last executing test programs: 30.185767945s ago: executing program 0 (id=2653): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) socket$caif_stream(0x25, 0x1, 0x5) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18020000000000000000000000000000180100002020702500000000002020207b"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10001}, 0x94) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x18, 0xe, 0x0, 0x0, 0x2, 0x0, 0x0, 0x40f00, 0x8, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xa30}, 0x94) ioctl$sock_SIOCBRADDBR(r0, 0x89a0, &(0x7f00000002c0)='ip6_vti0\x00') r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x2}, 0x2000400c) bpf$TOKEN_CREATE(0x24, &(0x7f0000000340)={0x0, r1}, 0x8) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x1, 0x6a, 0x0, 0x0, 0xf7ffff7e, 0x0, 0x0, 0x0, 0xe}, 0x94) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r4 = accept4(r3, 0x0, 0x0, 0x800) sendmmsg$alg(r4, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) getsockopt$inet_sctp_SCTP_MAX_BURST(r4, 0x84, 0x14, &(0x7f0000000580), &(0x7f0000000600)=0x4) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000680)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r5, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r6, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0) 29.854565082s ago: executing program 0 (id=2655): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$mptcp(&(0x7f00000002c0), 0xffffffffffffffff) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r2) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r2, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r3, 0x0) r4 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r4, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) socket$pppl2tp(0x18, 0x1, 0x1) syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) r7 = syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r5, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYRES8=r7, @ANYRESDEC=r6, @ANYBLOB="010000000097dd59730001000000280001801400040000800000000000000000ffffac1414aa060001000a"], 0x3c}}, 0x4000000) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r0, &(0x7f0000000000)={0x0, 0x21, &(0x7f0000000440)={&(0x7f0000000480)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0100000000000000000002000000140001800500020001"], 0x28}, 0x1, 0x0, 0x0, 0x20044811}, 0x2000c094) r8 = socket(0x2a, 0x2, 0x0) getsockname$packet(r8, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) ioctl$sock_bt_bnep_BNEPCONNADD(r8, 0x400442c8, &(0x7f0000000100)={r5, 0x1, 0xf, "cf1adcc947db1afb0d33af64ebe1f0049f1dd2d8475e6d48a4d3b6c59dc4875662871cc785aff86f67ecbb6bd511b789791d5227c5884b286b8d0d5cd1b448e8c443fed57e5583ccdcd128cdeeddb02dde3c9f37051af5a68759360a13d1bd8fc528b4df1d5f35fd71bc71a99a8acd03ab5552"}) 29.647107082s ago: executing program 0 (id=2657): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000180)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @dev}}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000040), 0x4) r1 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r1, &(0x7f0000000140)=[{&(0x7f00000001c0)="580000001400192340834b80040d8c560a067f0202ff0000000000000fff58000b4824ca945f64009400ff0325010ebc000000000000008000f0fffeffe809005300fff5dd00000010000100060c10000000010000000000", 0x58}], 0x1) 29.566301942s ago: executing program 4 (id=2658): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000a00)=@delchain={0x12c, 0x65, 0x8, 0x70bd27, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0xe, 0x2}, {0x0, 0xe}, {0x6, 0xb}}, [@filter_kind_options=@f_flow={{0x9}, {0xec, 0x2, [@TCA_FLOW_ADDEND={0x8, 0x5, 0x1}, @TCA_FLOW_XOR={0x8, 0x7, 0x1ff}, @TCA_FLOW_XOR={0x8, 0x7, 0xfffffff9}, @TCA_FLOW_DIVISOR={0x8, 0x8, 0x7fff}, @TCA_FLOW_MODE={0x8, 0x2, 0x1}, @TCA_FLOW_ACT={0xc0, 0x9, 0x0, 0x1, [@m_bpf={0xbc, 0x1e, 0x0, 0x0, {{0x8}, {0x4c, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_FD={0x8}, @TCA_ACT_BPF_NAME={0xc, 0x6, './file0\x00'}, @TCA_ACT_BPF_OPS={0x14, 0x4, [{0x6, 0x5, 0xb4, 0xa5}, {0xcc, 0xd8, 0x9, 0xe}]}, @TCA_ACT_BPF_FD={0x8}, @TCA_ACT_BPF_FD={0x8}, @TCA_ACT_BPF_FD={0x8}, @TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x9}]}, {0x49, 0x6, "cdc0d4226748cbf59c2823643af4039afbdb9215f0afec585a77a575cf2caee84678ed79c9fa076cbd69d3828a76fc4a3e3196f3a087530b8db00da19f216cbc5314efc0be"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}]}]}}, @TCA_RATE={0x6, 0x5, {0xff, 0x2}}, @TCA_CHAIN={0x8, 0xb, 0x441d}]}, 0x12c}, 0x1, 0x0, 0x0, 0x80}, 0x20000080) r0 = socket(0x10, 0x803, 0x0) (async) r1 = socket$inet(0x2, 0x1, 0x0) setsockopt$inet_opts(r1, 0x0, 0x4, &(0x7f0000000080)="441f0801000000e8c94ef56491ee54be0e1c2074ed27c1c6fe76cef3e2", 0x1d) (async) sendto(r0, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) (async) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x14}, {&(0x7f00000007c0)=""/154, 0x21}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0xffffffffffffff2f, 0xa1}}], 0x4000000000003b4, 0x2040000, &(0x7f0000003700)={0x77359400}) 29.457741205s ago: executing program 4 (id=2659): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$mptcp(&(0x7f00000002c0), 0xffffffffffffffff) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r2) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r2, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r3, 0x0) r4 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r4, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r5, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000004c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="0100000000000000000001000000280001801400040000000000000000000000ffffac1414aa060001000a"], 0x3c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000000) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r0, &(0x7f0000000000)={0x0, 0x21, &(0x7f0000000440)={&(0x7f0000000480)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0100000000000000000002000000140001800500020001"], 0x28}, 0x1, 0x0, 0x0, 0x20044811}, 0x2000c094) (fail_nth: 8) 29.388437148s ago: executing program 0 (id=2660): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x1, 0x2, 0x3, 0x2, 0x1, 0x3f}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000000)={0x42, 0x1}, 0x10) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) r2 = socket$kcm(0x2, 0x200000000000003, 0x106) sendmsg$inet(r2, &(0x7f0000000080)={&(0x7f0000000000)={0x2, 0x4001, @local}, 0x10, 0x0}, 0x34004811) r3 = socket$nl_route(0x10, 0x3, 0x0) mmap(&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0, 0x31, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=@newtaction={0x98, 0x30, 0x1, 0x0, 0x0, {}, [{0x84, 0x1, [@m_ct={0x2c, 0x2, 0x0, 0x0, {{0x7}, {0x4}, {0x4}, {0xc}, {0xc}}}, @m_ife={0x54, 0x1, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c}, @TCA_IFE_METALST={0xc, 0x6, [@IFE_META_SKBMARK={0x8, 0x1, @val=0x5}]}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x98}}, 0x0) r4 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x4, 0x4}, 0x50) getsockname$packet(0xffffffffffffffff, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000000300)=0x14) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000840)=ANY=[@ANYBLOB="300000006800010000000000000000000a000000000000001400060000000000000000000000000000000000040004"], 0x30}}, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000340)={0x1b, 0x0, 0x0, 0x5e3, 0x0, r4, 0x7, '\x00', r5, 0xffffffffffffffff, 0x0, 0x4}, 0x50) socket$kcm(0x29, 0x0, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000100)={'erspan0\x00', &(0x7f00000000c0)={'syztnl1\x00', 0x0, 0x10, 0x8, 0x8, 0x8, {{0x8, 0x4, 0x1, 0x2d, 0x20, 0x65, 0x0, 0x7f, 0x29, 0x0, @dev={0xac, 0x14, 0x14, 0x42}, @multicast1, {[@rr={0x7, 0xb, 0x8e, [@loopback, @broadcast]}]}}}}}) sendmsg$nl_route_sched(r3, 0x0, 0x40) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000800000000bf91000000000000b702000043e7b5538500000085000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r7}, 0x10) ppoll(&(0x7f0000000500)=[{r1}], 0x1, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0xfffffffffffffffd, 0x0, 0x80, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x8, 0x9, 0x0, 0x0, 0x7fffffff}, 0x0, 0x0) 28.350826618s ago: executing program 4 (id=2664): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000f6000000850000004300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0xffffffffffffff58, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b000000000000000000"], 0x48) r0 = socket$nl_generic(0x10, 0x3, 0x10) unshare(0x24060400) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'wlan1\x00'}) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r2, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r2, 0x0) ioctl(r1, 0x8b29, &(0x7f0000000040)) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x15, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="6eaa000000000000711010000000000095"], &(0x7f0000000480)='syzkaller\x00'}, 0x90) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f000000a780), 0xffffffffffffffff) r5 = socket$inet_udplite(0x2, 0x2, 0x88) r6 = socket$inet6_icmp(0xa, 0x2, 0x3a) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = epoll_create1(0x80000) epoll_ctl$EPOLL_CTL_ADD(r8, 0x1, r6, &(0x7f0000000140)={0x1f}) epoll_ctl$EPOLL_CTL_ADD(r8, 0x1, r7, &(0x7f00000000c0)={0x7b7306ca40510a6}) epoll_pwait(r8, &(0x7f0000000000)=[{}, {}], 0x2, 0x200, 0x0, 0x0) bpf$ITER_CREATE(0x21, &(0x7f0000000040)={r3}, 0x8) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000340)={'bridge0\x00', 0x0}) getsockopt$ARPT_SO_GET_ENTRIES(r5, 0x0, 0x61, &(0x7f0000000080)={'filter\x00', 0x17, "cacca246c3c9127e3de3d304ed5229c4a993bcc5b9a40b"}, &(0x7f0000000180)=0x3b) r10 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r10, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000280)=@getchain={0x24, 0x11, 0x839, 0x70bd27, 0x0, {0x0, 0x0, 0x0, r9}}, 0x24}, 0x1, 0x0, 0x0, 0x4000091}, 0x0) sendmsg$ETHTOOL_MSG_LINKSTATE_GET(r0, &(0x7f000000a8c0)={0x0, 0x0, &(0x7f000000a880)={&(0x7f000000a7c0)={0x20, r4, 0x201, 0x70bd29, 0x25dfdbfe, {}, [@HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r9}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x24048091}, 0x80) 28.322203356s ago: executing program 0 (id=2665): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0xb, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) r1 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000040)='contention_begin\x00', r0}, 0x18) r2 = socket$packet(0x11, 0x3, 0x300) r3 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) setsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r3, 0x84, 0x18, 0x0, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000480)=@base={0x20, 0x8000, 0xb, 0x8, 0x24000, 0xffffffffffffffff, 0xa, '\x00', 0x0, 0xffffffffffffffff, 0x5, 0x2, 0x1}, 0x50) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=@bloom_filter={0x1e, 0x100, 0x9f, 0x7fff, 0x20172, 0xffffffffffffffff, 0x8ef, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x4, 0x2, 0x5}, 0x50) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0100000004000900041122000b00000001"], 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000380), &(0x7f00000000c0), 0x2, r6}, 0x38) bpf$BPF_MAP_LOOKUP_AND_DELETE_BATCH(0x19, &(0x7f0000000080)={0x0, &(0x7f0000000000)=""/56, &(0x7f00000001c0), &(0x7f00000000c0), 0x1, r6}, 0x38) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000005c0)={0x18, 0x1e, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000008000000000000000800000018110000", @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000004055090100000000009500000000000000b708000000000000d775668dbcc1b31f7b8af8ff00000000b7080000010400007b8af0ff00000000bfa100000007010000f8ffffffbfa400000000000007040000f0ffffffb7020000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70500000800000085000000a500000085200000020000008520000004000000bf91000000000000b7020000020000008500000084000000b7000000000000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0x1, 0x91, &(0x7f00000003c0)=""/145, 0x40f00, 0x11, '\x00', 0x0, 0x0, r3, 0x8, &(0x7f0000000080)={0x3, 0x5}, 0x8, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=[r4, r5, 0x1, r6], 0x0, 0x10, 0x4}, 0x94) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r2, 0x8933, &(0x7f00000001c0)={'batadv_slave_1\x00', 0x0}) setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000000140)={r7, 0x1, 0x6, @local}, 0x10) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f0000000580)={0x0, 0x1, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1b}}, 0x10) 27.918944215s ago: executing program 0 (id=2669): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r0, 0x0) r1 = socket(0x1, 0x2, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x48) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000140)={r2, &(0x7f0000000180), &(0x7f00000000c0)=@tcp6=r1}, 0x20) recvmmsg(r1, &(0x7f0000000d40), 0x0, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010101}]}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x7a, &(0x7f0000000340)={r3, @in6={{0xa, 0x3, 0xb, @private1={0xfc, 0x1, '\x00', 0x1}}}}, &(0x7f0000000040)=0x84) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r0, 0x84, 0x71, &(0x7f0000000000)={r3}, &(0x7f00000000c0)=0x8) r4 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) r5 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r6 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$sock_linger(r6, 0x1, 0xd, 0x0, 0xb5) ioctl$IOCTL_GET_NCIDEV_IDX(r5, 0x0, &(0x7f0000000000)=0x0) bind$nfc_llcp(r4, &(0x7f0000001040)={0x27, r7, 0xffffffffffffffff, 0x5, 0x0, 0x0, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x3c}, 0x60) readv(r4, &(0x7f0000000600), 0x0) close(r5) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000240)={0x0, 0xffffffffffffffff, 0x0, 0x73, &(0x7f0000000280)='/proc/net\x00\x00t4/c+\x0fG\xf9\xe1K\fX\a0\x04\x00\x00\x82D\x80\xa2EZ\xad}\\-\xd1\x96R\x91\xd7x\xb5\xfb\xc4N\xc7\xb3+\xb3qW\xa9\x83\x9b\x84\xbc\xe9\xc6$\x9b/\xda\x9d=P\xd1Xzk\xb5\x95\x18\xd7\xa8\xcc\x99v\x84hQ\xf1fZ\n\xb6\x02\xd5\xf1\xb4b\xa6\aM+\xc1\xe8\"\x0f\x89\xba\xb3\x06:a\xd335^x\xaf\x14\x82'}, 0x30) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) r9 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r9, &(0x7f0000000200), 0x806000) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000009, 0x12, r8, 0x1000) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) writev(r4, &(0x7f0000000100)=[{&(0x7f0000000080)='6', 0x1}], 0x1) 27.859562551s ago: executing program 4 (id=2670): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000180)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @dev}}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000040), 0x4) r1 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r1, &(0x7f0000000140)=[{&(0x7f00000001c0)="580000001400192340834b80040d8c560a067f0202ff000000000000ffff58000b4824ca945f64009400ff0325010ebc000000000000008000f0fffeffe809005300fff5dd00000010000100060c10000000010000000000", 0x58}], 0x1) 27.688015829s ago: executing program 4 (id=2673): r0 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_IPV6_RTHDRDSTOPTS(r1, 0x29, 0x37, &(0x7f00000000c0), 0x8) setsockopt$inet6_IPV6_HOPOPTS(r1, 0x29, 0x36, &(0x7f0000000040)=ANY=[], 0x8) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x10, 0x8, &(0x7f0000001340)=ANY=[@ANYBLOB="beaa000000000000791008000000000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000bf03000000000000850000000c000000b70000000000000095"], &(0x7f0000000480)='syzkaller\x00'}, 0x94) 27.482630649s ago: executing program 4 (id=2675): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000540)={0x11, 0x3, &(0x7f0000000040)=@framed={{0x18, 0x0, 0x0, 0x0, 0x7}}, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r0, 0x0, 0x5}, 0x18) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x101801, 0x0) clock_gettime(0x0, &(0x7f0000000180)={0x0, 0x0}) pselect6(0x40, &(0x7f0000000080)={0xc8f, 0x9, 0xffff, 0x100, 0x8, 0x65f9e5cb, 0x4a94, 0x2}, &(0x7f00000000c0)={0x0, 0x6, 0x4000000000000000, 0x3, 0x3, 0x1, 0x401, 0x7}, &(0x7f0000000140)={0x3, 0x10, 0xfffffffffffffffb, 0x5, 0x3, 0x40, 0x10000, 0x4}, &(0x7f00000001c0)={r2, r3+60000000}, &(0x7f0000000280)={&(0x7f0000000240)={[0xf]}, 0x8}) clock_gettime(0x3, &(0x7f00000002c0)) write$rfkill(r1, &(0x7f0000000000)={0x5, 0x0, 0x3, 0xfc}, 0x8) 24.12780087s ago: executing program 2 (id=2709): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r0, &(0x7f0000000080)=ANY=[], 0x10448) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x2000001, 0x110, r0, 0x3c95b000) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$PPPIOCNEWUNIT(r2, 0xc004743e, &(0x7f0000000080)=0x3) ioctl$PPPIOCSMAXCID(r2, 0x40047451, &(0x7f0000002540)=0x1) vmsplice(r1, &(0x7f0000002440)=[{&(0x7f00000002c0)="62af263ea3c1befb3bd81deb2fc1cacaa4d2f3c7d8ed578a43f7c4bb44173641f1fd8524ba1d6678d41a89626989170aadb2c8de3262863630637e1f80b2b4b51ee58b9299e10879e5e7cf131a96d45102b25ddcd1a9c1396236f8a9e1be48f3df174a31122fc89187100d16d31e65e68a314119e411a442d36d25fa1a910a16926bbe70937af1a2daffcd5c3a62c21741d80998ec5bdc21609f993fe686eab92a3d9509e824ba65d8ca5a278c2daaa30bae078462870b37ea7868c8f4793a95dfe47a9c60ea83231e51dda3ae07e726e228a4b101565798f3c4d0633da550910f4615720e9ca37e6f3e77bb52ae52a1312724d2f1a641035db3e81b35e55ca077ae17a98a375b6c3f56395c052113c3f125304a41a735b325b05243c1b8a0b8e47ad70f831e640e4d68e32614faef764f07940dbd655c7c45a7a22630e1c3d77bd86fd2c51621f5196efd4844bc327210f9d34141daa5acc425005e38ccdbeba7eafd392b4f3eb9f297aa6dbc28320b48b3f878d9e45916396519eb2f5c4084d210892cc8bd34489e4e12d78c16e5abcf841243e65dddfd7cbe36ec49b51d4ad368a01bba176ecdd8d147bedd7464a07dc59ad833ab8d26639de4131d324c8c1c1401a6758e660e0c7f0c9bd612f5f3589acba3b06198c30d6beb86a76c18cffff86ea6ebc282411a12ea8959b84672e17f10146575abcf6064ff36821f10c23c2e555b4c8d0af9f368e7db70ba47218a5947a1ecd42e08e6dc08ec3f3d51c522caed9d102a44f6d8f5944fa3307b7234f27483b285ef16925815cd9c05fbeee24b369c18fd05d3e7f034e99462de5f6b45c54f137b4b86e88ae17906071194223638760200d6e185e111301f039780bd9ab2d62682da82b0b752ef85f36a2308ced8b395405d2d30c3c883754767ed379aefbb8e4ff465ac1c6e938a41cb04915a16ab25eed7c2e54cd151821e0620fc314472c57b51d003d07a287d256744b8c8f6ac08fb3c143670b3b8318218d6be5e2ee5b71ad03a7c327a272de129875f170b5f1ea10473c3dac826e96a845aa809905b02c8e3e2e1b451d00f437271af7689f93920db839aba8c8c632cc31c7043b3b7e358c4f5725b31db55aa4f260504f6a78c6ff74d59c480b6f4276433eec67beef368c238bba859d2f4f4c28ab94a65821f55045e540914677befa72c15071d28435a016387cf0c69cef003550d83ef4f866ee78add21e6e69a19ca03ba5381791e38b4fb91d725d3e8c0bc7cfa95aa35f48a9127eb93dd67e9746ab92b9cdc9519f2bca2d5d2eaf864381ee2c6a76db4d1b0440dd3aa65b34fbcb3dbfd649c5886cb9b9be8e6aa0a1e5e09ad0afa6a70c203344468ae3e3750af30aff7b140d0906112767a4f5ce3147206ebe7478af7a3ec636f898f09063d138cf90b715bf1bcfb9f8132f9c612db07b458c249244a737095bbb428722e4473e4ef36494ebca4c6463e217ecea9beb0b9df3172e928464a67d0747ef707ee4a9ea8c1d0a8a608243305b8454a28230cf7632b5d6d67b176aadd4aa532b28a3b66a30aca5fcaf7cb2564c3543f97878cb1e35b6a636ab54e54f4cb6eab7c2315128dae5525db24b576ce67e50e2624ecdfedcda8f092a4622e8df12626c9036432f06f6e195dbbe3a1248000607a6ce5624d046239f5931ec6a4930abc7e5a42988a288bf781301c372d98b4236bba6151d51235db9e585cac207dfa16ca0eb6dfc748bdd091f39c86e5fbba9dc32abad2387ecf64d611ed8f433a42d2d12a7c603e86d70219469751108bf822934709171d54211d80e094be85cd034a4930e227b18907bceac6c441988c2e51f053abb79cb82df556b8e1db7dafd436002cd787773e5f58a1421784e402eea625e818d2fdbfcc2fc6480d98f6df816c3392a867a06cbcb8702f95588b919b7641f6fcac161994c399ebd24fbf1e4fe0a3c44aa921270e2246c37a43c64ffd4a0127733c1791a5fcb14b1c02d092e79b024e881fcdb44996e3fa669bea354bf81bbdc6efec3bd4f139b2bf42f52d9568dc6914117854228a7d5094814e739f738a6f5d97a60e17db7def18a7144f7e9bbe8585650b2993aff9d60d583ef8a2cdff8aca32d95df2f3c41c85c37178d82187379474fed55b657dc8ce8f6416243a370a495f26e5f48bd4ca8ba425baf1ab7250fbe51582f079a44b7c2fa76c780e68a83a8f32abf4777eeefb08a946ca65a19f835baf4df8fe86b8cb5855cd0bb84b7232c36ebec956fb8ea5860d730cf5e4387511dd6f1abeecc1e88ecaefa693483a470029ea91062be1c5510db404cabab5daece35f6850685f3111703eecf99f547d2ada94113668902b4bb8454605394bc61cfde83a4b05d67e21bb16dc0fbf0f45eb4b2b22b04859a544e58f67fd83562469f9b69a9fe904d823054a6d2cf0681af76de2b78c40cba4884dbd1e1c979f81ea46fb33f2003366e60ef95ea5bfaa657333b31925535c059a4a651e6bd163bdbba248764faea7bda94472d9528e6c9ae178610f50f89c8f72226ed2a3957aa2d487b2dc75bcf101b93cd9dd5d66d3a1d1f74a5e8fd201f89dada283421c1e8702d8ef7c856a1a74e00464e48d905c72bcda7eb2ce0f73470e9398a0dde2c8d2714a45c1e29d93e0b5110695a03ded4f9365fe8d9b9e80806e5cce3aefc32a61f98a30a67bcdf0225edd3b06f41e666d77a41155bf094a3bafc04574ec2577dbf4683aecb2787f150f4da6eb6bed511ec4dcc9180094126e74013c8210a26777e55807e392e0ddb230d68106a9f37f033a838d79338abb539742552b11f03b123c1f7b05fe50ba0e6bd84b071f440bdc997cebf8e43e1c363778f59561f347ca33277c4afd20baf7efd0955e39299752a9f67639b0026eeab3d7d9dab6bca37e12359beb8ca08d1edde6c2e25c12f31249e29e8d5a65d4981608bb749ce3ec39adfa8bfa5865e05936954f6f82cde751605fcbe340a1efdee658dd866bc524d0709235e43097dd03ac24b7d3d8e72c27f9573ed195ad2937056f03b108f038d36416557831e61bb028dad4dca398fdba94a57ea82569c8f9cca5a8a1a894a2c11cc59d0fdb77d4a3917dccfdc05f583a4ab23291e8411e0523825a9ccfa46362fb33f78705c27ca13964a7cfca4bea68a0cfe90e0f73a52ec0e5db4cc05ece6ce799ebdee293bccdc4d52e4fca656d65edd130b16d8f7b05c7b01e50416b0a27d982b737fdbabc3ef14d540554713933155e492c9357c5fedd7f3792e1904d004c5f911622b4da91f0fd4505ca1fd69bebf5ed272b5745156b9a04de7afc94de584515918d8ecbbaa60f66613347485f6c6113b04db56b7aa39cb4bb41e68ba2f3a9d61b91e85e992358322f15d8600549d1a285dccc2650261bf65b69528a00afab33b48e86aee274de4d6017db9209cbaf74e44a32dfb85dca5d17f9c21f0093832103123fdea8fd3089353104065e9c9b776c1f4fbee236291eaadf8932c9848f74142f7b21d4172918fad9bdf3f6c8fac092268642eafd079f9793f5ace3f2d17665db0096030cfbecd06a26cc4611f8eeaae82dcf6c8e094a1b75414062ce27bde32aeda48a536e9c8a3d9289ce04a39ab7cb1029313f2ed065a8bce81e8c1d42db0c700af6d45f85e18661948884dad9c4a1de0872d4452856f6053113ba67faeb78e666b0edb7a2242385d82e5b443dfacfaac403329ca5c7557b117b86e8ac10d007ad5b4b39faeee5d93934986ae2861effd21271fc33e8ecb857733be4bd2f266aea0436e9fd536e5c64d3e24e388e1a621ec4ea2f53ea430315400356aacc4a2a8c164dad3adfe4e013805f5e6662a5021ec401dab7f5fb55d577f1d17fa703fd526a07eefcf6910bb12b20c36109c159b226441adb20eb1191580c1d72f27941376bc5d1e4432f91b0418871799bcfa3fa62a8b49d94640ce8e80bae07ca21bcd060e95b060b7bcd7c8a1500b9a52449f3c80dad0a6c2ea1f58502fb2ba07948b16296e7fe9bb0932488ee752b524fb29fcadcafab464055cd7b226fb9bc585dabcc480395f3bb636b1ee4ea19687af3eb2d610c07e3902dadb2b0127c3bb58ce8b55087a2f9388eae27dad0153f6796058ada83cbdb7f33da85942981053bf891c30fb602fd07c3534269290ce9866b80569e3bc7784f033bbd18f8dfc61ce61cc5d4519087328c6381a21707f782b6a530b202687bc56f8207293679f84a039c411d330acccd5b5b1f4994575c742a4d7985fd4a66481c0c60d65478ef90703b2604917bf3fc7e1b5c088102bd2458f9943522e9dd054e9143c4aa758bdaad4cf79332e9ce996a6b8583821a2719e09f07890705e694ad97011a8915e921451d0af226a7e32a2297bd7fc38e5126bc33af6a357e91905d77165965db0753e5b5abc5c87f156d0c9bdf74111aa1e927ca3ad5921f0a34fcc63a46a2cd44551f7e3e9bfd9745761afcb2554bca484bdebd28e321ec4ab620ad3a451dac22af718cdae96064523d13bb5e606eee22e3436b6608380cf80339d60daa631484d0ed1b6d0d415febfe2831970156f3af71e0e94f617a18e5024408e96a4e27d8ff2f11f069acf04e54ffa41b720cbd97f81d160d3d501cf78425cf970407c37dc65f2e84628350b8c2adefefae0fe39252af352656587cbff711be1eb3b24e4de8b16f47416f02cdbe19cef1a12b0c1a8ef9714dd24a27e5246ee25c56032a1e246b4aa6f586fe96f245d8b8c57c93d742d36c6125cd4793f5bb7ba4dbf2b508925d27f8814e78ad22409e0088d300aaab4d475e5f625ce32256f4a68d7cdb3c5dba87b395dc9e9ad7b186db3b0048f18d48e78ceca669c5e66b9fffad80eb4490fd41540fe1bc9cdedaa99cb0716ffbd44f3c688995a6a4a80a8fddcd192a47808f0fb3699d2bc85c6e57bbf7c3cc8f77bb1b7c7a1424f019abdae1aa7e91a83b5a9639d603745174b16be2ba7f8d8f6e04b9eb7335886f812e843845f311f8908ae025c3404d24bad76738c010f04ae946b5cdbf2afba0bbfe6a08e78ed6ff786e740a77e7dfae4b5a936035baaad0038ee12149aaebc83d4020f8281b24571e2a3a8e81dd16f541808e2bf1ad5f9e4872e5d0a33fec46b2fea6ae0d3d6c23487dfa70f3a1c0431110188426deb0da618cf25c1b6a2b7efcb48363aafd5fdb57f745da914931f54e8ddb7829a8a3f41cfdc111bb9ac232476fb2a16450e96937ab53d9b2948a93e87e291fc23cd11200c4acab8a8e734df955f102018c78c2e08afa013009ab14b043ea03eee8bb146e4ac9e44688a860c422a99d5dc50722aef6fab77a115a9a0a155d2f2c74c6dc87f9827a5bc24e2a7121ecb1ff66a13d01fadfa34cd887c5823d8ce5a63415f53bfbf0e95dd039515d91e4129cd594c03705b4c30e1f15fac8ec956c5edb3d47e061bdd58490cce1f25344fdaf5d92a9ff147f4ace3af93fc7e15c9304e5b21c75343778de9dd49a1a10189232b42b25fd77f64754f4f8aff4a2ed54bef0d0bed27ea450c97060b755d02fcb36742b998bd0d434cc1d37e997cba6258eb717edd4c9441725b92f556431ea317b53c6c76067a3b797b931b5782028781ef7282c3da30d79a7f9277f4f632304127745647028bc2df9033c968e975579d50136230f28e95a648cedcd6aa5e9777fca2419cef6fe5fc0e42280114bfee49da6b7946b9582e75ee4d74006a9140bb018b857d9c84d925b175f2c041abd9d226f61758c3d636939f37c2fd0121a5affd17b95844aaf5987889896c0b44cdcd568", 0x1000}, {&(0x7f00000012c0)="53822fd833", 0x5}, {0x0}], 0x3, 0x9) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000100)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x10000, '\x00', 0x0, 0x0, 0x1, 0x0, 0x4}, 0x50) 23.970431632s ago: executing program 2 (id=2710): r0 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) r1 = socket$kcm(0x2d, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r1, 0x89e2, &(0x7f0000000340)={r1}) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x3, &(0x7f0000000d00)=ANY=[@ANYRES16], 0x0, 0xfffffffd}, 0x94) r3 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000300)={&(0x7f0000000400)='netfs_rreq_ref\x00', r2, 0x0, 0x9}, 0x18) r4 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r3}, 0x8) close(r4) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x5, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18080000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000700000095"], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x5, r4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$sock_kcm_SIOCKCMATTACH(r1, 0x89e3, &(0x7f0000000180)={r1, r5}) bpf$MAP_GET_NEXT_KEY(0x2, 0x0, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, 0x0, &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000800)={'xfrm0\x00', 0x0}) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYRES64=r0], 0x20}, 0x1, 0x0, 0x0, 0x2004c010}, 0x0) r8 = socket(0x11, 0x3, 0x0) sendto$packet(r8, &(0x7f0000000180)="6fa4bf90aa8a2fa36a8f6c8fa168f069adfc79fefab38d472a35afef1a050076aa851156780bb0fe39", 0x29, 0x0, &(0x7f0000000140)={0x11, 0x0, r6, 0x1, 0x0, 0x6, @random="0786dbd848f5"}, 0x14) r9 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r9, &(0x7f0000000040)={0xa, 0xe22, 0x33, @mcast2, 0x2}, 0x1c) connect$inet6(r9, &(0x7f00000002c0)={0x2, 0x4e22, 0x0, @private0={0xfc, 0x0, '\x00', 0x1}}, 0x1c) 23.929902228s ago: executing program 2 (id=2711): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r1, 0x0) unshare(0x400) r2 = socket$kcm(0x29, 0x2, 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r2, 0x119, 0x487, 0x0, &(0x7f0000000480)) (async) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r3) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r4) sendmsg$TIPC_CMD_ENABLE_BEARER(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) (async) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) (async) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) (async) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r7, 0x6) (async) r8 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000700)=ANY=[@ANYBLOB="b4050000200080006110600000000000c60000000000000095000000000000009f33ef60916e6e893f1eeb0be20000d072f5b89c3043c47c896ce0bc8731fa595b6b4d45ef26dcca5582054d54d53cd2b685b431c70ea948259c4c869b4fc8db714e4b94bdae214fa68a051d4dca7d2647bec1fc89398d2b9000f224891060017c4700de60beac671e8e8f00cb03588aa6007e71f871ab5c2ff88afc6002084e5b52710aeee835cf0d78e45f70983826fb8579c1fb47d2c59005cff414ed55b0d18a9d446935fb332bb593ee341ab59016f81860324b800c00000000000092d9c5fe34ccb80a61ffcb3363073fd8962823ee45f5d7394e9510f4ac6c702cfabe8a9c55c8dafcdb110036e14c1035cafdfef6a358cbfadb3579a285580a3c080d4e0a48d7bdc38a0437c8c1b3aa408a0000000000002248950b000000"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) (async) r9 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="12000000040000000400000012"], 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000ac0)=ANY=[@ANYRES32=r9, @ANYRES32=r8, @ANYBLOB='&'], 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000048c0)={r9, &(0x7f00000047c0), &(0x7f0000004880)=@udp=r7}, 0x20) (async) close(0x3) close(r6) (async) r10 = socket$unix(0x1, 0x1, 0x0) r11 = socket$nl_route(0x10, 0x3, 0x0) (async) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r11, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000800)=@newqdisc={0x64, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r12, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x34, 0x2, {{0x3, 0x6, 0x6361, 0x5, 0x1, 0x6}, [@TCA_NETEM_DELAY_DIST={0x7, 0x2, "6ad2a3"}, @TCA_NETEM_CORR={0x10, 0x1, {0x5, 0x5, 0x9}}]}}}]}, 0x64}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) (async) ioctl$SIOCSIFHWADDR(r6, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) clock_gettime(0x0, &(0x7f0000000180)={0x0, 0x0}) ppoll(&(0x7f0000000140)=[{r11, 0x21}, {r3, 0x820c}], 0x2, &(0x7f0000000200)={r13, r14+60000000}, &(0x7f0000000240), 0x8) 23.650665646s ago: executing program 2 (id=2713): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r4 = socket(0x400000000010, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r6, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x0, 0x3}}}]}, 0x38}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x12, 0x4, &(0x7f00000005c0)=ANY=[@ANYBLOB="18000000010000000000000000001000711813000000000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_sock_addr=0x20, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$nl_route_sched(r4, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newtfilter={0x84, 0x2c, 0xd27, 0x30b529, 0x25dfdc00, {0x0, 0x0, 0x0, r6, {0x0, 0x4}, {}, {0xfff2}}, [@filter_kind_options=@f_matchall={{0xd}, {0x50, 0x2, [@TCA_MATCHALL_ACT={0x4c, 0x2, [@m_gact={0x48, 0x1, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x2, 0x2, 0xfffffffffffffffd, 0xa, 0x8}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x2, 0x3}}}}]}]}}]}, 0x84}, 0x1, 0x0, 0x0, 0x10}, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000300), r2) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000340)={'wlan1\x00'}) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={0x20, r1, 0x9c3fa077fa966179, 0xfffffffd, 0x0, {{0x7e}, {@void, @val={0xc, 0x99, {0x916d, 0x15}}}}}, 0x20}}, 0x4000054) sendmsg$NL80211_CMD_RELOAD_REGDB(r0, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000340)={0x14, r1, 0x1, 0x70bd2d, 0x25dfdbfe, {}, ["", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x20000000}, 0x20008004) 23.450657051s ago: executing program 2 (id=2716): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[@ANYBLOB="140000001000040000000000000000000000000a20000000090a01040000000000000000070008000900140073797a310000eeff140000001000010000000000000000000084000a"], 0x48}}, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000080)=@generic={&(0x7f0000000040)='./file0\x00', 0x0, 0x8}, 0x18) 23.418490915s ago: executing program 2 (id=2718): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000300)=[{0x0, 0x0, &(0x7f0000004b40)=[{&(0x7f00000019c0)="e94e6785facdeda4e9a789778edd8051746667861fcb55fc79f3dce63694e62c7129c14cad36728ec771c9b3ad8ff8bb3b3aef032adf92a73fccc368f7e4d07073ce68baace2fe4cd861eb3a2988ca9fd7f2705cfa224834816767e62ff51ae65db5ee09c76585f0722b13d592d9802d70802efe930242ca43280995f58a88253329a8f6edea76902bd788304505c89f7fcdf8ae99f9d7d90748f6ba6fe67f634fd01f4748a6cdf5e7b532b57d822b4b931229e2be3205408e37917aa6aa36391d5f2d55d44148932f2e849bb14e69fca4e3bcece4c70f56094e0c5e1e489fd63b691adb46cfb1234810341415f0cd066ef33a67b6ae1c87eff349aac90632539d0f3842ac7d8d101bfb58a8ac8c353b0be5b1e16bf560cf4a909d369a73da8c5627edce549e1e307377bb768da857d113a603f051769c9df45c64550ef7299271dd821421e60977f693942666cd79fb7c96899e57b56aa13dc3334dbe96879ba304d672f92548f3b5d7df7835d7307a6d47cb13afd113609f093cf527d64d29437d15eee3cf82ecb328e7beb0595f534d712154092ab45559c25dce68753ed7956c98dd8c432415c6e7f1b1444e7178afd18f506033d4a4c5feaf56c663cad615f7e04a009e53edcbc2d587e9f8edd184d9cf8cefb8a722510f4b037fc0eeb88e4e294c3bdcd2bc36e5a79e5b03d8f0fd363142d85bc0098a13b29e5dda20f20e1f22b10bdce593ea7d0ab6a88455d2acd4667d996b3e913923099ed01944efc2427f04fa09886c6e7c43120a023d9427d38a6b0be6a35b8e83491c5e472f2bb1bdbd39b6e3c8d8fd803529de9ea66155928aa56f4cec6654d3480ad9da35624ae41b836b455a5449c73ac22a3fe8fc020a8af63e4e21c1e791bd160d1c04a2a42e93784a225fdbd169bdea851f91886433813fcd7677c2b87791dfa280c9d322b52bcd3708778cb644fd8656321416c905c893ffd578a57c2ecd21a75e34cf2e9ddb56b6e62347cfd9d4413047903a5643f6734d42699715d457ca11721e21fa2cd0bd776548d2f9da40900848606d8587fdc24612b6d9042c9f1785db6628c11d7e79e9a550a8bfbcc82f218926b3043701e0e4111d73ca7bf7b061debe7231d9293abfe2ff6dbfbdbebbed3915e9d27f2f63cb0a6091ba7bda625aa9d978fe41aed03bbd0aeb6cc2985e0c2c4d9d1eeb2474e7d26ab7cc472afe2f11f243708ed43623fd5c0861ad7cf5970f154048fbc58678cb14a4e4e6fdd43605cb3e23efd9df955c7f9539a2074bbe65ee1748a81fe5efe6bf533836becce2afb20366e647a225d7ed6d554d9df7ac1b7c466aab548283a2a9b54fea91bb1ddeceb71aa078c1b847c92d7d5ba703f9d7d9a116f9b18a27ca47c3500ccffb187d70d3b86b31da43d02f1dc0fd92072471c66b931c81dae72bbaa19556a8a806471ff5d91e6489066a287cc1f6dee365f65416fa506edfacbd4a16a66e138f93eb603babe582027e38fee835a002e1a94eb0424c016619f26604517d0bc03e7bdbf2a437fbcb6a3f9ec6977762193665339ad6af2f84872cfcc794fe1e61f6392d1f5cbc409d3050cc655435d6fdd38385e39e18d70c6ea1618e962b6b4b4d0edbffd882c700bf900137832027f807d7739af211ad5be5c538b70d1983bf6693ed909fd406e1d5c8b7bfbdd36d5f9d6a88100895f08cb6ef123e41419d5877d1e17ec72b862fbfc7ddf6f37c8aacbcfb05dad0c2a596b610da09b0bf3b72b420fd797ed0aa72fcac87a6192c0ef7551baa06d50739abff50ba92e79451dc3588ed45e821bfe9b8e25fb871e592dcfedb1b5de9fba1b1635f7e10a4aa8f1785429ac582b4d5a725c6d0051af07ab043d62326b77ea259cf44e8cf14bd8d6a1353c770ab6f1dbedd7f3b39fe2bbd9cc986db49782b34be117cf578cbc417799f12cc5c5bf32ea96d2d7ca48650c74e827f5fe12393be2181416e4030d02c875eb242f815774211cb50a1ce4d53e926388723c5d157b12bcccaf193f2fffb8a53b0b0ec9834c07e96a2cf2323cfb2e1cc92e18baf8bf87ac9a7336f8c04fe6c8fae5ccc81976a26afb44c1aa0efbd93ef87e722c6c3f00da78bdc81dad9795fe2c1c644fdc09c842c138f704353c786311a0e14c226ef9061e36cdade4febdad904cdad6cbc4edcd1d73e27e835324988510534af9475416d5b8c14075b774efaddaad27889736369ab28ac8d005292105d1c3bdc7c665fceef0d945626bf76c8c147f7de23b07c9ca073058f1150958e85193303c7f1f7a60839dcce54d466a210a6d123968fbec47ba47239c1a2fadf9566e356ac610e562b77934bf56456e16edf9a8c0915c0a0b9405676d0d20d31ad62844416de5c043255f24c591427a21479c7fccd231c6b6a90880a551832ef874a879cc7b847aa926964224231a81af9b13d48f02828cb960d88a46302d2ef1492fae558a3d9c81042e2450b3a0aa1cb86bfa58ec3b09da9c360a202d28136565bb956ab1b814a64cb9d89c6122d191faaaee8c908c45919a22aae4cae89446114d5435d4805cbe3158068868daa1a6acfcc5f35c335094b517f9092073449ffb77b951e202a7444b5d96bc97207b30dd69a0c87ee620c559526c1641d159173c81cfe18ceafcd56325b99e1ed851d7cca0255c2b1aada05c1aac26131d342bd6e8fccc547f31d428c491dc8d8273d795ae9972b5386d427309183c5a6a72d049497192f62e50588885414033be661f91e0df461d5bbdb3f6b531d09f5deae7e5ef1f2318b359960e25b4c21cfb844bbe3a67aca7126742737f0b5ea90b42879dad5d00711a96a39d73d58d1eb6184310ca77227696e2969df90352f327391c590581757b98f7a8e3cb65f9e8c2631e742f4ee1629b2241a88ef6c3ba7dfbffbaa5a39e143d26c8c892f2facb83d38a12e966cad83f7b917feb56f26197c31028d968f50426ac1e6cc2c590af1eaf51044b53c32a34d3e03b4f82c324fa321c12299c1fb17504579307476ac3ef6195e2035d94df49f860c7e1a91cb2a76d723b17996cb041e056719c8063aaf2bb0ec90e7194029b19e46ef194a6f5be88459b53765fe8b2176e2bb87b7433b6f6874fc73bac9acff85798d18656499ca6b7b2d22d5e6597bc4151c3aa8f17097ee544f828782f050b13dd31c1cef1cae4dab9e3a52dcd8c851ebba82e619407122071467dee6c8b163aa904d0e2bdf1c0ee7b651be51836ea07f5b2be94a56d5880b8c8c263b7324f90a17460b78d07cad7c6edebba75dd4448e7eaa319ee4c2d87138f34a620a0f6979142e92317fa852ca9b13ee0f864b08fcfa43c0aa31ba47b8c132255300e01384466f2e2b8b284051c99a6058b4edb209a03dbf3f5f69c3cb6f0b62cac07069e8a3dec0243683582e3463922152c0839c8ce7a01f7545e1a7f010af59000e6956e7aa5b0d6ef82b676726053a6a9df5541f5ae2bd770ef65bf4c1be546098770c097debd558cce23091fb8b89797956b8d526fa53eab747367d82e58690338185bfdf9bd9c5b2555de31c47cf750d933d87f0e4f4175a28a8943666a563adef827d3d478cc06d76b69f2d9641cccd39ebfea5514a1141162cf5abb3930d5ead0cd27935de280553e6fc7fbeb2700c85dc666468da3014379122e9a92dcdd2fb7b7f3395c2520c3cb34608fa5b0c744840b76dff7d9203da5f720e3b577eb0b5e88c3073f31dc280d711d989dfe27b6f503aa60dbb52bd0f8345b7b0890ad8073af80d79671e1f646d26a9eca69c2cfcf317d28b78626e2487c4a01115180cd88151fc0dba9ba7476e3d7f60f2c4c1f5368340b54df764086f1ca358a887a9a1a94d4b8d326198cf18f5b6bdd5a4a611a8807f292acc712b02656a487f280086d4d366f224cac1daf8af144eeaa5959b9b4ec5194b05759ee545fd5c708014548257d1603fdd9bb3dddffa34f2c7da8fab09358083fb29e2732959f742405247c7046409ea157dbc434fca910d0fd273ca477a6ba5761759a3688402ae02214a59f8825385897dbfd6cb74c681f51fbeb5fe654dd5347414501a25efc20d6f1fd98ec698df9aa1ea90b1305fbfc61e2f1114767acac8a6ce0c643714fc03dc868797451edd37ff397e62015f0e5d4f6786e52aac5d29f7909d61700cf7b506a51121aa030a21b538c09ab2b097612108d2c512a63e75e35f09a063d361d3d8463ca6b16c407538b5d20a7dfb0c9639b241e70c8bed9c24643f2358807d450e8eb58741a360ad24a05f66f78b9b40ab9c13bb74856769ab68ca095f6e4ff80eec8246aad3874331dc060c4a37c70d756973dd3a8ed74dd3f7a89f9d4e958a3fe69828f50ad950dd59736eb5e270bc960a1cedfeb8f4a15db33ac634502241905833a9e3543058cb753dbfb05378bc955fd14add776adfb126540c3119292fe5a23bf345f10d43aa2bb37eb166bc90475b1d7edf10aa20b0cedf3c65c36c1e732b028a4954a2cf1b8cca8c23e9850889b9ecebff204ef26f915b670b2e2ce059cae6ba7aecfe6966aad7a65bcc186cfe465d7f2027960efb14abced50a2e48170995023805c401f5bb70e22a42b5dc432880e2b36dbefd85bbfb8abb0606e59e74ab4f6073a90d01928ae910fe1da94201a68712ba06ced2ab6500770da4a7182cee0fc92e210eb11aa64a6a523211ee456fc3fbf7caec4ca1f9aa64f3bf70ae1fb6bf6a6df0701debec5e5c73f33b9ce767175220d64b7be0bfddb6340b71426ade83df2382b57c55634e141ef5b8dc2ca6f9c32e5aa5f6b1ba3a1b21d38c1017b6a3aa1c5406928e054e4123e003be90ac7074c9ed36261e550c75f3a60ed70e5f8288ca2628dcf31da9ce72d23e913e727df6efcbba28bff54e8ed1eca653e2b16f3e84a9ccb2455ccf2d8d244c9e0ec84c075020737db6c4fc951ed9878bd8d4231800c237f88bc5db2e95d14d77281e0b7c02cd6bcf0220a8f726469262cabfc60091a4be37031dfce9c964554c2459d6fbbe9da09d9ef3faf507b4234f5423508b1ddbbb07924618b00f6fc6b0eaf100b608a3056ebaba0a1dcb250b572aeb21303c6c02a11eab76a67189f823f006c24a580914d45d0e45dfd9b902ca516ea8bbb2cdfbebdb46b7695174b70d55265208478d2e1e475fc3bd631704a55f7251cd4a718b82fdbd0472e22e48f583f4f032826a28fd3b2da39dd6ae1fea56b9a17b4d1acb90998c0aefe6af3c19f3fc5e3a7c6b83dc17ba52faf0b46396c5e755d12647962f667ea6a1068e8205252c8ee6a9635af207528ee957bc09eeda020e3e1494cb9f3135756351ae20e2a957b433c2207205d8c82b9f9bb344787ab367601fd2e9f89a8e43927c2fd04b4eb5bfe74f84144f926b292b16aabd2033dfd4c2fa28034a75444ec60d74b369acd34378222bd6cfb2611c23df5787cf45ec2a057b0998c1df9de44cd3a86833d80c9f8fee39f2be9da9667dac56286cce406735f3650ba65e471e43fc83fc0470d98162c181a0a751dbbec50df98de4fb65ef812a563e48c491ca15ef74054915226d489836be2c7ca822f83153dd68ac435f5d22f38813ea998a1790114a07516e0bc2519896ab4f77433ffb57f2a7f777dc81bc32e8d94066ce70f0a8908f3dbfaa842bcc3e48e9a09ac775939e99bcc8d7ab3baff6e9f85593b1c95b7b9a9a4b76d82b4bbae9f43eaa690960852f422bdf7e5aebfd662381969d71da4483ebf7a9572bd9fba8ede91d157e2382b2fcbef444901c3759ac6299b6506249cce97fe624e36ea6ba0f72da6da0", 0x1000}, {&(0x7f0000000340)="3ecfeb443a592462958e8fb1f42dcfafed50682dd2e6d99be287950b93650b32f39f0d3133ad70f6dc999230e202a34cc6a53c25d39403aa99593d26f81fd25027c1659e3d7c8832ed698ccd35d3a977d6fc1bf82430c4f903ceaf963afacb30353653a9b59ad8dcd7f24f93822a76ce6e6e8db76736c7e6222f7963d093db9c75fa29be8f4d8471f107e0", 0x8b}, {&(0x7f00000029c0)="6547ce4a7f230eeb502f3803233188f44df0028f8cf5f5b74f3c05ee137df6be89228eacfb5a1663ad31169cf36a60e945d2533cc6c4f2f6dc5376ff2d90194679792ca0665ceaddc71420757c8651d5710a6b41c8d09ec1096126938a24a40029a7df8ba49da7eb0f3eac3a4bf1735a5124cff8bd", 0x75}], 0x3, 0x0, 0x0, 0x40080}], 0x1, 0x20040800) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000600)="ac2314f8347b4d7a67546f08162c49a5d96ff3d6e7b5e4ef16694227489565b70ba1d959a0d36cc6832e18cb880428170659fdb9e9b9a70b8d383194714df3decc7e0412075d4f1a844095c30f4eebdc441bcc2afeb7d7b1549d5ec6b85b6f157f0df2411038c857e90b350b905c69668474bc8feb9800a6e4fb1498f6d5bf94f4bdf65c4a19388a93dbe027d8f9c2cf28498b9d0ee017d836bd64da0e8351b185aa08a55c7f2450a86be5a748a186a4a3ae0475b2b84412a4aa41676749e44a054d080f4e05e1d24028f9db717a3c841f438abc4b1add861515804542ed2816de0fb2e9248c2c1b20604e62087b71d90ab6ba207711827846a087f7c2", 0xfd) r2 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400), r1) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000004c0)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010027bd7000fcdbdf254400000008000300", @ANYRES32=r4, @ANYBLOB="0a001800030303030303000004005a8020005a8018000080140005"], 0x4c}}, 0x4040810) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r1, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000140)={&(0x7f0000000040)={0x48, r3, 0x20, 0x70bd2d, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0x10, 0x7}}}}, [@NL80211_ATTR_CRIT_PROT_ID={0x6, 0xb3, 0x2}, @NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6, 0xb4, 0x134e}, @NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6, 0xb4, 0x31f}, @NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6, 0xb4, 0x218}, @NL80211_ATTR_CRIT_PROT_ID={0x6, 0xb3, 0x3}]}, 0x48}, 0x1, 0x0, 0x0, 0x800}, 0x20008000) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) 19.486467961s ago: executing program 3 (id=2763): r0 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) r1 = socket$kcm(0x2d, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r1, 0x89e2, &(0x7f0000000340)={r1}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x3, &(0x7f0000000d00)=ANY=[@ANYRES16], &(0x7f0000000000)='syzkaller\x00', 0xfffffffd}, 0x94) r2 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r3 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r2}, 0x8) close(r3) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x5, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18080000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000700000095"], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x5, r3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$sock_kcm_SIOCKCMATTACH(r1, 0x89e3, &(0x7f0000000180)={r1, r4}) bpf$MAP_GET_NEXT_KEY(0x2, 0x0, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, 0x0, &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000800)={'xfrm0\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYRES64=r0], 0x20}, 0x1, 0x0, 0x0, 0x2004c010}, 0x0) r7 = socket(0x11, 0x3, 0x0) sendto$packet(r7, &(0x7f0000000180)="6fa4bf90aa8a2fa36a8f6c8fa168f069adfc79fefab38d472a35afef1a050076aa851156780bb0fe39", 0x29, 0x0, &(0x7f0000000140)={0x11, 0x0, r5, 0x1, 0x0, 0x6, @random="0786dbd848f5"}, 0x14) r8 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r8, &(0x7f0000000040)={0xa, 0xe22, 0x33, @mcast2, 0x2}, 0x1c) connect$inet6(r8, &(0x7f00000002c0)={0x2, 0x4e22, 0x0, @private0={0xfc, 0x0, '\x00', 0x1}}, 0x1c) 19.434897823s ago: executing program 3 (id=2765): r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f00000005c0), 0x10) connect$can_bcm(r0, &(0x7f0000000040), 0x10) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_tcp_buf(r1, 0x6, 0x1f, &(0x7f00000001c0)="1a8f8a5e0cbbd5fb8d709c3313594dca5729c856af583605d1b42b707e3685a6cb30ceeb4e3adc8e03", 0x29) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000780)=ANY=[@ANYRES32, @ANYRES32, @ANYBLOB="1b"], 0x20) r2 = socket$nl_generic(0x10, 0x3, 0x10) getsockopt(r2, 0x1, 0x9, &(0x7f00000042c0)=""/102396, &(0x7f0000000440)=0x18ffc) ioctl$sock_SIOCGIFCONF(r2, 0x8912, &(0x7f0000000000)=@buf={0xb6, &(0x7f0000000100)="f12c4b6481022f1108f46817873c3ac13bb79f617fc462416b081ffcf1c21f5e992c93dbc328efd65b41a1963a1e37dd382e65a7fb734aa52dd65904e73439647655e6808bbad0f30c0ff09f53e8705d8d800a44b1645fbda03310af5c0dd8b1c3688e78785a39e4f580d06463c603267a9c7678a35b823b8060e5895a2fd4aef7a3a866a7309489077a762665723c2f00bb5ca273a50385fe75a14bc018b2fd841d4f515884ae29495e0480e615bc4dec052494775d"}) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x7}, 0x1c) listen(r3, 0xfffffffc) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff) ioctl$BTRFS_IOC_TREE_SEARCH(r1, 0xd0009411, &(0x7f0000002700)={{0x0, 0xc, 0x6c9d, 0x20000005, 0xf5, 0x4, 0x5, 0x5, 0x5, 0x8, 0x48000, 0x1, 0x800000000009, 0x6, 0x4000000002}}) ioctl$BTRFS_IOC_INO_LOOKUP(r4, 0xd0009412, &(0x7f0000001640)={r5, 0x80}) r6 = socket$inet_mptcp(0x2, 0x1, 0x106) r7 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000200), 0x60400, 0x0) ioctl$PPPIOCSMAXCID(r7, 0x40047451, &(0x7f00000003c0)=0x2) connect$inet(r6, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000500)) getsockopt$bt_BT_SECURITY(r9, 0x112, 0x4, &(0x7f0000000400), 0x2) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000007c0)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYBLOB="8320ed74bec5e495454edde49d405da034cc7cabc14babd52d2d496d7affa6e1c2abf190f01f618646590557b4465f9f485689ac2b8733462f51c2feb31ae47a7428b2be4a179583b98af557bd8898c52f981b717e3da02d77f48933720c8dd4e15ccc737e644d98f4f2ba78c5a6440af345bfbcc339ad40ca0360ee2ba39749e982f2ed93e9bab1177af38e535a26bc037f12cf7894a6addbbf84781061186e84889e58f4c2bfbb6c2db0ebd1e60b77909560329848aa4782a234fdead577163c6295ae", @ANYBLOB="070000141d269f7b0000810b149f9e402004f300000000000201800700ad732804921414aac4beac88f85cd9050c650fb6951cb9e8f790bf8ac0b19e4fb101dfb57da5a50aa5350cdebd472fc12bfe88302a7109f1e98be7c3ccb9679791143e0d5afe9f505a9827603e5bbf872c195823aa2e4bfad76f531bcfe56a27a53f5ec3f4"], 0x20}}, 0x0) r10 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet6_int(r10, 0x29, 0x8, 0x0, &(0x7f0000000440)) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000080)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x40, 0x40, 0x0, 0x1, {{0x23, 0x4, 0x2, 0x7, 0x8c, 0x7f, 0x0, 0x0, 0x2f, 0x0, @broadcast, @local, {[@generic={0x44, 0x10, "8e78279b5f4fe89e0e12eff313c7"}, @timestamp={0x44, 0x20, 0x83, 0x0, 0x0, [0x2, 0x1000, 0x1004, 0x6, 0x28000000, 0x3, 0x7]}, @timestamp={0x44, 0x20, 0x5b, 0x0, 0x5, [0x3, 0x27, 0xffffffff, 0x10000, 0x8, 0x400, 0x40000]}, @lsrr={0x83, 0x23, 0x8c, [@multicast1, @broadcast, @multicast2, @private=0xa010101, @local, @broadcast, @private=0xa010101, @empty]}, @noop, @end]}}}}}) 18.543774722s ago: executing program 3 (id=2779): r0 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000004c0)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.swap.events\x00', 0x275a, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r4 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) connect$bt_l2cap(r4, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) setsockopt$bt_BT_SECURITY(r4, 0x112, 0x4, &(0x7f0000003000)={0x2}, 0x2) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f00c00e}, 0x4080) recvmsg$kcm(0xffffffffffffffff, 0x0, 0x40000100) recvmsg$kcm(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0) socket$inet(0x2, 0x3, 0x7) socket$nl_generic(0x10, 0x3, 0x10) r5 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x0, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000800000000bf91000000000000b702000043e7b5538500000085000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r6, 0x0, 0x6}, 0x18) ppoll(&(0x7f0000000500)=[{r5}], 0x1, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x6, 0x3, 0x4, 0x0, 0x0, 0x3}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x9, 0x200000000000000, 0x0, 0x7fffffff}, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) close(0x4) setsockopt$sock_attach_bpf(r1, 0x1, 0x2a, &(0x7f0000000100)=r3, 0x4) sendmsg$unix(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000200)="c3", 0x1}], 0x1, 0x0, 0x0, 0x40000}, 0x20004011) recvmsg$unix(r1, &(0x7f0000000580)={0x0, 0x0, 0x0}, 0x10002) sendmsg$inet(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000001c0)='l', 0x1}], 0x1}, 0x2404c140) write$cgroup_subtree(r2, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00'], 0x6) sendmsg$inet(r0, &(0x7f0000000700)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000180)="1c00000021006bcd210002006e04000081000010000000017aa60864", 0x1c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000240)={'ip6tnl0\x00', &(0x7f00000003c0)={'ip6_vti0\x00', 0x0, 0x4, 0x6, 0x62, 0x1, 0x0, @loopback, @mcast1, 0x20, 0x1, 0x8, 0x11e}}) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x14, 0x1c, &(0x7f00000002c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x6}, {{0x18, 0x1, 0x1, 0x0, r3}}, {}, [@map_idx_val={0x18, 0x9, 0x6, 0x0, 0x5, 0x0, 0x0, 0x0, 0x5}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r3}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xfffffffd}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}}, @exit, @exit], {{}, {}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f00000000c0)='syzkaller\x00', 0x9, 0x0, 0x0, 0x41000, 0x10, '\x00', r7, @fallback=0x30, 0xffffffffffffffff, 0x8, &(0x7f0000000440)={0x6, 0x3}, 0x8, 0x10, 0x0, 0x0, 0xffffffffffffffff, r3, 0x2, &(0x7f0000000480)=[r3], &(0x7f0000000500)=[{0x0, 0x1, 0x9, 0x5}, {0x3, 0x2, 0xa, 0x6}], 0x10, 0x6}, 0x94) 17.598481329s ago: executing program 3 (id=2786): socket$nl_generic(0x10, 0x3, 0x10) (async) r0 = socket$nl_audit(0x10, 0x3, 0x9) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x1c1341, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) (async) r4 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x161042, 0x0) ioctl$PPPIOCNEWUNIT(r4, 0xc004743e, &(0x7f0000000000)=0x2) (async) ioctl$PPPIOCSPASS(r4, 0x40107447, &(0x7f0000000100)={0x2, &(0x7f0000000080)=[{0x40, 0x0, 0x38, 0x8}, {0x6, 0xfc}]}) (async) ioctl$PPPIOCSDEBUG(r4, 0x40047440, &(0x7f0000000240)=0x10001) (async) write(r4, &(0x7f0000000280)="4591", 0x2) (async) close(r3) (async) socket$netlink(0x10, 0x3, 0x0) (async) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local}) (async) writev(r2, &(0x7f00000003c0)=[{&(0x7f0000000140)="e21a6260c8bcfdc60c7a74381fae38769b97a9173523a11e55d0054def06", 0x1e}, {&(0x7f00000002c0)="42258947123b7d3d3d439f94acdf14f103653fad3353d802b6c52c556ee25ba3c6bec4998743243dde2c3d3365e1709ade1420", 0x33}, {&(0x7f0000000840)="35f96bc8cbcad08f72fadbd2990f86dce7ef02160f7cf0951cd956809b70f5f58bb8c521ac812c50e24df5628b3cae05845586a26c4f7c65a03744f934ba409a9096eceb2a5abcda58268c1ed32039e17cac4a3f8e6132d368de486c4225bef91a072c76c544aa4a42ede7c4ddf7d1861957a3aba04d4fa0a6a7cc5150867b92b927501f224c042b4682b79ed05a9a8548d94dbe7e32bc7a2908ccc3f4fa340261f44ccaadb031c90d88f7ab7c44613ea7bff7399cdbcf09f469117a9a7592aeec6debcc4aaa31d3fa9ec7cdf4e361bde027a338feb29e271056d0f79f5d03516b902ffaffc48074304817090ba795b5386a2e77", 0xf4}, {&(0x7f0000000380)="8121736d79c45e42ad949e644321c78e5f1da1cc2dcca3", 0x17}], 0x4) r5 = syz_genetlink_get_family_id$team(&(0x7f0000000080), 0xffffffffffffffff) (async) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000040)) (async) r6 = socket(0xa, 0x2, 0x3a) connect$unix(r6, &(0x7f00000000c0)=@file={0x0, './file0\x00'}, 0x6e) (async) r7 = socket$isdn_base(0x22, 0x3, 0x0) bind$isdn_base(r7, 0x0, 0x0) (async) r8 = socket(0x11, 0x6, 0x80001) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000040)={'team_slave_1\x00', 0x0}) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000700)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="01002cbd7000ffdbdf250100000008000100", @ANYRES32=r4, @ANYBLOB="400002803c00010024000100757365725f6c696e6b75705f656e61626c65640000000000000000000000000005000300060000000400040008000600", @ANYRES32=r9, @ANYBLOB="b257c37d43adef68554531ed15b330f4324d357fc3b1203481ca471d8ce307c087adb2807111c39c785518d0150b04e5f8510a225223c7f3ed914a2f5f3715c9f1eea7df52d6711124c1272c364bcb2c9a3e094d68f865af206b9b9cb579d4bc3f3012f2bdbb24ebc851332606a568e781e4922bc07aa2cd123f17cab2059aa825517a3765f4895bf93c31314ed7aa2d68f51808647e9bbd10b83029e7853ee70b8d0b87ce9fc3dc5887d99bf97a44718cdc7fdfaa03851a1c8d242b8317335c75b4d9c86b56c370ce77322a276d9d96b196d3b2d83c737e933069e9d60c7893691350"], 0x5c}, 0x1, 0x0, 0x0, 0x400}, 0x0) (async) r10 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000005c0)={0x18, 0xc, &(0x7f0000000300)=ANY=[@ANYBLOB="18000000000000000000000000000000850000002a000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000b000000095"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffff9}, 0x94) r11 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xc, &(0x7f0000000300)=ANY=[], &(0x7f0000000400)='GPL\x00', 0x4, 0x0, 0x0, 0x41000, 0x62, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r10, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r11}, 0x10) r12 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r12, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f00000001c0)="d8000000180081064e81f782db4cb904021d080006007c09e8fe55a10a0015000600142603600e1208000f0000000401a80016002000024006000200035c0461c1d60008000000000000fb8000a0e408e8d8ef52a98516277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9e00360db70100000040fad95667e006dcdf63951f0f49e119c849ea6e5a0fc55e4cde205a214d6102d6dcbf33fb5ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6cc", 0xd8}], 0x1}, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) 17.418492771s ago: executing program 3 (id=2787): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x1c}, 0x1, 0x0, 0x0, 0x20004002}, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0xffffffffffffffff, 0x2}, 0x6) recvmmsg(r0, &(0x7f0000000000)=[{{0x0, 0x27, 0x0, 0x0, &(0x7f0000000700)=""/176, 0xb0}}], 0x40000000000012f, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) socket$caif_stream(0x25, 0x1, 0x5) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="1802000000000000000000000000000018010000202070250000000000202020"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10001}, 0x94) socket$xdp(0x2c, 0x3, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) r2 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r2, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/74, 0x328000, 0x1000}, 0x1c) setsockopt$XDP_RX_RING(r2, 0x11b, 0x2, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x18, 0xe, &(0x7f0000000780)=ANY=[], 0x0, 0x2, 0x4b, 0x0, 0x40f00, 0x8, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xa30}, 0x94) ioctl$sock_SIOCBRADDBR(r1, 0x89a0, &(0x7f00000002c0)='ip6_vti0\x00') r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_SET_MESH(r3, &(0x7f0000000640)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000600)={&(0x7f0000000380)=ANY=[@ANYBLOB="34015028043c9c4771b8aab401c48135375d5f067fb13dc3ccf7cea4073d36334f53264b891f1363cbd8942dd78d57005a5b9fed76fa39340e29bbe695f3414824680708948c6642897d895ead0eb3c365e8", @ANYRES16=0x0, @ANYBLOB="01002dbd7000fcdbdf250f00000005002900000000000500330001000000050030000000000005002a0000000000"], 0x34}, 0x1, 0x0, 0x0, 0x8040}, 0x10) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x2}, 0x2000400c) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x1, 0x6a, &(0x7f0000000340)=ANY=[], 0x0, 0xf7fffffe, 0x0, 0x0, 0x0, 0xe}, 0x94) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r5 = accept4(r4, 0x0, 0x0, 0x800) sendmmsg$alg(r5, &(0x7f0000000040), 0x0, 0x40800) ioctl$sock_inet_SIOCSIFFLAGS(r4, 0x8914, &(0x7f0000000540)={'\x00', 0x2}) recvmsg(r5, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000840)=""/81, 0x51}, {&(0x7f00000007c0)=""/83, 0x53}], 0x2}, 0x0) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r8, 0x0, 0xc000) sendmsg$NL80211_CMD_FRAME(r3, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000680)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r6, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r7, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0) 17.389691192s ago: executing program 3 (id=2788): r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r1, 0x0, &(0x7f00000000c0)=0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0xc, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000610000001801000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000001700000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000a40)={r4, 0x27, 0x36, 0x0, &(0x7f0000000880)="f8ad1dcc02cb29dcc8003200810066a286ddc6617f503e7457188353133a3d4070574ac945c1be1c9b296e268bd0fabb3a4ba7534035", 0x0, 0x4000, 0xf2ffffff, 0x0, 0x0, 0x0, 0x0}, 0x50) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r5) sendmsg$NFC_CMD_DEV_UP(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000000)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r6, @ANYBLOB="010028bd7000070000000200000008000100", @ANYRES32=r2], 0x1c}, 0x1, 0x0, 0x0, 0x40089}, 0x8004) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="3c0000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="312000000000000014002b8008000400", @ANYRES32, @ANYBLOB="080003000300000008001b"], 0x3c}, 0x1, 0x0, 0x0, 0x20048054}, 0x0) r8 = socket$nl_xfrm(0x10, 0x3, 0x6) write$nci(r1, &(0x7f00000001c0)=ANY=[@ANYBLOB="414601", @ANYRES8=r8], 0x4) r9 = socket$alg(0x26, 0x5, 0x0) bind$alg(r9, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha224\x00'}, 0x58) r10 = accept(r9, 0x0, 0x0) sendmsg$TIPC_NL_PEER_REMOVE(r10, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000580)={0x14, 0x0, 0x1, 0x70bd2b, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x80}, 0xca4ffd611946ea37) ioctl$sock_SIOCSIFVLAN_SET_VLAN_NAME_TYPE_CMD(r0, 0x8983, &(0x7f0000000040)={0x6, 'syz_tun\x00', {0x10000}, 0x4}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'wlan1\x00', 0x0}) r12 = socket$netlink(0x10, 0x3, 0x15) sendmsg$nl_route(r12, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000380)=@newlink={0x50, 0x10, 0x503, 0x70bd2a, 0x4, {0x0, 0x0, 0x0, 0x0, 0x3a, 0x201a0}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @vlan={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_VLAN_ID={0x6, 0x1, 0x2}]}}}, @IFLA_LINK={0x8, 0x5, r11}, @IFLA_BROADCAST={0xa, 0x2, @remote}]}, 0x50}}, 0x800) 16.117888825s ago: executing program 1 (id=2794): r0 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) r1 = socket$kcm(0x2d, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r1, 0x89e2, &(0x7f0000000340)={r1}) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x3, &(0x7f0000000d00)=ANY=[@ANYRES16], &(0x7f0000000000)='syzkaller\x00', 0xfffffffd}, 0x94) r3 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000300)={0x0, r2, 0x0, 0x9}, 0x18) r4 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r3}, 0x8) close(r4) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x5, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18080000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000700000095"], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x5, r4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$sock_kcm_SIOCKCMATTACH(r1, 0x89e3, &(0x7f0000000180)={r1, r5}) bpf$MAP_GET_NEXT_KEY(0x2, 0x0, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, 0x0, &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000800)={'xfrm0\x00', 0x0}) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYRES64=r0], 0x20}, 0x1, 0x0, 0x0, 0x2004c010}, 0x0) r8 = socket(0x11, 0x3, 0x0) sendto$packet(r8, &(0x7f0000000180)="6fa4bf90aa8a2fa36a8f6c8fa168f069adfc79fefab38d472a35afef1a050076aa851156780bb0fe39", 0x29, 0x0, &(0x7f0000000140)={0x11, 0x0, r6, 0x1, 0x0, 0x6, @random="0786dbd848f5"}, 0x14) r9 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r9, &(0x7f0000000040)={0xa, 0xe22, 0x33, @mcast2, 0x2}, 0x1c) connect$inet6(r9, &(0x7f00000002c0)={0x2, 0x4e22, 0x0, @private0={0xfc, 0x0, '\x00', 0x1}}, 0x1c) 16.074090123s ago: executing program 1 (id=2795): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=ANY=[@ANYBLOB="3c0200001900013c0000000001000000fe880000000000000000000000000101ac1414bb00000000000000000000000000000000000000000200000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000300000000000000000000000000000000000000000000000000000000000000000000000003000000000000000000000000000000000000000000000000000036000000000000000000000000000800000000000000000000000000000002000000000000000001000000000084010500ac1414aa0000000000000000000000000000000033"], 0x23c}, 0x1, 0x0, 0x0, 0x1}, 0x4000) 16.042842413s ago: executing program 1 (id=2796): syz_emit_ethernet(0x82, &(0x7f0000000580)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x74, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0xe0, 0x0, 0xe000, {0x16, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @loopback, {[@rr={0x7, 0x3}, @ssrr={0x89, 0x3, 0x2b}, @timestamp_prespec={0x44, 0x3c, 0x0, 0x3, 0x0, [{@private=0xa010188}, {@multicast1}, {@loopback, 0x200}, {@local}, {}, {@dev}, {@private}]}]}}}}}}}, 0x0) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[], 0x38}}, 0x40000) 15.966618177s ago: executing program 1 (id=2797): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), r0) sendmsg$NL802154_CMD_SET_CCA_MODE(r0, &(0x7f0000000340)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x2c, r1, 0x100, 0x70bd2c, 0x25dfdbfd, {}, [@NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x2}, @NL802154_ATTR_CCA_OPT={0x8}, @NL802154_ATTR_CCA_OPT={0x8, 0xd, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x80}, 0x4000000) (async) r2 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f00000001c0), r0) (async) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00004cdc71dce3a371365759cc009234d9513f", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001540)={0x3, 0xd, &(0x7f0000000140)=@framed={{0x18, 0x2, 0x0, 0x0, 0x2040, 0x0, 0x0, 0x0, 0xffffffff}, [@call={0x85, 0x0, 0x0, 0x27}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r3}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x8}}]}, &(0x7f0000000040)='syzkaller\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r4, 0x0, 0x43, 0x0, &(0x7f0000000880)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) (async) sendmsg$NLBL_UNLABEL_C_STATICREMOVEDEF(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYRESDEC=r0, @ANYRES8=0x0, @ANYRESOCT=r2, @ANYRES8=r0, @ANYRESOCT=r2], 0x78}, 0x1, 0xffffffff00000003, 0x0, 0x10}, 0x0) 15.96368367s ago: executing program 1 (id=2798): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0a0000000400000004000000"], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000580), &(0x7f00000004c0), 0x1000, r0}, 0x38) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x18, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f00000004c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000300)='rcu_utilization\x00', r2}, 0x10) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0xa, 0x1, 0x3f, 0x40, 0x42}, 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000340), &(0x7f0000000100), 0x1003, r3}, 0x38) r4 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x0, @dev}, 0x2}}, 0x2e) connect$pppl2tp(r1, &(0x7f0000000040)=@pppol2tpv3={0x18, 0x1, {0x0, r4, {0x2, 0x4e24, @empty}, 0x3ff, 0x0, 0x2}}, 0x2e) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x2, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='tlb_flush\x00', r5}, 0x10) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) r7 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, r7) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000002c0)={{{@in6=@private2, @in=@broadcast}}, {{@in6=@loopback}, 0x0, @in6=@private0}}, &(0x7f00000003c0)=0xe8) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f00000006c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000680)={0x0}, 0x1, 0x0, 0x0, 0x800}, 0x80) sendmsg$NFQNL_MSG_CONFIG(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x2, 0x3, 0x201, 0x0, 0x0, {0x0, 0x0, 0xf}}, 0x14}}, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000240)={'ipvlan0\x00'}) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={0x0}, 0x1, 0x0, 0x0, 0x1}, 0x24004004) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_DELETE(r10, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="4c000000021a010000000000000000000200000a300002802c00018004000300ff01000000000000000000000000000114000400fe880000bd52000000000000000001010600074000000000"], 0x4c}, 0x1, 0x0, 0x0, 0x804}, 0x80) 15.880114187s ago: executing program 1 (id=2799): r0 = epoll_create1(0x0) writev(r0, 0x0, 0x0) r1 = socket$inet6_sctp(0xa, 0x801, 0x84) sendmmsg$inet6(r1, &(0x7f0000002680)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) socket(0x400000000010, 0x3, 0x0) socket$unix(0x1, 0x5, 0x0) bind$alg(0xffffffffffffffff, &(0x7f00000003c0)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_pr_hmac_sha384\x00'}, 0x58) accept4(0xffffffffffffffff, 0x0, 0x0, 0x80000) socket(0x2, 0x80805, 0x0) socket(0x1, 0x2, 0x0) pipe(&(0x7f0000000040)={0xffffffffffffffff}) socket(0x1d, 0x2, 0x6) socket(0x10, 0x3, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) pselect6(0x40, &(0x7f00000001c0)={0x7, 0x2, 0x3, 0x1}, 0x0, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_COALESCE_SET(r4, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000180)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010000000000000000001400000008000a00fc00000018000180140002006e657464657673696d300000000000000800050000fcffff08000700fc000000080011000700000008000e00800000000800", @ANYRES16=r3], 0x5c}, 0x1, 0x0, 0x0, 0x800}, 0x0) getsockopt$inet_sctp6_SCTP_RTOINFO(r1, 0x84, 0x82, 0x0, &(0x7f0000000480)) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000140)={r2, 0x20, &(0x7f0000000000)={&(0x7f0000000280)=""/233, 0xe9, 0x0, &(0x7f0000000580)=""/152, 0x98}}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x6, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, r6}, 0x94) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x701203, 0x0) close(r8) socket$nl_generic(0x10, 0x3, 0x10) 12.03365265s ago: executing program 32 (id=2669): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r0, 0x0) r1 = socket(0x1, 0x2, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x48) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000140)={r2, &(0x7f0000000180), &(0x7f00000000c0)=@tcp6=r1}, 0x20) recvmmsg(r1, &(0x7f0000000d40), 0x0, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010101}]}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x7a, &(0x7f0000000340)={r3, @in6={{0xa, 0x3, 0xb, @private1={0xfc, 0x1, '\x00', 0x1}}}}, &(0x7f0000000040)=0x84) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r0, 0x84, 0x71, &(0x7f0000000000)={r3}, &(0x7f00000000c0)=0x8) r4 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) r5 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r6 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$sock_linger(r6, 0x1, 0xd, 0x0, 0xb5) ioctl$IOCTL_GET_NCIDEV_IDX(r5, 0x0, &(0x7f0000000000)=0x0) bind$nfc_llcp(r4, &(0x7f0000001040)={0x27, r7, 0xffffffffffffffff, 0x5, 0x0, 0x0, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x3c}, 0x60) readv(r4, &(0x7f0000000600), 0x0) close(r5) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000240)={0x0, 0xffffffffffffffff, 0x0, 0x73, &(0x7f0000000280)='/proc/net\x00\x00t4/c+\x0fG\xf9\xe1K\fX\a0\x04\x00\x00\x82D\x80\xa2EZ\xad}\\-\xd1\x96R\x91\xd7x\xb5\xfb\xc4N\xc7\xb3+\xb3qW\xa9\x83\x9b\x84\xbc\xe9\xc6$\x9b/\xda\x9d=P\xd1Xzk\xb5\x95\x18\xd7\xa8\xcc\x99v\x84hQ\xf1fZ\n\xb6\x02\xd5\xf1\xb4b\xa6\aM+\xc1\xe8\"\x0f\x89\xba\xb3\x06:a\xd335^x\xaf\x14\x82'}, 0x30) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) r9 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r9, &(0x7f0000000200), 0x806000) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000009, 0x12, r8, 0x1000) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) writev(r4, &(0x7f0000000100)=[{&(0x7f0000000080)='6', 0x1}], 0x1) 11.988237815s ago: executing program 33 (id=2675): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000540)={0x11, 0x3, &(0x7f0000000040)=@framed={{0x18, 0x0, 0x0, 0x0, 0x7}}, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r0, 0x0, 0x5}, 0x18) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x101801, 0x0) clock_gettime(0x0, &(0x7f0000000180)={0x0, 0x0}) pselect6(0x40, &(0x7f0000000080)={0xc8f, 0x9, 0xffff, 0x100, 0x8, 0x65f9e5cb, 0x4a94, 0x2}, &(0x7f00000000c0)={0x0, 0x6, 0x4000000000000000, 0x3, 0x3, 0x1, 0x401, 0x7}, &(0x7f0000000140)={0x3, 0x10, 0xfffffffffffffffb, 0x5, 0x3, 0x40, 0x10000, 0x4}, &(0x7f00000001c0)={r2, r3+60000000}, &(0x7f0000000280)={&(0x7f0000000240)={[0xf]}, 0x8}) clock_gettime(0x3, &(0x7f00000002c0)) write$rfkill(r1, &(0x7f0000000000)={0x5, 0x0, 0x3, 0xfc}, 0x8) 2.02435275s ago: executing program 34 (id=2788): r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r1, 0x0, &(0x7f00000000c0)=0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0xc, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000610000001801000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000001700000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000a40)={r4, 0x27, 0x36, 0x0, &(0x7f0000000880)="f8ad1dcc02cb29dcc8003200810066a286ddc6617f503e7457188353133a3d4070574ac945c1be1c9b296e268bd0fabb3a4ba7534035", 0x0, 0x4000, 0xf2ffffff, 0x0, 0x0, 0x0, 0x0}, 0x50) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r5) sendmsg$NFC_CMD_DEV_UP(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000000)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r6, @ANYBLOB="010028bd7000070000000200000008000100", @ANYRES32=r2], 0x1c}, 0x1, 0x0, 0x0, 0x40089}, 0x8004) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="3c0000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="312000000000000014002b8008000400", @ANYRES32, @ANYBLOB="080003000300000008001b"], 0x3c}, 0x1, 0x0, 0x0, 0x20048054}, 0x0) r8 = socket$nl_xfrm(0x10, 0x3, 0x6) write$nci(r1, &(0x7f00000001c0)=ANY=[@ANYBLOB="414601", @ANYRES8=r8], 0x4) r9 = socket$alg(0x26, 0x5, 0x0) bind$alg(r9, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha224\x00'}, 0x58) r10 = accept(r9, 0x0, 0x0) sendmsg$TIPC_NL_PEER_REMOVE(r10, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000580)={0x14, 0x0, 0x1, 0x70bd2b, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x80}, 0xca4ffd611946ea37) ioctl$sock_SIOCSIFVLAN_SET_VLAN_NAME_TYPE_CMD(r0, 0x8983, &(0x7f0000000040)={0x6, 'syz_tun\x00', {0x10000}, 0x4}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'wlan1\x00', 0x0}) r12 = socket$netlink(0x10, 0x3, 0x15) sendmsg$nl_route(r12, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000380)=@newlink={0x50, 0x10, 0x503, 0x70bd2a, 0x4, {0x0, 0x0, 0x0, 0x0, 0x3a, 0x201a0}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @vlan={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_VLAN_ID={0x6, 0x1, 0x2}]}}}, @IFLA_LINK={0x8, 0x5, r11}, @IFLA_BROADCAST={0xa, 0x2, @remote}]}, 0x50}}, 0x800) 0s ago: executing program 35 (id=2799): r0 = epoll_create1(0x0) writev(r0, 0x0, 0x0) r1 = socket$inet6_sctp(0xa, 0x801, 0x84) sendmmsg$inet6(r1, &(0x7f0000002680)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) socket(0x400000000010, 0x3, 0x0) socket$unix(0x1, 0x5, 0x0) bind$alg(0xffffffffffffffff, &(0x7f00000003c0)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_pr_hmac_sha384\x00'}, 0x58) accept4(0xffffffffffffffff, 0x0, 0x0, 0x80000) socket(0x2, 0x80805, 0x0) socket(0x1, 0x2, 0x0) pipe(&(0x7f0000000040)={0xffffffffffffffff}) socket(0x1d, 0x2, 0x6) socket(0x10, 0x3, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) pselect6(0x40, &(0x7f00000001c0)={0x7, 0x2, 0x3, 0x1}, 0x0, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_COALESCE_SET(r4, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000180)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010000000000000000001400000008000a00fc00000018000180140002006e657464657673696d300000000000000800050000fcffff08000700fc000000080011000700000008000e00800000000800", @ANYRES16=r3], 0x5c}, 0x1, 0x0, 0x0, 0x800}, 0x0) getsockopt$inet_sctp6_SCTP_RTOINFO(r1, 0x84, 0x82, 0x0, &(0x7f0000000480)) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000140)={r2, 0x20, &(0x7f0000000000)={&(0x7f0000000280)=""/233, 0xe9, 0x0, &(0x7f0000000580)=""/152, 0x98}}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x6, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, r6}, 0x94) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x701203, 0x0) close(r8) socket$nl_generic(0x10, 0x3, 0x10) kernel console output (not intermixed with test programs): 409'. [ 245.440711][T11266] netlink: 36 bytes leftover after parsing attributes in process `syz.4.1409'. [ 245.450833][T11266] netlink: 36 bytes leftover after parsing attributes in process `syz.4.1409'. [ 245.460655][T11266] netlink: 36 bytes leftover after parsing attributes in process `syz.4.1409'. [ 245.470235][T11261] lo speed is unknown, defaulting to 1000 [ 245.497649][T11261] wg1 speed is unknown, defaulting to 1000 [ 245.948932][T11287] openvswitch: netlink: IP tunnel dst address not specified [ 245.992800][T11284] 8021q: adding VLAN 0 to HW filter on device bond1 [ 246.200537][T11297] tipc: Enabling of bearer rejected, failed to enable media [ 246.450010][T11303] netlink: 'syz.3.1420': attribute type 1 has an invalid length. [ 246.552287][T11311] netlink: 'syz.0.1422': attribute type 2 has an invalid length. [ 246.800963][T11324] netlink: 'syz.2.1421': attribute type 10 has an invalid length. [ 246.833472][T11310] bond6: (slave vxcan1): The slave device specified does not support setting the MAC address [ 246.890241][T11310] bond6: (slave vxcan1): Error -95 calling set_mac_address [ 247.431891][T11311] : entered promiscuous mode [ 247.458130][T11324] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 247.482868][T11324] bond0: (slave batadv0): Enslaving as an active interface with an up link [ 248.802556][T11376] sch_tbf: burst 0 is lower than device veth0_to_team mtu (1514) ! [ 249.470986][T11394] nbd: couldn't find device at index 0 [ 250.278959][T11418] netlink: 'syz.0.1449': attribute type 13 has an invalid length. [ 250.281640][T11413] __nla_validate_parse: 47 callbacks suppressed [ 250.281656][T11413] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1446'. [ 250.354902][T11413] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1446'. [ 250.358121][T11421] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1449'. [ 250.432705][T11423] RDS: rds_bind could not find a transport for 2001::2, load rds_tcp or rds_rdma? [ 250.437959][T11413] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1446'. [ 250.684754][T11423] vlan2: entered promiscuous mode [ 250.690050][T11423] bridge0: entered promiscuous mode [ 250.700343][T11434] netlink: 'syz.3.1454': attribute type 1 has an invalid length. [ 250.712312][T11423] vlan2: entered allmulticast mode [ 250.719956][T11423] bridge0: entered allmulticast mode [ 250.726408][T11434] netlink: 232 bytes leftover after parsing attributes in process `syz.3.1454'. [ 250.766718][T11432] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1453'. [ 250.805079][T11440] tipc: Enabling of bearer rejected, already enabled [ 250.833631][T11432] netlink: 'syz.1.1453': attribute type 1 has an invalid length. [ 250.855745][T11432] netlink: 'syz.1.1453': attribute type 2 has an invalid length. [ 251.068519][T11453] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1458'. [ 251.093471][T11453] netlink: 32 bytes leftover after parsing attributes in process `syz.2.1458'. [ 251.309491][T11467] netlink: 'syz.1.1462': attribute type 2 has an invalid length. [ 251.621474][T11474] netlink: 'syz.1.1464': attribute type 5 has an invalid length. [ 251.805468][T11477] netlink: 212408 bytes leftover after parsing attributes in process `syz.1.1465'. [ 251.897341][T11477] delete_channel: no stack [ 251.989305][T11485] netlink: 'syz.0.1466': attribute type 5 has an invalid length. [ 252.212439][T11498] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1467'. [ 252.743647][T11520] (unnamed net_device) (uninitialized): (slave bond_slave_1): Device is not bonding slave [ 252.775276][T11520] (unnamed net_device) (uninitialized): option active_slave: invalid value (bond_slave_1) [ 253.396996][T11548] lo speed is unknown, defaulting to 1000 [ 253.425312][T11548] wg1 speed is unknown, defaulting to 1000 [ 253.951862][T11583] netlink: 'syz.1.1493': attribute type 10 has an invalid length. [ 254.609668][T11612] Bluetooth: hci0: Opcode 0x0401 failed: -22 [ 254.667676][T11604] lo speed is unknown, defaulting to 1000 [ 254.676158][T11604] wg1 speed is unknown, defaulting to 1000 [ 254.743384][T11608] bridge: RTM_NEWNEIGH with unconfigured vlan 4 on bridge0 [ 254.805472][T11611] batman_adv: batadv0: Adding interface: vxlan0 [ 254.827185][T11611] batman_adv: batadv0: The MTU of interface vxlan0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 254.880301][T11611] batman_adv: batadv0: Interface activated: vxlan0 [ 254.913154][T11617] bridge0: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 254.925269][ T8012] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 254.936018][ T8012] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 254.945667][ T8012] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 254.954929][ T8012] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 255.062476][T11619] lo speed is unknown, defaulting to 1000 [ 255.071183][T11619] wg1 speed is unknown, defaulting to 1000 [ 255.383296][T11632] vlan2: entered promiscuous mode [ 255.386580][T11643] __nla_validate_parse: 33 callbacks suppressed [ 255.386596][T11643] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1508'. [ 255.398536][T11632] vlan2: entered allmulticast mode [ 255.449969][T11632] hsr_slave_1: entered allmulticast mode [ 255.636567][T11655] netlink: 159784 bytes leftover after parsing attributes in process `syz.4.1513'. [ 255.813658][T11654] netlink: 36 bytes leftover after parsing attributes in process `syz.0.1512'. [ 255.831503][T11654] netlink: 36 bytes leftover after parsing attributes in process `syz.0.1512'. [ 255.843484][T11654] netlink: 36 bytes leftover after parsing attributes in process `syz.0.1512'. [ 255.855606][T11654] netlink: 36 bytes leftover after parsing attributes in process `syz.0.1512'. [ 255.868540][T11654] netlink: 36 bytes leftover after parsing attributes in process `syz.0.1512'. [ 255.878838][T11654] netlink: 36 bytes leftover after parsing attributes in process `syz.0.1512'. [ 255.896954][T11654] netlink: 36 bytes leftover after parsing attributes in process `syz.0.1512'. [ 255.906896][T11654] netlink: 36 bytes leftover after parsing attributes in process `syz.0.1512'. [ 255.951674][ T1303] ieee802154 phy1 wpan1: encryption failed: -22 [ 256.060032][ T980] wg1 speed is unknown, defaulting to 1000 [ 256.066899][ T980] syz0: Port: 1 Link ACTIVE [ 256.639450][T11698] netlink: 'syz.2.1528': attribute type 6 has an invalid length. [ 256.664086][ T5867] Bluetooth: hci0: command tx timeout [ 257.202092][T11722] ieee802154 phy1 wpan1: encryption failed: -90 [ 258.391810][T11765] lo speed is unknown, defaulting to 1000 [ 258.410550][T11765] wg1 speed is unknown, defaulting to 1000 [ 258.569119][T11777] tipc: Enabling of bearer rejected, already enabled [ 258.662711][T11777] pimreg: entered allmulticast mode [ 259.401702][T11796] bond0 (unregistering): (slave wlan1): Releasing backup interface [ 259.414857][T11796] bond0 (unregistering): Released all slaves [ 260.712691][T11855] tipc: Enabled bearer , priority 0 [ 260.742644][T11863] __nla_validate_parse: 30 callbacks suppressed [ 260.742740][T11863] netlink: 256 bytes leftover after parsing attributes in process `syz.3.1577'. [ 260.767677][T11859] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1576'. [ 260.786335][T11860] tipc: Disabling bearer [ 260.878349][T11867] sch_fq: defrate 0 ignored. [ 260.946298][T11869] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1579'. [ 261.055494][T11871] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input7 [ 261.706762][T11902] netlink: 72 bytes leftover after parsing attributes in process `syz.2.1587'. [ 262.267564][T11928] sit0: entered promiscuous mode [ 262.280461][T11928] netlink: 'syz.3.1596': attribute type 1 has an invalid length. [ 262.306874][T11928] netlink: 1 bytes leftover after parsing attributes in process `syz.3.1596'. [ 262.775766][T11949] netlink: 48 bytes leftover after parsing attributes in process `syz.2.1603'. [ 262.786419][T11945] sit0: entered promiscuous mode [ 262.791688][T11945] netlink: 'syz.4.1601': attribute type 1 has an invalid length. [ 262.802304][T11945] netlink: 1 bytes leftover after parsing attributes in process `syz.4.1601'. [ 262.827121][T11950] vlan2: entered promiscuous mode [ 262.832221][T11950] mac80211_hwsim hwsim12 wlan2: entered promiscuous mode [ 263.047812][T11959] netlink: 'syz.1.1605': attribute type 1 has an invalid length. [ 263.064358][T11959] netlink: 'syz.1.1605': attribute type 2 has an invalid length. [ 263.099375][T11959] netlink: 104 bytes leftover after parsing attributes in process `syz.1.1605'. [ 263.139541][T11964] netlink: 40 bytes leftover after parsing attributes in process `syz.4.1606'. [ 263.346741][T11978] netlink: 'syz.0.1609': attribute type 27 has an invalid length. [ 263.553058][T11985] lo speed is unknown, defaulting to 1000 [ 263.669930][T11985] wg1 speed is unknown, defaulting to 1000 [ 264.317477][T12018] 8021q: adding VLAN 0 to HW filter on device ipvlan2 [ 264.328650][T12018] bond0: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 264.772049][T12035] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1629'. [ 264.945299][T12044] tipc: Enabling of bearer rejected, already enabled [ 265.078196][T12051] netlink: 'syz.0.1634': attribute type 1 has an invalid length. [ 265.145667][T12055] netlink: 'syz.1.1636': attribute type 1 has an invalid length. [ 265.232016][T12059] netlink: 'syz.0.1638': attribute type 1 has an invalid length. [ 265.248026][T12059] netlink: 'syz.0.1638': attribute type 1 has an invalid length. [ 265.274044][T12055] 8021q: adding VLAN 0 to HW filter on device bond4 [ 265.395875][T12058] bond4: (slave gretap2): making interface the new active one [ 265.424452][T12058] bond4: (slave gretap2): Enslaving as an active interface with an up link [ 265.900749][T12093] __nla_validate_parse: 2 callbacks suppressed [ 265.900770][T12093] netlink: 64 bytes leftover after parsing attributes in process `syz.1.1646'. [ 266.229922][T12108] netlink: 'syz.1.1650': attribute type 13 has an invalid length. [ 266.426817][T12107] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1651'. [ 266.446970][ T1598] netdevsim netdevsim1 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 266.474503][ T1598] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 266.505456][ T1598] netdevsim netdevsim1 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 266.522282][ T1598] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 266.551056][ T1598] netdevsim netdevsim1 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 266.594445][ T1598] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 266.603462][ T1598] netdevsim netdevsim1 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 266.634841][ T1598] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 266.640222][T12118] netlink: 388 bytes leftover after parsing attributes in process `syz.0.1653'. [ 267.130121][T12135] lo speed is unknown, defaulting to 1000 [ 267.160730][T12135] wg1 speed is unknown, defaulting to 1000 [ 267.472760][T12156] lo speed is unknown, defaulting to 1000 [ 267.483218][T12164] FAULT_INJECTION: forcing a failure. [ 267.483218][T12164] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 267.501109][T12162] netlink: 32 bytes leftover after parsing attributes in process `syz.3.1665'. [ 267.580560][T12164] CPU: 0 UID: 0 PID: 12164 Comm: syz.4.1666 Not tainted 6.17.0-rc1-syzkaller-00201-g88250d40ed59 #0 PREEMPT(full) [ 267.580591][T12164] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 267.580604][T12164] Call Trace: [ 267.580612][T12164] [ 267.580621][T12164] dump_stack_lvl+0x189/0x250 [ 267.580651][T12164] ? __pfx____ratelimit+0x10/0x10 [ 267.580680][T12164] ? __pfx_dump_stack_lvl+0x10/0x10 [ 267.580703][T12164] ? __pfx__printk+0x10/0x10 [ 267.580732][T12164] ? __might_fault+0xb0/0x130 [ 267.580771][T12164] should_fail_ex+0x414/0x560 [ 267.580802][T12164] _copy_from_user+0x2d/0xb0 [ 267.580825][T12164] __sys_sendto+0x25c/0x520 [ 267.580857][T12164] ? __pfx___sys_sendto+0x10/0x10 [ 267.580898][T12164] ? count_memcg_event_mm+0x21/0x260 [ 267.580935][T12164] ? exc_page_fault+0x76/0xf0 [ 267.580963][T12164] ? do_user_addr_fault+0xc8a/0x1390 [ 267.580999][T12164] __x64_sys_sendto+0xde/0x100 [ 267.581031][T12164] do_syscall_64+0xfa/0x3b0 [ 267.581057][T12164] ? lockdep_hardirqs_on+0x9c/0x150 [ 267.581081][T12164] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 267.581100][T12164] ? clear_bhb_loop+0x60/0xb0 [ 267.581124][T12164] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 267.581142][T12164] RIP: 0033:0x7fc4fd390a7c [ 267.581160][T12164] Code: 2a 5f 02 00 44 8b 4c 24 2c 4c 8b 44 24 20 89 c5 44 8b 54 24 28 48 8b 54 24 18 b8 2c 00 00 00 48 8b 74 24 10 8b 7c 24 08 0f 05 <48> 3d 00 f0 ff ff 77 34 89 ef 48 89 44 24 08 e8 70 5f 02 00 48 8b [ 267.581186][T12164] RSP: 002b:00007fc4fe24eec0 EFLAGS: 00000293 ORIG_RAX: 000000000000002c [ 267.581207][T12164] RAX: ffffffffffffffda RBX: 00007fc4fe24efc0 RCX: 00007fc4fd390a7c [ 267.581221][T12164] RDX: 0000000000000020 RSI: 00007fc4fe24f010 RDI: 0000000000000004 [ 267.581234][T12164] RBP: 0000000000000000 R08: 00007fc4fe24ef14 R09: 000000000000000c [ 267.581246][T12164] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000004 [ 267.581257][T12164] R13: 00007fc4fe24ef68 R14: 00007fc4fe24f010 R15: 0000000000000000 [ 267.581290][T12164] [ 267.944139][T12156] wg1 speed is unknown, defaulting to 1000 [ 268.487923][T12194] pim6reg1: entered allmulticast mode [ 268.590086][T12201] validate_nla: 1 callbacks suppressed [ 268.590107][T12201] netlink: 'syz.3.1673': attribute type 2 has an invalid length. [ 268.609835][T12201] netlink: 119 bytes leftover after parsing attributes in process `syz.3.1673'. [ 268.652591][T12203] netlink: 'syz.3.1673': attribute type 2 has an invalid length. [ 268.699800][T12183] infiniband syz1: set down [ 268.705109][T12183] infiniband syz1: added macvlan1 [ 268.783286][T12203] `: entered promiscuous mode [ 268.792870][T12183] RDS/IB: syz1: added [ 268.798438][T12183] smc: adding ib device syz1 with port count 1 [ 268.806453][T12183] smc: ib device syz1 port 1 has pnetid [ 268.851351][T12208] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1677'. [ 268.870844][T12208] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1677'. [ 268.911560][T12208] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1677'. [ 268.960042][T12212] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1678'. [ 269.021349][T12212] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1678'. [ 269.164908][T12216] lo speed is unknown, defaulting to 1000 [ 269.172763][T12216] wg1 speed is unknown, defaulting to 1000 [ 269.284587][T12226] FAULT_INJECTION: forcing a failure. [ 269.284587][T12226] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 269.337341][T12226] CPU: 0 UID: 0 PID: 12226 Comm: syz.3.1682 Not tainted 6.17.0-rc1-syzkaller-00201-g88250d40ed59 #0 PREEMPT(full) [ 269.337373][T12226] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 269.337384][T12226] Call Trace: [ 269.337392][T12226] [ 269.337401][T12226] dump_stack_lvl+0x189/0x250 [ 269.337430][T12226] ? __pfx____ratelimit+0x10/0x10 [ 269.337457][T12226] ? __pfx_dump_stack_lvl+0x10/0x10 [ 269.337479][T12226] ? __pfx__printk+0x10/0x10 [ 269.337506][T12226] ? __might_fault+0xb0/0x130 [ 269.337546][T12226] should_fail_ex+0x414/0x560 [ 269.337577][T12226] _copy_from_user+0x2d/0xb0 [ 269.337600][T12226] ___sys_sendmsg+0x158/0x2a0 [ 269.337625][T12226] ? __pfx____sys_sendmsg+0x10/0x10 [ 269.337688][T12226] ? __fget_files+0x2a/0x420 [ 269.337705][T12226] ? __fget_files+0x3a0/0x420 [ 269.337734][T12226] __x64_sys_sendmsg+0x19b/0x260 [ 269.337758][T12226] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 269.337790][T12226] ? __pfx_ksys_write+0x10/0x10 [ 269.337812][T12226] ? rcu_is_watching+0x15/0xb0 [ 269.337839][T12226] ? do_syscall_64+0xbe/0x3b0 [ 269.337871][T12226] do_syscall_64+0xfa/0x3b0 [ 269.337896][T12226] ? lockdep_hardirqs_on+0x9c/0x150 [ 269.337920][T12226] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 269.337939][T12226] ? clear_bhb_loop+0x60/0xb0 [ 269.337972][T12226] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 269.337990][T12226] RIP: 0033:0x7f666318ebe9 [ 269.338007][T12226] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 269.338024][T12226] RSP: 002b:00007f666403e038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 269.338045][T12226] RAX: ffffffffffffffda RBX: 00007f66633b5fa0 RCX: 00007f666318ebe9 [ 269.338059][T12226] RDX: 0000000000000000 RSI: 0000200000000140 RDI: 0000000000000003 [ 269.338071][T12226] RBP: 00007f666403e090 R08: 0000000000000000 R09: 0000000000000000 [ 269.338082][T12226] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 269.338094][T12226] R13: 00007f66633b6038 R14: 00007f66633b5fa0 R15: 00007ffd855088a8 [ 269.338127][T12226] [ 269.705549][T12230] RDS: rds_bind could not find a transport for fe80::1a, load rds_tcp or rds_rdma? [ 269.849355][T12237] geneve2: entered promiscuous mode [ 269.882361][ T8005] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 269.896508][ T8005] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 269.925776][ T8005] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 269.985824][ T8005] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 270.526315][T12257] lo speed is unknown, defaulting to 1000 [ 270.539506][T12257] wg1 speed is unknown, defaulting to 1000 [ 271.065503][T12273] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 271.529691][T12279] tipc: Enabled bearer , priority 0 [ 271.555431][T12279] syzkaller0: entered promiscuous mode [ 271.564434][T12279] syzkaller0: entered allmulticast mode [ 271.612851][T12279] tipc: Resetting bearer [ 271.914800][T12278] tipc: Resetting bearer [ 271.974981][T12278] tipc: Disabling bearer [ 272.009216][T12289] FAULT_INJECTION: forcing a failure. [ 272.009216][T12289] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 272.022745][T12289] CPU: 1 UID: 0 PID: 12289 Comm: syz.1.1701 Not tainted 6.17.0-rc1-syzkaller-00201-g88250d40ed59 #0 PREEMPT(full) [ 272.022773][T12289] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 272.022784][T12289] Call Trace: [ 272.022791][T12289] [ 272.022799][T12289] dump_stack_lvl+0x189/0x250 [ 272.022826][T12289] ? __pfx____ratelimit+0x10/0x10 [ 272.022847][T12289] ? __pfx_dump_stack_lvl+0x10/0x10 [ 272.022866][T12289] ? __pfx__printk+0x10/0x10 [ 272.022893][T12289] ? __might_fault+0xb0/0x130 [ 272.022928][T12289] should_fail_ex+0x414/0x560 [ 272.022959][T12289] _copy_from_user+0x2d/0xb0 [ 272.022981][T12289] sock_do_ioctl+0x182/0x300 [ 272.023009][T12289] ? __pfx_sock_do_ioctl+0x10/0x10 [ 272.023027][T12289] ? __lock_acquire+0xab9/0xd20 [ 272.023074][T12289] sock_ioctl+0x576/0x790 [ 272.023096][T12289] ? __pfx_sock_ioctl+0x10/0x10 [ 272.023118][T12289] ? __fget_files+0x2a/0x420 [ 272.023135][T12289] ? __fget_files+0x3a0/0x420 [ 272.023149][T12289] ? __fget_files+0x2a/0x420 [ 272.023178][T12289] ? bpf_lsm_file_ioctl+0x9/0x20 [ 272.023200][T12289] ? __pfx_sock_ioctl+0x10/0x10 [ 272.023219][T12289] __se_sys_ioctl+0xf9/0x170 [ 272.023242][T12289] do_syscall_64+0xfa/0x3b0 [ 272.023264][T12289] ? lockdep_hardirqs_on+0x9c/0x150 [ 272.023284][T12289] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 272.023302][T12289] ? clear_bhb_loop+0x60/0xb0 [ 272.023325][T12289] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 272.023344][T12289] RIP: 0033:0x7f437458ebe9 [ 272.023363][T12289] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 272.023380][T12289] RSP: 002b:00007f4375365038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 272.023402][T12289] RAX: ffffffffffffffda RBX: 00007f43747b5fa0 RCX: 00007f437458ebe9 [ 272.023417][T12289] RDX: 0000200000000700 RSI: 0000000000008914 RDI: 000000000000000d [ 272.023429][T12289] RBP: 00007f4375365090 R08: 0000000000000000 R09: 0000000000000000 [ 272.023441][T12289] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 272.023452][T12289] R13: 00007f43747b6038 R14: 00007f43747b5fa0 R15: 00007ffedca7e738 [ 272.023487][T12289] [ 272.497529][T12299] tipc: Enabled bearer , priority 0 [ 272.507303][T12299] syzkaller0: entered promiscuous mode [ 272.512847][T12299] syzkaller0: entered allmulticast mode [ 272.569324][T12299] tipc: Resetting bearer [ 272.602937][T12298] tipc: Resetting bearer [ 272.659703][T12298] tipc: Disabling bearer [ 273.916764][T12338] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 273.948546][T12336] FAULT_INJECTION: forcing a failure. [ 273.948546][T12336] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 273.990216][T12338] netlink: 'syz.4.1713': attribute type 1 has an invalid length. [ 273.997917][T12336] CPU: 0 UID: 0 PID: 12336 Comm: syz.3.1712 Not tainted 6.17.0-rc1-syzkaller-00201-g88250d40ed59 #0 PREEMPT(full) [ 273.997951][T12336] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 273.997961][T12336] Call Trace: [ 273.997969][T12336] [ 273.997977][T12336] dump_stack_lvl+0x189/0x250 [ 273.998004][T12336] ? __pfx____ratelimit+0x10/0x10 [ 273.998029][T12336] ? __pfx_dump_stack_lvl+0x10/0x10 [ 273.998050][T12336] ? __pfx__printk+0x10/0x10 [ 273.998089][T12336] should_fail_ex+0x414/0x560 [ 273.998120][T12336] _copy_to_user+0x31/0xb0 [ 273.998145][T12336] simple_read_from_buffer+0xe1/0x170 [ 273.998177][T12336] proc_fail_nth_read+0x1b3/0x220 [ 273.998202][T12336] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 273.998234][T12336] ? rw_verify_area+0x2a6/0x4d0 [ 273.998256][T12336] ? __lock_acquire+0xab9/0xd20 [ 273.998280][T12336] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 273.998302][T12336] vfs_read+0x1fd/0xa30 [ 273.998325][T12336] ? fdget_pos+0x247/0x320 [ 273.998347][T12336] ? __pfx___mutex_lock+0x10/0x10 [ 273.998374][T12336] ? __pfx_vfs_read+0x10/0x10 [ 273.998400][T12336] ? __fget_files+0x2a/0x420 [ 273.998422][T12336] ? __fget_files+0x3a0/0x420 [ 273.998437][T12336] ? __fget_files+0x2a/0x420 [ 273.998464][T12336] ksys_read+0x145/0x250 [ 273.998486][T12336] ? __fget_files+0x3a0/0x420 [ 273.998504][T12336] ? __pfx_ksys_read+0x10/0x10 [ 273.998534][T12336] ? do_syscall_64+0xbe/0x3b0 [ 273.998565][T12336] do_syscall_64+0xfa/0x3b0 [ 273.998589][T12336] ? lockdep_hardirqs_on+0x9c/0x150 [ 273.998613][T12336] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 273.998632][T12336] ? clear_bhb_loop+0x60/0xb0 [ 273.998656][T12336] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 273.998673][T12336] RIP: 0033:0x7f666318d5fc [ 273.998692][T12336] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 273.998708][T12336] RSP: 002b:00007f666403e030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 273.998729][T12336] RAX: ffffffffffffffda RBX: 00007f66633b5fa0 RCX: 00007f666318d5fc [ 273.998742][T12336] RDX: 000000000000000f RSI: 00007f666403e0a0 RDI: 000000000000000a [ 273.998754][T12336] RBP: 00007f666403e090 R08: 0000000000000000 R09: 0000000000000000 [ 273.998766][T12336] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 273.998778][T12336] R13: 00007f66633b6038 R14: 00007f66633b5fa0 R15: 00007ffd855088a8 [ 273.998812][T12336] [ 274.320403][T12352] netlink: 'syz.4.1713': attribute type 3 has an invalid length. [ 274.331337][T12352] __nla_validate_parse: 31 callbacks suppressed [ 274.331357][T12352] netlink: 199836 bytes leftover after parsing attributes in process `syz.4.1713'. [ 274.402212][T12338] 8021q: adding VLAN 0 to HW filter on device bond2 [ 274.581416][T12367] tipc: Enabled bearer , priority 0 [ 274.591804][T12367] syzkaller0: entered promiscuous mode [ 274.598278][T12367] syzkaller0: entered allmulticast mode [ 274.631938][T12367] tipc: Resetting bearer [ 274.660651][T12366] tipc: Resetting bearer [ 274.689415][T12366] tipc: Disabling bearer [ 274.744574][T12372] lo speed is unknown, defaulting to 1000 [ 274.752209][T12372] wg1 speed is unknown, defaulting to 1000 [ 274.850433][T12375] nbd: couldn't find device at index 0 [ 275.299034][T12387] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1726'. [ 275.304054][T12386] netlink: 'syz.4.1727': attribute type 13 has an invalid length. [ 275.320311][T12388] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1726'. [ 275.412876][T12388] vti0: entered promiscuous mode [ 275.444941][T12388] vti0: entered allmulticast mode [ 275.609073][T12386] tipc: Resetting bearer [ 275.650120][T12386] batman_adv: batadv0: Interface deactivated: vxlan0 [ 275.878684][ T1598] netdevsim netdevsim4 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 275.900916][ T1598] netdevsim netdevsim4 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 275.925396][T12406] tipc: Enabling of bearer rejected, media not registered [ 275.972292][T12410] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1733'. [ 276.009416][ T1598] netdevsim netdevsim4 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 276.029622][T12415] netlink: 212376 bytes leftover after parsing attributes in process `syz.4.1734'. [ 276.036660][ T1598] netdevsim netdevsim4 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 276.055639][T12416] nbd: couldn't find device at index 0 [ 276.079981][T12399] syzkaller1: entered promiscuous mode [ 276.086291][T12399] syzkaller1: entered allmulticast mode [ 276.233913][T12421] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1736'. [ 276.363598][T12424] FAULT_INJECTION: forcing a failure. [ 276.363598][T12424] name failslab, interval 1, probability 0, space 0, times 1 [ 276.377549][T12424] CPU: 0 UID: 0 PID: 12424 Comm: syz.4.1739 Not tainted 6.17.0-rc1-syzkaller-00201-g88250d40ed59 #0 PREEMPT(full) [ 276.377579][T12424] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 276.377591][T12424] Call Trace: [ 276.377599][T12424] [ 276.377608][T12424] dump_stack_lvl+0x189/0x250 [ 276.377638][T12424] ? __pfx____ratelimit+0x10/0x10 [ 276.377665][T12424] ? __pfx_dump_stack_lvl+0x10/0x10 [ 276.377688][T12424] ? __pfx__printk+0x10/0x10 [ 276.377722][T12424] ? __pfx___might_resched+0x10/0x10 [ 276.377746][T12424] should_fail_ex+0x414/0x560 [ 276.377779][T12424] should_failslab+0xa8/0x100 [ 276.377808][T12424] __kmalloc_noprof+0xcb/0x4f0 [ 276.377833][T12424] ? sock_kmalloc+0xd6/0x160 [ 276.377860][T12424] sock_kmalloc+0xd6/0x160 [ 276.377884][T12424] af_alg_alloc_areq+0x8d/0x260 [ 276.377911][T12424] skcipher_recvmsg+0x356/0x11c0 [ 276.377940][T12424] ? aa_sk_perm+0x81e/0x950 [ 276.377983][T12424] ? __pfx_skcipher_recvmsg+0x10/0x10 [ 276.378012][T12424] ? bpf_lsm_socket_recvmsg+0x9/0x20 [ 276.378032][T12424] ? security_socket_recvmsg+0x7e/0x2e0 [ 276.378053][T12424] ? __pfx_skcipher_recvmsg+0x10/0x10 [ 276.378078][T12424] sock_recvmsg+0x229/0x270 [ 276.378108][T12424] __sys_recvfrom+0x1f6/0x340 [ 276.378148][T12424] ? __pfx___sys_recvfrom+0x10/0x10 [ 276.378190][T12424] ? count_memcg_event_mm+0x21/0x260 [ 276.378230][T12424] ? exc_page_fault+0x76/0xf0 [ 276.378261][T12424] ? do_user_addr_fault+0xc8a/0x1390 [ 276.378296][T12424] __x64_sys_recvfrom+0xde/0x100 [ 276.378330][T12424] do_syscall_64+0xfa/0x3b0 [ 276.378354][T12424] ? lockdep_hardirqs_on+0x9c/0x150 [ 276.378379][T12424] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 276.378398][T12424] ? clear_bhb_loop+0x60/0xb0 [ 276.378422][T12424] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 276.378441][T12424] RIP: 0033:0x7fc4fd3909b4 [ 276.378458][T12424] Code: 89 4c 24 1c e8 ed 5f 02 00 44 8b 54 24 1c 8b 3c 24 45 31 c9 89 c5 48 8b 54 24 10 48 8b 74 24 08 45 31 c0 b8 2d 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 34 89 ef 48 89 04 24 e8 39 60 02 00 48 8b 04 [ 276.378475][T12424] RSP: 002b:00007fc4fe24eed0 EFLAGS: 00000246 ORIG_RAX: 000000000000002d [ 276.378497][T12424] RAX: ffffffffffffffda RBX: 00007fc4fe24efc0 RCX: 00007fc4fd3909b4 [ 276.378510][T12424] RDX: 0000000000001000 RSI: 00007fc4fe24f010 RDI: 0000000000000004 [ 276.378523][T12424] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 276.378534][T12424] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 [ 276.378544][T12424] R13: 00007fc4fe24ef68 R14: 00007fc4fe24f010 R15: 0000000000000000 [ 276.378576][T12424] [ 277.150213][T12444] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1745'. [ 277.163462][T12444] tipc: Enabling of bearer rejected, already enabled [ 277.442679][T12457] nbd: couldn't find device at index 0 [ 277.599281][T12464] FAULT_INJECTION: forcing a failure. [ 277.599281][T12464] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 277.643527][T12464] CPU: 0 UID: 0 PID: 12464 Comm: syz.0.1751 Not tainted 6.17.0-rc1-syzkaller-00201-g88250d40ed59 #0 PREEMPT(full) [ 277.643559][T12464] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 277.643571][T12464] Call Trace: [ 277.643578][T12464] [ 277.643587][T12464] dump_stack_lvl+0x189/0x250 [ 277.643616][T12464] ? __pfx____ratelimit+0x10/0x10 [ 277.643642][T12464] ? __pfx_dump_stack_lvl+0x10/0x10 [ 277.643665][T12464] ? __pfx__printk+0x10/0x10 [ 277.643709][T12464] should_fail_ex+0x414/0x560 [ 277.643745][T12464] _copy_to_user+0x31/0xb0 [ 277.643769][T12464] simple_read_from_buffer+0xe1/0x170 [ 277.643801][T12464] proc_fail_nth_read+0x1b3/0x220 [ 277.643826][T12464] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 277.643850][T12464] ? rw_verify_area+0x2a6/0x4d0 [ 277.643871][T12464] ? __lock_acquire+0xab9/0xd20 [ 277.643896][T12464] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 277.643918][T12464] vfs_read+0x1fd/0xa30 [ 277.643941][T12464] ? fdget_pos+0x247/0x320 [ 277.643970][T12464] ? __pfx___mutex_lock+0x10/0x10 [ 277.643998][T12464] ? __pfx_vfs_read+0x10/0x10 [ 277.644024][T12464] ? __fget_files+0x2a/0x420 [ 277.644046][T12464] ? __fget_files+0x3a0/0x420 [ 277.644061][T12464] ? __fget_files+0x2a/0x420 [ 277.644088][T12464] ksys_read+0x145/0x250 [ 277.644115][T12464] ? __pfx_ksys_read+0x10/0x10 [ 277.644146][T12464] ? do_syscall_64+0xbe/0x3b0 [ 277.644177][T12464] do_syscall_64+0xfa/0x3b0 [ 277.644200][T12464] ? lockdep_hardirqs_on+0x9c/0x150 [ 277.644223][T12464] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 277.644241][T12464] ? clear_bhb_loop+0x60/0xb0 [ 277.644265][T12464] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 277.644283][T12464] RIP: 0033:0x7f9d8cb8d5fc [ 277.644302][T12464] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 277.644318][T12464] RSP: 002b:00007f9d8adf6030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 277.644340][T12464] RAX: ffffffffffffffda RBX: 00007f9d8cdb5fa0 RCX: 00007f9d8cb8d5fc [ 277.644354][T12464] RDX: 000000000000000f RSI: 00007f9d8adf60a0 RDI: 0000000000000006 [ 277.644365][T12464] RBP: 00007f9d8adf6090 R08: 0000000000000000 R09: 0000000000000000 [ 277.644377][T12464] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 277.644388][T12464] R13: 00007f9d8cdb6038 R14: 00007f9d8cdb5fa0 R15: 00007ffffeef2968 [ 277.644423][T12464] [ 278.120857][T12479] tipc: Enabled bearer , priority 0 [ 278.130356][T12479] syzkaller0: entered promiscuous mode [ 278.135977][T12479] syzkaller0: entered allmulticast mode [ 278.194454][T12479] tipc: Resetting bearer [ 278.223473][T12478] tipc: Resetting bearer [ 278.310672][T12478] tipc: Disabling bearer [ 278.570248][T12502] nbd: couldn't find device at index 0 [ 278.780875][T12511] syzkaller1: entered promiscuous mode [ 278.795676][T12511] syzkaller1: entered allmulticast mode [ 279.022065][T12521] lo speed is unknown, defaulting to 1000 [ 279.077405][T12521] wg1 speed is unknown, defaulting to 1000 [ 279.126111][T12516] lo speed is unknown, defaulting to 1000 [ 279.175859][T12516] wg1 speed is unknown, defaulting to 1000 [ 279.269744][T12504] netlink: 124 bytes leftover after parsing attributes in process `syz.0.1763'. [ 279.472479][T12535] tipc: Enabled bearer , priority 0 [ 279.496751][T12537] netlink: 'syz.1.1771': attribute type 13 has an invalid length. [ 279.505211][T12537] netlink: 'syz.1.1771': attribute type 17 has an invalid length. [ 279.641331][T12535] syzkaller0: entered promiscuous mode [ 279.665832][T12535] syzkaller0: entered allmulticast mode [ 279.712524][T12537] tunl0: left promiscuous mode [ 279.785399][T12537] tunl0: left allmulticast mode [ 280.034833][T12537] 8021q: adding VLAN 0 to HW filter on device bond0 [ 280.055427][T12537] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 280.163003][T12544] tipc: Resetting bearer [ 280.197928][T12533] tipc: Resetting bearer [ 280.318201][T12533] tipc: Disabling bearer [ 280.420304][T12538] lo speed is unknown, defaulting to 1000 [ 280.432053][T12538] wg1 speed is unknown, defaulting to 1000 [ 280.686161][T12562] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1774'. [ 280.749160][T12562] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1774'. [ 280.769380][T12562] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1774'. [ 280.778803][T12562] FAULT_INJECTION: forcing a failure. [ 280.778803][T12562] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 280.792415][T12562] CPU: 0 UID: 0 PID: 12562 Comm: syz.2.1774 Not tainted 6.17.0-rc1-syzkaller-00201-g88250d40ed59 #0 PREEMPT(full) [ 280.792444][T12562] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 280.792456][T12562] Call Trace: [ 280.792464][T12562] [ 280.792472][T12562] dump_stack_lvl+0x189/0x250 [ 280.792502][T12562] ? __pfx____ratelimit+0x10/0x10 [ 280.792529][T12562] ? __pfx_dump_stack_lvl+0x10/0x10 [ 280.792552][T12562] ? __pfx__printk+0x10/0x10 [ 280.792594][T12562] should_fail_ex+0x414/0x560 [ 280.792626][T12562] _copy_to_user+0x31/0xb0 [ 280.792651][T12562] simple_read_from_buffer+0xe1/0x170 [ 280.792685][T12562] proc_fail_nth_read+0x1b3/0x220 [ 280.792711][T12562] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 280.792737][T12562] ? rw_verify_area+0x2a6/0x4d0 [ 280.792761][T12562] ? __lock_acquire+0xab9/0xd20 [ 280.792785][T12562] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 280.792809][T12562] vfs_read+0x1fd/0xa30 [ 280.792832][T12562] ? fdget_pos+0x247/0x320 [ 280.792855][T12562] ? __pfx___mutex_lock+0x10/0x10 [ 280.792883][T12562] ? __pfx_vfs_read+0x10/0x10 [ 280.792910][T12562] ? __fget_files+0x2a/0x420 [ 280.792941][T12562] ? __fget_files+0x3a0/0x420 [ 280.792957][T12562] ? __fget_files+0x2a/0x420 [ 280.792986][T12562] ksys_read+0x145/0x250 [ 280.793012][T12562] ? __pfx_ksys_read+0x10/0x10 [ 280.793034][T12562] ? rcu_is_watching+0x15/0xb0 [ 280.793060][T12562] ? do_syscall_64+0xbe/0x3b0 [ 280.793093][T12562] do_syscall_64+0xfa/0x3b0 [ 280.793117][T12562] ? lockdep_hardirqs_on+0x9c/0x150 [ 280.793141][T12562] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 280.793160][T12562] ? clear_bhb_loop+0x60/0xb0 [ 280.793183][T12562] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 280.793201][T12562] RIP: 0033:0x7effc118d5fc [ 280.793219][T12562] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 280.793235][T12562] RSP: 002b:00007effbf3f6030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 280.793257][T12562] RAX: ffffffffffffffda RBX: 00007effc13b6090 RCX: 00007effc118d5fc [ 280.793271][T12562] RDX: 000000000000000f RSI: 00007effbf3f60a0 RDI: 0000000000000006 [ 280.793282][T12562] RBP: 00007effbf3f6090 R08: 0000000000000000 R09: 0000000000000000 [ 280.793293][T12562] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 280.793305][T12562] R13: 00007effc13b6128 R14: 00007effc13b6090 R15: 00007ffe20d6f4b8 [ 280.793340][T12562] [ 281.606401][T12573] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1777'. [ 281.652373][T12573] syzkaller1: renamed from bridge_slave_0 [ 281.692335][T12567] netlink: 'syz.2.1775': attribute type 3 has an invalid length. [ 281.867389][T12577] nbd: couldn't find device at index 0 [ 283.221215][T12595] netlink: 32 bytes leftover after parsing attributes in process `syz.0.1783'. [ 283.231326][T12595] tipc: Invalid UDP bearer configuration [ 283.231392][T12595] tipc: Enabling of bearer rejected, failed to enable media [ 284.908808][T12613] tipc: Enabled bearer , priority 0 [ 284.931864][T12613] syzkaller0: entered promiscuous mode [ 284.938403][T12613] syzkaller0: entered allmulticast mode [ 285.033438][T12613] tipc: Resetting bearer [ 285.125234][T12623] tipc: Resetting bearer [ 285.164599][T12625] netlink: 1041 bytes leftover after parsing attributes in process `syz.3.1790'. [ 285.205283][T12623] tipc: Disabling bearer [ 285.214432][T12630] IPv6: NLM_F_REPLACE set, but no existing node found! [ 285.251706][T12624] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1792'. [ 285.304879][T12633] nbd: couldn't find device at index 0 [ 285.467786][T12642] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1797'. [ 285.487932][T12641] netlink: 36 bytes leftover after parsing attributes in process `syz.0.1798'. [ 285.582515][T12641] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1798'. [ 285.603687][T12650] netlink: 'syz.1.1799': attribute type 7 has an invalid length. [ 285.710865][T12656] team0: Port device sit1 removed [ 285.737221][T12658] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1802'. [ 285.759313][T12656] A link change request failed with some changes committed already. Interface bond1 may have been left with an inconsistent configuration, please check. [ 286.215875][T12682] nbd: couldn't find device at index 0 [ 286.497277][T12694] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1813'. [ 286.521943][T12694] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1813'. [ 286.720889][T12700] pim6reg: entered allmulticast mode [ 287.330096][T12724] netlink: 232 bytes leftover after parsing attributes in process `syz.3.1823'. [ 287.415539][T12724] netlink: 292 bytes leftover after parsing attributes in process `syz.3.1823'. [ 287.932697][T12735] lo speed is unknown, defaulting to 1000 [ 287.946337][T12735] wg1 speed is unknown, defaulting to 1000 [ 288.199471][T12752] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1829'. [ 288.337378][T12757] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1831'. [ 288.539140][T12757] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1831'. [ 288.548407][T12757] netlink: 84 bytes leftover after parsing attributes in process `syz.1.1831'. [ 288.620218][T12772] netlink: 'syz.3.1834': attribute type 1 has an invalid length. [ 288.628311][T12772] netlink: 224 bytes leftover after parsing attributes in process `syz.3.1834'. [ 289.009654][T12785] netlink: 'syz.1.1839': attribute type 3 has an invalid length. [ 289.669769][T12816] lo speed is unknown, defaulting to 1000 [ 289.719367][T12816] wg1 speed is unknown, defaulting to 1000 [ 289.720541][T12815] lo speed is unknown, defaulting to 1000 [ 289.768017][T12815] wg1 speed is unknown, defaulting to 1000 [ 290.247663][T12839] ip6tnl1: entered promiscuous mode [ 290.253063][T12839] ip6tnl1: entered allmulticast mode [ 290.531791][T12843] netlink: 'syz.3.1855': attribute type 2 has an invalid length. [ 291.019113][T12858] __nla_validate_parse: 72 callbacks suppressed [ 291.019136][T12858] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1858'. [ 291.103690][T12860] netlink: 'syz.0.1859': attribute type 1 has an invalid length. [ 291.119637][T12860] netlink: 224 bytes leftover after parsing attributes in process `syz.0.1859'. [ 291.132941][T12860] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1859'. [ 291.199269][T12861] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1859'. [ 291.210127][T12861] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1859'. [ 291.223444][T12860] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1859'. [ 291.434483][T12865] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1861'. [ 291.614759][T12872] netlink: 2 bytes leftover after parsing attributes in process `syz.3.1863'. [ 291.860040][T12888] tipc: Enabling of bearer rejected, failed to enable media [ 291.927364][T12890] netlink: 32 bytes leftover after parsing attributes in process `syz.3.1870'. [ 292.023886][T12900] netlink: 388 bytes leftover after parsing attributes in process `syz.0.1872'. [ 292.172520][T12908] netlink: 'syz.3.1874': attribute type 9 has an invalid length. [ 292.437251][T12919] lo speed is unknown, defaulting to 1000 [ 292.448573][T12919] wg1 speed is unknown, defaulting to 1000 [ 292.728994][T12927] batadv_slave_1: entered promiscuous mode [ 293.321130][T12943] netlink: 'syz.1.1887': attribute type 1 has an invalid length. [ 293.572824][T12943] 8021q: adding VLAN 0 to HW filter on device bond5 [ 293.633156][T12953] 8021q: adding VLAN 0 to HW filter on device bond5 [ 293.642299][T12953] bond5: (slave vcan1): The slave device specified does not support setting the MAC address [ 293.660481][T12960] netlink: 'syz.2.1892': attribute type 1 has an invalid length. [ 293.673168][T12953] bond5: (slave vcan1): Error -95 calling set_mac_address [ 293.708626][T12926] batadv_slave_1: left promiscuous mode [ 293.740283][T12943] macvlan3: entered promiscuous mode [ 293.746627][T12943] macvlan3: entered allmulticast mode [ 293.753189][T12943] bond5: entered promiscuous mode [ 293.763452][T12943] 8021q: adding VLAN 0 to HW filter on device macvlan3 [ 293.779077][T12943] bond5: left promiscuous mode [ 293.882801][T12960] 8021q: adding VLAN 0 to HW filter on device bond4 [ 293.932011][T12966] 8021q: adding VLAN 0 to HW filter on device bond4 [ 293.978479][T12966] bond4: (slave vxcan5): The slave device specified does not support setting the MAC address [ 294.029552][T12966] bond4: (slave vxcan5): Error -95 calling set_mac_address [ 294.193203][T12967] veth7: entered promiscuous mode [ 294.223132][T12967] bond4: (slave veth7): Enslaving as an active interface with a down link [ 294.240636][T12970] erspan0: entered allmulticast mode [ 294.259790][T12970] bond4: (slave erspan0): making interface the new active one [ 294.269776][T12970] bond4: (slave erspan0): Enslaving as an active interface with an up link [ 294.279410][T12973] sctp: [Deprecated]: syz.4.1894 (pid 12973) Use of struct sctp_assoc_value in delayed_ack socket option. [ 294.279410][T12973] Use struct sctp_sack_info instead [ 294.304385][T12954] lo speed is unknown, defaulting to 1000 [ 294.324606][T12954] wg1 speed is unknown, defaulting to 1000 [ 294.356924][T12977] lo speed is unknown, defaulting to 1000 [ 294.365730][T12977] wg1 speed is unknown, defaulting to 1000 [ 294.379097][T12971] lo speed is unknown, defaulting to 1000 [ 294.412641][T12971] wg1 speed is unknown, defaulting to 1000 [ 294.667589][T12987] lo speed is unknown, defaulting to 1000 [ 294.684819][T12987] wg1 speed is unknown, defaulting to 1000 [ 295.765350][T13005] tipc: Enabling of bearer rejected, failed to enable media [ 297.374306][T13023] lo speed is unknown, defaulting to 1000 [ 297.382287][T13023] wg1 speed is unknown, defaulting to 1000 [ 298.000134][T13053] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 298.012843][T13043] syzkaller0: entered promiscuous mode [ 298.020875][T13043] syzkaller0: entered allmulticast mode [ 298.605545][T13060] sctp: [Deprecated]: syz.4.1914 (pid 13060) Use of int in max_burst socket option. [ 298.605545][T13060] Use struct sctp_assoc_value instead [ 298.817403][T13069] __nla_validate_parse: 7 callbacks suppressed [ 298.817425][T13069] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1917'. [ 298.833641][T13071] netlink: 36 bytes leftover after parsing attributes in process `syz.2.1918'. [ 298.991841][T13079] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1919'. [ 299.006104][T13079] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1919'. [ 299.015572][T13079] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1919'. [ 299.213608][T13091] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1925'. [ 299.676673][T13124] batadv_slave_1: entered promiscuous mode [ 299.684546][T13123] batadv_slave_1: left promiscuous mode [ 299.855808][T13129] sit0: left promiscuous mode [ 299.890482][T13129] geneve2: left promiscuous mode [ 299.952375][T13129] vti0: left promiscuous mode [ 300.001789][T13129] vti0: left allmulticast mode [ 300.073085][T13139] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1935'. [ 300.108805][T13129] ip6tnl1: left promiscuous mode [ 300.132739][T13129] ip6tnl1: left allmulticast mode [ 300.188752][ T8010] netdevsim netdevsim3 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 300.229162][T13139] hsr_slave_0: left promiscuous mode [ 300.278322][T13139] hsr_slave_1: left promiscuous mode [ 300.398473][ T8010] netdevsim netdevsim3 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 300.410564][ T8010] netdevsim netdevsim3 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 300.428963][ T8010] netdevsim netdevsim3 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 300.693464][T13159] lo speed is unknown, defaulting to 1000 [ 300.716960][T13167] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1944'. [ 300.733119][T13159] wg1 speed is unknown, defaulting to 1000 [ 300.739053][T13167] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1944'. [ 300.762278][T13167] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1944'. [ 300.931355][T13171] lo speed is unknown, defaulting to 1000 [ 300.985912][T13171] wg1 speed is unknown, defaulting to 1000 [ 301.081289][T13173] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 301.361562][T13183] FAULT_INJECTION: forcing a failure. [ 301.361562][T13183] name failslab, interval 1, probability 0, space 0, times 0 [ 301.389032][T13183] CPU: 1 UID: 0 PID: 13183 Comm: syz.0.1949 Not tainted 6.17.0-rc1-syzkaller-00201-g88250d40ed59 #0 PREEMPT(full) [ 301.389072][T13183] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 301.389083][T13183] Call Trace: [ 301.389091][T13183] [ 301.389100][T13183] dump_stack_lvl+0x189/0x250 [ 301.389130][T13183] ? __pfx____ratelimit+0x10/0x10 [ 301.389156][T13183] ? __pfx_dump_stack_lvl+0x10/0x10 [ 301.389177][T13183] ? __pfx__printk+0x10/0x10 [ 301.389211][T13183] ? __pfx___might_resched+0x10/0x10 [ 301.389235][T13183] should_fail_ex+0x414/0x560 [ 301.389265][T13183] should_failslab+0xa8/0x100 [ 301.389294][T13183] kmem_cache_alloc_node_noprof+0x76/0x3c0 [ 301.389321][T13183] ? __alloc_skb+0x112/0x2d0 [ 301.389353][T13183] __alloc_skb+0x112/0x2d0 [ 301.389386][T13183] netlink_sendmsg+0x5c6/0xb30 [ 301.389426][T13183] ? __pfx_netlink_sendmsg+0x10/0x10 [ 301.389458][T13183] ? aa_sock_msg_perm+0xf1/0x1d0 [ 301.389489][T13183] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 301.389510][T13183] ? __pfx_netlink_sendmsg+0x10/0x10 [ 301.389539][T13183] __sock_sendmsg+0x219/0x270 [ 301.389568][T13183] sock_write_iter+0x258/0x330 [ 301.389595][T13183] ? __pfx_sock_write_iter+0x10/0x10 [ 301.389645][T13183] do_iter_readv_writev+0x61c/0x8b0 [ 301.389681][T13183] ? __pfx_do_iter_readv_writev+0x10/0x10 [ 301.389706][T13183] ? common_file_perm+0x1b5/0x230 [ 301.389739][T13183] ? bpf_lsm_file_permission+0x9/0x20 [ 301.389761][T13183] ? security_file_permission+0x75/0x290 [ 301.389787][T13183] ? rw_verify_area+0x255/0x4d0 [ 301.389813][T13183] vfs_writev+0x31a/0x960 [ 301.389836][T13183] ? __lock_acquire+0xab9/0xd20 [ 301.389863][T13183] ? __pfx_vfs_writev+0x10/0x10 [ 301.389899][T13183] ? __fget_files+0x2a/0x420 [ 301.389921][T13183] ? __fget_files+0x3a0/0x420 [ 301.389937][T13183] ? __fget_files+0x2a/0x420 [ 301.389965][T13183] do_writev+0x14d/0x2d0 [ 301.389987][T13183] ? __pfx_do_writev+0x10/0x10 [ 301.390003][T13183] ? rcu_is_watching+0x15/0xb0 [ 301.390029][T13183] ? do_syscall_64+0xbe/0x3b0 [ 301.390072][T13183] do_syscall_64+0xfa/0x3b0 [ 301.390097][T13183] ? lockdep_hardirqs_on+0x9c/0x150 [ 301.390122][T13183] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 301.390141][T13183] ? clear_bhb_loop+0x60/0xb0 [ 301.390165][T13183] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 301.390184][T13183] RIP: 0033:0x7f9d8cb8ebe9 [ 301.390203][T13183] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 301.390219][T13183] RSP: 002b:00007f9d8adf6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 301.390242][T13183] RAX: ffffffffffffffda RBX: 00007f9d8cdb5fa0 RCX: 00007f9d8cb8ebe9 [ 301.390255][T13183] RDX: 0000000000000001 RSI: 0000200000000140 RDI: 0000000000000004 [ 301.390267][T13183] RBP: 00007f9d8adf6090 R08: 0000000000000000 R09: 0000000000000000 [ 301.390280][T13183] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 301.390291][T13183] R13: 00007f9d8cdb6038 R14: 00007f9d8cdb5fa0 R15: 00007ffffeef2968 [ 301.390325][T13183] [ 301.536524][T13187] netlink: 'syz.1.1947': attribute type 13 has an invalid length. [ 301.868822][T13187] 8021q: adding VLAN 0 to HW filter on device bond0 [ 301.923565][T13187] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 301.953478][T13201] netlink: 'syz.0.1954': attribute type 13 has an invalid length. [ 301.972784][T13201] netlink: 'syz.0.1954': attribute type 17 has an invalid length. [ 302.199772][T13208] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 302.266779][T13201] 8021q: adding VLAN 0 to HW filter on device bond0 [ 302.319860][T13201] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 302.479470][T13200] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 302.498605][T13209] lo speed is unknown, defaulting to 1000 [ 302.534465][T13209] wg1 speed is unknown, defaulting to 1000 [ 302.602122][T13203] lo speed is unknown, defaulting to 1000 [ 302.614691][T13203] wg1 speed is unknown, defaulting to 1000 [ 302.711592][T13217] netlink: 'syz.2.1956': attribute type 1 has an invalid length. [ 302.720612][T13217] netlink: 'syz.2.1956': attribute type 2 has an invalid length. [ 302.799570][T13222] batadv_slave_1: entered promiscuous mode [ 302.808059][T13221] batadv_slave_1: left promiscuous mode [ 303.169283][T13230] sctp: [Deprecated]: syz.1.1960 (pid 13230) Use of struct sctp_assoc_value in delayed_ack socket option. [ 303.169283][T13230] Use struct sctp_sack_info instead [ 303.853698][T13227] lo speed is unknown, defaulting to 1000 [ 303.862699][T13227] wg1 speed is unknown, defaulting to 1000 [ 304.161395][T13245] __nla_validate_parse: 4 callbacks suppressed [ 304.161418][T13245] netlink: 388 bytes leftover after parsing attributes in process `syz.3.1964'. [ 304.314490][T13248] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1965'. [ 304.938240][T13262] (unnamed net_device) (uninitialized): option ad_user_port_key: invalid value (65535) [ 304.954317][T13262] (unnamed net_device) (uninitialized): option ad_user_port_key: allowed values 0 - 1023 [ 305.589086][T13271] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1971'. [ 305.658646][T13269] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1970'. [ 305.668389][T13269] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1970'. [ 305.677638][T13269] netlink: 'syz.0.1970': attribute type 14 has an invalid length. [ 305.706007][T13269] netlink: 'syz.0.1970': attribute type 11 has an invalid length. [ 306.263330][T13283] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1975'. [ 306.286523][T13283] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1975'. [ 306.299841][T13283] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1975'. [ 306.351695][T13286] netlink: 388 bytes leftover after parsing attributes in process `syz.4.1976'. [ 306.489161][T13290] nbd: nbd4 already in use [ 306.495436][ T8808] IPVS: starting estimator thread 0... [ 306.501212][T13294] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 306.647799][T13295] IPVS: using max 25 ests per chain, 60000 per kthread [ 307.117283][T13318] netlink: 388 bytes leftover after parsing attributes in process `syz.1.1988'. [ 307.745203][T13334] FAULT_INJECTION: forcing a failure. [ 307.745203][T13334] name failslab, interval 1, probability 0, space 0, times 0 [ 307.830948][T13334] CPU: 0 UID: 0 PID: 13334 Comm: syz.3.1993 Not tainted 6.17.0-rc1-syzkaller-00201-g88250d40ed59 #0 PREEMPT(full) [ 307.830993][T13334] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 307.831005][T13334] Call Trace: [ 307.831013][T13334] [ 307.831022][T13334] dump_stack_lvl+0x189/0x250 [ 307.831052][T13334] ? __pfx____ratelimit+0x10/0x10 [ 307.831079][T13334] ? __pfx_dump_stack_lvl+0x10/0x10 [ 307.831103][T13334] ? __pfx__printk+0x10/0x10 [ 307.831137][T13334] ? __pfx___might_resched+0x10/0x10 [ 307.831162][T13334] should_fail_ex+0x414/0x560 [ 307.831195][T13334] should_failslab+0xa8/0x100 [ 307.831225][T13334] kmem_cache_alloc_node_noprof+0x76/0x3c0 [ 307.831253][T13334] ? __alloc_skb+0x112/0x2d0 [ 307.831286][T13334] __alloc_skb+0x112/0x2d0 [ 307.831320][T13334] netlink_dump+0x1b7/0xe90 [ 307.831364][T13334] ? __pfx_netlink_dump+0x10/0x10 [ 307.831390][T13334] ? apparmor_capable+0x137/0x1b0 [ 307.831430][T13334] ? __inet_diag_dump_start+0x89a/0xa10 [ 307.831462][T13334] __netlink_dump_start+0x5cb/0x7e0 [ 307.831500][T13334] inet_diag_handler_cmd+0x1bf/0x290 [ 307.831534][T13334] ? __pfx_inet_diag_handler_cmd+0x10/0x10 [ 307.831561][T13334] ? __pfx_inet_diag_dump_start+0x10/0x10 [ 307.831588][T13334] ? __pfx_inet_diag_dump+0x10/0x10 [ 307.831613][T13334] ? __pfx_inet_diag_dump_done+0x10/0x10 [ 307.831634][T13334] ? sock_diag_lock_handler+0x19/0x290 [ 307.831660][T13334] ? sock_diag_lock_handler+0x19/0x290 [ 307.831693][T13334] sock_diag_rcv_msg+0x4cc/0x600 [ 307.831725][T13334] netlink_rcv_skb+0x205/0x470 [ 307.831749][T13334] ? __lock_acquire+0xab9/0xd20 [ 307.831777][T13334] ? __pfx_sock_diag_rcv_msg+0x10/0x10 [ 307.831805][T13334] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 307.831848][T13334] ? netlink_deliver_tap+0x2e/0x1b0 [ 307.831885][T13334] netlink_unicast+0x82c/0x9e0 [ 307.831922][T13334] ? __pfx_netlink_unicast+0x10/0x10 [ 307.831949][T13334] ? netlink_sendmsg+0x642/0xb30 [ 307.831987][T13334] ? skb_put+0x11b/0x210 [ 307.832010][T13334] netlink_sendmsg+0x805/0xb30 [ 307.832050][T13334] ? __pfx_netlink_sendmsg+0x10/0x10 [ 307.832082][T13334] ? aa_sock_msg_perm+0xf1/0x1d0 [ 307.832113][T13334] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 307.832134][T13334] ? __pfx_netlink_sendmsg+0x10/0x10 [ 307.832163][T13334] __sock_sendmsg+0x219/0x270 [ 307.832193][T13334] sock_write_iter+0x258/0x330 [ 307.832220][T13334] ? __pfx_sock_write_iter+0x10/0x10 [ 307.832274][T13334] do_iter_readv_writev+0x61c/0x8b0 [ 307.832310][T13334] ? __pfx_do_iter_readv_writev+0x10/0x10 [ 307.832334][T13334] ? common_file_perm+0x1b5/0x230 [ 307.832368][T13334] ? bpf_lsm_file_permission+0x9/0x20 [ 307.832389][T13334] ? security_file_permission+0x75/0x290 [ 307.832415][T13334] ? rw_verify_area+0x255/0x4d0 [ 307.832445][T13334] vfs_writev+0x31a/0x960 [ 307.832470][T13334] ? __lock_acquire+0xab9/0xd20 [ 307.832500][T13334] ? __pfx_vfs_writev+0x10/0x10 [ 307.832538][T13334] ? __fget_files+0x2a/0x420 [ 307.832562][T13334] ? __fget_files+0x3a0/0x420 [ 307.832578][T13334] ? __fget_files+0x2a/0x420 [ 307.832607][T13334] do_writev+0x14d/0x2d0 [ 307.832630][T13334] ? __pfx_do_writev+0x10/0x10 [ 307.832646][T13334] ? rcu_is_watching+0x15/0xb0 [ 307.832672][T13334] ? do_syscall_64+0xbe/0x3b0 [ 307.832705][T13334] do_syscall_64+0xfa/0x3b0 [ 307.832729][T13334] ? lockdep_hardirqs_on+0x9c/0x150 [ 307.832753][T13334] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 307.832772][T13334] ? clear_bhb_loop+0x60/0xb0 [ 307.832796][T13334] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 307.832814][T13334] RIP: 0033:0x7f666318ebe9 [ 307.832833][T13334] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 307.832849][T13334] RSP: 002b:00007f666403e038 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 307.832872][T13334] RAX: ffffffffffffffda RBX: 00007f66633b5fa0 RCX: 00007f666318ebe9 [ 307.832886][T13334] RDX: 0000000000000001 RSI: 0000200000000140 RDI: 0000000000000004 [ 307.832898][T13334] RBP: 00007f666403e090 R08: 0000000000000000 R09: 0000000000000000 [ 307.832910][T13334] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 307.832921][T13334] R13: 00007f66633b6038 R14: 00007f66633b5fa0 R15: 00007ffd855088a8 [ 307.832956][T13334] [ 308.573462][T13344] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 309.466003][T13370] __nla_validate_parse: 4 callbacks suppressed [ 309.466024][T13370] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2004'. [ 309.668239][T13379] netlink: 324 bytes leftover after parsing attributes in process `syz.3.2007'. [ 309.861014][T13385] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2009'. [ 310.005045][T13390] mac80211_hwsim hwsim7 wlan1: entered allmulticast mode [ 310.128972][T13390] bond0: (slave wlan1): Releasing backup interface [ 310.190722][T13396] netlink: 'syz.1.2011': attribute type 10 has an invalid length. [ 310.208885][T13390] bond1: (slave gretap1): Releasing active interface [ 310.305463][T13390] bond4: (slave gretap2): Releasing active interface [ 310.376555][T13399] netlink: 92 bytes leftover after parsing attributes in process `syz.3.2013'. [ 310.394507][T13399] netlink: 92 bytes leftover after parsing attributes in process `syz.3.2013'. [ 310.444592][T13396] mac80211_hwsim hwsim7 wlan1: left allmulticast mode [ 310.490664][T13396] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 310.617204][T13404] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 310.695649][T13405] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2015'. [ 310.751461][T13405] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2015'. [ 310.804364][T13405] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2015'. [ 310.930989][T13413] netlink: 44 bytes leftover after parsing attributes in process `syz.1.2016'. [ 310.970702][T13413] netlink: 44 bytes leftover after parsing attributes in process `syz.1.2016'. [ 311.849456][T13432] bond4: (slave erspan0): Releasing active interface [ 311.877583][T13432] bond0: (slave batadv0): Releasing backup interface [ 311.940423][T13432] bond4: (slave veth7): Releasing active interface [ 312.164906][T13442] netlink: 'syz.3.2026': attribute type 10 has an invalid length. [ 312.267113][ C1] vcan0: j1939_tp_rxtimer: 0xffff88807b8a6000: rx timeout, send abort [ 312.542545][T13449] veth11: entered promiscuous mode [ 312.775435][ C1] vcan0: j1939_tp_rxtimer: 0xffff88807b8a6000: abort rx timeout. Force session deactivation [ 314.384626][T13518] netlink: 'syz.3.2054': attribute type 6 has an invalid length. [ 315.061026][T13538] lo speed is unknown, defaulting to 1000 [ 315.123302][T13538] wg1 speed is unknown, defaulting to 1000 [ 315.149001][T13531] __nla_validate_parse: 18 callbacks suppressed [ 315.149025][T13531] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2059'. [ 315.311329][T13544] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2064'. [ 315.849000][T13548] netlink: 'syz.1.2065': attribute type 1 has an invalid length. [ 316.032735][T13555] netlink: 388 bytes leftover after parsing attributes in process `syz.3.2066'. [ 316.205296][T13559] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2068'. [ 316.292624][T13566] netlink: 68 bytes leftover after parsing attributes in process `syz.4.2070'. [ 316.467954][T13575] netlink: 'syz.2.2061': attribute type 4 has an invalid length. [ 316.480333][T13576] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2072'. [ 316.511848][T13576] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2072'. [ 316.533271][T13576] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2072'. [ 316.694728][T13580] netlink: 'syz.4.2074': attribute type 9 has an invalid length. [ 316.730615][T13580] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2074'. [ 316.788311][T13580] macvlan3: entered promiscuous mode [ 316.799707][T13580] hsr0: entered promiscuous mode [ 316.808748][T13580] macvlan3: entered allmulticast mode [ 316.816461][T13580] hsr0: entered allmulticast mode [ 316.821797][T13580] hsr_slave_0: entered allmulticast mode [ 316.832340][T13580] hsr_slave_1: entered allmulticast mode [ 317.407509][ T1303] ieee802154 phy1 wpan1: encryption failed: -22 [ 317.772987][T13601] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2080'. [ 317.835956][T13596] lo speed is unknown, defaulting to 1000 [ 317.934365][T13596] wg1 speed is unknown, defaulting to 1000 [ 317.967913][T13603] lo speed is unknown, defaulting to 1000 [ 318.037589][T13603] wg1 speed is unknown, defaulting to 1000 [ 318.045623][T13610] batman_adv: batadv0: Removing interface: vxlan0 [ 318.700015][T13627] batadv_slave_0: entered promiscuous mode [ 318.835346][T13624] batadv_slave_0: left promiscuous mode [ 319.323983][T13645] nbd: couldn't find device at index 0 [ 319.609370][T13651] batadv_slave_1: entered promiscuous mode [ 319.616607][T13650] batadv_slave_1: left promiscuous mode [ 320.319739][T13656] openvswitch: netlink: Missing valid actions attribute. [ 320.348650][T13656] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 321.233240][T13669] syzkaller1: entered promiscuous mode [ 321.253319][T13669] syzkaller1: entered allmulticast mode [ 321.271923][T13673] x_tables: ip6_tables: quota.0 match: invalid size 24 (kernel) != (user) 144 [ 321.562130][T13683] __nla_validate_parse: 7 callbacks suppressed [ 321.562152][T13683] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2101'. [ 321.600669][T13683] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2101'. [ 321.611160][T13683] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2101'. [ 321.743906][T13687] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 321.773279][T13685] lo speed is unknown, defaulting to 1000 [ 321.796513][T13685] wg1 speed is unknown, defaulting to 1000 [ 321.978356][T13694] batadv_slave_1: entered promiscuous mode [ 322.000888][T13693] batadv_slave_1: left promiscuous mode [ 322.290497][T13702] netlink: 65039 bytes leftover after parsing attributes in process `syz.4.2108'. [ 322.471874][T13702] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2108'. [ 322.665394][T13718] tipc: Enabled bearer , priority 0 [ 322.701480][T13718] syzkaller0: entered promiscuous mode [ 322.734161][T13718] syzkaller0: entered allmulticast mode [ 322.779937][T13718] tipc: Resetting bearer [ 322.808554][T13713] tipc: Resetting bearer [ 322.833558][T13727] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2114'. [ 322.852351][T13727] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2114'. [ 322.898244][T13727] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2114'. [ 322.924806][T13713] tipc: Disabling bearer [ 323.051359][T13734] netlink: 388 bytes leftover after parsing attributes in process `syz.3.2118'. [ 323.200047][T13736] batadv_slave_1: entered promiscuous mode [ 323.319684][T13735] batadv_slave_1: left promiscuous mode [ 323.474542][T13741] lo speed is unknown, defaulting to 1000 [ 323.551030][T13749] netlink: 'syz.2.2123': attribute type 1 has an invalid length. [ 323.566089][T13741] wg1 speed is unknown, defaulting to 1000 [ 323.692446][T13752] netlink: 36 bytes leftover after parsing attributes in process `syz.3.2124'. [ 323.758950][T13755] netlink: 'syz.4.2125': attribute type 1 has an invalid length. [ 324.335563][T13755] 8021q: adding VLAN 0 to HW filter on device bond4 [ 324.543431][T13759] veth5: entered promiscuous mode [ 324.554213][T13759] bond4: (slave veth5): Enslaving as an active interface with a down link [ 324.611763][T13742] netlink: 'syz.0.2121': attribute type 13 has an invalid length. [ 324.757426][T13742] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 325.869513][T13819] tipc: Enabled bearer , priority 0 [ 325.886167][T13819] syzkaller0: entered promiscuous mode [ 325.913997][T13819] syzkaller0: entered allmulticast mode [ 325.997459][T13819] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 326.035549][T13826] syzkaller1: entered promiscuous mode [ 326.050042][T13826] syzkaller1: entered allmulticast mode [ 326.099202][T13818] tipc: Resetting bearer [ 326.223664][T13818] tipc: Disabling bearer [ 326.472661][T13834] lo speed is unknown, defaulting to 1000 [ 326.498385][T13834] wg1 speed is unknown, defaulting to 1000 [ 326.502018][T13837] batadv_slave_1: entered promiscuous mode [ 326.530595][T13836] batadv_slave_1: left promiscuous mode [ 326.621275][T13841] __nla_validate_parse: 6 callbacks suppressed [ 326.621299][T13841] netlink: 48 bytes leftover after parsing attributes in process `syz.4.2150'. [ 326.646139][T13842] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2149'. [ 326.655440][T13842] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2149'. [ 326.664507][T13842] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2149'. [ 326.698922][T13842] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2149'. [ 327.271886][T13860] netlink: 'syz.0.2153': attribute type 3 has an invalid length. [ 327.715761][T13866] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2157'. [ 327.725733][T13866] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2157'. [ 327.738716][T13866] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2157'. [ 327.748854][T13866] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2157'. [ 327.879963][T13872] syzkaller1: entered promiscuous mode [ 327.901363][T13872] syzkaller1: entered allmulticast mode [ 328.438146][T13896] batadv_slave_1: entered promiscuous mode [ 328.455146][T13892] batadv_slave_1: left promiscuous mode [ 328.502906][T13897] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2168'. [ 328.550963][T13899] ip6tnl4: entered promiscuous mode [ 328.557334][T13899] ip6tnl4: entered allmulticast mode [ 328.933153][T13909] syzkaller1: entered promiscuous mode [ 328.949278][T13909] syzkaller1: entered allmulticast mode [ 330.093428][T13955] lo speed is unknown, defaulting to 1000 [ 330.121802][T13955] wg1 speed is unknown, defaulting to 1000 [ 330.857483][T13981] batadv_slave_1: entered promiscuous mode [ 330.904037][T13979] batadv_slave_1: left promiscuous mode [ 331.256492][T13992] netlink: zone id is out of range [ 331.273391][T13992] netlink: zone id is out of range [ 331.283565][T13992] netlink: zone id is out of range [ 331.299562][T13992] netlink: zone id is out of range [ 331.310348][T13992] netlink: zone id is out of range [ 331.320372][T13992] netlink: zone id is out of range [ 331.361917][T13992] netlink: zone id is out of range [ 331.375122][T13999] netlink: 'syz.2.2201': attribute type 2 has an invalid length. [ 331.415861][T13992] netlink: zone id is out of range [ 331.429602][T13992] netlink: zone id is out of range [ 331.457243][T13992] netlink: zone id is out of range [ 331.772308][ T8808] wg1 speed is unknown, defaulting to 1000 [ 331.781941][ T8808] syz0: Port: 1 Link DOWN [ 331.801939][T14023] batadv_slave_1: entered promiscuous mode [ 331.834230][T14021] batadv_slave_1: left promiscuous mode [ 332.146518][T14046] __nla_validate_parse: 11 callbacks suppressed [ 332.146539][T14046] netlink: 616 bytes leftover after parsing attributes in process `syz.4.2216'. [ 332.177139][T14046] sctp: [Deprecated]: syz.4.2216 (pid 14046) Use of struct sctp_assoc_value in delayed_ack socket option. [ 332.177139][T14046] Use struct sctp_sack_info instead [ 332.276722][T14042] netlink: 1624 bytes leftover after parsing attributes in process `syz.0.2213'. [ 332.340506][T14059] netlink: 48 bytes leftover after parsing attributes in process `syz.2.2217'. [ 332.408267][T14053] tipc: Enabling of bearer rejected, failed to enable media [ 332.640021][T14073] batadv_slave_1: entered promiscuous mode [ 332.656582][T14072] batadv_slave_1: left promiscuous mode [ 332.954317][T14086] netlink: 'syz.2.2228': attribute type 2 has an invalid length. [ 332.955359][T14087] netlink: 64 bytes leftover after parsing attributes in process `syz.1.2227'. [ 332.973285][T14086] netlink: 224 bytes leftover after parsing attributes in process `syz.2.2228'. [ 332.999688][T14090] netlink: 208 bytes leftover after parsing attributes in process `syz.3.2230'. [ 333.031069][T14090] mac80211_hwsim hwsim11 wlan1: entered allmulticast mode [ 333.129934][T14096] netlink: 392 bytes leftover after parsing attributes in process `syz.1.2231'. [ 333.442902][T14106] batadv_slave_1: entered promiscuous mode [ 333.465098][T14105] batadv_slave_1: left promiscuous mode [ 333.575396][T14103] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2234'. [ 333.604600][T14103] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2234'. [ 333.657037][T14103] netlink: 'syz.1.2234': attribute type 13 has an invalid length. [ 334.132173][T14127] netlink: 64 bytes leftover after parsing attributes in process `syz.1.2242'. [ 334.137204][T14125] netlink: 'syz.2.2241': attribute type 1 has an invalid length. [ 334.599152][T14147] batadv_slave_1: entered promiscuous mode [ 334.618482][T14146] batadv_slave_1: left promiscuous mode [ 334.725331][T14150] netlink: 'syz.4.2250': attribute type 29 has an invalid length. [ 334.752384][T14150] netlink: 'syz.4.2250': attribute type 29 has an invalid length. [ 335.063580][T14163] pim6reg1: entered promiscuous mode [ 335.079509][T14163] pim6reg1: entered allmulticast mode [ 335.934098][T14203] netlink: 'syz.3.2270': attribute type 10 has an invalid length. [ 335.968697][T14203] team0: Port device geneve0 added [ 335.976709][T14208] netlink: 'syz.2.2271': attribute type 1 has an invalid length. [ 335.994933][ T8012] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 336.014230][ T8012] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 336.102706][T14208] 8021q: adding VLAN 0 to HW filter on device bond5 [ 336.172287][T14210] 8021q: adding VLAN 0 to HW filter on device bond5 [ 336.185305][T14210] bond5: (slave vcan0): The slave device specified does not support setting the MAC address [ 336.201422][T14210] bond5: (slave vcan0): Error -95 calling set_mac_address [ 336.231496][ T8012] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 336.243637][ T8012] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 336.276391][T14214] gretap3: entered promiscuous mode [ 336.283263][T14217] batadv_slave_1: entered promiscuous mode [ 336.308703][T14215] batadv_slave_1: left promiscuous mode [ 336.495851][T14227] net_ratelimit: 28 callbacks suppressed [ 336.495957][T14227] openvswitch: netlink: Duplicate or invalid key (type 0). [ 336.523898][T14227] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 336.768781][T14249] netlink: 'syz.3.2286': attribute type 1 has an invalid length. [ 337.027116][T14265] batadv_slave_1: entered promiscuous mode [ 337.056231][T14264] batadv_slave_1: left promiscuous mode [ 337.217494][T14273] __nla_validate_parse: 51 callbacks suppressed [ 337.217516][T14273] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2293'. [ 337.219218][T14276] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2294'. [ 337.300212][T14279] netlink: 64 bytes leftover after parsing attributes in process `syz.2.2296'. [ 337.353239][T14287] FAULT_INJECTION: forcing a failure. [ 337.353239][T14287] name failslab, interval 1, probability 0, space 0, times 0 [ 337.372016][T14287] CPU: 1 UID: 0 PID: 14287 Comm: syz.1.2297 Not tainted 6.17.0-rc1-syzkaller-00201-g88250d40ed59 #0 PREEMPT(full) [ 337.372049][T14287] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 337.372061][T14287] Call Trace: [ 337.372070][T14287] [ 337.372078][T14287] dump_stack_lvl+0x189/0x250 [ 337.372108][T14287] ? __pfx____ratelimit+0x10/0x10 [ 337.372136][T14287] ? __pfx_dump_stack_lvl+0x10/0x10 [ 337.372160][T14287] ? __pfx__printk+0x10/0x10 [ 337.372196][T14287] ? __pfx___might_resched+0x10/0x10 [ 337.372214][T14287] ? fs_reclaim_acquire+0x7d/0x100 [ 337.372250][T14287] should_fail_ex+0x414/0x560 [ 337.372283][T14287] should_failslab+0xa8/0x100 [ 337.372313][T14287] kmem_cache_alloc_node_noprof+0x76/0x3c0 [ 337.372341][T14287] ? __alloc_skb+0x112/0x2d0 [ 337.372375][T14287] __alloc_skb+0x112/0x2d0 [ 337.372409][T14287] netlink_ack+0x146/0xa50 [ 337.372440][T14287] ? rcu_is_watching+0x15/0xb0 [ 337.372461][T14287] ? trace_contention_end+0x39/0x120 [ 337.372497][T14287] netlink_rcv_skb+0x28c/0x470 [ 337.372526][T14287] ? __pfx_xfrm_user_rcv_msg+0x10/0x10 [ 337.372552][T14287] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 337.372598][T14287] ? netlink_deliver_tap+0x2e/0x1b0 [ 337.372625][T14287] ? netlink_deliver_tap+0x2e/0x1b0 [ 337.372655][T14287] xfrm_netlink_rcv+0x79/0x90 [ 337.372678][T14287] netlink_unicast+0x82c/0x9e0 [ 337.372714][T14287] ? __pfx_netlink_unicast+0x10/0x10 [ 337.372742][T14287] ? netlink_sendmsg+0x642/0xb30 [ 337.372766][T14287] ? skb_put+0x11b/0x210 [ 337.372789][T14287] netlink_sendmsg+0x805/0xb30 [ 337.372830][T14287] ? __pfx_netlink_sendmsg+0x10/0x10 [ 337.372871][T14287] ? aa_sock_msg_perm+0xf1/0x1d0 [ 337.372904][T14287] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 337.372925][T14287] ? __pfx_netlink_sendmsg+0x10/0x10 [ 337.372953][T14287] __sock_sendmsg+0x219/0x270 [ 337.372983][T14287] ____sys_sendmsg+0x505/0x830 [ 337.373017][T14287] ? __pfx_____sys_sendmsg+0x10/0x10 [ 337.373051][T14287] ? import_iovec+0x74/0xa0 [ 337.373079][T14287] ___sys_sendmsg+0x21f/0x2a0 [ 337.373102][T14287] ? __pfx____sys_sendmsg+0x10/0x10 [ 337.373170][T14287] ? __fget_files+0x2a/0x420 [ 337.373187][T14287] ? __fget_files+0x3a0/0x420 [ 337.373218][T14287] __x64_sys_sendmsg+0x19b/0x260 [ 337.373243][T14287] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 337.373276][T14287] ? __pfx_ksys_write+0x10/0x10 [ 337.373298][T14287] ? rcu_is_watching+0x15/0xb0 [ 337.373325][T14287] ? do_syscall_64+0xbe/0x3b0 [ 337.373357][T14287] do_syscall_64+0xfa/0x3b0 [ 337.373382][T14287] ? lockdep_hardirqs_on+0x9c/0x150 [ 337.373408][T14287] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 337.373428][T14287] ? clear_bhb_loop+0x60/0xb0 [ 337.373452][T14287] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 337.373471][T14287] RIP: 0033:0x7f437458ebe9 [ 337.373490][T14287] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 337.373506][T14287] RSP: 002b:00007f4375365038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 337.373529][T14287] RAX: ffffffffffffffda RBX: 00007f43747b5fa0 RCX: 00007f437458ebe9 [ 337.373544][T14287] RDX: 0000000000004000 RSI: 0000200000000480 RDI: 0000000000000003 [ 337.373556][T14287] RBP: 00007f4375365090 R08: 0000000000000000 R09: 0000000000000000 [ 337.373569][T14287] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 337.373581][T14287] R13: 00007f43747b6038 R14: 00007f43747b5fa0 R15: 00007ffedca7e738 [ 337.373614][T14287] [ 337.726865][T14290] netlink: 'syz.4.2294': attribute type 1 has an invalid length. [ 337.734922][T14290] netlink: 'syz.4.2294': attribute type 11 has an invalid length. [ 337.736238][T14283] bridge5: port 1(veth7) entered blocking state [ 337.743553][T14290] netlink: 220 bytes leftover after parsing attributes in process `syz.4.2294'. [ 337.801602][T14283] bridge5: port 1(veth7) entered disabled state [ 337.808890][T14283] veth7: entered allmulticast mode [ 337.817222][T14283] veth7: entered promiscuous mode [ 337.829081][T14276] bridge5: port 2(veth0_to_bond) entered blocking state [ 337.892207][T14276] bridge5: port 2(veth0_to_bond) entered disabled state [ 337.926291][T14276] veth0_to_bond: entered allmulticast mode [ 337.938736][T14276] veth0_to_bond: entered promiscuous mode [ 337.982825][T14303] netlink: 'syz.1.2300': attribute type 2 has an invalid length. [ 337.991288][T14303] netlink: 164 bytes leftover after parsing attributes in process `syz.1.2300'. [ 338.005544][T14288] vlan3: entered allmulticast mode [ 338.010713][T14288] veth1: entered allmulticast mode [ 338.016460][T14288] bridge5: port 3(vlan3) entered blocking state [ 338.022879][T14288] bridge5: port 3(vlan3) entered disabled state [ 338.031946][T14288] vlan3: entered promiscuous mode [ 338.038698][T14288] veth1: entered promiscuous mode [ 338.052940][T14300] 8021q: VLANs not supported on sit0 [ 338.221725][T14309] netlink: 68 bytes leftover after parsing attributes in process `syz.4.2304'. [ 338.267190][T14313] netlink: 'syz.0.2306': attribute type 5 has an invalid length. [ 338.311328][T14316] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2305'. [ 338.330931][T14316] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2305'. [ 338.366886][T14316] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2305'. [ 338.392833][T14317] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2305'. [ 338.424834][T14320] gretap0: entered promiscuous mode [ 338.450918][T14321] A link change request failed with some changes committed already. Interface bond2 may have been left with an inconsistent configuration, please check. [ 338.468498][T14320] 0{X: renamed from gretap0 [ 338.477623][T14320] 0{X: left promiscuous mode [ 338.485837][T14320] 0{X: entered allmulticast mode [ 338.494092][T14324] netlink: 'syz.2.2310': attribute type 13 has an invalid length. [ 338.494581][T14320] A link change request failed with some changes committed already. Interface 30{X may have been left with an inconsistent configuration, please check. [ 338.516832][T14324] netlink: 'syz.2.2310': attribute type 17 has an invalid length. [ 338.521823][T14326] netlink: 'syz.2.2310': attribute type 13 has an invalid length. [ 338.543682][T14327] IPVS: sync thread started: state = BACKUP, mcast_ifn = bridge0, syncid = 0, id = 0 [ 338.584803][T14326] netlink: 'syz.2.2310': attribute type 17 has an invalid length. [ 338.608316][T14324] erspan0: left allmulticast mode [ 338.628627][T14324] 8021q: adding VLAN 0 to HW filter on device bond0 [ 338.636754][T14324] 8021q: adding VLAN 0 to HW filter on device team0 [ 338.646714][T14324] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 338.672209][T14326] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 339.822587][T14330] openvswitch: netlink: VXLAN extension message has 4 unknown bytes. [ 339.898287][T14339] netlink: zone id is out of range [ 339.904579][T14339] netlink: zone id is out of range [ 339.915056][T14334] netlink: 'syz.2.2313': attribute type 5 has an invalid length. [ 339.917764][T14339] netlink: zone id is out of range [ 339.952592][T14335] lo speed is unknown, defaulting to 1000 [ 339.997714][T14335] wg1 speed is unknown, defaulting to 1000 [ 340.286683][T14348] mac80211_hwsim hwsim3 syzkaller0: entered promiscuous mode [ 340.295957][T14348] mac80211_hwsim hwsim3 syzkaller0: entered allmulticast mode [ 340.468532][T14359] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 340.983268][T14341] syzkaller1: entered promiscuous mode [ 341.001589][T14341] syzkaller1: entered allmulticast mode [ 341.437140][T14385] 8021q: adding VLAN 0 to HW filter on device bond0 [ 341.579866][T14388] lo speed is unknown, defaulting to 1000 [ 341.739123][T14388] wg1 speed is unknown, defaulting to 1000 [ 342.445170][T14435] __nla_validate_parse: 19 callbacks suppressed [ 342.445192][T14435] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2344'. [ 342.471291][T14429] lo speed is unknown, defaulting to 1000 [ 342.500247][T14429] wg1 speed is unknown, defaulting to 1000 [ 342.759400][T14435] lo speed is unknown, defaulting to 1000 [ 342.807882][T14435] wg1 speed is unknown, defaulting to 1000 [ 342.829520][ T30] audit: type=1800 audit(1755257858.544:7): pid=14422 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.2340" name="memory.events" dev="tmpfs" ino=2402 res=0 errno=0 [ 343.270243][T14455] validate_nla: 4 callbacks suppressed [ 343.270267][T14455] netlink: 'syz.4.2348': attribute type 10 has an invalid length. [ 343.496155][T14467] netlink: 132 bytes leftover after parsing attributes in process `syz.4.2350'. [ 343.879189][T14475] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2351'. [ 344.154319][T14488] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2354'. [ 344.176612][T14488] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2354'. [ 344.186359][T14488] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2354'. [ 344.207453][T14488] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2354'. [ 344.234902][T14488] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2354'. [ 344.432016][T14482] lo speed is unknown, defaulting to 1000 [ 344.493185][T14482] wg1 speed is unknown, defaulting to 1000 [ 345.230060][T14498] netlink: 'syz.4.2358': attribute type 1 has an invalid length. [ 345.329309][T14498] 8021q: adding VLAN 0 to HW filter on device bond5 [ 345.374423][T14498] nbd: must specify at least one socket [ 345.458976][T14498] bond5: (slave gretap1): making interface the new active one [ 345.486182][T14498] bond5: (slave gretap1): Enslaving as an active interface with an up link [ 345.740281][T14511] !: renamed from dummy0 (while UP) [ 346.083365][T14531] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2366'. [ 346.250854][T14511] lo speed is unknown, defaulting to 1000 [ 346.409887][T14511] wg1 speed is unknown, defaulting to 1000 [ 346.840414][T14552] tipc: Enabled bearer , priority 0 [ 346.869669][T14552] syzkaller0: entered promiscuous mode [ 346.902213][T14552] syzkaller0: entered allmulticast mode [ 346.983588][T14551] tipc: Resetting bearer [ 347.021283][T14559] netlink: 27 bytes leftover after parsing attributes in process `syz.4.2373'. [ 347.086649][T14551] tipc: Disabling bearer [ 347.997463][T14593] __nla_validate_parse: 1 callbacks suppressed [ 347.997483][T14593] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2376'. [ 348.431164][T14593] veth0_to_team: entered promiscuous mode [ 348.618361][T14600] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2383'. [ 348.778264][T14606] netlink: 'syz.3.2384': attribute type 13 has an invalid length. [ 348.869883][T14608] netlink: 'syz.4.2383': attribute type 1 has an invalid length. [ 348.959881][T14608] netlink: 5624 bytes leftover after parsing attributes in process `syz.4.2383'. [ 349.084266][T14602] lo speed is unknown, defaulting to 1000 [ 349.133133][T14602] wg1 speed is unknown, defaulting to 1000 [ 349.408423][T14624] netlink: 92 bytes leftover after parsing attributes in process `syz.2.2390'. [ 349.422399][T14624] netlink: 92 bytes leftover after parsing attributes in process `syz.2.2390'. [ 349.600974][T14610] netlink: 'syz.3.2384': attribute type 13 has an invalid length. [ 349.899991][T14610] 8021q: adding VLAN 0 to HW filter on device team0 [ 349.955179][T14610] net_ratelimit: 7 callbacks suppressed [ 349.955192][T14610] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 349.989406][ T5875] lo speed is unknown, defaulting to 1000 [ 349.996622][ T5875] sz1: Port: 1 Link ACTIVE [ 350.107183][T14642] lo speed is unknown, defaulting to 1000 [ 350.118745][T14642] wg1 speed is unknown, defaulting to 1000 [ 350.221257][T14647] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2396'. [ 351.128606][T14671] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2402'. [ 351.139669][T14671] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2402'. [ 351.462288][T14676] syzkaller1: left promiscuous mode [ 351.479554][T14676] syzkaller1: left allmulticast mode [ 351.882811][T14685] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2407'. [ 351.903099][T14691] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2408'. [ 352.741710][T14713] lo speed is unknown, defaulting to 1000 [ 352.834984][T14713] wg1 speed is unknown, defaulting to 1000 [ 353.018356][T14735] syzkaller0: Caught tx_queue_len zero misconfig [ 353.637353][T14758] ieee802154 phy1 wpan1: encryption failed: -22 [ 353.753186][T14760] __nla_validate_parse: 2 callbacks suppressed [ 353.753209][T14760] netlink: 32 bytes leftover after parsing attributes in process `syz.3.2424'. [ 355.405808][T14799] lo speed is unknown, defaulting to 1000 [ 355.425805][T14799] wg1 speed is unknown, defaulting to 1000 [ 355.732295][T14821] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2447'. [ 356.285677][T14845] netlink: 64 bytes leftover after parsing attributes in process `syz.4.2453'. [ 356.386914][T14851] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2455'. [ 356.731659][T14862] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2457'. [ 357.497872][T14868] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2461'. [ 357.680884][T14877] bridge2: port 1(veth13) entered blocking state [ 357.692300][T14877] bridge2: port 1(veth13) entered disabled state [ 357.699324][T14877] veth13: entered allmulticast mode [ 357.715403][T14877] veth13: entered promiscuous mode [ 357.736125][T14868] bridge2: port 2(veth0_to_bond) entered blocking state [ 357.743276][T14868] bridge2: port 2(veth0_to_bond) entered disabled state [ 357.755610][T14868] veth0_to_bond: entered allmulticast mode [ 357.771483][T14868] veth0_to_bond: entered promiscuous mode [ 357.782285][T14880] syzkaller1: entered promiscuous mode [ 357.788118][T14880] syzkaller1: entered allmulticast mode [ 358.113086][T14897] sctp: [Deprecated]: syz.0.2469 (pid 14897) Use of int in max_burst socket option deprecated. [ 358.113086][T14897] Use struct sctp_assoc_value instead [ 358.580423][T14899] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2470'. [ 358.637869][T14909] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2476'. [ 358.655485][T14910] tipc: Enabled bearer , priority 0 [ 358.673009][T14910] batadv_slave_1: left promiscuous mode [ 358.688479][T14910] batadv_slave_1: entered allmulticast mode [ 358.701922][T14909] netlink: 32 bytes leftover after parsing attributes in process `syz.3.2476'. [ 358.727712][T14909] netlink: 34 bytes leftover after parsing attributes in process `syz.3.2476'. [ 359.137329][T14933] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2479'. [ 359.331895][T14945] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2480'. [ 359.774075][ T10] tipc: Node number set to 1356464108 [ 360.413629][T14990] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2494'. [ 360.443409][T14990] bridge: RTM_NEWNEIGH with invalid ether address [ 360.809064][T15003] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2499'. [ 360.837458][T15003] netlink: 'syz.0.2499': attribute type 11 has an invalid length. [ 361.197966][T15021] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2503'. [ 361.198756][T15022] netlink: 'syz.0.2504': attribute type 10 has an invalid length. [ 361.228462][T15021] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2503'. [ 361.233049][T15022] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2504'. [ 361.244213][T15021] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2503'. [ 361.275639][T15022] !: entered promiscuous mode [ 361.306891][T15022] !: entered allmulticast mode [ 361.349777][T15022] bridge0: port 3(0!) entered blocking state [ 361.362131][T15022] bridge0: port 3(0!) entered disabled state [ 361.397195][T15022] bridge0: port 3(0!) entered blocking state [ 361.403759][T15022] bridge0: port 3(0!) entered forwarding state [ 361.554109][T15029] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2508'. [ 361.578072][T15029] netlink: 300 bytes leftover after parsing attributes in process `syz.0.2508'. [ 362.307895][T15061] netlink: 'syz.3.2518': attribute type 1 has an invalid length. [ 362.771069][T15073] lo speed is unknown, defaulting to 1000 [ 362.813277][T15073] wg1 speed is unknown, defaulting to 1000 [ 363.176936][T15092] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 363.527727][T15075] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 364.162989][T15110] __nla_validate_parse: 8 callbacks suppressed [ 364.163011][T15110] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2529'. [ 364.457626][T15120] syzkaller1: entered promiscuous mode [ 364.461764][T15123] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2534'. [ 364.470944][T15120] syzkaller1: entered allmulticast mode [ 364.485440][T15123] netlink: 44 bytes leftover after parsing attributes in process `syz.3.2534'. [ 364.520866][T15123] bridge3: the hash_elasticity option has been deprecated and is always 16 [ 364.632098][T15126] lo speed is unknown, defaulting to 1000 [ 364.666210][T15126] wg1 speed is unknown, defaulting to 1000 [ 365.069394][T15133] nbd: must specify a device to reconfigure [ 365.344783][T15145] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2540'. [ 365.386395][T15145] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2540'. [ 365.444177][T15145] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2540'. [ 365.983315][T15159] lo speed is unknown, defaulting to 1000 [ 365.995691][T15159] wg1 speed is unknown, defaulting to 1000 [ 366.657413][T15163] netlink: 14593 bytes leftover after parsing attributes in process `syz.1.2546'. [ 366.764093][T15169] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2548'. [ 366.783514][T15158] netlink: 156 bytes leftover after parsing attributes in process `syz.0.2545'. [ 366.854853][T15172] syzkaller1: entered promiscuous mode [ 366.860483][T15172] syzkaller1: entered allmulticast mode [ 367.670292][T15200] netlink: 388 bytes leftover after parsing attributes in process `syz.0.2558'. [ 367.939125][T15210] netlink: 'syz.3.2561': attribute type 1 has an invalid length. [ 368.157926][T15212] bond9: (slave ip6gretap1): Enslaving as a backup interface with an up link [ 368.236878][ T8012] bond9: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 368.244904][T15210] 8021q: adding VLAN 0 to HW filter on device bond9 [ 368.309853][T15212] veth15: entered promiscuous mode [ 368.356219][T15212] bond9: (slave veth15): Enslaving as a backup interface with a down link [ 368.374309][ T8012] bond9: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 368.421396][T15210] veth0_to_bond: left allmulticast mode [ 368.446240][T15210] veth0_to_bond: left promiscuous mode [ 368.454369][T15210] bridge2: port 2(veth0_to_bond) entered disabled state [ 368.490995][T15210] team0: Port device geneve0 removed [ 368.510326][T15210] veth13: left allmulticast mode [ 368.516207][T15210] veth13: left promiscuous mode [ 368.521785][T15210] bridge2: port 1(veth13) entered disabled state [ 368.545178][T15210] bond9: (slave ip6gretap1): Removing an active aggregator [ 368.558306][T15210] bond9: (slave ip6gretap1): Releasing backup interface [ 368.565856][T15210] bond9: (slave ip6gretap1): the permanent HWaddr of slave - 0a:6b:8c:d4:11:c8 - is still in use by bond - set the HWaddr of slave to a different address to avoid conflicts [ 368.601170][T15210] bond9: (slave veth15): Releasing backup interface [ 368.642970][T15216] syzkaller1: entered promiscuous mode [ 368.649150][T15216] syzkaller1: entered allmulticast mode [ 368.656945][ T8010] netdevsim netdevsim3 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 368.672104][ T8010] netdevsim netdevsim3 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 368.772145][ T8010] netdevsim netdevsim3 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 368.798070][ T8010] netdevsim netdevsim3 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 368.878055][T15224] netlink: 'syz.2.2564': attribute type 1 has an invalid length. [ 369.242910][T15231] : entered promiscuous mode [ 369.562011][T15245] __nla_validate_parse: 9 callbacks suppressed [ 369.562033][T15245] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2572'. [ 369.582232][T15245] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2572'. [ 369.591650][T15245] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2572'. [ 369.609300][T15245] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2572'. [ 369.621529][T15245] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2572'. [ 370.298316][T15269] batadv_slave_1: entered promiscuous mode [ 370.322261][T15268] batadv_slave_1: left promiscuous mode [ 370.659552][T15279] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 371.075099][T15297] FAULT_INJECTION: forcing a failure. [ 371.075099][T15297] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 371.100869][T15297] CPU: 0 UID: 0 PID: 15297 Comm: syz.3.2588 Not tainted 6.17.0-rc1-syzkaller-00201-g88250d40ed59 #0 PREEMPT(full) [ 371.100900][T15297] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 371.100912][T15297] Call Trace: [ 371.100919][T15297] [ 371.100927][T15297] dump_stack_lvl+0x189/0x250 [ 371.100957][T15297] ? __pfx____ratelimit+0x10/0x10 [ 371.100983][T15297] ? __pfx_dump_stack_lvl+0x10/0x10 [ 371.101006][T15297] ? __pfx__printk+0x10/0x10 [ 371.101032][T15297] ? __might_fault+0xb0/0x130 [ 371.101071][T15297] should_fail_ex+0x414/0x560 [ 371.101103][T15297] _copy_from_iter+0x1db/0x16f0 [ 371.101128][T15297] ? rcu_is_watching+0x15/0xb0 [ 371.101150][T15297] ? kmem_cache_alloc_node_noprof+0x217/0x3c0 [ 371.101178][T15297] ? __pfx__copy_from_iter+0x10/0x10 [ 371.101200][T15297] ? __build_skb_around+0x257/0x3e0 [ 371.101232][T15297] ? netlink_sendmsg+0x642/0xb30 [ 371.101257][T15297] ? skb_put+0x11b/0x210 [ 371.101280][T15297] netlink_sendmsg+0x6b2/0xb30 [ 371.101343][T15297] ? __pfx_netlink_sendmsg+0x10/0x10 [ 371.101375][T15297] ? aa_sock_msg_perm+0xf1/0x1d0 [ 371.101407][T15297] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 371.101427][T15297] ? __pfx_netlink_sendmsg+0x10/0x10 [ 371.101455][T15297] __sock_sendmsg+0x219/0x270 [ 371.101484][T15297] ____sys_sendmsg+0x505/0x830 [ 371.101510][T15297] ? __pfx_____sys_sendmsg+0x10/0x10 [ 371.101551][T15297] ? import_iovec+0x74/0xa0 [ 371.101577][T15297] ___sys_sendmsg+0x21f/0x2a0 [ 371.101600][T15297] ? __pfx____sys_sendmsg+0x10/0x10 [ 371.101663][T15297] ? __fget_files+0x2a/0x420 [ 371.101680][T15297] ? __fget_files+0x3a0/0x420 [ 371.101710][T15297] __x64_sys_sendmsg+0x19b/0x260 [ 371.101734][T15297] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 371.101765][T15297] ? __pfx_ksys_write+0x10/0x10 [ 371.101796][T15297] ? do_syscall_64+0xbe/0x3b0 [ 371.101827][T15297] do_syscall_64+0xfa/0x3b0 [ 371.101852][T15297] ? lockdep_hardirqs_on+0x9c/0x150 [ 371.101875][T15297] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 371.101895][T15297] ? clear_bhb_loop+0x60/0xb0 [ 371.101919][T15297] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 371.101938][T15297] RIP: 0033:0x7f666318ebe9 [ 371.101956][T15297] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 371.101973][T15297] RSP: 002b:00007f666403e038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 371.101995][T15297] RAX: ffffffffffffffda RBX: 00007f66633b5fa0 RCX: 00007f666318ebe9 [ 371.102009][T15297] RDX: 0000000000000000 RSI: 0000200000000140 RDI: 0000000000000003 [ 371.102021][T15297] RBP: 00007f666403e090 R08: 0000000000000000 R09: 0000000000000000 [ 371.102033][T15297] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 371.102045][T15297] R13: 00007f66633b6038 R14: 00007f66633b5fa0 R15: 00007ffd855088a8 [ 371.102078][T15297] [ 371.406011][T15300] netlink: 'syz.4.2586': attribute type 13 has an invalid length. [ 371.423026][T15300] netlink: 'syz.4.2586': attribute type 17 has an invalid length. [ 371.490640][T15300] sit0: left promiscuous mode [ 371.532790][T15300] 8021q: adding VLAN 0 to HW filter on device bond0 [ 371.543518][T15300] tipc: Resetting bearer [ 371.550928][T15300] tipc: Resetting bearer [ 371.560379][T15300] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 371.577837][T15303] netlink: 48 bytes leftover after parsing attributes in process `syz.3.2591'. [ 371.588464][T15304] netlink: 140 bytes leftover after parsing attributes in process `syz.3.2591'. [ 371.600714][T15303] netlink: 'syz.3.2591': attribute type 5 has an invalid length. [ 371.621775][T15307] tipc: Enabled bearer , priority 0 [ 371.644764][T15306] lo speed is unknown, defaulting to 1000 [ 371.669416][T15307] tipc: Resetting bearer [ 371.686693][T15306] wg1 speed is unknown, defaulting to 1000 [ 371.851724][T15313] batadv_slave_1: entered promiscuous mode [ 371.874781][T15313] batadv_slave_1: left promiscuous mode [ 372.198763][T15323] netlink: 'syz.0.2595': attribute type 10 has an invalid length. [ 372.315380][T15326] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2596'. [ 372.649753][T15344] netlink: 'syz.0.2600': attribute type 10 has an invalid length. [ 372.701885][T15351] netlink: 'syz.0.2600': attribute type 10 has an invalid length. [ 372.739940][T15344] bridge0: port 3(0!) entered disabled state [ 372.791136][T15344] !: left allmulticast mode [ 372.818052][T15344] !: left promiscuous mode [ 372.846229][T15344] bridge0: port 3(0!) entered disabled state [ 372.869279][T15356] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2602'. [ 372.930639][T15346] lo speed is unknown, defaulting to 1000 [ 372.938835][T15346] wg1 speed is unknown, defaulting to 1000 [ 372.948906][T15351] bond0: (slave 0!): Enslaving as an active interface with an up link [ 372.987631][T15356] batadv1: entered allmulticast mode [ 372.994872][T15356] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 373.199332][T15358] batadv_slave_1: entered promiscuous mode [ 373.226883][T15357] batadv_slave_1: left promiscuous mode [ 374.300646][T15391] netlink: 201916 bytes leftover after parsing attributes in process `syz.2.2609'. [ 374.603612][T15400] ip6tnl1: entered promiscuous mode [ 374.609332][T15400] ip6tnl1: entered allmulticast mode [ 374.621747][T15400] team0: Device ip6tnl1 is up. Set it down before adding it as a team port [ 374.956863][T15411] syzkaller1: entered promiscuous mode [ 374.962554][T15411] syzkaller1: entered allmulticast mode [ 375.315568][T15431] __nla_validate_parse: 2 callbacks suppressed [ 375.315590][T15431] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2622'. [ 375.370803][T15431] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2622'. [ 375.384155][T15431] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2622'. [ 375.406137][T15433] FAULT_INJECTION: forcing a failure. [ 375.406137][T15433] name failslab, interval 1, probability 0, space 0, times 0 [ 375.425221][T15433] CPU: 1 UID: 0 PID: 15433 Comm: syz.0.2622 Not tainted 6.17.0-rc1-syzkaller-00201-g88250d40ed59 #0 PREEMPT(full) [ 375.425252][T15433] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 375.425264][T15433] Call Trace: [ 375.425273][T15433] [ 375.425281][T15433] dump_stack_lvl+0x189/0x250 [ 375.425311][T15433] ? __pfx____ratelimit+0x10/0x10 [ 375.425338][T15433] ? __pfx_dump_stack_lvl+0x10/0x10 [ 375.425362][T15433] ? __pfx__printk+0x10/0x10 [ 375.425393][T15433] ? __pfx___might_resched+0x10/0x10 [ 375.425413][T15433] ? fs_reclaim_acquire+0x7d/0x100 [ 375.425454][T15433] should_fail_ex+0x414/0x560 [ 375.425533][T15433] should_failslab+0xa8/0x100 [ 375.425563][T15433] __kmalloc_noprof+0xcb/0x4f0 [ 375.425589][T15433] ? genl_family_rcv_msg_attrs_parse+0xa3/0x2a0 [ 375.425620][T15433] genl_family_rcv_msg_attrs_parse+0xa3/0x2a0 [ 375.425653][T15433] genl_family_rcv_msg_doit+0xb8/0x300 [ 375.425685][T15433] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 375.425719][T15433] ? apparmor_capable+0x137/0x1b0 [ 375.425744][T15433] ? bpf_lsm_capable+0x9/0x20 [ 375.425767][T15433] ? security_capable+0x7e/0x2e0 [ 375.425801][T15433] genl_rcv_msg+0x60e/0x790 [ 375.425831][T15433] ? __pfx_genl_rcv_msg+0x10/0x10 [ 375.425851][T15433] ? __pfx_mptcp_pm_nl_del_addr_doit+0x10/0x10 [ 375.425878][T15433] ? __asan_memcpy+0x40/0x70 [ 375.425899][T15433] ? __pfx_ref_tracker_free+0x10/0x10 [ 375.425934][T15433] netlink_rcv_skb+0x205/0x470 [ 375.425957][T15433] ? __lock_acquire+0xab9/0xd20 [ 375.425984][T15433] ? __pfx_genl_rcv_msg+0x10/0x10 [ 375.426007][T15433] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 375.426056][T15433] ? down_read+0x1ad/0x2e0 [ 375.426078][T15433] genl_rcv+0x28/0x40 [ 375.426096][T15433] netlink_unicast+0x82c/0x9e0 [ 375.426131][T15433] ? __pfx_netlink_unicast+0x10/0x10 [ 375.426158][T15433] ? netlink_sendmsg+0x642/0xb30 [ 375.426182][T15433] ? skb_put+0x11b/0x210 [ 375.426204][T15433] netlink_sendmsg+0x805/0xb30 [ 375.426249][T15433] ? __pfx_netlink_sendmsg+0x10/0x10 [ 375.426279][T15433] ? aa_sock_msg_perm+0xf1/0x1d0 [ 375.426309][T15433] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 375.426329][T15433] ? __pfx_netlink_sendmsg+0x10/0x10 [ 375.426357][T15433] __sock_sendmsg+0x219/0x270 [ 375.426385][T15433] ____sys_sendmsg+0x505/0x830 [ 375.426412][T15433] ? __pfx_____sys_sendmsg+0x10/0x10 [ 375.426443][T15433] ? import_iovec+0x74/0xa0 [ 375.426470][T15433] ___sys_sendmsg+0x21f/0x2a0 [ 375.426499][T15433] ? __pfx____sys_sendmsg+0x10/0x10 [ 375.426565][T15433] ? __fget_files+0x2a/0x420 [ 375.426581][T15433] ? __fget_files+0x3a0/0x420 [ 375.426612][T15433] __x64_sys_sendmsg+0x19b/0x260 [ 375.426634][T15433] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 375.426667][T15433] ? __pfx_ksys_write+0x10/0x10 [ 375.426699][T15433] ? do_syscall_64+0xbe/0x3b0 [ 375.426729][T15433] do_syscall_64+0xfa/0x3b0 [ 375.426749][T15433] ? lockdep_hardirqs_on+0x9c/0x150 [ 375.426772][T15433] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 375.426790][T15433] ? clear_bhb_loop+0x60/0xb0 [ 375.426813][T15433] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 375.426830][T15433] RIP: 0033:0x7f9d8cb8ebe9 [ 375.426848][T15433] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 375.426864][T15433] RSP: 002b:00007f9d8add5038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 375.426885][T15433] RAX: ffffffffffffffda RBX: 00007f9d8cdb6090 RCX: 00007f9d8cb8ebe9 [ 375.426898][T15433] RDX: 000000002000c094 RSI: 0000200000000000 RDI: 0000000000000003 [ 375.426910][T15433] RBP: 00007f9d8add5090 R08: 0000000000000000 R09: 0000000000000000 [ 375.426921][T15433] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 375.426932][T15433] R13: 00007f9d8cdb6128 R14: 00007f9d8cdb6090 R15: 00007ffffeef2968 [ 375.426967][T15433] [ 376.076658][T15441] batadv_slave_1: entered promiscuous mode [ 376.083367][T15440] batadv_slave_1: left promiscuous mode [ 376.248341][T15447] netlink: 36 bytes leftover after parsing attributes in process `syz.0.2628'. [ 376.258390][T15447] FAULT_INJECTION: forcing a failure. [ 376.258390][T15447] name failslab, interval 1, probability 0, space 0, times 0 [ 376.276457][T15447] CPU: 1 UID: 0 PID: 15447 Comm: syz.0.2628 Not tainted 6.17.0-rc1-syzkaller-00201-g88250d40ed59 #0 PREEMPT(full) [ 376.276488][T15447] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 376.276500][T15447] Call Trace: [ 376.276508][T15447] [ 376.276516][T15447] dump_stack_lvl+0x189/0x250 [ 376.276547][T15447] ? __pfx____ratelimit+0x10/0x10 [ 376.276573][T15447] ? __pfx_dump_stack_lvl+0x10/0x10 [ 376.276596][T15447] ? __pfx__printk+0x10/0x10 [ 376.276629][T15447] ? __pfx___might_resched+0x10/0x10 [ 376.276646][T15447] ? fs_reclaim_acquire+0x7d/0x100 [ 376.276676][T15447] should_fail_ex+0x414/0x560 [ 376.276704][T15447] should_failslab+0xa8/0x100 [ 376.276732][T15447] kmem_cache_alloc_node_noprof+0x76/0x3c0 [ 376.276756][T15447] ? __alloc_skb+0x112/0x2d0 [ 376.276787][T15447] __alloc_skb+0x112/0x2d0 [ 376.276819][T15447] netlink_ack+0x146/0xa50 [ 376.276841][T15447] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 376.276865][T15447] ? ref_tracker_free+0x63a/0x7d0 [ 376.276891][T15447] ? __asan_memcpy+0x40/0x70 [ 376.276911][T15447] ? __pfx_ref_tracker_free+0x10/0x10 [ 376.276948][T15447] netlink_rcv_skb+0x28c/0x470 [ 376.276975][T15447] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 376.277004][T15447] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 376.277042][T15447] ? netlink_deliver_tap+0x2e/0x1b0 [ 376.277076][T15447] netlink_unicast+0x82c/0x9e0 [ 376.277110][T15447] ? __pfx_netlink_unicast+0x10/0x10 [ 376.277135][T15447] ? netlink_sendmsg+0x642/0xb30 [ 376.277159][T15447] ? skb_put+0x11b/0x210 [ 376.277181][T15447] netlink_sendmsg+0x805/0xb30 [ 376.277219][T15447] ? __pfx_netlink_sendmsg+0x10/0x10 [ 376.277250][T15447] ? aa_sock_msg_perm+0xf1/0x1d0 [ 376.277278][T15447] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 376.277299][T15447] ? __pfx_netlink_sendmsg+0x10/0x10 [ 376.277326][T15447] __sock_sendmsg+0x219/0x270 [ 376.277354][T15447] ____sys_sendmsg+0x505/0x830 [ 376.277379][T15447] ? __pfx_____sys_sendmsg+0x10/0x10 [ 376.277418][T15447] ? import_iovec+0x74/0xa0 [ 376.277444][T15447] ___sys_sendmsg+0x21f/0x2a0 [ 376.277468][T15447] ? __pfx____sys_sendmsg+0x10/0x10 [ 376.277530][T15447] ? __fget_files+0x2a/0x420 [ 376.277546][T15447] ? __fget_files+0x3a0/0x420 [ 376.277577][T15447] __x64_sys_sendmsg+0x19b/0x260 [ 376.277600][T15447] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 376.277631][T15447] ? __pfx_ksys_write+0x10/0x10 [ 376.277653][T15447] ? rcu_is_watching+0x15/0xb0 [ 376.277678][T15447] ? do_syscall_64+0xbe/0x3b0 [ 376.277710][T15447] do_syscall_64+0xfa/0x3b0 [ 376.277734][T15447] ? lockdep_hardirqs_on+0x9c/0x150 [ 376.277758][T15447] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 376.277778][T15447] ? clear_bhb_loop+0x60/0xb0 [ 376.277801][T15447] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 376.277817][T15447] RIP: 0033:0x7f9d8cb8ebe9 [ 376.277834][T15447] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 376.277850][T15447] RSP: 002b:00007f9d8adf6038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 376.277871][T15447] RAX: ffffffffffffffda RBX: 00007f9d8cdb5fa0 RCX: 00007f9d8cb8ebe9 [ 376.277885][T15447] RDX: 0000000000000000 RSI: 0000200000000140 RDI: 0000000000000003 [ 376.277895][T15447] RBP: 00007f9d8adf6090 R08: 0000000000000000 R09: 0000000000000000 [ 376.277906][T15447] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 376.277917][T15447] R13: 00007f9d8cdb6038 R14: 00007f9d8cdb5fa0 R15: 00007ffffeef2968 [ 376.277951][T15447] [ 376.377557][T15450] syzkaller1: entered promiscuous mode [ 376.524142][T15460] netlink: 'syz.4.2632': attribute type 1 has an invalid length. [ 376.540733][T15450] syzkaller1: entered allmulticast mode [ 376.779057][T15460] 8021q: adding VLAN 0 to HW filter on device bond6 [ 376.812733][T15462] ipvlan2: entered allmulticast mode [ 376.818610][T15462] bond6: entered allmulticast mode [ 377.008278][T15480] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2634'. [ 377.023363][T15480] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2634'. [ 377.033379][T15480] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2634'. [ 377.066794][T15480] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2634'. [ 377.089286][T15480] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2634'. [ 377.245182][T15485] lo speed is unknown, defaulting to 1000 [ 377.253175][T15485] wg1 speed is unknown, defaulting to 1000 [ 377.320090][T15487] lo speed is unknown, defaulting to 1000 [ 377.376222][T15487] wg1 speed is unknown, defaulting to 1000 [ 377.391412][T15498] tipc: Enabling of bearer rejected, already enabled [ 377.432779][T15498] tipc: Resetting bearer [ 377.442065][T15498] netlink: 'syz.4.2641': attribute type 4 has an invalid length. [ 377.450878][T15498] netlink: 17 bytes leftover after parsing attributes in process `syz.4.2641'. [ 377.465327][T15503] batadv_slave_1: entered promiscuous mode [ 377.529367][T15494] batadv_slave_1: left promiscuous mode [ 377.891519][T15521] netlink: 'syz.4.2647': attribute type 9 has an invalid length. [ 377.946290][T15521] netlink: 'syz.4.2647': attribute type 7 has an invalid length. [ 377.957290][T15521] netlink: 'syz.4.2647': attribute type 8 has an invalid length. [ 377.986269][T15520] syzkaller1: entered promiscuous mode [ 377.993243][T15520] syzkaller1: entered allmulticast mode [ 378.011106][T15525] tc_dump_action: action bad kind [ 378.833488][ T1303] ieee802154 phy1 wpan1: encryption failed: -22 [ 378.903322][T15544] lo speed is unknown, defaulting to 1000 [ 378.921481][T15544] wg1 speed is unknown, defaulting to 1000 [ 380.044744][T15574] syzkaller1: entered promiscuous mode [ 380.050269][T15574] syzkaller1: entered allmulticast mode [ 380.364155][T15582] batadv_slave_1: entered promiscuous mode [ 380.490149][T15578] batadv_slave_1: left promiscuous mode [ 380.703097][T15592] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 380.757907][T15600] __nla_validate_parse: 10 callbacks suppressed [ 380.757929][T15600] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2668'. [ 380.784674][T15600] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2668'. [ 380.810827][T15600] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2668'. [ 380.851805][T15604] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2668'. [ 380.883480][T15604] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2668'. [ 381.016628][T15613] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2674'. [ 381.046962][T15613] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2674'. [ 381.061156][T15613] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2674'. [ 381.072318][T15616] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2674'. [ 381.086569][T15616] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2674'. [ 381.151412][T15618] FAULT_INJECTION: forcing a failure. [ 381.151412][T15618] name failslab, interval 1, probability 0, space 0, times 0 [ 381.164885][T15618] CPU: 0 UID: 0 PID: 15618 Comm: syz.2.2676 Not tainted 6.17.0-rc1-syzkaller-00201-g88250d40ed59 #0 PREEMPT(full) [ 381.164906][T15618] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 381.164912][T15618] Call Trace: [ 381.164917][T15618] [ 381.164923][T15618] dump_stack_lvl+0x189/0x250 [ 381.164941][T15618] ? __pfx____ratelimit+0x10/0x10 [ 381.164956][T15618] ? __pfx_dump_stack_lvl+0x10/0x10 [ 381.164969][T15618] ? __pfx__printk+0x10/0x10 [ 381.164982][T15618] ? netlink_unicast+0x82c/0x9e0 [ 381.164997][T15618] ? ___sys_sendmsg+0x21f/0x2a0 [ 381.165009][T15618] ? do_syscall_64+0xfa/0x3b0 [ 381.165031][T15618] should_fail_ex+0x414/0x560 [ 381.165048][T15618] should_failslab+0xa8/0x100 [ 381.165065][T15618] kmem_cache_alloc_noprof+0x73/0x3c0 [ 381.165079][T15618] ? skb_clone+0x212/0x3a0 [ 381.165094][T15618] skb_clone+0x212/0x3a0 [ 381.165108][T15618] __netlink_deliver_tap+0x404/0x850 [ 381.165131][T15618] ? netlink_deliver_tap+0x2e/0x1b0 [ 381.165148][T15618] netlink_deliver_tap+0x19c/0x1b0 [ 381.165163][T15618] netlink_sendskb+0x68/0x140 [ 381.165179][T15618] netlink_unicast+0x397/0x9e0 [ 381.165190][T15618] ? __asan_memcpy+0x40/0x70 [ 381.165208][T15618] ? __pfx_netlink_unicast+0x10/0x10 [ 381.165229][T15618] netlink_rcv_skb+0x28c/0x470 [ 381.165244][T15618] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 381.165261][T15618] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 381.165284][T15618] ? netlink_deliver_tap+0x2e/0x1b0 [ 381.165304][T15618] netlink_unicast+0x82c/0x9e0 [ 381.165324][T15618] ? __pfx_netlink_unicast+0x10/0x10 [ 381.165339][T15618] ? netlink_sendmsg+0x642/0xb30 [ 381.165355][T15618] ? skb_put+0x11b/0x210 [ 381.165375][T15618] netlink_sendmsg+0x805/0xb30 [ 381.165413][T15618] ? __pfx_netlink_sendmsg+0x10/0x10 [ 381.165442][T15618] ? aa_sock_msg_perm+0xf1/0x1d0 [ 381.165472][T15618] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 381.165493][T15618] ? __pfx_netlink_sendmsg+0x10/0x10 [ 381.165520][T15618] __sock_sendmsg+0x219/0x270 [ 381.165548][T15618] ____sys_sendmsg+0x505/0x830 [ 381.165565][T15618] ? __pfx_____sys_sendmsg+0x10/0x10 [ 381.165583][T15618] ? import_iovec+0x74/0xa0 [ 381.165598][T15618] ___sys_sendmsg+0x21f/0x2a0 [ 381.165612][T15618] ? __pfx____sys_sendmsg+0x10/0x10 [ 381.165648][T15618] ? __fget_files+0x2a/0x420 [ 381.165657][T15618] ? __fget_files+0x3a0/0x420 [ 381.165674][T15618] __x64_sys_sendmsg+0x19b/0x260 [ 381.165696][T15618] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 381.165714][T15618] ? __pfx_ksys_write+0x10/0x10 [ 381.165726][T15618] ? rcu_is_watching+0x15/0xb0 [ 381.165748][T15618] ? do_syscall_64+0xbe/0x3b0 [ 381.165771][T15618] do_syscall_64+0xfa/0x3b0 [ 381.165784][T15618] ? lockdep_hardirqs_on+0x9c/0x150 [ 381.165798][T15618] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 381.165809][T15618] ? clear_bhb_loop+0x60/0xb0 [ 381.165823][T15618] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 381.165834][T15618] RIP: 0033:0x7effc118ebe9 [ 381.165846][T15618] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 381.165856][T15618] RSP: 002b:00007effc1f15038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 381.165870][T15618] RAX: ffffffffffffffda RBX: 00007effc13b5fa0 RCX: 00007effc118ebe9 [ 381.165878][T15618] RDX: 0000000000000000 RSI: 0000200000000140 RDI: 0000000000000003 [ 381.165885][T15618] RBP: 00007effc1f15090 R08: 0000000000000000 R09: 0000000000000000 [ 381.165892][T15618] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 381.165898][T15618] R13: 00007effc13b6038 R14: 00007effc13b5fa0 R15: 00007ffe20d6f4b8 [ 381.165918][T15618] [ 381.582394][T15620] syzkaller1: entered promiscuous mode [ 381.591938][T15620] syzkaller1: entered allmulticast mode [ 381.751792][T15626] batadv_slave_1: entered promiscuous mode [ 381.761644][T15623] batadv_slave_1: left promiscuous mode [ 381.871061][T15615] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 381.883491][T15615] Bluetooth: hci1: Error when powering off device on rfkill (-4) [ 381.897169][T15633] syz_tun: entered allmulticast mode [ 381.907267][T15615] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 381.913188][T15633] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 381.913482][T15615] Bluetooth: hci2: Error when powering off device on rfkill (-4) [ 381.946181][T15615] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 381.952618][T15615] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 381.975324][T15615] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 381.983114][T15615] Bluetooth: hci4: Error when powering off device on rfkill (-4) [ 382.003470][T15615] tipc: Resetting bearer [ 382.546247][T15648] FAULT_INJECTION: forcing a failure. [ 382.546247][T15648] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 382.560183][T15648] CPU: 1 UID: 0 PID: 15648 Comm: syz.3.2687 Not tainted 6.17.0-rc1-syzkaller-00201-g88250d40ed59 #0 PREEMPT(full) [ 382.560203][T15648] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 382.560211][T15648] Call Trace: [ 382.560216][T15648] [ 382.560224][T15648] dump_stack_lvl+0x189/0x250 [ 382.560253][T15648] ? __pfx____ratelimit+0x10/0x10 [ 382.560277][T15648] ? __pfx_dump_stack_lvl+0x10/0x10 [ 382.560301][T15648] ? __pfx__printk+0x10/0x10 [ 382.560326][T15648] ? __might_fault+0xb0/0x130 [ 382.560352][T15648] should_fail_ex+0x414/0x560 [ 382.560370][T15648] _copy_from_user+0x2d/0xb0 [ 382.560383][T15648] kstrtouint_from_user+0xc4/0x170 [ 382.560401][T15648] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 382.560436][T15648] proc_fail_nth_write+0x88/0x200 [ 382.560449][T15648] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 382.560465][T15648] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 382.560479][T15648] vfs_write+0x27e/0xb30 [ 382.560499][T15648] ? __pfx_vfs_write+0x10/0x10 [ 382.560515][T15648] ? __fget_files+0x2a/0x420 [ 382.560529][T15648] ? __fget_files+0x3a0/0x420 [ 382.560538][T15648] ? __fget_files+0x2a/0x420 [ 382.560554][T15648] ksys_write+0x145/0x250 [ 382.560569][T15648] ? __pfx_ksys_write+0x10/0x10 [ 382.560587][T15648] ? do_syscall_64+0xbe/0x3b0 [ 382.560605][T15648] do_syscall_64+0xfa/0x3b0 [ 382.560618][T15648] ? lockdep_hardirqs_on+0x9c/0x150 [ 382.560632][T15648] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 382.560643][T15648] ? clear_bhb_loop+0x60/0xb0 [ 382.560660][T15648] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 382.560673][T15648] RIP: 0033:0x7f666318d69f [ 382.560686][T15648] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48 [ 382.560696][T15648] RSP: 002b:00007f666403e030 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 382.560710][T15648] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f666318d69f [ 382.560718][T15648] RDX: 0000000000000001 RSI: 00007f666403e0a0 RDI: 0000000000000004 [ 382.560729][T15648] RBP: 00007f666403e090 R08: 0000000000000000 R09: 0000000000000000 [ 382.560740][T15648] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000002 [ 382.560751][T15648] R13: 00007f66633b6038 R14: 00007f66633b5fa0 R15: 00007ffd855088a8 [ 382.560784][T15648] [ 382.957202][T15657] netlink: 'syz.3.2688': attribute type 21 has an invalid length. [ 383.716502][T15690] syzkaller1: entered promiscuous mode [ 383.731951][T15690] syzkaller1: entered allmulticast mode [ 383.899915][T15698] netlink: 'syz.2.2701': attribute type 2 has an invalid length. [ 383.912190][T15698] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 383.962279][T15698] batadv_slave_1: entered promiscuous mode [ 383.969634][T15697] batadv_slave_1: left promiscuous mode [ 384.082292][T15710] wireguard0: entered promiscuous mode [ 384.088254][T15710] wireguard0: entered allmulticast mode [ 384.180012][T15715] veth0: entered promiscuous mode [ 384.217203][T15714] veth0: left promiscuous mode [ 384.692775][T15724] batadv_slave_1: left allmulticast mode [ 384.706337][T15724] gretap1: left promiscuous mode [ 384.713108][T15724] tipc: Resetting bearer [ 384.720192][T15724] syzkaller0: left promiscuous mode [ 384.726029][T15724] syzkaller0: left allmulticast mode [ 384.755125][T15724] ip6tnl4: left promiscuous mode [ 384.760985][T15724] ip6tnl4: left allmulticast mode [ 384.804819][T15736] syzkaller1: entered promiscuous mode [ 384.811308][T15736] syzkaller1: entered allmulticast mode [ 384.961139][T15740] batadv_slave_1: entered promiscuous mode [ 384.968084][T15739] batadv_slave_1: left promiscuous mode [ 385.550075][T15759] syzkaller0: entered promiscuous mode [ 385.558486][T15759] syzkaller0: entered allmulticast mode [ 385.847226][T15767] batadv_slave_1: entered promiscuous mode [ 385.862878][T15766] batadv_slave_1: left promiscuous mode [ 386.012091][T15777] netlink: 'syz.1.2730': attribute type 1 has an invalid length. [ 386.020299][T15777] netlink: 'syz.1.2730': attribute type 2 has an invalid length. [ 386.030222][T15777] __nla_validate_parse: 18 callbacks suppressed [ 386.030242][T15777] netlink: 1172 bytes leftover after parsing attributes in process `syz.1.2730'. [ 386.088669][T15779] netlink: 16178 bytes leftover after parsing attributes in process `syz.1.2731'. [ 386.178906][T15783] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2733'. [ 387.157288][T15796] netlink: 'syz.1.2739': attribute type 1 has an invalid length. [ 387.204812][T15796] 8021q: adding VLAN 0 to HW filter on device bond6 [ 387.251601][T15796] 8021q: adding VLAN 0 to HW filter on device bond6 [ 387.259595][T15796] bond6: (slave vxcan3): The slave device specified does not support setting the MAC address [ 387.273537][T15796] bond6: (slave vxcan3): Error -95 calling set_mac_address [ 387.579413][T15813] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2744'. [ 387.694989][ T43] lo speed is unknown, defaulting to 1000 [ 387.722098][ T43] sz1: Port: 1 Link DOWN [ 387.723342][T15822] nbd: couldn't find device at index 0 [ 388.088961][T15826] batadv_slave_1: entered promiscuous mode [ 388.111269][T15826] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2748'. [ 388.125604][T15826] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2748'. [ 388.177926][T15825] batadv_slave_1: left promiscuous mode [ 388.329808][T15837] syzkaller0: entered promiscuous mode [ 388.338182][T15837] syzkaller0: entered allmulticast mode [ 388.479125][T15844] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2755'. [ 388.629363][T15851] nbd: couldn't find device at index 0 [ 388.837712][T15858] netlink: 44 bytes leftover after parsing attributes in process `syz.1.2760'. [ 388.912532][T15862] netlink: 88 bytes leftover after parsing attributes in process `syz.1.2762'. [ 388.915603][T15861] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2761'. [ 388.939392][T15861] batadv_slave_1: entered promiscuous mode [ 388.949237][T15859] batadv_slave_1: left promiscuous mode [ 389.116259][T15868] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 389.327172][T15882] netlink: 'syz.1.2768': attribute type 1 has an invalid length. [ 389.376885][T15887] nbd: couldn't find device at index 0 [ 389.614004][T15897] batadv_slave_1: entered promiscuous mode [ 389.622260][T15896] batadv_slave_1: left promiscuous mode [ 390.208698][T15927] batadv_slave_1: entered promiscuous mode [ 390.225290][T15926] batadv_slave_1: left promiscuous mode [ 391.231329][T15946] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 391.248408][ T43] lo speed is unknown, defaulting to 1000 [ 391.257480][ T43] sz1: Port: 1 Link ACTIVE [ 391.296417][T15948] __nla_validate_parse: 4 callbacks suppressed [ 391.296440][T15948] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2789'. [ 391.462312][T15956] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2791'. [ 391.471738][T15956] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2791'. [ 391.481023][T15956] netlink: 'syz.1.2791': attribute type 18 has an invalid length. [ 392.366411][T15961] batadv_slave_1: entered promiscuous mode [ 392.372913][T15960] batadv_slave_1: left promiscuous mode [ 440.271719][ T1303] ieee802154 phy1 wpan1: encryption failed: -22 [ 501.706747][ T1303] ieee802154 phy1 wpan1: encryption failed: -22 [ 529.864005][ T31] INFO: task syz-executor:5864 blocked for more than 143 seconds. [ 529.872056][ T31] Not tainted 6.17.0-rc1-syzkaller-00201-g88250d40ed59 #0 [ 529.879946][ T31] Blocked by coredump. [ 529.884894][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 529.893579][ T31] task:syz-executor state:D stack:20376 pid:5864 tgid:5864 ppid:1 task_flags:0x40054c flags:0x00004006 [ 529.905850][ T31] Call Trace: [ 529.909165][ T31] SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 529.912115][ T31] __schedule+0x1798/0x4cc0 [ 529.916879][ T31] ? __lock_acquire+0xab9/0xd20 [ 529.921808][ T31] ? __lock_acquire+0xab9/0xd20 [ 529.926997][ T31] ? __pfx___schedule+0x10/0x10 [ 529.931912][ T31] ? schedule+0x91/0x360 [ 529.941721][ T31] schedule+0x165/0x360 [ 529.946383][ T31] schedule_preempt_disabled+0x13/0x30 [ 529.951900][ T31] __mutex_lock+0x7e6/0x1360 [ 529.961680][ T31] ? __mutex_lock+0x5b6/0x1360 [ 529.966592][ T31] ? rfkill_unregister+0xc8/0x220 [ 529.971668][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 529.982019][ T31] ? __pfx_device_del+0x10/0x10 [ 529.987418][ T31] ? hci_sock_dev_event+0x42d/0x600 [ 529.992959][ T31] rfkill_unregister+0xc8/0x220 [ 530.003239][ T31] hci_unregister_dev+0x374/0x510 [ 530.028100][ T31] vhci_release+0x80/0xd0 [ 530.032518][ T31] ? __pfx_vhci_release+0x10/0x10 [ 530.037730][ T31] __fput+0x449/0xa70 [ 530.041786][ T31] task_work_run+0x1d4/0x260 [ 530.046464][ T31] ? __pfx_task_work_run+0x10/0x10 [ 530.051623][ T31] ? kmem_cache_free+0x18f/0x400 [ 530.057128][ T31] do_exit+0x6b5/0x2300 [ 530.061607][ T31] ? do_raw_spin_lock+0x121/0x290 [ 530.066935][ T31] ? __pfx_do_exit+0x10/0x10 [ 530.071693][ T31] do_group_exit+0x21c/0x2d0 [ 530.076411][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 530.081746][ T31] get_signal+0x1286/0x1340 [ 530.086357][ T31] arch_do_signal_or_restart+0x9a/0x750 [ 530.092044][ T31] ? fput_close_sync+0x119/0x200 [ 530.097015][ T31] ? kmem_cache_free+0x309/0x400 [ 530.101951][ T31] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 530.108305][ T31] ? exit_to_user_mode_loop+0x40/0x110 [ 530.113851][ T31] exit_to_user_mode_loop+0x75/0x110 [ 530.119148][ T31] do_syscall_64+0x2bd/0x3b0 [ 530.123770][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 530.129856][ T31] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 530.136066][ T31] ? clear_bhb_loop+0x60/0xb0 [ 530.140765][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 530.146734][ T31] RIP: 0033:0x7effc118d5fc [ 530.151314][ T31] RSP: 002b:00007ffe20d6f810 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 530.159801][ T31] RAX: fffffffffffffe00 RBX: 0000000000000003 RCX: 00007effc118d5fc [ 530.167876][ T31] RDX: 0000000000000030 RSI: 00007ffe20d6f8d0 RDI: 00000000000000f9 [ 530.175908][ T31] RBP: 00007ffe20d6f87c R08: 0000000000000000 R09: 00007ffe20d6f587 [ 530.184142][ T31] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000258 [ 530.192213][ T31] R13: 00000000000927c0 R14: 000000000005e069 R15: 00007ffe20d6f8d0 [ 530.200259][ T31] [ 530.203358][ T31] INFO: task kworker/1:7:8800 blocked for more than 143 seconds. [ 530.211193][ T31] Not tainted 6.17.0-rc1-syzkaller-00201-g88250d40ed59 #0 [ 530.218877][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 530.227605][ T31] task:kworker/1:7 state:D stack:23664 pid:8800 tgid:8800 ppid:2 task_flags:0x4208060 flags:0x00004000 [ 530.239706][ T31] Workqueue: events rfkill_global_led_trigger_worker [ 530.246537][ T31] Call Trace: [ 530.249862][ T31] [ 530.252808][ T31] __schedule+0x1798/0x4cc0 [ 530.257521][ T31] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 530.263112][ T31] ? __pfx___schedule+0x10/0x10 [ 530.268058][ T31] ? schedule+0x91/0x360 [ 530.272376][ T31] schedule+0x165/0x360 [ 530.276552][ T31] schedule_preempt_disabled+0x13/0x30 [ 530.282099][ T31] __mutex_lock+0x7e6/0x1360 [ 530.286760][ T31] ? __mutex_lock+0x5b6/0x1360 [ 530.291563][ T31] ? rfkill_global_led_trigger_worker+0x27/0xd0 [ 530.297969][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 530.303123][ T31] ? process_scheduled_works+0x9ef/0x17b0 [ 530.309002][ T31] ? process_scheduled_works+0x9ef/0x17b0 [ 530.314814][ T31] rfkill_global_led_trigger_worker+0x27/0xd0 [ 530.321014][ T31] ? process_scheduled_works+0x9ef/0x17b0 [ 530.326920][ T31] process_scheduled_works+0xade/0x17b0 [ 530.332539][ T31] ? __pfx_process_scheduled_works+0x10/0x10 [ 530.338591][ T31] worker_thread+0x8a0/0xda0 [ 530.343228][ T31] kthread+0x70e/0x8a0 [ 530.347400][ T31] ? __pfx_worker_thread+0x10/0x10 [ 530.352577][ T31] ? __pfx_kthread+0x10/0x10 [ 530.357282][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 530.362499][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 530.367944][ T31] ? __pfx_kthread+0x10/0x10 [ 530.372575][ T31] ret_from_fork+0x3f9/0x770 [ 530.377247][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 530.382376][ T31] ? __switch_to_asm+0x39/0x70 [ 530.387303][ T31] ? __switch_to_asm+0x33/0x70 [ 530.392094][ T31] ? __pfx_kthread+0x10/0x10 [ 530.396761][ T31] ret_from_fork_asm+0x1a/0x30 [ 530.401623][ T31] [ 530.404900][ T31] INFO: task syz.0.2669:15593 blocked for more than 143 seconds. [ 530.412628][ T31] Not tainted 6.17.0-rc1-syzkaller-00201-g88250d40ed59 #0 [ 530.421527][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 530.430625][ T31] task:syz.0.2669 state:D stack:25096 pid:15593 tgid:15593 ppid:5858 task_flags:0x400040 flags:0x00004004 [ 530.442602][ T31] Call Trace: [ 530.445942][ T31] [ 530.448990][ T31] __schedule+0x1798/0x4cc0 [ 530.453534][ T31] ? __lock_acquire+0xab9/0xd20 [ 530.458449][ T31] ? __pfx___schedule+0x10/0x10 [ 530.463309][ T31] ? schedule+0x91/0x360 [ 530.467605][ T31] schedule+0x165/0x360 [ 530.471795][ T31] schedule_preempt_disabled+0x13/0x30 [ 530.477313][ T31] __mutex_lock+0x7e6/0x1360 [ 530.481919][ T31] ? __mutex_lock+0x5b6/0x1360 [ 530.486783][ T31] ? rfkill_unregister+0xc8/0x220 [ 530.491863][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 530.496993][ T31] ? __pfx_device_del+0x10/0x10 [ 530.501897][ T31] rfkill_unregister+0xc8/0x220 [ 530.507068][ T31] nfc_unregister_device+0x96/0x2a0 [ 530.512407][ T31] ? __pfx_virtual_ncidev_close+0x10/0x10 [ 530.518365][ T31] virtual_ncidev_close+0x56/0x90 [ 530.523412][ T31] __fput+0x449/0xa70 [ 530.527507][ T31] task_work_run+0x1d4/0x260 [ 530.532133][ T31] ? __pfx_task_work_run+0x10/0x10 [ 530.537292][ T31] ? exit_to_user_mode_loop+0x40/0x110 [ 530.542770][ T31] exit_to_user_mode_loop+0xec/0x110 [ 530.548096][ T31] do_syscall_64+0x2bd/0x3b0 [ 530.552800][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 530.558977][ T31] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 530.565190][ T31] ? clear_bhb_loop+0x60/0xb0 [ 530.569890][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 530.575842][ T31] RIP: 0033:0x7f9d8cb8ebe9 [ 530.580252][ T31] RSP: 002b:00007ffffeef2ac8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 530.588701][ T31] RAX: 0000000000000000 RBX: 00007f9d8cdb7da0 RCX: 00007f9d8cb8ebe9 [ 530.596739][ T31] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 530.604740][ T31] RBP: 00007f9d8cdb7da0 R08: 00000000000001a8 R09: 00000018feef2dbf [ 530.612909][ T31] R10: 00000000003ffc34 R11: 0000000000000246 R12: 000000000005d229 [ 530.620942][ T31] R13: 00007f9d8cdb5fa0 R14: ffffffffffffffff R15: 00007ffffeef2be0 [ 530.628987][ T31] [ 530.632027][ T31] INFO: task syz.4.2675:15615 blocked for more than 144 seconds. [ 530.644940][ T31] Not tainted 6.17.0-rc1-syzkaller-00201-g88250d40ed59 #0 [ 530.652711][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 530.661419][ T31] task:syz.4.2675 state:D stack:24280 pid:15615 tgid:15614 ppid:5871 task_flags:0x400140 flags:0x00004006 [ 530.673855][ T31] Call Trace: [ 530.677176][ T31] [ 530.680130][ T31] __schedule+0x1798/0x4cc0 [ 530.684812][ T31] ? __lock_acquire+0xab9/0xd20 [ 530.689719][ T31] ? __lock_acquire+0xab9/0xd20 [ 530.694633][ T31] ? __pfx___schedule+0x10/0x10 [ 530.699514][ T31] ? schedule+0x91/0x360 [ 530.703884][ T31] schedule+0x165/0x360 [ 530.708062][ T31] schedule_preempt_disabled+0x13/0x30 [ 530.713518][ T31] __mutex_lock+0x7e6/0x1360 [ 530.718138][ T31] ? __mutex_lock+0x5b6/0x1360 [ 530.723861][ T31] ? nfc_rfkill_set_block+0x50/0x2e0 [ 530.729165][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 530.734307][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 530.739548][ T31] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 530.745872][ T31] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 530.752246][ T31] ? __pfx_nfc_rfkill_set_block+0x10/0x10 [ 530.758163][ T31] nfc_rfkill_set_block+0x50/0x2e0 [ 530.763306][ T31] ? __pfx_nfc_rfkill_set_block+0x10/0x10 [ 530.769114][ T31] rfkill_set_block+0x1d2/0x440 [ 530.774055][ T31] rfkill_fop_write+0x44b/0x570 [ 530.778964][ T31] ? __pfx_rfkill_fop_write+0x10/0x10 [ 530.784373][ T31] ? security_kernfs_init_security+0x240/0x290 [ 530.790590][ T31] ? rw_verify_area+0x255/0x4d0 [ 530.795532][ T31] ? __lock_acquire+0xab9/0xd20 [ 530.800413][ T31] ? __pfx_rfkill_fop_write+0x10/0x10 [ 530.805849][ T31] vfs_write+0x27e/0xb30 [ 530.810224][ T31] ? __pfx_vfs_write+0x10/0x10 [ 530.815035][ T31] ? __fget_files+0x2a/0x420 [ 530.819755][ T31] ? __fget_files+0x2a/0x420 [ 530.824445][ T31] ? __fget_files+0x3a0/0x420 [ 530.829167][ T31] ? __fget_files+0x2a/0x420 [ 530.833875][ T31] ksys_write+0x145/0x250 [ 530.838246][ T31] ? __pfx_ksys_write+0x10/0x10 [ 530.843114][ T31] ? rcu_is_watching+0x15/0xb0 [ 530.847946][ T31] ? do_syscall_64+0xbe/0x3b0 [ 530.852654][ T31] do_syscall_64+0xfa/0x3b0 [ 530.857237][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 530.862439][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 530.868537][ T31] ? clear_bhb_loop+0x60/0xb0 [ 530.873216][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 530.879157][ T31] RIP: 0033:0x7fc4fd38ebe9 [ 530.883593][ T31] RSP: 002b:00007fc4fe250038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 530.892157][ T31] RAX: ffffffffffffffda RBX: 00007fc4fd5b5fa0 RCX: 00007fc4fd38ebe9 [ 530.900190][ T31] RDX: 0000000000000008 RSI: 0000200000000000 RDI: 0000000000000005 [ 530.908504][ T31] RBP: 00007fc4fd411e19 R08: 0000000000000000 R09: 0000000000000000 [ 530.916531][ T31] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 530.925515][ T31] R13: 00007fc4fd5b6038 R14: 00007fc4fd5b5fa0 R15: 00007ffdc91620d8 [ 530.933518][ T31] [ 530.936577][ T31] INFO: task syz-executor:15768 blocked for more than 144 seconds. [ 530.944519][ T31] Not tainted 6.17.0-rc1-syzkaller-00201-g88250d40ed59 #0 [ 530.952173][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 530.961076][ T31] task:syz-executor state:D stack:28040 pid:15768 tgid:15768 ppid:1 task_flags:0x400040 flags:0x00004000 [ 530.973023][ T31] Call Trace: [ 530.976351][ T31] [ 530.979294][ T31] __schedule+0x1798/0x4cc0 [ 530.983873][ T31] ? __lock_acquire+0xab9/0xd20 [ 530.988753][ T31] ? __lock_acquire+0xab9/0xd20 [ 530.993607][ T31] ? __pfx___schedule+0x10/0x10 [ 530.998530][ T31] ? schedule+0x91/0x360 [ 531.002944][ T31] schedule+0x165/0x360 [ 531.007161][ T31] schedule_preempt_disabled+0x13/0x30 [ 531.012642][ T31] __mutex_lock+0x7e6/0x1360 [ 531.017365][ T31] ? __mutex_lock+0x5b6/0x1360 [ 531.022203][ T31] ? rfkill_register+0x37/0x8e0 [ 531.027171][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 531.032337][ T31] ? __raw_spin_lock_init+0x45/0x100 [ 531.037713][ T31] ? __init_waitqueue_head+0xa9/0x150 [ 531.043141][ T31] ? device_initialize+0x24b/0x440 [ 531.048400][ T31] rfkill_register+0x37/0x8e0 [ 531.053098][ T31] hci_register_dev+0x3f5/0x890 [ 531.057973][ T31] vhci_create_device+0x39c/0x6e0 [ 531.063088][ T31] vhci_write+0x3ce/0x4a0 [ 531.067564][ T31] vfs_write+0x5c6/0xb30 [ 531.071835][ T31] ? __pfx_vhci_write+0x10/0x10 [ 531.076722][ T31] ? __pfx_vfs_write+0x10/0x10 [ 531.081487][ T31] ? count_memcg_event_mm+0x21/0x260 [ 531.086874][ T31] ksys_write+0x145/0x250 [ 531.091248][ T31] ? __pfx_ksys_write+0x10/0x10 [ 531.096144][ T31] ? do_syscall_64+0xbe/0x3b0 [ 531.101124][ T31] do_syscall_64+0xfa/0x3b0 [ 531.105676][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 531.110915][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 531.117053][ T31] ? clear_bhb_loop+0x60/0xb0 [ 531.121749][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 531.127722][ T31] RIP: 0033:0x7f254858d660 [ 531.132178][ T31] RSP: 002b:00007ffe9954f198 EFLAGS: 00000202 ORIG_RAX: 0000000000000001 [ 531.140713][ T31] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f254858d660 [ 531.150455][ T31] RDX: 0000000000000002 RSI: 00007ffe9954f1aa RDI: 00000000000000ca [ 531.158601][ T31] RBP: 00007f25487b67b8 R08: 0000000000000000 R09: 00007f25492ed6c0 [ 531.166737][ T31] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000008 [ 531.174758][ T31] R13: 0000000000000003 R14: 0000000000000009 R15: 0000000000000000 [ 531.182745][ T31] [ 531.185953][ T31] [ 531.185953][ T31] Showing all locks held in the system: [ 531.193767][ T31] 1 lock held by khungtaskd/31: [ 531.198626][ T31] #0: ffffffff8e139ee0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 531.208516][ T31] 2 locks held by getty/5620: [ 531.213185][ T31] #0: ffff88814ccdc0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 531.223032][ T31] #1: ffffc900036cb2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x43e/0x1400 [ 531.233371][ T31] 1 lock held by syz-executor/5864: [ 531.238616][ T31] #0: ffffffff8f811868 (rfkill_global_mutex){+.+.}-{4:4}, at: rfkill_unregister+0xc8/0x220 [ 531.248779][ T31] 2 locks held by kworker/u8:10/8008: [ 531.254207][ T31] #0: ffff88801a489148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 [ 531.266046][ T31] #1: ffffc900039ffbc0 ((work_completion)(&(&kfence_timer)->work)){+.+.}-{0:0}, at: psi_task_switch+0x53/0x880 [ 531.277964][ T31] 3 locks held by kworker/1:7/8800: [ 531.283260][ T31] #0: ffff88801a480d48 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 [ 531.294294][ T31] #1: ffffc9001c2ffbc0 ((work_completion)(&rfkill_global_led_trigger_work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 [ 531.308048][ T31] #2: ffffffff8f811868 (rfkill_global_mutex){+.+.}-{4:4}, at: rfkill_global_led_trigger_worker+0x27/0xd0 [ 531.319457][ T31] 2 locks held by syz.0.2669/15593: [ 531.324771][ T31] #0: ffff888078333100 (&dev->mutex){....}-{4:4}, at: nfc_unregister_device+0x63/0x2a0 [ 531.334599][ T31] #1: ffffffff8f811868 (rfkill_global_mutex){+.+.}-{4:4}, at: rfkill_unregister+0xc8/0x220 [ 531.344747][ T31] 2 locks held by syz.4.2675/15615: [ 531.349952][ T31] #0: ffffffff8f811868 (rfkill_global_mutex){+.+.}-{4:4}, at: rfkill_fop_write+0x191/0x570 [ 531.360260][ T31] #1: ffff888078333100 (&dev->mutex){....}-{4:4}, at: nfc_rfkill_set_block+0x50/0x2e0 [ 531.369968][ T31] 2 locks held by syz-executor/15768: [ 531.375390][ T31] #0: ffff88807a17f918 (&data->open_mutex){+.+.}-{4:4}, at: vhci_create_device+0x34/0x6e0 [ 531.385520][ T31] #1: ffffffff8f811868 (rfkill_global_mutex){+.+.}-{4:4}, at: rfkill_register+0x37/0x8e0 [ 531.395508][ T31] 3 locks held by syz.3.2788/15942: [ 531.400697][ T31] #0: ffffffff8e9c1308 (misc_mtx){+.+.}-{4:4}, at: misc_open+0x51/0x330 [ 531.409176][ T31] #1: ffff88805989f100 (&dev->mutex){....}-{4:4}, at: nfc_register_device+0xa1/0x320 [ 531.418857][ T31] #2: ffffffff8f811868 (rfkill_global_mutex){+.+.}-{4:4}, at: rfkill_register+0x37/0x8e0 [ 531.428891][ T31] 1 lock held by syz.1.2799/15975: [ 531.434032][ T31] #0: ffffffff8e9c1308 (misc_mtx){+.+.}-{4:4}, at: misc_open+0x51/0x330 [ 531.442686][ T31] 1 lock held by syz.1.2799/15977: [ 531.447909][ T31] #0: ffffffff8e9c1308 (misc_mtx){+.+.}-{4:4}, at: misc_open+0x51/0x330 [ 531.456421][ T31] 1 lock held by syz-executor/15981: [ 531.461721][ T31] #0: ffffffff8e9c1308 (misc_mtx){+.+.}-{4:4}, at: misc_open+0x51/0x330 [ 531.470238][ T31] 1 lock held by syz-executor/15982: [ 531.475636][ T31] #0: ffffffff8e9c1308 (misc_mtx){+.+.}-{4:4}, at: misc_open+0x51/0x330 [ 531.484469][ T31] 1 lock held by syz-executor/15984: [ 531.489763][ T31] #0: ffffffff8e9c1308 (misc_mtx){+.+.}-{4:4}, at: misc_open+0x51/0x330 [ 531.498286][ T31] 1 lock held by syz-executor/15986: [ 531.503575][ T31] #0: ffffffff8e9c1308 (misc_mtx){+.+.}-{4:4}, at: misc_open+0x51/0x330 [ 531.512101][ T31] 1 lock held by syz-executor/15988: [ 531.517466][ T31] #0: ffffffff8e9c1308 (misc_mtx){+.+.}-{4:4}, at: misc_open+0x51/0x330 [ 531.525995][ T31] 1 lock held by syz-executor/15991: [ 531.531301][ T31] #0: ffffffff8e9c1308 (misc_mtx){+.+.}-{4:4}, at: misc_open+0x51/0x330 [ 531.539795][ T31] 1 lock held by syz-executor/15992: [ 531.545141][ T31] #0: ffffffff8e9c1308 (misc_mtx){+.+.}-{4:4}, at: misc_open+0x51/0x330 [ 531.553716][ T31] 1 lock held by syz-executor/15994: [ 531.559057][ T31] #0: ffffffff8e9c1308 (misc_mtx){+.+.}-{4:4}, at: misc_open+0x51/0x330 [ 531.567539][ T31] 1 lock held by syz-executor/15996: [ 531.572991][ T31] #0: ffffffff8e9c1308 (misc_mtx){+.+.}-{4:4}, at: misc_open+0x51/0x330 [ 531.581467][ T31] 1 lock held by syz-executor/15998: [ 531.586884][ T31] #0: ffffffff8e9c1308 (misc_mtx){+.+.}-{4:4}, at: misc_open+0x51/0x330 [ 531.595476][ T31] 1 lock held by syz-executor/16001: [ 531.600753][ T31] #0: ffffffff8e9c1308 (misc_mtx){+.+.}-{4:4}, at: misc_open+0x51/0x330 [ 531.609249][ T31] 1 lock held by syz-executor/16002: [ 531.614553][ T31] #0: ffffffff8e9c1308 (misc_mtx){+.+.}-{4:4}, at: misc_open+0x51/0x330 [ 531.623014][ T31] 1 lock held by syz-executor/16004: [ 531.628436][ T31] #0: ffffffff8e9c1308 (misc_mtx){+.+.}-{4:4}, at: misc_open+0x51/0x330 [ 531.636959][ T31] 1 lock held by syz-executor/16006: [ 531.642252][ T31] #0: ffffffff8e9c1308 (misc_mtx){+.+.}-{4:4}, at: misc_open+0x51/0x330 [ 531.650844][ T31] [ 531.653194][ T31] ============================================= [ 531.653194][ T31] [ 531.661906][ T31] NMI backtrace for cpu 0 [ 531.661923][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted 6.17.0-rc1-syzkaller-00201-g88250d40ed59 #0 PREEMPT(full) [ 531.661937][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 531.661944][ T31] Call Trace: [ 531.661949][ T31] [ 531.661956][ T31] dump_stack_lvl+0x189/0x250 [ 531.661977][ T31] ? __pfx_dump_stack_lvl+0x10/0x10 [ 531.661991][ T31] ? __pfx__printk+0x10/0x10 [ 531.662013][ T31] nmi_cpu_backtrace+0x39e/0x3d0 [ 531.662028][ T31] ? __pfx_nmi_cpu_backtrace+0x10/0x10 [ 531.662042][ T31] ? __pfx__printk+0x10/0x10 [ 531.662059][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 531.662077][ T31] nmi_trigger_cpumask_backtrace+0x17a/0x300 [ 531.662091][ T31] watchdog+0xf93/0xfe0 [ 531.662109][ T31] ? watchdog+0x1de/0xfe0 [ 531.662126][ T31] kthread+0x70e/0x8a0 [ 531.662141][ T31] ? __pfx_watchdog+0x10/0x10 [ 531.662155][ T31] ? __pfx_kthread+0x10/0x10 [ 531.662169][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 531.662183][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 531.662196][ T31] ? __pfx_kthread+0x10/0x10 [ 531.662209][ T31] ret_from_fork+0x3f9/0x770 [ 531.662223][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 531.662237][ T31] ? __switch_to_asm+0x39/0x70 [ 531.662250][ T31] ? __switch_to_asm+0x33/0x70 [ 531.662262][ T31] ? __pfx_kthread+0x10/0x10 [ 531.662276][ T31] ret_from_fork_asm+0x1a/0x30 [ 531.662298][ T31] [ 531.662302][ T31] Sending NMI from CPU 0 to CPUs 1: [ 531.811509][ C1] NMI backtrace for cpu 1 [ 531.811530][ C1] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted 6.17.0-rc1-syzkaller-00201-g88250d40ed59 #0 PREEMPT(full) [ 531.811548][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 531.811557][ C1] RIP: 0010:pv_native_safe_halt+0x13/0x20 [ 531.811582][ C1] Code: 13 e8 02 00 cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 33 d7 0e 00 f3 0f 1e fa fb f4 cc cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 [ 531.811596][ C1] RSP: 0018:ffffc90000197de0 EFLAGS: 000002c2 [ 531.811611][ C1] RAX: 0a1d25262eaa9200 RBX: ffffffff81968308 RCX: 0a1d25262eaa9200 [ 531.811623][ C1] RDX: 0000000000000001 RSI: ffffffff8d9b6ea2 RDI: ffffffff8be33400 [ 531.811633][ C1] RBP: ffffc90000197f20 R08: ffff8880b8732f9b R09: 1ffff110170e65f3 [ 531.811644][ C1] R10: dffffc0000000000 R11: ffffed10170e65f4 R12: ffffffff8fa37f30 [ 531.811655][ C1] R13: 0000000000000001 R14: 0000000000000001 R15: 1ffff110039d5b40 [ 531.811666][ C1] FS: 0000000000000000(0000) GS:ffff888125d1c000(0000) knlGS:0000000000000000 [ 531.811678][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 531.811688][ C1] CR2: 00005604a19a3000 CR3: 000000000df36000 CR4: 00000000003526f0 [ 531.811704][ C1] Call Trace: [ 531.811712][ C1] [ 531.811718][ C1] default_idle+0x13/0x20 [ 531.811733][ C1] default_idle_call+0x74/0xb0 [ 531.811749][ C1] do_idle+0x1e8/0x510 [ 531.811767][ C1] ? __pfx_do_idle+0x10/0x10 [ 531.811786][ C1] ? do_idle+0x4f3/0x510 [ 531.811801][ C1] cpu_startup_entry+0x44/0x60 [ 531.811815][ C1] start_secondary+0x101/0x110 [ 531.811837][ C1] common_startup_64+0x13e/0x147 [ 531.811862][ C1] [ 531.812539][ T31] Kernel panic - not syncing: hung_task: blocked tasks [ 531.985882][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted 6.17.0-rc1-syzkaller-00201-g88250d40ed59 #0 PREEMPT(full) [ 531.997688][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 532.007933][ T31] Call Trace: [ 532.011216][ T31] [ 532.014151][ T31] dump_stack_lvl+0x99/0x250 [ 532.018757][ T31] ? __asan_memcpy+0x40/0x70 [ 532.023350][ T31] ? __pfx_dump_stack_lvl+0x10/0x10 [ 532.028562][ T31] ? __pfx__printk+0x10/0x10 [ 532.033197][ T31] vpanic+0x281/0x750 [ 532.037206][ T31] ? __pfx_vpanic+0x10/0x10 [ 532.041798][ T31] ? preempt_schedule+0xae/0xc0 [ 532.046752][ T31] ? preempt_schedule_common+0x83/0xd0 [ 532.052223][ T31] panic+0xb9/0xc0 [ 532.055946][ T31] ? __pfx_panic+0x10/0x10 [ 532.060366][ T31] ? preempt_schedule_thunk+0x16/0x30 [ 532.065754][ T31] ? nmi_trigger_cpumask_backtrace+0x2bb/0x300 [ 532.071912][ T31] watchdog+0xfd2/0xfe0 [ 532.076095][ T31] ? watchdog+0x1de/0xfe0 [ 532.080434][ T31] kthread+0x70e/0x8a0 [ 532.084510][ T31] ? __pfx_watchdog+0x10/0x10 [ 532.089201][ T31] ? __pfx_kthread+0x10/0x10 [ 532.093801][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 532.099002][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 532.104291][ T31] ? __pfx_kthread+0x10/0x10 [ 532.108904][ T31] ret_from_fork+0x3f9/0x770 [ 532.113523][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 532.118651][ T31] ? __switch_to_asm+0x39/0x70 [ 532.123437][ T31] ? __switch_to_asm+0x33/0x70 [ 532.128217][ T31] ? __pfx_kthread+0x10/0x10 [ 532.132819][ T31] ret_from_fork_asm+0x1a/0x30 [ 532.137751][ T31] [ 532.141090][ T31] Kernel Offset: disabled [ 532.145424][ T31] Rebooting in 86400 seconds..