panic+0x10/0x10 [ 830.288370][ C1] ? rose_t0timer_expiry+0x1ea/0x560 [ 830.293656][ C1] ? rose_t0timer_expiry+0x1ea/0x560 [ 830.298945][ C1] check_panic_on_warn+0x89/0xb0 [ 830.303886][ C1] ? rose_t0timer_expiry+0x1ea/0x560 [ 830.309162][ C1] end_report+0x73/0x180 [ 830.313394][ C1] ? rose_t0timer_expiry+0x1ea/0x560 [ 830.318675][ C1] kasan_report+0x128/0x150 [ 830.323191][ C1] ? rose_t0timer_expiry+0x1ea/0x560 [ 830.328489][ C1] rose_t0timer_expiry+0x1ea/0x560 [ 830.333595][ C1] call_timer_fn+0x192/0x640 [ 830.338181][ C1] ? __pfx_rose_t0timer_expiry+0x10/0x10 [ 830.343806][ C1] ? call_timer_fn+0xd4/0x640 [ 830.348480][ C1] ? __pfx_call_timer_fn+0x10/0x10 [ 830.353586][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 830.358785][ C1] ? __pfx_rose_t0timer_expiry+0x10/0x10 [ 830.364428][ C1] __run_timer_base+0x652/0x8b0 [ 830.369279][ C1] ? ktime_get+0x45/0x200 [ 830.373603][ C1] ? __pfx___run_timer_base+0x10/0x10 [ 830.378976][ C1] ? sched_clock_cpu+0x74/0x440 [ 830.383823][ C1] run_timer_softirq+0xb7/0x170 [ 830.388665][ C1] handle_softirqs+0x22a/0x870 [ 830.393442][ C1] ? __irq_exit_rcu+0x5f/0x150 [ 830.398221][ C1] __irq_exit_rcu+0x5f/0x150 [ 830.402822][ C1] irq_exit_rcu+0x9/0x30 [ 830.407057][ C1] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 830.412682][ C1] [ 830.415599][ C1] [ 830.418515][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 830.424492][ C1] RIP: 0010:batadv_hardif_get_by_netdev+0x15f/0x3d0 [ 830.431087][ C1] Code: f6 4c 8b 3d f3 5b 07 0f 49 81 ff 80 13 7e 9a 0f 84 a8 01 00 00 4c 89 6c 24 10 49 8d 5f 18 48 89 d8 48 c1 e8 03 42 80 3c 20 00 <74> 08 48 89 df e8 c7 fd b8 f6 4c 39 2b 74 0a e8 cd d4 4e f6 e9 fd [ 830.450685][ C1] RSP: 0018:ffffc9000e257240 EFLAGS: 00000246 [ 830.456746][ C1] RAX: 1ffff11004f9ac03 RBX: ffff888027cd6018 RCX: ffff8880546a5ac0 [ 830.464718][ C1] RDX: 0000000000000000 RSI: ffffffff8c27a460 RDI: ffffffff8c27a420 [ 830.472674][ C1] RBP: ffffc9000e2572e8 R08: ffffffff8b76b6c9 R09: ffffffff8e7602e0 [ 830.480627][ C1] R10: dffffc0000000000 R11: ffffffff8b76f6a0 R12: dffffc0000000000 [ 830.488585][ C1] R13: ffff88807341c000 R14: 1ffff92001c4ae4c R15: ffff888027cd6000 [ 830.496547][ C1] ? __pfx_batadv_hard_if_event+0x10/0x10 [ 830.502257][ C1] ? batadv_hardif_get_by_netdev+0x79/0x3d0 [ 830.508143][ C1] ? batadv_hardif_get_by_netdev+0x79/0x3d0 [ 830.514024][ C1] ? __pfx_batadv_hardif_get_by_netdev+0x10/0x10 [ 830.520339][ C1] ? __asan_memset+0x22/0x50 [ 830.524926][ C1] ? lowpan_event+0x122/0x6b0 [ 830.529589][ C1] batadv_hard_if_event+0x82/0x1700 [ 830.534862][ C1] ? dcbnl_netdevice_event+0x268/0x2b0 [ 830.540306][ C1] ? lockdep_rtnl_is_held+0x26/0x40 [ 830.545496][ C1] notifier_call_chain+0x1be/0x400 [ 830.550622][ C1] unregister_netdevice_many_notify+0x1cbf/0x2370 [ 830.557053][ C1] ? __pfx_unregister_netdevice_many_notify+0x10/0x10 [ 830.563821][ C1] unregister_netdevice_queue+0x31f/0x360 [ 830.569556][ C1] ? __pfx_unregister_netdevice_queue+0x10/0x10 [ 830.575812][ C1] _cfg80211_unregister_wdev+0x155/0x570 [ 830.581446][ C1] ieee80211_remove_interfaces+0x49c/0x6d0 [ 830.587246][ C1] ? __pfx_autoremove_wake_function+0x10/0x10 [ 830.593305][ C1] ? __pfx_ieee80211_remove_interfaces+0x10/0x10 [ 830.599628][ C1] ieee80211_unregister_hw+0x5d/0x2c0 [ 830.604999][ C1] mac80211_hwsim_del_radio+0x28a/0x490 [ 830.610540][ C1] ? __pfx_mac80211_hwsim_del_radio+0x10/0x10 [ 830.616599][ C1] ? hwsim_exit_net+0xd11/0xfa0 [ 830.621442][ C1] ? __local_bh_enable_ip+0xd0/0x130 [ 830.626891][ C1] hwsim_exit_net+0xede/0xfa0 [ 830.631565][ C1] ? hwsim_exit_net+0x336/0xfa0 [ 830.636407][ C1] ? __pfx_hwsim_exit_net+0x10/0x10 [ 830.641596][ C1] ? __ip_vs_dev_cleanup_batch+0x238/0x260 [ 830.647386][ C1] ops_undo_list+0x49f/0x940 [ 830.651966][ C1] ? __pfx_ops_undo_list+0x10/0x10 [ 830.657066][ C1] ? idr_destroy+0x218/0x290 [ 830.661640][ C1] ? do_raw_spin_unlock+0xf5/0x210 [ 830.666738][ C1] cleanup_net+0x56b/0x800 [ 830.671147][ C1] ? __pfx_cleanup_net+0x10/0x10 [ 830.676073][ C1] ? process_scheduled_works+0xa25/0x1830 [ 830.681779][ C1] ? process_scheduled_works+0xa25/0x1830 [ 830.687485][ C1] process_scheduled_works+0xb02/0x1830 [ 830.693032][ C1] ? __pfx_process_scheduled_works+0x10/0x10 [ 830.699005][ C1] ? assign_work+0x3d5/0x5e0 [ 830.703594][ C1] worker_thread+0xa50/0xfc0 [ 830.708199][ C1] kthread+0x388/0x470 [ 830.712261][ C1] ? __pfx_worker_thread+0x10/0x10 [ 830.717357][ C1] ? __pfx_kthread+0x10/0x10 [ 830.721943][ C1] ret_from_fork+0x51e/0xb90 [ 830.726526][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 830.731623][ C1] ? __switch_to+0xc7d/0x1450 [ 830.736285][ C1] ? __pfx_kthread+0x10/0x10 [ 830.740857][ C1] ret_from_fork_asm+0x1a/0x30 [ 830.745633][ C1] [ 830.749014][ C1] Kernel Offset: disabled [ 830.753320][ C1] Rebooting in 86400 seconds..