last executing test programs: 3m0.848402191s ago: executing program 2 (id=11282): socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f0000000740), 0xffffffffffffffff) bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = socket$netlink(0x10, 0x3, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x8, &(0x7f0000000000)=0x80, 0x4) setsockopt$netlink_NETLINK_BROADCAST_ERROR(0xffffffffffffffff, 0x10e, 0x4, 0x0, 0x0) r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_NEW(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000300)={0x34, r1, 0x1, 0x0, 0x25dfdbfb, {0x25}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x34}, 0x1, 0x0, 0x0, 0x41}, 0x0) r2 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) connect$llc(r2, &(0x7f0000000180)={0x1a, 0x0, 0x0, 0x8, 0x0, 0x0, @multicast}, 0x10) bind$llc(r2, 0x0, 0x0) sendmmsg(r2, 0x0, 0x0, 0x0) socket(0x1, 0x6, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmmsg(r2, &(0x7f00000019c0)=[{{&(0x7f00000000c0)=@tipc=@nameseq={0x1e, 0x1, 0x3, {0x43, 0x1}}, 0x80, &(0x7f0000001940)=[{&(0x7f00000001c0)="817142456f031cf0990fc79d6848e0b98507c60b3deba37122d9df49df4040bdd439d2555310ddac27424a701cd24945ad779633055d447325122610c48c909b67fa6fc2743bfddb2d8a0bd7fad8e0800ab48a03139b3d02f1a2d025bb11e48952c6a2a457a8cc86447dfce53f2dcb5034392753bbd274ba3b993134d9128a1aa8c586182dc3cc6502b947e954b84a1e89260dffe6cc82f2eee1e99b70ff5b82b03f7dd6f1dd17e7ef5263b7075d33476767a46759aef9745bcc8c8f", 0xbc}, {&(0x7f0000000400)="15344f8da2e6b10124fb7849f175dc346d63fc0462898eca53b716aafa86895abd3bf2d6799dea764ff0647dba52a4fe23836672466e317f382870a427aa21113553932085cf5affce86b817b8b6af3df1ae4a6d2ee46f326d7a9c2e3d064076543559864a88d12a400bc13ee2c1a4000ac14d111cd296e6", 0x78}, {&(0x7f0000000480)="59093360169544b8e2c315da1fb699d657357869ad3ec411cb4fd8006fd6dff8f0ff3f62a30df709c84fea5d48033bbb5ab628462525c306a7faae5000c593b358c9ad735d8989bbf0116d1a8b200881a3aac1dd8131fdd19c1f48a1be045929fe2f23f7431bc5014f52928a16fd0f688268e330a5d3", 0x76}, {&(0x7f0000000500)="69f5345e39bf367280046bb4e081f514034f05393dd5e6299b44dfe3a2502c3de23f9ccef740ac55b421ebcae74ebd11f1e21dc3f44aa48a8a1556b556e0828f7542e31270a48cdee447e60a2cfc1e218a5c7a3d301eec90efd0c29086aa6911d0cd3808d3dc882090582a823b45fb8e96366437e3c1af", 0x77}, {&(0x7f0000000780)="705b4a0842afb87387714e129072364e02f543b5bc63fec602bdd461929f27221ca8e24ecd12f64b898912448f529fe85e262eaf06573a52f5f009e6a7965847201c2914be15053a8ecf6bdc1b053af76904f95f955bfb0a8bfd2708de23749cf6b90b0020eef56fb28db1322f9167375178e92c6d94105b467dec8f6500f80803784dd04f0563eecf8d08a0df8e3d79c8baf89924d1cf11c2bba2b7bc1cb1add0bce81aa849d0d6c3c074d7061a02aecff98c67d7456ba50b02d0b18896aa6c6b0a530e5cbdf8be6410b1d5343ffa8a70d966955e59805259cb01c20843e5417b2e7294a1867b3956ef98fdab7baa5b49d7c5d5380bf882cf5c034b267a966d8d97e637495d182400b7effa6ca9e331a12d963cdfbc4da2ead662b3904bc4db4c2579a92803d22f463ae54505ba4a493452fc766f53e1504b5710cb5b47084e2550d5781d353ba984626ba514e49c99bd7551829b089dd765cfdb2c1afdc7def773c64670b22d92f1d7d69e62e857d4b28bfdc3e2e303cf8e6827878a6409d1e48f3dfbf7bc6c10cb1d5ce57f643f5bac117057989fefc136d2c8c3fa96b7849eed7dfe411e7f1f12884e550f85c9240a5945a40ab9b6ea62e3c9f57bb1dce02f01f65e03f78e0d63105bf9b0b8baa2b087cf555eaf4f83d4621f1a589c232b2f445b920dc74eb5b1938a3834884751f65caf67a8a5d5817394c47f2647c0893feb28f1131a4b9550c69db0a1da9b823875e6a3493b4036e7f5029384f6be39e6f70e19cb55fe31b45b7bee917492abe6792297cbb35f4c6d7758d2d6f58a0cdabafd6588402019581f3498ececa033d16096d007b36c9fe168241b02bc2b0cf4077d9332537b2448b4e26b9f514bcad43b2983aa6e79304fc538683e890a747d95dacad5d82f8d59a1adb6da294c68f7123f4352310e6201d403037bd7ab6077d6262e6c9ed97e90a1afe3c9348d2088974c13593d290b1c3a902d798322c0dd16596593ff2969771316f886e2e82d58182d63f21453d58a509fc0faa8c0bd1afd571e5ac19d1e10dd02ffa99516ebe528de7f64dcd91170544a4754e535170dde7757b0797b9941e76bcb9928f59083cc53ff377ebf5797217825464b47078c8c83426142faa44699cb37d37f802f124d8d6c724ca758fcb61e833277b60dda580dc41d46edb63b0674044e8051d4e49f90357181c2ef765b6a5a12835a2dcab797e02e20d86d57d06290c4e5edcd3a8b445d4f80f566fbab6772b6642d98ef4de452867c9ebf6a350b3e2288d23ec67a0c4a1eb7297ae4696c08fee37871b9cd8b5c798ddb93c46c7a17e8177169d5c858c13609753f4d6bcdcae1901385944fdebdc587cf1ae2f3d8f215d058d44cdbd93c4897cfb8d19f9aa15d90b3ccbd961325205e241ef2e7351f2439046dce8b55f0bd4a83d3f1d9a0fd96601ab4d96326209ee4fceb99bfaa59cc1d0a4071528381116764dd7d0adde77c760824917a2a57f6c68b2367f31a28dd00eef78e5be1e1f2b0c6cf0766b323d4f6aab0746de09a33c10159eb87ee530b7ac8ac6a89c0b66af2c8604a00869a4b0f0a91c00c91a450bd1613b6140c0c35ae0592a2b05be11b6e56c0625963e686831fd4c548a410b24eb1aac17799f9e6480f131112e4b005e6c90c36c308e134ad95adf9c4e0948a3ed08299180258f49f164ad24f9e930fe52cbcfbe9877dd314246571525c8b14b22ebef32fd76d1b2d5ae7c0bdd2882b3eb71fe01b5b177c2044d66926a6af15772429597e5574cbaaf9abdffdd965572ec125f3f5ebb1f7d0997b43f4b9c28e97c91375a1bd6a322381a24b2676805dc8ef192629ec23ddefdee856cab816813ad0dcf0930363c964a4613cbfde1c6b4a9b167307b414d19ebe09f5e67a3ca38fcfd7ac09665db9eae290d852ed44770dd272ad35ce43384091d58be1e17030e58b0a48b6cb20c3409f8d5d130bc8220f14ae342f3a52587db5921f26f3bc2316139d592e91376507b3322152b4175d5aa7ae60dffbcc709d56e96b1fd701f7f39c0512abc756618581794c8af951164d2e47de047315dc4ecde1016a2fccb3e852848d5e794c63c1e25ef0b5afab0b0a182a695aa28dd149c54a34a50f5804c9fe2255eb5a7ea04e5f0b517570c4663ef20893c6875457431cb2796a5953f333c285926e0cd4c968396e439cb6f0cc04d6167f436b9efa45a815f12ae33c082de2d20cff1c02f336c32ac32f0700ae51f2a27b8b3560f47d3061f750e5fe7b8f688dfea926d94ed50c8d944bd638872663c1b04d07fcbdd39ebcf3ff738c2873f96c31578f9b61438002270e63f3d894c30915259d4796cb643008876a028fae337ba14e581753467444ed0008e56ceae51a030d52652d10b827a001ede8d85fb393364f3206463849c1732bd641f4bf53e705994513656c164185dd2e4a0f2c60e45bea10a8c3e1e16f915d4b4b3a09a8b5ddf14400d08395a7a795c661fabdb5d9a2025389d6e05cd75d1855153eced634e65dcc8e2b35fb59cf310afb0337c18c21951f7cf36e8eee0117fe693820f0be6e19ece0e9edcdaac19f27cba2fbc2c94656b087cc552d69d2c3b20f7bc04cc3ee68169822370c2d506adf1c78d27a4c21d100000bed29105fd1b53c2d3cb55c82ea5a1da9e85150824e0d65d0503ad8626db7391f3e76eae26a80d054188d1f961e7a6c8a3f2bd7cddf25e42ea970b39c188967ac3a2da1f0e6a4d64c2ac5a78255632ab6124f6a2a683dac753cc191246a6a0b4f10a0917a8d4664f6abd160c904936b47d80dd4a2559c062680c99b9dd0b9085305f9735591a6515923db9414953d68257973009685196f614da601e36f28aa0883b5b6f95cac24bba26b16b99dcfc3262dcac8f6341a4d08dbd3e9e0adb32d14adaf48e3c9832048317e9f9095abfbcac04f905831e3b1518ba47d1ce8664fa1cb4cbe60714b32d5ba252b24e8e481d091a0610ee21cb7d979e2a1ae49e6b6e782435da3c12e455b6bdb0e12a825584427a0a37bb824a970efc247cb8fbe2385e35794ec383ed969a767ba1bcd0cb27fc8546814c6a688fe37eb991eb2206ea34e69ef07d4e0d336214cec3fd1797ee5dd9c24f1d5e51f65b5b7c350a92eb100c39fe3b501a1c5d3d8fd71de2b6628dfeecd9490ed1a6fd8ef1703b758a0f4afc8db35e30549759ae989dfc13a184fd4b83602fbc09335ff8d9f7ce36cad90af9abe61019e6b86594668aa0f35d456bac0aa55b8e64484836f35a165eba415fc6fee3ef4cc750f0d5bc2d88225c119992aee34251213924da815da89a13d6fdcac30e1eda47c1ebbf940826e60e836d23772f45327d346ef8a94c72e7872ba622d68fd7a64f75a85afaec8ff7ad712ece3db128fadbc317d1cf7fda3312418c6d215a2ba79215dc960ad3161b870a811538e18341303e0d42b71ae11cb54d907ac31272cc7d521484afada02354a43a6af7bba59e6f159a5b16d6dbd3fd2846c0eedfbf6a712125c1a123aaeabc6d89a51132132c26671160db15fdf9565866756d8affe11be6e88650fad2132c52b33daa0a81508ea771f0b9d26f74ba2c489015a26e89f96df5fc53422d2469664a3ff05e9ca3f4be1c21bd88c15794123665b5125e2fe4b3b3055cffea6f957eced0944909490d39c90d7f75fa93b2e141f939e44c6cc636db5283d2970c60a63e850acc7670613dd6c62fb24f1960bf0b988ee6c50ff4b8fe85ba04d64fd3b98e82cf55f3295b1ff3559988e76b3a8ecbf9b2bbfdb12ce0563fcbb88924f2cefd915626ed39e2a73e86eddc919c70811745e11ef8a8046d89bfa569597f54d246aa70e4009487fae9b2beca923e9eb32c6e90d1e7b882c4cc481bf7f16e29716ac0cb268b31a5182021e62dec96dcf4cbbf1e6ff59709cd0187dc8cc2dec47e54fbbbeed76a59abca673ff2d6042a068799dcaa77df5db20986bf7dcf871c987a225264cfbcdbffc94178884cb01f8962842e3baea6b041eb9bf8cb6b77ba1201133efe212fc6e232a4858875746ed06b4c83f2795dd066d8619b6b99ac28b02cd55959a04590163fa54a520961e57bafea7b1ad65d28c6d24d40c0a5ac5edc5b064dda6539584cffe1efc063909133807d66be92ca7a5be5bf7321ab437cc4216aed051d1efa41cae78d6442ad0be099b09f74f1250bde56d29f04b2a02fddb48e65265165dc6356330c1850d09b0af52d3a588a401a3045d4af3eb24fbfbd815a1fb9dcc38baa969bb7e62b13bfb5de8c2ae6ce1d5771ae2af4fc3963a15e19f490a1b135d5170fc892cd99881c54f9281e2ebb44bc7e207a14d0162ab864618f457248d6e4e81d106d8b41bcaf635968f211cf30ee01b17a651373091d992e73b63157d51dc1b2c6b1f6c4c1d020876eae3eef3d06bf68839f67aba1c7121e15471542f805525792440ae043c871404277b7e399b3861282e7677672c82fab903907cedb1b44e88fc6021849be953210289c0a59ed0b425ce1ca30091f501424c67ff7aff4435955357dc56e24cebd6b5f3961d355c5a44eba2470b3433a75948d05e55262e2948684ee2e235f2b7633653a26462ecaf91047e268249a198dc4733d71e5500d95ef5d8699ecce7bb734061d7af9b3e1da5254410b1dd2ad4734a30820b0c496088bf79698a9e4b893fb138949b5936ec6a531fc3cfe5a630f7a0c1ec3333fa620df34a70ea4edd4c2f2613d3acbabb13029085ef97b3e0a24248f8d4364590e23a79841ba400de9583ce3bbd851922f599f4384c59940252c435d759938d8d1269876756bd5a85ebbeabfcee490aa0ee907001381fcec3293a2a73774cf997cd78b1b341795fc3aa3c9cbe7be7f1cf6d0e15b3189d25bcfb8711e49cbd13c1fafc7d5573eaed98aac98173fddd806dca4f4b0df19ee1e519406c4ff7f01f9856aeea0c396562ef314e0bf63631e29452fd5473a8a7cffba31c40dda637e832ebcd8d0bb8309581a96f47315f7fc3145cd190108ca16b0ffd6a449232c654b7ec967c6a6ee070e7c6de6a9a43d2c8f2b68a790ba46b8879947092164ff1628f991c2cd82ccc8094f8049c2966edd73858ac01df6e6be626f2ee2bc3e00c666325ce80f3372a9210c964f1b5d9aaae5f72928a3c1b55b9e17ddf8de94f1bd68a1e7ec5ced0ce1ee395d3a6208ca55a7094b3b789ca0143a19de015d0895d988b71f469251c02160459b85c4667852c15af74cae8e3d353f1abe6a0b13bcdc30cfbd92d82ff35a02e33e56bffd86d280a4a34f2f80f905b0e79ff3bd5a27d32a5e6ef8ff9122e25f6e941bcea89932980c08525627365e75ca835de87e3e8e5311d4f5e76f74491231da6a6008344089d57b9ea310b492596c3f5d747ab5fc3f8a9b0286c666fed57e5b35ddbaf6822aefcd739c375a21417410fafc9f06a01f23a1ed95beeda5d40ddcbc3357ab1de12209e9a535a756d197140377347bbeeb0974d856b7e3b52a29a334f02737c4a83094a1291a515556784149573c0e6f30fe8320bf3c7b9a143202e182284a851c3f5719d889db6744fda35959354c0a0bd7e88fd277418de90d0c4f3e97c4418ab8e027a58bcd0e3b846a1b0307dac150f4f28f9e68ce4b1e87579215e3655efb8a5f0117adb9438f2f368bdc59365fa3a73d29c49b56a1547cc25fb2a1fad1d203657f0c819e0f14e3114b53336832af6f9723867dbd229929844f35a6ed5b7533f320277141c008cab2e8a43bd9606029ad40f5e1bf9e1cf604468d4242ccc8e48f5be1a0a47550798520255cb", 0x1000}, {&(0x7f0000001780)="5de7e37228d79245654c05e5fbd2fe53f08f918103bed5015c1da96a6d63e3c9dfaeaa5383f0f71788b87197f30bd04b81275e120ce94b500ddfc582c8c734361986b4807115fc1c45efaed94689d8a99a613eaf5e4f3336b3b3446714e738ebe02249ca551d4b6d53775ffb802bf9f86a7f676c935a3fd1", 0x78}, {&(0x7f0000001800)="d4f5e3a83d7a0ef5b1824fe0ac1d37578adb2c0c88a1d965143b46c52fc8036270790de00d376bbee248fa77cdc699894a6beed68fed2a5c664af80bb327e2f58587b8398f149f7d0dca2fe54b078d5a1db86398da6ac35a1c3a2ec4d47839f62f2732e2b32c6db502adb54b3472172e62b0e6a051378ccd1fee77075bce9c1a0b5157d1b37dd7", 0x87}, {&(0x7f00000018c0)="303d3e48543c8ce8f44fc1fd824957d710333a7b44d4e9cde0031ba24e0688c694e2f2a7021e2caf75003b83cadfb69ca987ba0c5f001cf6b7047afbaa93c482fa4131046bbb75ea", 0x48}], 0x8}}], 0x1, 0x48000) sendmsg$nl_generic(r3, 0x0, 0x0) syz_genetlink_get_family_id$nl80211(0x0, r3) socket$nl_generic(0x10, 0x3, 0x10) socket$inet_mptcp(0x2, 0x1, 0x106) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000003c0)={0xffffffffffffffff, 0xe0, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x44, 0x8, 0x0, 0x0}}, 0x10) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) 2m58.149045288s ago: executing program 2 (id=11300): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r0, 0x84, 0x81, &(0x7f00000002c0)="1a00000002000000", 0x8) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000000080), 0x1) sendto$inet6(r0, &(0x7f0000000040)='l', 0x1, 0xc000, 0x0, 0x0) 2m58.043199706s ago: executing program 2 (id=11301): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)) unshare(0x400) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000340)=@base={0x6, 0x4, 0x4, 0x6, 0x0, 0x1}, 0x50) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000300)={r0, 0xfffffffffffffddf, &(0x7f0000000140)}, 0x10) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000100), 0x6ad01, 0x0) writev(r1, &(0x7f0000000240)=[{&(0x7f0000000b00)="130000000102039839", 0x9}, {0x0}], 0x2) socket$nl_generic(0x10, 0x3, 0x10) socket$inet_tcp(0x2, 0x1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0xe, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="850000002e0000002e000000000000005c000000000000009500000000000000"], &(0x7f0000000040)='syzkaller\x00', 0x4, 0x99, 0xffffffffffffffff, 0x0, 0x0, '\x00', 0x0, @sk_skb=0xffffff7f, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0xfffffffffffffed8, 0x0, 0xffffffffffffffff, 0xfe8e}, 0x3f) bpf$MAP_CREATE(0x1900000000000000, &(0x7f0000000380)=ANY=[@ANYBLOB="1b00000000000000040000000020000000000000", @ANYRES32, @ANYBLOB="fcffffff00"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000ee54bd7afaec173fe11791923e86000000421f28abcb4d221a00000000"], 0x50) socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000040)={@private0={0xfc, 0x0, '\x00', 0x1}, 0x3, 0x1, 0x0, 0x0, 0xbc, 0x5}, 0x20) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl(r2, 0x8b32, &(0x7f0000000040)) getsockopt(0xffffffffffffffff, 0x77821c35, 0x271a, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x10, &(0x7f0000000bc0)=ANY=[@ANYBLOB="1808000000000000000000000000000018120000", @ANYRES32, @ANYBLOB="0000000000000000b703000000000000850000000c000000b7000000000000001801000000082c2500000000002120207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000700000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 2m57.849265515s ago: executing program 2 (id=11303): r0 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_ERR_FILTER(r0, 0x65, 0x7, &(0x7f0000000100)=0x6, 0x4) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'hsr0\x00', 0x0}) sendmsg$can_raw(r0, &(0x7f00000004c0)={&(0x7f0000000a00)={0x1d, r1}, 0x10, &(0x7f0000000080)={&(0x7f0000000340)=@can={{0x0, 0x0, 0x0, 0x1}, 0x82, 0x1, 0x4, 0x0, "06400000008000"}, 0x10}, 0x1, 0x0, 0x0, 0x4081991}, 0x4004080) 2m57.653959155s ago: executing program 2 (id=11304): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000440)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0xae0, 0x6361, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000010c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd28, 0x25dfdc01, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xb}, {0x4, 0xffe0}}, [@qdisc_kind_options=@q_skbprio={{0xc}, {0x8, 0x2, 0xdd}}]}, 0x38}, 0x1, 0x0, 0x0, 0x240408a0}, 0x4890) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc(&(0x7f0000000380), r4) sendmsg$TIPC_CMD_ENABLE_BEARER(r4, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x44081}, 0x0) 2m57.191033903s ago: executing program 2 (id=11307): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) close(r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) ioctl$SIOCSIFHWADDR(r0, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x1c1842, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f00000022c0)=ANY=[@ANYBLOB="bf16000000000000b70700000100f0ef5070000000000000480000000820000095000000000000002ba7e1d30c04aa8b3382022ce2a1d97411a0f6b599e83f24a3aa81d36bb7019c13bd23212fb56f040026fbfefc4a056bdc17487902317142fac7e7be168c1869d0d4d94f2f4eb45c652fbc1626cca2a28d67893547db51ee988e6e06c8cedf7ceb9fc40400ae5e4aa74c92c6a51cbf9b0a4def23d410f6accd3641130bfc4e90a6341865c3f5ab3e89cf6c662ed4148d3b3e22278d00031e5388ee5c867de2c6211d6ececb0c18ce7400dae15cb7947c491b8bea3fd2f73902ebcfcf4982277d9800011b405bbf7b02433a9bcd715f5888b2007f000000001c000000010000000000000600000000309329170ee5b567e70f000006a10f58fa64533500000000000000000000000031000000000000001208e75a89faffbfb11b7dc6ea31001e846c12423a169f87463ad6f7c2e8ee1a39244960b318778f2a047f6d5bc24fef5d7d617de7a6520655a80d0900f4d433623c850af895abba14f6fbd7fbad1f98e26ad4deaf1a4f294b2a431ab9142f3a06d54740a4bc5e3abd378af7c9676a08e774c48785f895b4ec8d1141d5e8744d7f09ab4df6027bf48cabecead649f96ea24d32872c494160cb7f33ce680eeb80157eb23f9902519ac655fa73103170cbc496d7122034b85e7e87a2db762cbb253fbd76b9117c1a11d18aa2040c5f0c289906000000000000005ffe94ff799a29459aff1374df5c49ca11d9b219c00c369a12bf8685b862d0dbdd956cbda1bae489bcef5ae59136aaadc59609f4d42617c0e6066938b521a0f2e2467a6c435ad5b800262a5da053ced5e95394e500000072737638ac44fb61310e2df511c60b3c88113996a81fb64bce5eb95ce91738640ff7ae6ed6b62086e699955926934389cdf9bcffff3ffd86fe9ce05268bf8a3958f2206cdc7095682c14f10be1075832956762b2dcc6251e7b74cb1da627e332765511c58215bf84d263e8778e6e8ffe4ea50b076446f35efffc006b340658342d2d9e06008c6ef3e98407d2fcefb34a0000000000000000895ddbb76122b1222e4da37177fe833e4fcaa67997e9dffd8918de33aed5bb09cb2a206ebd085bd9f90008d3fdd528efe6c1dca17f45ba5e8bd311a40030f9ffce75ffff996a80153a0077bb43f8a63dd390d18f0239b41da1a52383a4c6768ca1bb66b8fb3c5000f6f246fd20356a60769b461b6cdf133de073b1df08ae09268b0073bb97d88d741a5546e76caf4b6b1387ff37ec13d262dae0260be74cdf7bb6d3107597430ef5bbd476bb9d69b2aef9f3cb644b4bf01ccf16d40720939daf422b7473c24b93085c51e02af469bdfb361b9c015dd026fd0fffe3c66f5c343afb78a7cfd852f3e05c089887d7df2ff4f9982030019421af6b78ff9c444a17091875cfe4eab0e7f50eb69c860b1613a6b4f5af04f9c635d8d646c89f8b85f820ce7464c731deba39f9ff7b815f7b0acba754c01ed8bf1bba0010a8c6a2b966d861f9dd547abf2e9b23e5607f00bb02000000000000c84799aa792cdaeb607ba513250e13ae696cd6ed7d318190a93b9ee07927efca6b8d1f5980994690bbe002db5146439d906a0d4aef065214b15666cdca81091b69acee127ce0821fc19e0891f0b53469f935c5ac420100010000000000fb53faf4420638489e6a1c696d8c414a87b60000000000080000b6be1557951854c01dbc2d061827ae6349a045b780893771524a424335b9fc34616ee9f09141057262530b7c2f7c9b969938779736ece7b470078ac0b1b4b528000000009866e9994ca9096672ec9f3800c2fc35ba6516e542624c47bdba76a816c3a3dd6c3fa87a3ec91df199a9af91a7babf2b8d0e7b77e6dfb4bbc9817847b705000000a1000000000000ab8353f3800f045b90b0eaab6d731199c9447eabbc8c740183aff5389742e47de5000000826a570d14310700cf2ae3366ebdb7f1000000000000333c00e6addbf4c71ffad6bfb5babb49109f92a5a52042c435c98ce7616355493d280f2d0be99e18fd0900c769e7eb4edc1c03a33676590bd2047229e0237c1e34641848531712ff09e89fb062a3e66f4fceea0691f0b4e0b33194404e643243c3841e1e7fe301f7f47a7f89512d92e83624e3de705bdfbfe089e381398e9d5428a00cc8a6d097d97e6ac8bd09b1a5577920a650114a522c1e2dcdc4f606fcbcee91770a9fada34d38cd7976a9228a0a0dd8661be8162e966aac26bea4c11458cd6ce22ddf7054cdd0a60ef3ec000000000000000000425cb75dc7ec92e9a5d29f9c99697d2a98ae0a9f35e4196c3faeb7a60a0290bf897846f6f0f1c163d6075119169d55d10da9ad0e4b2c636d200000009baaf94e2b2c48e70d8453f832eecfb1de2a3f38a5c986de9e37737dac74db251d5e9ea2b8ed39e91a7a17d01b49f7aaff7c4c73c3484bdcab362838ed940035b239a3646ef55b9f070ae14466b3acef9f8b28fb938a237e2e068ae4a6bce4407b54cc14614c2cdf877f000000000000000000000000bdcf23144e6c16b9235552aed83b6428f34d88c258a9ad16386bba51b60838fb11bc193a206b5a25b7233b222e4e68e0d1e88f26b9a45b6c29469530a37ea92aaf421cf594ecfaff9a79b56f8b38038002d29b3193cea9cd0a0ef4f5bce1cdaa99705a8fa48f61071f548d411353965615c24c1860790dfae0f4cdf8c8f8645a289a79f9b919b674f0325d81eacaa8399324a304885da01733bb7917ec5e52718eb05f9c1ffd69f834150e9100c215968e8fb31c83526e6f66897569e28d01ca6135a2acca398c1415e0f9b58b63ee9dc33608ba7e5c4bdf3f37d8e4f4f424be263d9c2a5204f41e9b0ee01ad4cc0519395b69c310c98d3c8edc7d07b30617f3535634257f5472d9f3263a6f04778a920c12000721bb82f9884780ac294b8bb07ebf6e3f16584e95607e319b2ea9776f89c19fb775514246159bbfa9dc0fdf711d3efa316a3323c915a40e6d7c8f8d7daf98824fd0bc955dc9731cc8c7a600d94b8049af764688c7ffdd26a741b03b065ba9c586914d8beb94c8a265ace34172ed003357ddd400557230b2caba26bb91d7b1b98f11fb7a77b03206c151b00015305af815f7da19872085b503a21cbe722842c26ad8dd6b83018300000000000000000000f4ffffffffffffff000000000000000000000000000000000000798d011c62dbfdbad9e58e07d371e3a2399f2369631138ad4fb3aeb3f51233922b4c700fb163efbc55c912276685a774f2dce9bb9c54fd1f505eccf06323fad86c37adafb5e80b96ba9f925a6fd57de5fedf691e8b41c9835a840d12a224ed233c93ed92603401e5a61298294e9cab078c231121d4e32fb8286478fb12f5804d13c7bcff5dcffccd1d520dc04910239efc397b7736682e1c0ef0d001c17ec1441026ed4b1395b8e88a58d667a65cec1ddee1b30bcc96652a238c990a2701e2ee0915335fa4b8c33372bd00021f17c012451519ad56594c9469f164bb915edb1fd4ce76fb37bb9512632e9c9e7dcc772128c280c6e6cc0e859bd65c666e8b7732a2c2d517af56f4cde502f364922f3c2bbf9f4ced5c6f3d33428775b7399e6c6cf52bc8d5b48079700db251c7cdad3836c1e137b11917cff00e0ecc5e93fd7e8bdd83313a27197651c92f2f9be4a6f83662fa948c46632a979e8c66d22777a06601c5f5d3ab28b9f9e39543d2bb9de6ce57a6c1c3a635a0515c87abd11988cae405b9495f54b8d89503a8c9e96bdf08eb563e4cffe00e27272ca6e392ffca16b172ce8b6ee542ec9135e969b7b029beaeba12836110fcb686d82c066d0fc67fee8a00acda99a302a7aac9e920e34174323e7c6aeefd0a092545274fb164f21ac2f46849a6d0b51ad5a230a5ffab7a66e7dde5a335aeaa9736678319f344a32c99ac748bf200368963de24c237873ff5a01f14335de9a6d06c8b49ff27ddf0f13d5fe0901355765c397ce52791339d666eec141f0d33ca51f7b8"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) ioctl$TUNSETSTEERINGEBPF(r1, 0x800454e0, &(0x7f0000000180)=r3) ioctl$TUNSETDEBUG(r1, 0x400454c9, &(0x7f00000001c0)=0x7) write$cgroup_devices(r2, &(0x7f00000000c0)=ANY=[@ANYBLOB="1e0306003c5c980128846360864666702c1ffe800000000000"], 0xffdd) 2m42.067599711s ago: executing program 32 (id=11307): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) close(r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) ioctl$SIOCSIFHWADDR(r0, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x1c1842, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f00000022c0)=ANY=[@ANYBLOB="bf16000000000000b70700000100f0ef5070000000000000480000000820000095000000000000002ba7e1d30c04aa8b3382022ce2a1d97411a0f6b599e83f24a3aa81d36bb7019c13bd23212fb56f040026fbfefc4a056bdc17487902317142fac7e7be168c1869d0d4d94f2f4eb45c652fbc1626cca2a28d67893547db51ee988e6e06c8cedf7ceb9fc40400ae5e4aa74c92c6a51cbf9b0a4def23d410f6accd3641130bfc4e90a6341865c3f5ab3e89cf6c662ed4148d3b3e22278d00031e5388ee5c867de2c6211d6ececb0c18ce7400dae15cb7947c491b8bea3fd2f73902ebcfcf4982277d9800011b405bbf7b02433a9bcd715f5888b2007f000000001c000000010000000000000600000000309329170ee5b567e70f000006a10f58fa64533500000000000000000000000031000000000000001208e75a89faffbfb11b7dc6ea31001e846c12423a169f87463ad6f7c2e8ee1a39244960b318778f2a047f6d5bc24fef5d7d617de7a6520655a80d0900f4d433623c850af895abba14f6fbd7fbad1f98e26ad4deaf1a4f294b2a431ab9142f3a06d54740a4bc5e3abd378af7c9676a08e774c48785f895b4ec8d1141d5e8744d7f09ab4df6027bf48cabecead649f96ea24d32872c494160cb7f33ce680eeb80157eb23f9902519ac655fa73103170cbc496d7122034b85e7e87a2db762cbb253fbd76b9117c1a11d18aa2040c5f0c289906000000000000005ffe94ff799a29459aff1374df5c49ca11d9b219c00c369a12bf8685b862d0dbdd956cbda1bae489bcef5ae59136aaadc59609f4d42617c0e6066938b521a0f2e2467a6c435ad5b800262a5da053ced5e95394e500000072737638ac44fb61310e2df511c60b3c88113996a81fb64bce5eb95ce91738640ff7ae6ed6b62086e699955926934389cdf9bcffff3ffd86fe9ce05268bf8a3958f2206cdc7095682c14f10be1075832956762b2dcc6251e7b74cb1da627e332765511c58215bf84d263e8778e6e8ffe4ea50b076446f35efffc006b340658342d2d9e06008c6ef3e98407d2fcefb34a0000000000000000895ddbb76122b1222e4da37177fe833e4fcaa67997e9dffd8918de33aed5bb09cb2a206ebd085bd9f90008d3fdd528efe6c1dca17f45ba5e8bd311a40030f9ffce75ffff996a80153a0077bb43f8a63dd390d18f0239b41da1a52383a4c6768ca1bb66b8fb3c5000f6f246fd20356a60769b461b6cdf133de073b1df08ae09268b0073bb97d88d741a5546e76caf4b6b1387ff37ec13d262dae0260be74cdf7bb6d3107597430ef5bbd476bb9d69b2aef9f3cb644b4bf01ccf16d40720939daf422b7473c24b93085c51e02af469bdfb361b9c015dd026fd0fffe3c66f5c343afb78a7cfd852f3e05c089887d7df2ff4f9982030019421af6b78ff9c444a17091875cfe4eab0e7f50eb69c860b1613a6b4f5af04f9c635d8d646c89f8b85f820ce7464c731deba39f9ff7b815f7b0acba754c01ed8bf1bba0010a8c6a2b966d861f9dd547abf2e9b23e5607f00bb02000000000000c84799aa792cdaeb607ba513250e13ae696cd6ed7d318190a93b9ee07927efca6b8d1f5980994690bbe002db5146439d906a0d4aef065214b15666cdca81091b69acee127ce0821fc19e0891f0b53469f935c5ac420100010000000000fb53faf4420638489e6a1c696d8c414a87b60000000000080000b6be1557951854c01dbc2d061827ae6349a045b780893771524a424335b9fc34616ee9f09141057262530b7c2f7c9b969938779736ece7b470078ac0b1b4b528000000009866e9994ca9096672ec9f3800c2fc35ba6516e542624c47bdba76a816c3a3dd6c3fa87a3ec91df199a9af91a7babf2b8d0e7b77e6dfb4bbc9817847b705000000a1000000000000ab8353f3800f045b90b0eaab6d731199c9447eabbc8c740183aff5389742e47de5000000826a570d14310700cf2ae3366ebdb7f1000000000000333c00e6addbf4c71ffad6bfb5babb49109f92a5a52042c435c98ce7616355493d280f2d0be99e18fd0900c769e7eb4edc1c03a33676590bd2047229e0237c1e34641848531712ff09e89fb062a3e66f4fceea0691f0b4e0b33194404e643243c3841e1e7fe301f7f47a7f89512d92e83624e3de705bdfbfe089e381398e9d5428a00cc8a6d097d97e6ac8bd09b1a5577920a650114a522c1e2dcdc4f606fcbcee91770a9fada34d38cd7976a9228a0a0dd8661be8162e966aac26bea4c11458cd6ce22ddf7054cdd0a60ef3ec000000000000000000425cb75dc7ec92e9a5d29f9c99697d2a98ae0a9f35e4196c3faeb7a60a0290bf897846f6f0f1c163d6075119169d55d10da9ad0e4b2c636d200000009baaf94e2b2c48e70d8453f832eecfb1de2a3f38a5c986de9e37737dac74db251d5e9ea2b8ed39e91a7a17d01b49f7aaff7c4c73c3484bdcab362838ed940035b239a3646ef55b9f070ae14466b3acef9f8b28fb938a237e2e068ae4a6bce4407b54cc14614c2cdf877f000000000000000000000000bdcf23144e6c16b9235552aed83b6428f34d88c258a9ad16386bba51b60838fb11bc193a206b5a25b7233b222e4e68e0d1e88f26b9a45b6c29469530a37ea92aaf421cf594ecfaff9a79b56f8b38038002d29b3193cea9cd0a0ef4f5bce1cdaa99705a8fa48f61071f548d411353965615c24c1860790dfae0f4cdf8c8f8645a289a79f9b919b674f0325d81eacaa8399324a304885da01733bb7917ec5e52718eb05f9c1ffd69f834150e9100c215968e8fb31c83526e6f66897569e28d01ca6135a2acca398c1415e0f9b58b63ee9dc33608ba7e5c4bdf3f37d8e4f4f424be263d9c2a5204f41e9b0ee01ad4cc0519395b69c310c98d3c8edc7d07b30617f3535634257f5472d9f3263a6f04778a920c12000721bb82f9884780ac294b8bb07ebf6e3f16584e95607e319b2ea9776f89c19fb775514246159bbfa9dc0fdf711d3efa316a3323c915a40e6d7c8f8d7daf98824fd0bc955dc9731cc8c7a600d94b8049af764688c7ffdd26a741b03b065ba9c586914d8beb94c8a265ace34172ed003357ddd400557230b2caba26bb91d7b1b98f11fb7a77b03206c151b00015305af815f7da19872085b503a21cbe722842c26ad8dd6b83018300000000000000000000f4ffffffffffffff000000000000000000000000000000000000798d011c62dbfdbad9e58e07d371e3a2399f2369631138ad4fb3aeb3f51233922b4c700fb163efbc55c912276685a774f2dce9bb9c54fd1f505eccf06323fad86c37adafb5e80b96ba9f925a6fd57de5fedf691e8b41c9835a840d12a224ed233c93ed92603401e5a61298294e9cab078c231121d4e32fb8286478fb12f5804d13c7bcff5dcffccd1d520dc04910239efc397b7736682e1c0ef0d001c17ec1441026ed4b1395b8e88a58d667a65cec1ddee1b30bcc96652a238c990a2701e2ee0915335fa4b8c33372bd00021f17c012451519ad56594c9469f164bb915edb1fd4ce76fb37bb9512632e9c9e7dcc772128c280c6e6cc0e859bd65c666e8b7732a2c2d517af56f4cde502f364922f3c2bbf9f4ced5c6f3d33428775b7399e6c6cf52bc8d5b48079700db251c7cdad3836c1e137b11917cff00e0ecc5e93fd7e8bdd83313a27197651c92f2f9be4a6f83662fa948c46632a979e8c66d22777a06601c5f5d3ab28b9f9e39543d2bb9de6ce57a6c1c3a635a0515c87abd11988cae405b9495f54b8d89503a8c9e96bdf08eb563e4cffe00e27272ca6e392ffca16b172ce8b6ee542ec9135e969b7b029beaeba12836110fcb686d82c066d0fc67fee8a00acda99a302a7aac9e920e34174323e7c6aeefd0a092545274fb164f21ac2f46849a6d0b51ad5a230a5ffab7a66e7dde5a335aeaa9736678319f344a32c99ac748bf200368963de24c237873ff5a01f14335de9a6d06c8b49ff27ddf0f13d5fe0901355765c397ce52791339d666eec141f0d33ca51f7b8"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) ioctl$TUNSETSTEERINGEBPF(r1, 0x800454e0, &(0x7f0000000180)=r3) ioctl$TUNSETDEBUG(r1, 0x400454c9, &(0x7f00000001c0)=0x7) write$cgroup_devices(r2, &(0x7f00000000c0)=ANY=[@ANYBLOB="1e0306003c5c980128846360864666702c1ffe800000000000"], 0xffdd) 4.082661231s ago: executing program 3 (id=12434): bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000840)={0x6, 0x3, 0x0, 0x0, 0x5, 0x0, 0x0, 0x60ff78ce1cb3c070}, 0x94) bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001800)=ANY=[@ANYBLOB="180000002500010324bd7002ffdbdf25010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x4008}, 0x0) recvmmsg(r0, &(0x7f0000000d80)=[{{0x0, 0x0, 0x0}, 0xac}, {{0x0, 0x0, 0x0}, 0x8}, {{0x0, 0x0, &(0x7f0000001840)=[{&(0x7f0000000480)=""/77, 0x4d}, {&(0x7f0000001880)=""/4112, 0x1010}, {&(0x7f0000001680)=""/100, 0x64}, {&(0x7f0000001740)=""/72, 0x48}, {&(0x7f00000005c0)=""/48, 0x30}], 0x5}, 0xfffffffe}, {{0x0, 0x0, 0x0}, 0x8000d3a7}, {{0x0, 0x0, 0x0}, 0x7}, {{0x0, 0x0, 0x0}, 0x5}, {{0x0, 0x0, 0x0}, 0xef23fe83}, {{0x0, 0x0, 0x0}, 0x10003}, {{0x0, 0x0, 0x0}, 0xd9f}], 0x9, 0x2030, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000100)={'gre0\x00', &(0x7f0000000680)={'ip_vti0\x00', 0x0, 0x1, 0x20, 0x5, 0x2, {{0x21, 0x4, 0x0, 0x9, 0x84, 0x64, 0x0, 0x2, 0x29, 0x0, @private=0xa010101, @empty, {[@timestamp_addr={0x44, 0x3c, 0xe, 0x1, 0xf, [{@multicast2, 0x2fd0}, {@remote, 0x10001}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x2}, {@dev={0xac, 0x14, 0x14, 0x13}, 0x4}, {@local, 0x5}, {@multicast1, 0xc000}, {@local, 0x2}]}, @generic={0x82, 0x12, "5c6c342a88a48bc88a58b5bcdae249e2"}, @rr={0x7, 0xb, 0x64, [@multicast1, @multicast1]}, @lsrr={0x83, 0x17, 0x48, [@initdev={0xac, 0x1e, 0x1, 0x0}, @rand_addr=0x64010102, @rand_addr=0x64010100, @broadcast, @dev={0xac, 0x14, 0x14, 0x28}]}]}}}}}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x2) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r2) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffff11feffffff000000", @ANYRES32=r3, @ANYBLOB="01"], 0x3c}}, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r6, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r7, @ANYBLOB="01000000020000001c0012000c000100626f6e64000000000c0002000800010005"], 0x3c}}, 0x0) sendmsg$nl_route(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000540)=ANY=[@ANYBLOB="6c00000010001fff109e00008000000000000000", @ANYRES32=0x0, @ANYBLOB="00000000003f0000440012800b00010067656e6576650000340002800500030003000000060005004e20000005000400ab000000050009000100000005000a0001000000050009000100000008000a00", @ANYRES32=r7], 0x6c}, 0x1, 0x0, 0x0, 0x1}, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000000)={'ipvlan0\x00', 0x0}) sendmsg$nl_route(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000600)=ANY=[@ANYBLOB="3c0000001000030500"/20, @ANYRES32=0x0, @ANYBLOB="0000000000400000140012800c0001006d6163766c616e000400028008000500", @ANYRES32=r10, @ANYBLOB="ed1a30b801a22b40a1ff19b2482c56ae9b075866afd103"], 0x3c}, 0x1, 0x0, 0x0, 0x20000080}, 0x20000090) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000240)={'erspan0\x00', &(0x7f00000001c0)={'erspan0\x00', 0x0, 0x7800, 0x7800, 0xb, 0x7fffffff, {{0x15, 0x4, 0x3, 0x39, 0x54, 0x65, 0x0, 0x0, 0x4, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local, {[@timestamp_addr={0x44, 0x3c, 0x31, 0x1, 0x6, [{@rand_addr=0x64010101, 0x6}, {@local}, {@multicast2, 0x9}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0xb}, {@rand_addr=0x64010100, 0xd}, {@private=0xa010100, 0x7}, {@loopback}]}, @ra={0x94, 0x4, 0x1}]}}}}}) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000280)) r11 = socket(0x400000000010, 0x80000, 0x0) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r11, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r12, {0x0, 0xfff3}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x4c840) sendmsg$nl_route_sched(r11, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000200)=@newtfilter={0x30, 0x2c, 0x800, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r12, {0x1, 0xfff3}, {0x0, 0xfff3}, {0xb, 0x10}}, [@filter_kind_options=@f_bpf={{0x8}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x20041090}, 0x24004008) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f00000002c0)={0x0, @rand_addr, @remote}, &(0x7f0000000300)=0xc) 3.829474858s ago: executing program 0 (id=12439): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_UPDATE_OWE_INFO(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x2c, r0, 0x300, 0x70bd2d, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x1000, 0x21}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}]}, 0x2c}, 0x1, 0x0, 0x0, 0x800}, 0x4000) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket(0x400000000010, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0x1}, {0xffff, 0xffff}, {0x0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x1, 0x8}}}]}, 0x38}}, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x1c1341, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r6 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000a40)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff5653f, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, r7, {0x0, 0x9}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x81}, 0x4000800) sendmsg$nl_route_sched(r6, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000007c0)=@newtfilter={0x44, 0x2c, 0xd3f, 0x70bd29, 0x25dfdbfb, {0x0, 0x0, 0x0, r7, {0xe, 0x9}, {0x0, 0x9}, {0xf, 0x9}}, [@filter_kind_options=@f_flower={{0xb}, {0x14, 0x2, [@TCA_FLOWER_KEY_ENC_UDP_SRC_PORT={0x6}, @TCA_FLOWER_KEY_ENC_UDP_SRC_PORT_MASK={0x6}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x1}, 0x20040054) sendmsg$nl_route_sched(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000740)=@newtfilter={0x50, 0x2c, 0xd27, 0x30bd29, 0x25dfdbff, {0x0, 0x0, 0x0, r4, {0x0, 0x9}, {}, {0x10, 0x10}}, [@filter_kind_options=@f_flow={{0x9}, {0x20, 0x2, [@TCA_FLOW_EMATCHES={0x1c, 0xb, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0xff}}, @TCA_EMATCH_TREE_LIST={0x10, 0x2, 0x0, 0x1, [@TCF_EM_CONTAINER={0xc, 0x1, 0x0, 0x0, {{0xe6a7}}}]}]}]}}]}, 0x50}, 0x1, 0x0, 0x0, 0x20048084}, 0x2008c010) 3.6953523s ago: executing program 3 (id=12440): r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r0, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000000040)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x0, 0x0, 0xffffffff}, 0x1c) ioctl$sock_SIOCGIFVLAN_SET_VLAN_EGRESS_PRIORITY_CMD(r0, 0x8982, &(0x7f00000000c0)={0x3, 'veth0_to_bridge\x00', {0x3}, 0x8001}) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r1, &(0x7f0000000080)='X', 0x1, 0x0, &(0x7f0000000140)={0xa, 0x0, 0x0, @private0}, 0x1c) shutdown(r1, 0x1) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r1, 0x84, 0x18, &(0x7f0000000180)={0x0, 0x8}, &(0x7f00000001c0)=0x8) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket$packet(0x11, 0x3, 0x300) socket$nl_generic(0x10, 0x3, 0x10) r3 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r3, 0x10e, 0xc, &(0x7f0000000040)={0x802, 0x0, 0x0, 0x7}, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="200000005200010003000000000000000a0000000c00", @ANYRES32=r3], 0x20}}, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r4) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r5 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x50) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000000)={{r5, 0xffffffffffffffff}, &(0x7f00000001c0), &(0x7f0000000280)='%+9llu \x00'}, 0x7f) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000480)={r6, r5}, 0x4) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x16, 0x10, &(0x7f00000000c0)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000341218007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000000000018230000", @ANYRES32=r5, @ANYBLOB="0000000000000000b70500000800000085000000a500000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r7, 0x0, 0xe, 0x5, &(0x7f0000000040)="f4b84de4115d64244a0e839e8971", 0x0, 0x401, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0xfffffffe}, 0x50) r8 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendto$packet(0xffffffffffffffff, &(0x7f0000000240)="800000800000210ee7decd7a000340", 0xf, 0x40, &(0x7f00000001c0)={0x11, 0x8100, r9, 0x1, 0xd8, 0x6, @broadcast}, 0x14) socket$nl_netfilter(0x10, 0x3, 0xc) 3.643316331s ago: executing program 0 (id=12441): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000480)={'wlan0\x00', 0x0}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000004c0)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000000000000000003700000008000300", @ANYRES32=r1], 0x2c}}, 0x0) sendmsg$NL80211_CMD_DEL_PMK(r0, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x4c, r2, 0x800, 0x70bd29, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r1}, @val={0xc, 0x99, {0x3, 0x32}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) 3.543674619s ago: executing program 0 (id=12443): sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x10) r0 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000a80)=@mangle={'mangle\x00', 0x44, 0x6, 0x478, 0x2e8, 0xc0, 0xc0, 0x228, 0x2e8, 0x3e0, 0x3e0, 0x3e0, 0x3e0, 0x3e0, 0x6, 0x0, {[{{@uncond, 0x0, 0x98, 0xc0, 0x0, {}, [@inet=@rpfilter={{0x28}, {0x1}}]}, @ECN={0x28, 'ECN\x00', 0x0, {0x30, 0xff, 0x2}}}, {{@ip={@private=0xa010101, @multicast2, 0x0, 0xffffff00, 'vcan0\x00', 'veth0_virt_wifi\x00', {}, {0xff}, 0x11}, 0x0, 0x70, 0x98}, @unspec=@CHECKSUM={0x28}}, {{@ip={@private=0xa010100, @empty, 0x5607d1016e8ee1dd, 0xffffff00, 'wlan0\x00', 'syz_tun\x00', {}, {}, 0xff, 0x0, 0x1a}, 0x0, 0x70, 0xd0}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x3, [0x2, 0x6, 0x7, 0x6, 0x2, 0x1], 0x6, 0x5}, {0x1, [0x3, 0x4, 0x3, 0x4, 0x7], 0x4, 0x6}}}}, {{@uncond, 0x0, 0x98, 0xc0, 0x0, {}, [@common=@ttl={{0x28}, {0x1, 0x9}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xc8, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}, {0x8}}, @common=@addrtype={{0x30}, {0x0, 0xe48, 0x1, 0x1}}]}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x3, 0x400, @remote, 0x4e24}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x4d8) r1 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000040)={'bridge0\x00', &(0x7f0000000100)=@ethtool_coalesce={0x8, 0x0, 0x1000, 0x0, 0x400000, 0x7ff, 0x40004, 0xc0000000, 0x402, 0x9, 0x4, 0x5, 0x3, 0x4006, 0x84, 0xfffffffc, 0x0, 0x37e9, 0x80000004, 0x1, 0x5, 0x424f, 0x3}}) r2 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="3c00000013000100000000000000000007000001", @ANYRES32=r3, @ANYBLOB="00000000000000001c001a801800048014000480"], 0x3c}, 0x1, 0x0, 0x0, 0x4080}, 0x4004000) connect$bt_l2cap(0xffffffffffffffff, 0x0, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) recvmmsg(r5, &(0x7f0000004200)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f00000004c0)=""/4095, 0xfff}, {&(0x7f0000000340)=""/245, 0xf5}], 0x2}}], 0x1, 0x2000, 0x0) sendmsg$ETHTOOL_MSG_CHANNELS_SET(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="14000000", @ANYBLOB="01002d"], 0x14}, 0x1, 0x0, 0x0, 0x20000040}, 0x810) sendmsg$nl_generic(r5, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000002b40)=ANY=[@ANYBLOB="200000001000010700000000000000000a0000000c0002006e6c3830323131"], 0x20}}, 0x4000084) socket$unix(0x1, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x20004015) sendmsg$can_bcm(0xffffffffffffffff, 0x0, 0x20048841) close(0xffffffffffffffff) 3.334122729s ago: executing program 0 (id=12446): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000c80)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSETELEM={0x2c, 0xc, 0xa, 0x301, 0x0, 0x0, {0x1}, [@NFTA_SET_ELEM_LIST_SET_ID={0x8}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x4}]}], {0x14, 0x10, 0x1, 0x0, 0x2000000}}, 0x74}}, 0x0) 3.284974693s ago: executing program 3 (id=12448): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="05000000050000004943000005"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x52, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000fdff030018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x26, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000480)={'vcan0\x00', 0x0}) bind$can_j1939(r2, &(0x7f0000000100)={0x1d, r3, 0x0, {0x1, 0x1, 0x4}, 0x1}, 0x18) sendmsg$can_j1939(r2, &(0x7f0000000200)={&(0x7f0000000000)={0x1d, r3, 0x0, {0x0, 0x0, 0x4}, 0x1}, 0x18, &(0x7f00000001c0)={&(0x7f0000000140)="5ab37158946b88213a", 0x9}, 0x1, 0x0, 0x0, 0x20008840}, 0x4000000) readv(r2, &(0x7f00000000c0)=[{&(0x7f00000014c0)=""/4105, 0x1009}], 0x1) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1a, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000800)={{r1}, &(0x7f0000000780), &(0x7f00000007c0)='%pB \x00'}, 0x20) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r4}, 0xc) socket$igmp(0x2, 0x3, 0x2) connect$bt_l2cap(r0, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r5 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_bt_hidp_HIDPCONNADD(r5, 0x400448c8, &(0x7f0000000600)={r0, r0, 0x8, 0x0, 0x0, 0x6, 0xfe, 0x10cf, 0x5, 0x5, 0x2, 0x1, 'syz0\x00'}) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)=ANY=[@ANYBLOB="38000000480001002bcf3d8d26dbdf250a9a9900", @ANYRES32=0x0, @ANYBLOB="03000000080002000b00000014"], 0x38}, 0x1, 0x0, 0x0, 0x80}, 0x0) r7 = socket$alg(0x26, 0x5, 0x0) bind$alg(r7, &(0x7f0000000540)={0x26, 'hash\x00', 0x0, 0x0, 'hmac(sha384)\x00'}, 0x58) r8 = accept4(r7, 0x0, 0x0, 0x800) accept4$bt_l2cap(r8, 0x0, 0x0, 0x800) syz_emit_ethernet(0x3a, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaa00000000000008004600002c000000000006907864010100ac1414aa940400004e224001", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB], 0x0) shutdown(r0, 0x1) 3.15683919s ago: executing program 0 (id=12449): setsockopt$bt_l2cap_L2CAP_LM(0xffffffffffffffff, 0x6, 0x3, &(0x7f0000000000)=0x28, 0x4) connect$bt_l2cap(0xffffffffffffffff, &(0x7f0000000380)={0x1f, 0x5, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) 2.871939885s ago: executing program 0 (id=12451): r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r1) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000000c0)=0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="ebe3a0e9", 0x4}], 0x1}], 0x1, 0x40800) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0xd, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000850000002e00000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000009800000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$MAP_CREATE_TAIL_CALL(0x9, &(0x7f0000000480)=ANY=[@ANYBLOB="030000000400000004"], 0xc) sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000d80)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB="010426bd7000f8dbdf250200000008000100", @ANYRES32=r3], 0x1c}}, 0x4008054) write$nci(r0, &(0x7f0000000040)=ANY=[@ANYBLOB='p\x00\t'], 0xc) write$nci(r0, &(0x7f0000000dc0)=ANY=[@ANYBLOB="400104"], 0x14) write$nci(r0, &(0x7f0000000140)=ANY=[@ANYBLOB="5001", @ANYRES8=r1], 0x14) 2.613703121s ago: executing program 5 (id=12453): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r0, 0x84, 0x80, &(0x7f00000002c0)="1a00000002000000", 0x8) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x0, @empty, 0x4}], 0x1c) sendto$inet6(r0, &(0x7f0000000040)='l', 0x1, 0x14, &(0x7f0000000100)={0xa, 0x4e23, 0x3f89, @loopback, 0x2c010000}, 0x1c) socket$unix(0x1, 0x2, 0x0) socket(0x10, 0x3, 0x0) 2.192930162s ago: executing program 3 (id=12456): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'bridge_slave_1\x00'}) r1 = socket$inet6_udp(0xa, 0x2, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e23, 0x93, @local, 0xffff}, 0x1c) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000c80)={'lo\x00'}) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r3, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_rx_ring(r3, 0x107, 0x5, &(0x7f0000000040)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x0, 0x200000, 0xffffffff}, 0x1c) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000800)=@ipv6_delrule={0x2c, 0x21, 0x11, 0x0, 0x0, {}, [@FIB_RULE_POLICY=@FRA_L3MDEV={0x5, 0x13, 0x1}, @FIB_RULE_POLICY=@FRA_TABLE={0x8}]}, 0x2c}}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="120000a66a7aa563dfa699000600c2ea17b3000002ec85868e1de61a8e6b8206fd98ff6493f36c5889d8f779e20400577d4aba"], 0x50) r8 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) ioctl$sock_inet6_SIOCSIFADDR(r8, 0x8916, &(0x7f0000000180)={@loopback, 0x58, r9}) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r7}, 0x0, &(0x7f0000000140)=r6}, 0x20) r10 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r11 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) r12 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r12, 0x29, 0x40, &(0x7f00000005c0)=@raw={'raw\x00', 0x3c1, 0x3, 0x2d0, 0x348, 0x18c, 0x203, 0x0, 0x19030000, 0x480, 0x2e0, 0x2e0, 0x480, 0x2e0, 0x8000000, 0x0, {[{{@uncond, 0x300, 0xa8, 0xf0}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv4=@private, 'veth1_macvtap\x00', {0xffff}}}}, {{@uncond, 0x0, 0xa8, 0x110}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x10, 0x1a, 0xfffffff6, 0x81, 'syz1\x00', 'syz1\x00', {0xfffffffffffffffc}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x330) sendmsg$NBD_CMD_CONNECT(r10, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000ac0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r11, @ANYBLOB="01002cbd700000000000010000000c00020002000000000000001c0007800c00018008000100", @ANYRES32=r5, @ANYBLOB="0c00018008000100", @ANYRES32=r5, @ANYBLOB="52a2a0f45fe79e576cfd68a376592c23452f2cf372246f84b71f013b6a79354b6d590a2ac2502fa3a401cba0d4256e11164b30eff8ec09396e2a3eb819791eefb80ca370f1a98d713d408aec3bbe3f0ae44615f0b84322a2e3d9c7dc86b30c1d56ee9db2c03b146494340accef4fc300cf2ad46869c19b7574a1d89d8f86485c6eac862aca48ea1a4ee7c129c88075501939d78193274fdf7d08b4d9fe5b5d24c7fc35f73b6d937b"], 0x3c}, 0x1, 0x0, 0x0, 0x55ebfcb85e78e904}, 0x4) recvmsg$unix(r6, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000480)=[{&(0x7f00000004c0)=""/8, 0x8}], 0x1}, 0x10022) sendmsg$nl_crypto(r5, 0x0, 0x800) syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), r4) r13 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000300), r10) sendmsg$NLBL_CALIPSO_C_LISTALL(r10, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000003c0)={&(0x7f00000009c0)=ANY=[@ANYBLOB="4c0000009914f64ac0cf9b15b86f8db3777fd008a919aa68d9477a617825856567131f491afed29b165f27443184c28b6aaf773ce9a6de740f8d87f168ea2a19d5b5f689e21f5e7ac83ec64ee75cad9ec3913acf22b2751234663fdef2306ecc0920b6ea4fd515ad741973ac164820f5f23ac0f175098398d68e06ef93458313915cf4b9a01900c2a71b37c7e847123bfc5e62da100e78d67004b1", @ANYRES16=r13, @ANYBLOB="04002bbd7000fedbdf25040000000800020002000000080002000200000008000200020000000800020002000000080002000200000008000100010000000800020002000000"], 0x4c}, 0x1, 0x0, 0x0, 0x8001}, 0x14000) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x10, 0x16, &(0x7f0000000780)=ANY=[@ANYBLOB="61123000000000006113340000000000bf10000000000000160002000ee600f03d030100000000008701000000000000bc26000000000000bf67000000000000560300000ee60070670200001f000000160300000ee600f0bf050000000000000f610000000000006507f4ff02000400070700004c0040001f75000000000000bf54000000000000070500000300f9ffad430100000000009500000000000000050000000000000095000000000000004d9bd591d568253e9988431ec068e3a82983d58719d72183f2cb7f43dd55788be820b236dcb695dbfd737cbf719506d2d6b05fe7030586e3f640f9f7e9a73b761ad4f0952a70046270d2b6436fdeecd791614ed46de741eb8cf91c046ef9beca574b350021c7ec6ef130f53748068ca432dae4e248b22b9ad8b2811f67916a1764578cba4b069037bfb3362d5691ac397f7e207145d970f0d97867552629b146645c785fb77dbeca38e49a9d5221f1f45f0a25890d04d91a15a05ae7e7ed6252c3d6c1973fb858de1da70d67317e7872b0603ce47ed2c1520e71b527bb42aa2e20e1e85df73736ed0a782ab7e7278dd54358cfdf6313d40f926332623625b49626481054787ab2dff85a9bebd6b317f26c691a65aa97bb3d1506a3a565e9c7ea5ad4611d2d77ee8a5c1b23814a26b6a20061fbb65bdd03770fa849f2a29ba69f90625f42592a70ba890f7a92878ae73574c3a233ee5954119931a1905210715fa77a8795f2fbec3797cb90f59fe8a4abec25f40c87bf25b750bbaa"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) r14 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r14, &(0x7f0000000100)=ANY=[], 0x32600) 2.076932402s ago: executing program 4 (id=12457): r0 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_PKTINFO(r0, 0x10e, 0xc, &(0x7f0000000040)=0x8, 0x4) sendmsg$nl_route(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000000)=ANY=[@ANYBLOB="2800000012000100"/20, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00', @ANYRES32=r0], 0x28}}, 0x802) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$SOCK_DIAG_BY_FAMILY(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)={0x14, 0x14, 0x1, 0x0, 0x0, {0x1e, 0x88}}, 0x14}}, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000600)=ANY=[@ANYBLOB="3800000035000100fcff0700040000000100000008000180"], 0x38}, 0x1, 0x0, 0x0, 0x400c801}, 0x4008094) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt(r3, 0x84, 0x81, &(0x7f0000000000)="0000000000000002", 0x8) r4 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r4, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000280)=0x8) setsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r3, 0x84, 0x18, &(0x7f0000000400)={r5}, 0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000200)={r5, @in6={{0xa, 0x4e23, 0x7, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x1ff}}, 0xffff70da, 0x7ff, 0x0, 0x377, 0x10, 0x0, 0x7f}, 0x9c) ioctl$ifreq_SIOCGIFINDEX_team(r4, 0x8933, &(0x7f0000000080)) 1.959471608s ago: executing program 4 (id=12459): bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) bind$bt_l2cap(r0, &(0x7f00000005c0)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x12}, 0x4}, 0xe) unshare(0x400) connect$bt_l2cap(r0, &(0x7f0000000240)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x9, 0x2}, 0xe) 1.911515477s ago: executing program 4 (id=12460): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x6, 0x6, &(0x7f0000000140)=ANY=[@ANYBLOB="18020000fdffffff00000000feffffff85000000500000001800000003000000000000000600020095"], &(0x7f00000001c0)='GPL\x00', 0x2, 0x0, 0x0, 0x40f00, 0x40, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)=ANY=[@ANYBLOB="400000001000370400"/20, @ANYRES32=0x0, @ANYBLOB="8304051a000000002000128008000100677265001400028006000e00020000000600a9f661fc177c7e871151db9f5119c6ed92302fbe70bef0eae039135a686633f77918abf9f52903a99d348e418b2f6e4378f1bf639fa28efea99a74ecfc03"], 0x40}, 0x1, 0x0, 0x0, 0x2400004c}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000008c0)={r0, 0x0, 0xe, 0x0, &(0x7f0000000600)="87fc5d85da21530562070095c108", 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x9, 0x40}, 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x3, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="180200000100000400000000000000008500000087000000850000002a00000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x10021}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r2, 0x0, 0xe, 0x0, &(0x7f0000000240)="e027429b49dcd4ff9782762f86dd", 0x0, 0x103, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) setsockopt$inet6_icmp_ICMP_FILTER(r1, 0x1, 0x1, &(0x7f0000000000)={0x6}, 0x4) 1.869144949s ago: executing program 3 (id=12461): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000000300)=@raw={'raw\x00', 0x8, 0x3, 0x358, 0x1b0, 0x43, 0xa0, 0x1b0, 0x98, 0x2c0, 0x178, 0x178, 0x2c0, 0x178, 0x49, 0x0, {[{{@ip={@loopback, @local, 0x0, 0x0, 'veth0_to_bond\x00', 'ip6erspan0\x00'}, 0x12a, 0x190, 0x1b0, 0x0, {0x0, 0x7a010000}, [@common=@inet=@recent0={{0xf8}, {0x0, 0xfffffffd, 0x8, 0x1, 'syz0\x00'}}, @common=@unspec=@cgroup0={{0x28}, {0xa}}]}, @unspec=@TRACE={0x20}}, {{@uncond, 0x0, 0xd0, 0x110, 0x0, {}, [@common=@unspec=@connbytes={{0x38}, {[{0x9}]}}, @common=@icmp={{0x28}, {0xb, "17e4"}}]}, @common=@unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "f1c098b60204ed02d82cf440fef5497b80c29d381d41116000"}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x3b8) listen(r1, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000003780)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000000)="020b0700fc670000e4a17c45c8d260c9", 0x33fe0}], 0x1}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r5, 0x1, 0x1a, &(0x7f0000000000)={0x3, &(0x7f00000000c0)=[{0x20, 0x0, 0x2, 0xfffff010}, {0x20, 0x0, 0x0, 0xfffff034}, {0x6}]}, 0x10) sendmmsg(r4, &(0x7f0000000180), 0x4000190, 0x0) r6 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r6, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f0000000080)=[@in={0x2, 0x0, @private=0xa010101}]}, &(0x7f0000000100)=0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r6, 0x84, 0x1d, &(0x7f0000000000)={0x1, [0x0]}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r6, 0x84, 0x82, &(0x7f0000000300)={r7, 0x10, 0x7}, 0x8) r8 = socket$inet6_mptcp(0xa, 0x1, 0x106) listen(r8, 0x7d4165c9) listen(r3, 0x0) r9 = socket$inet6_mptcp(0xa, 0x1, 0x106) listen(r9, 0x0) r10 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r10, 0x0) socket$netlink(0x10, 0x3, 0x8000000004) r11 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r11, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) r12 = socket$inet6_sctp(0xa, 0x1, 0x84) r13 = socket(0x10, 0x80003, 0x0) ioctl$sock_SIOCGIFINDEX(r12, 0x8933, &(0x7f0000000300)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r13, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r14, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_prio={{0x9}, {0xfffffffffffffead, 0x2, {0xb, "0000000000020400000000000b00"}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x4000}, 0x40000) 1.783110211s ago: executing program 4 (id=12462): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) writev(0xffffffffffffffff, &(0x7f0000000000)=[{0x0}, {0x0}, {&(0x7f0000001480)}], 0x3) ioctl$FS_IOC_GETFSMAP(0xffffffffffffffff, 0x40305839, &(0x7f0000000000)=ANY=[@ANYBLOB="00000000000800000000000000000000000000000002"]) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$sock_timeval(r1, 0x1, 0x2, 0x0, 0x48) getsockopt$inet6_mptcp_buf(r1, 0x11c, 0x4, 0x0, &(0x7f00000005c0)) r2 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r2, &(0x7f0000000000)=@name={0x1e, 0x2, 0x1, {{0x41}, 0x3}}, 0x10) listen(r2, 0x0) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000240)) r3 = socket$tipc(0x1e, 0x5, 0x0) close(r3) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000b40)=ANY=[@ANYRES64=0x0, @ANYRES64=r4, @ANYBLOB="1f"], 0x20) accept4(r2, &(0x7f0000000180)=@xdp, &(0x7f0000000100)=0x80, 0x80800) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x3fc, 0x0, 0xd2}, 0xfffffffffffffe88) bind$inet6(r0, &(0x7f0000000300)={0xa, 0x4e23, 0x0, @loopback, 0x3}, 0x7e) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000004c0)=@ipv6_getroute={0x2c, 0x1a, 0x1, 0x70bd2c, 0x25dfdbfe, {0xa, 0x80, 0x14, 0xc, 0x0, 0x76e993a086cc320e, 0xfd, 0x7, 0x100}, [@RTA_OIF={0x8}, @RTA_IIF={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x48800}, 0x40) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000"], &(0x7f0000000000)='GPL\x00', 0x3, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}, 0x94) r7 = bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000180)={r6, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f00000002c0)='./cgroup/cgroup.procs\x00', 0x0}}, 0x40) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000680)={r7, 0x23, 0x0}, 0x10) setsockopt$inet_sctp6_SCTP_RTOINFO(r0, 0x84, 0x0, &(0x7f0000000000)={0x0, 0x1, 0x8001, 0x6}, 0x10) sendto$inet6(r0, &(0x7f0000847fff)='X', 0x34000, 0xe0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) socket$nl_route(0x10, 0x3, 0x0) close(0x3) 1.744437043s ago: executing program 3 (id=12463): socket$nl_generic(0x10, 0x3, 0x10) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000005c0)='hugetlb.1GB.rsvd.usage_in_bytes\x00', 0x275a, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r2 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000058000000160a03000000000000000000010000000900010073797a30000000000900020073797a30000000002c0003800800014000000000180003801400020000007468305f746f5f68737200000000080002"], 0xe8}}, 0x0) write$tun(r1, &(0x7f0000000840)={@val={0x8, 0x800}, @val={0x6, 0x0, 0x6, 0x8, 0x14}, @ipv4=@generic={{0x5, 0x4, 0x2, 0x2, 0x116, 0x66, 0x0, 0xb, 0x2f, 0x0, @rand_addr=0x64010101, @broadcast}, "3297e3ba0fa8a2e71bd9fe1a399b5110420b70460c0dad392d66248a43540df968e7fcaab34569c0e36170578c0d3c546a98b26295e2592f360905866eb4720fed03a977a3df4224895629fd6ccec64f13a999f18f518e3ee28798381975e862f1db9dccdb2f1c1fb60f5ffc7a339d40a8bd1f24cede8a32f186f142e194d4fb48224759faf813ea80e6a853e79b4fe27fe3e1aec5897b314a7f0d515b07b1835986b4885e9826d902c40f16cd77c58b6433ab039955ce9db11f36f459e7114ace6c9989eecea80a81fd39f339356c7c3391af83da2486503a7973f6db4806cf3e5ca94cf7e1f79fd00decd76100c18251a59d1474caabf4d3ca6a9a9885df710e68"}}, 0x124) recvmsg$unix(r0, 0x0, 0x0) ioctl$PPPIOCGUNIT(r0, 0x80047456, &(0x7f0000000000)) socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/pid_for_children\x00') unshare(0x6a040000) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r5 = socket$unix(0x1, 0x5, 0x0) r6 = socket(0x400000000010, 0x3, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, 0x0, 0x0) sendmsg$NFT_BATCH(r7, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8004}, 0x0) r8 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r9, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}, 0x1, 0x0, 0x0, 0x50}, 0x0) sendmsg$nl_route_sched(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000380)=@newtfilter={0x38, 0x2c, 0xd27, 0x70bd28, 0x0, {0x0, 0x0, 0x0, r9, {0x0, 0x7}, {}, {0x7, 0xe}}, [@filter_kind_options=@f_fw={{0x7}, {0xc, 0x2, [@TCA_FW_CLASSID={0x8, 0x1, {0x1, 0x6}}]}}]}, 0x38}, 0x1, 0x0, 0x0, 0x8d0}, 0x8000) socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) socket(0x10, 0x3, 0x0) 1.709146654s ago: executing program 5 (id=12464): r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) shutdown(r0, 0x1) socket$tipc(0x1e, 0x5, 0x0) connect$bt_rfcomm(r0, &(0x7f0000005dc0)={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x15}, 0xa) 1.559967149s ago: executing program 5 (id=12466): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000a40)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000bc0)={&(0x7f0000000080)=ANY=[@ANYRES32=r2], 0x24}, 0x1, 0x0, 0x0, 0x4008004}, 0x0) 1.484273798s ago: executing program 5 (id=12467): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) connect$inet6(r0, &(0x7f0000000180)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, '\x00', 0x1c}, 0xfffff30e}, 0x16) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$fou(&(0x7f0000000080), r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000007c0)={'vlan0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000a00)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=@newqdisc={0x8c, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0x10}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x5c, 0x2, {{0x0, 0x0, 0x1, 0x0, 0x0, 0x1}, [@TCA_NETEM_RATE={0x14, 0xd, {0x3, 0x0, 0x6}}, @TCA_NETEM_SLOT={0x2c, 0xc, {0x7b4, 0xfffffffffffff813, 0x0, 0xa, 0x6d9e, 0x55}}]}}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x48011}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r4, 0x89f6, &(0x7f00000000c0)={'bond0\x00', @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1b}}) getsockopt$IP6T_SO_GET_REVISION_TARGET(r0, 0x29, 0x45, &(0x7f0000000000)={'HL\x00'}, &(0x7f0000000040)=0x1e) 1.296730879s ago: executing program 5 (id=12468): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000300)="2000000011008188040f80ec59acbc0413a181000d0000000f01000000000000", 0x20}], 0x1}, 0x0) r1 = socket$kcm(0x10, 0x2, 0x0) r2 = socket$packet(0x11, 0x3, 0x300) r3 = socket(0x11, 0x3, 0x0) setsockopt(r3, 0x107, 0xf, &(0x7f0000000100)="00008634", 0x4) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000540)=@can_delroute={0x13, 0x19, 0x1, 0x70bd26, 0x25dfdbfe, {}, [@CGW_MOD_SET={0x15, 0x4, {{{0x0, 0x0, 0x0, 0x1}, 0x4, 0x3, 0x0, 0x0, "9094a9b270de6dc2"}}}]}, 0x2c}}, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000180)={'bridge0\x00', 0x0}) sendmsg(r3, &(0x7f0000000100)={&(0x7f0000000040)=@ll={0x11, 0x3, r5, 0x1, 0xe5, 0x6, @broadcast}, 0x80, &(0x7f0000000240)=[{&(0x7f00000003c0)="020195ff002d3922ff65b4355e953d23d254f00000000000", 0x18}, {&(0x7f00000001c0)="2cf2565b0e508224b706a643e98dc932f5fc6d8e51626cdbf9ff02dbb8b2d2ca2be0dfa8f2a777f680c590257a0641579678f72a6ff270a8989633cbe781bf372d4a0e61", 0xff87}], 0x2}, 0x44000) setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f0000000140)={0x0, 0x1000}, 0x4) r6 = socket(0x1e, 0x1, 0x0) r7 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r7, &(0x7f0000000640)={0xa, 0x4622, 0xb57, @mcast1, 0x7}, 0x1c) setsockopt$inet6_udp_int(r7, 0x11, 0x67, &(0x7f0000000040)=0xb4, 0x4) sendmsg$NFT_BATCH(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=ANY=[], 0x8ddc}}, 0x0) connect$tipc(r6, &(0x7f0000000000)=@name={0x1e, 0x2, 0x2, {{0x1, 0x1}}}, 0x10) recvmmsg(r2, &(0x7f0000000240)=[{{0x0, 0x0, 0x0}, 0x3}], 0x1, 0x10040, 0x0) sendmsg$kcm(r1, &(0x7f0000000940)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000000)="d8000000", 0x4}], 0x1}, 0x0) 896.324187ms ago: executing program 5 (id=12471): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) setsockopt$bt_l2cap_L2CAP_LM(r0, 0x6, 0x3, 0x0, 0x0) connect$bt_l2cap(r0, &(0x7f0000000380)={0x1f, 0x5, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) 895.39314ms ago: executing program 4 (id=12472): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000640)=ANY=[@ANYBLOB="14000000100001000000000000b890c1a000000a80000000160a01030000000000000000020000000900020073797a30000000000900010073797a30000000005400038008000240000000000800014000000000400003801400010076657468315f746f5f6272696467650014000100776732000000000000000000000000001400010076657468305f746f5f7465616d00000014000000110001"], 0xa8}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000800)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_DELFLOWTABLE={0x70, 0x18, 0xa, 0x5, 0x0, 0x0, {0x2}, [@NFTA_FLOWTABLE_HOOK={0x44, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_DEVS={0x40, 0x3, 0x0, 0x1, [{0x14, 0x1, 'wg2\x00'}, {0x14, 0x1, 'veth1_to_bridge\x00'}, {0x14, 0x1, 'veth0_vlan\x00'}]}]}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0x98}, 0x1, 0x0, 0x0, 0x40000}, 0x200080f5) 699.632773ms ago: executing program 4 (id=12474): r0 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x3, 0x2, 0x81, 0x1fd, 0x1, 0x1}, 0x1c) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000000c0)={0x3, 0x0, 0x0, &(0x7f0000000040)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xf}, 0x94) r1 = socket(0x1e, 0x4, 0x0) setsockopt$MRT_ADD_MFC(0xffffffffffffffff, 0x0, 0xcc, 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f00000deb00)={0xd, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0}, {}, {0x0}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0}, {0x0}, {}, {}, {}, {}, {}, {0x0, 0x0}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0}, {}, {}, {}, {}, {}, {}, {0x0, 0x0}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0}, {}, {0x0}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0}, {}, {}, {}, {}, {}, {}, {0x0, 0x0}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0}], 0x6, "d6c60e7fa3f7c8"}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(r0, 0xd000943d, &(0x7f00000dfb00)={0x8, [{}, {r5}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {r3}, {}, {}, {0x0, r7}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, r6}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, r12}, {}, {}, {}, {}, {0x0, r11}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {r10}, {}, {}, {}, {0x0, r2}, {}, {}, {}, {}, {}, {}, {}, {}, {r13}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, r15}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, r4}], 0x0, "cd798ffead4d6c"}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000116900)={0x9, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0}], 0x1, "f45eea8aed62fb"}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000117900)={0x0, ""/256, 0x0, 0x0}) ioctl$BTRFS_IOC_TREE_SEARCH(0xffffffffffffffff, 0xd0009411, &(0x7f0000117b00)={{0x0, 0xab7e, 0x6, 0x4, 0x491, 0x5, 0x0, 0x3f5, 0x80, 0x80, 0x8, 0x4, 0x1, 0x1, 0x1}}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000118b00)={0x1, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {r14}, {}, {}, {}, {0x0, r8}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, r9}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {r16}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {r17}], 0x6, "7fc27c7dfa4ed5"}) ioctl$BTRFS_IOC_TREE_SEARCH_V2(0xffffffffffffffff, 0xc0709411, &(0x7f0000119b00)={{0x0, 0x10, 0x8, 0xa90d, 0x35, 0x7, 0x9, 0x10, 0x4, 0x1, 0x0, 0x6, 0x7, 0x3, 0x2}, 0x40, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000119bc0)={0x5, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {r18, r19}, {r20, r21}, {r22}], 0x3, "c1650c01f470c2"}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f00000ddc80)={0x7, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, r19}], 0x9, "f0c83eca5c2321"}) ioctl$sock_inet_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r23, 0x8933, &(0x7f0000000000)={'sit0\x00'}) setsockopt$packet_tx_ring(r1, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x3, 0x2, 0x81, 0x1fd, 0x1, 0x1}, 0x1c) recvmsg$unix(r1, 0x0, 0x20) sendmmsg(r1, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x101d0}], 0x1}}], 0x400000000000181, 0x9200000000000000) setsockopt$sock_int(r1, 0x1, 0x21, &(0x7f0000000540)=0x5, 0x4) recvmsg$unix(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)=""/254, 0xfe}], 0x1, 0x0, 0xfffffffffffffe68}, 0x0) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r24, 0x0, 0x0, 0x1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) splice(r25, 0x0, r24, 0x0, 0x10000008ebc, 0x0) ioctl$TUNGETDEVNETNS(r24, 0x54e3, 0x0) sendmmsg(r0, &(0x7f00000030c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x9200000000000000) close(0x4) 572.685274ms ago: executing program 1 (id=12475): setsockopt$bt_l2cap_L2CAP_LM(0xffffffffffffffff, 0x6, 0x3, &(0x7f0000000000)=0x28, 0x4) connect$bt_l2cap(0xffffffffffffffff, &(0x7f0000000380)={0x1f, 0x5, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) 513.120347ms ago: executing program 1 (id=12476): r0 = socket$kcm(0xf, 0x5, 0x2) sendmsg$inet(r0, &(0x7f00000011c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000000)="020b070102000000e4a17c455b3a89e0", 0x10}], 0x1}, 0x0) r1 = socket$kcm(0xf, 0x3, 0x2) r2 = socket$inet(0x2, 0x5, 0x0) r3 = socket$igmp(0x2, 0x3, 0x2) setsockopt$inet_opts(r2, 0x0, 0x4, &(0x7f0000000080)="441f0801000000e8c94ef56491ee54be0e1c2074ed27c1c6fe76cef3e2", 0x1d) getsockopt$inet_opts(r2, 0x0, 0x4, 0x0, &(0x7f00000001c0)) sendmsg$inet(r1, &(0x7f0000003780)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000000)="020b0700fc670000e4a17c45c8d260c9", 0x33fe0}], 0x1}, 0x0) ioctl$AUTOFS_IOC_EXPIRE_MULTI(r3, 0x40049366, &(0x7f0000000240)=0x2) r4 = socket$phonet(0x23, 0x2, 0x1) ioctl$sock_SIOCETHTOOL(r4, 0x8946, &(0x7f0000000280)={'gre0\x00', &(0x7f0000000580)=@ethtool_pauseparam={0x13, 0xc04, 0x5, 0x2}}) sendmsg$inet(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)="020a030002000000e4a17c45c8d260c9", 0x10}], 0x1}, 0x0) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@allocspi={0xf8, 0x16, 0x1, 0x0, 0x0, {{{@in6=@private0={0xfc, 0x0, '\x00', 0x1}, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0xa0}, {@in6=@ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x40}}, 0x0, 0x33}, @in6=@empty, {0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffff1, 0x3}, {0x0, 0x0, 0x2, 0xfffffffffffffffe}, {0x0, 0x0, 0x796}, 0x0, 0x3505, 0x0, 0x3, 0x0, 0xe55286f1921f74be}, 0x0, 0x1a0b1}}, 0xf8}, 0x1, 0x0, 0x0, 0x4005}, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="2001000012001307"], 0x120}}, 0x0) 343.162262ms ago: executing program 1 (id=12477): r0 = socket(0x25, 0x1, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), r0) r1 = socket(0x10, 0x803, 0x0) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x2404c050}, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) r3 = openat$cgroup_devices(r2, &(0x7f0000000480)='devices.deny\x00', 0x2, 0x0) write$cgroup_devices(r3, &(0x7f0000000140)=ANY=[@ANYBLOB='b *:* m'], 0xa) socket$nl_route(0x10, 0x3, 0x0) r4 = socket$kcm(0x2d, 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_kcm_SIOCKCMATTACH(r4, 0x89e0, &(0x7f0000000040)={r5}) ioctl$sock_kcm_SIOCKCMATTACH(r4, 0x89e0, &(0x7f0000000080)={r5}) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r7 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r7, &(0x7f0000000180)={0xa, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=ANY=[@ANYBLOB="020300020c00000000000000000000000300060000000000020000000000000000000000000000000200010000000000000009077fffffff0300050000ac1414aa000000000000000002000800080000003423000000000000"], 0x60}, 0x1, 0x7}, 0x0) r8 = socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_KEY(r8, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d49100dc6626c892b6bc436a", 0x10) r9 = accept4(r4, 0x0, 0x0, 0x0) sendmsg$alg(r9, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8005}, 0x40040) sendmsg$nl_route_sched_retired(r9, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000007c0)=@deltfilter={0x24, 0x2d, 0x200, 0x70bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x8, 0xffe0}, {0x3, 0xffe0}, {0x9}}}, 0x24}}, 0x0) recvmmsg(r9, &(0x7f00000093c0)=[{{0x0, 0x0, &(0x7f0000001bc0)=[{&(0x7f0000000400)=""/115, 0x73}, {&(0x7f0000000800)=""/4096, 0x1000}, {&(0x7f0000001800)=""/48, 0x30}, {&(0x7f0000005e40)=""/71, 0x45}, {&(0x7f00000018c0)=""/129, 0x81}, {&(0x7f0000001980)=""/131, 0x83}, {&(0x7f0000001a40)=""/77, 0x4d}, {&(0x7f0000001ac0)=""/131, 0x83}, {&(0x7f0000001b80)}], 0x9, &(0x7f0000001c80)=""/144, 0x90}, 0xd}, {{0x0, 0x0, &(0x7f0000004540)=[{&(0x7f0000001d40)=""/103, 0x67}, {&(0x7f0000001dc0)=""/130, 0x82}, {&(0x7f0000001e80)=""/81, 0x51}, {&(0x7f0000002300)=""/4096, 0x1000}, {&(0x7f0000003300)=""/4096, 0x1000}, {&(0x7f0000004300)=""/56, 0x38}, {&(0x7f0000004340)=""/208, 0xd0}, {&(0x7f0000004440)=""/254, 0xfe}], 0x8, &(0x7f00000045c0)=""/96, 0x60}}, {{&(0x7f0000004640)=@ethernet={0x0, @random}, 0x80, &(0x7f00000046c0), 0x0, &(0x7f0000004700)=""/129, 0x81}, 0x4}, {{&(0x7f00000047c0)=@pppoe={0x18, 0x0, {0x0, @dev}}, 0x80, &(0x7f0000005d00)=[{&(0x7f0000004840)=""/203, 0xcb}, {&(0x7f0000004940)=""/83, 0x53}, {&(0x7f00000049c0)=""/70, 0x46}, {&(0x7f0000004a40)=""/39, 0x27}, {&(0x7f0000004a80)=""/108, 0x6c}, {&(0x7f0000004b00)=""/4096, 0x1000}, {&(0x7f0000007980)=""/161, 0xa1}, {&(0x7f0000005bc0)=""/22, 0x16}, {&(0x7f0000005c00), 0x6}, {&(0x7f0000005c40)=""/162, 0xa2}], 0xa}}, {{&(0x7f0000005dc0)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, 0x80, &(0x7f0000007300)=[{&(0x7f0000000300)=""/9, 0x9}, {&(0x7f0000006200)=""/155, 0x9b}, {&(0x7f0000005f40)=""/177, 0xb1}, {&(0x7f0000006000)=""/139, 0x8b}, {&(0x7f00000060c0)=""/191, 0xbf}, {&(0x7f0000006180)=""/80, 0x5e}, {&(0x7f0000005b00)=""/105, 0x60}, {&(0x7f0000009640)=""/4096, 0x1000}, {&(0x7f00000004c0)=""/132, 0x84}], 0x9, &(0x7f00000073c0)=""/194, 0xc2}, 0x1}, {{&(0x7f00000074c0)=@pppol2tpv3, 0x81, &(0x7f0000007700)=[{&(0x7f0000007540)=""/113, 0x71}, {&(0x7f00000075c0)=""/15, 0xf}, {&(0x7f0000007600)=""/237, 0xed}], 0x3, &(0x7f0000007740)=""/124, 0x7c}, 0x5893aa2b}, {{&(0x7f00000077c0)=@l2tp6, 0x80, &(0x7f00000078c0)=[{&(0x7f0000007840)=""/95, 0x5f}], 0x1, &(0x7f0000007900)=""/84, 0x54}, 0xfffffffe}, {{&(0x7f0000000680)=@can, 0x80, &(0x7f0000007c00)=[{&(0x7f0000001f00)=""/70, 0x46}, {&(0x7f0000007a80)=""/135, 0x87}, {&(0x7f0000007b40)=""/168, 0xa8}], 0x3, &(0x7f0000007c40)=""/243, 0xf3}, 0xfffffffc}, {{&(0x7f0000007d40)=@pppoe={0x18, 0x0, {0x0, @link_local}}, 0x80, &(0x7f0000008f00)=[{&(0x7f0000007dc0)=""/4096, 0x1000}, {&(0x7f0000008dc0)=""/150, 0x96}, {&(0x7f0000008e80)=""/115, 0x73}], 0x3, &(0x7f0000008f40)=""/168, 0xa8}, 0x7}, {{&(0x7f0000009000)=@l2tp, 0x80, &(0x7f00000092c0)=[{&(0x7f0000009080)=""/1, 0x1}, {&(0x7f00000090c0)=""/104, 0x68}, {&(0x7f0000000580)=""/149, 0x95}, {&(0x7f0000009200)=""/134, 0x86}], 0x4, &(0x7f0000009300)=""/148, 0x94}, 0x80}], 0xa, 0x60, 0x0) socket$kcm(0x2, 0x3, 0x2) 163.400998ms ago: executing program 1 (id=12478): bpf$MAP_CREATE(0x0, &(0x7f0000000840)=@base={0xb, 0x5, 0x2, 0x1, 0x5}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x11, 0x4, &(0x7f0000000700)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, [@call={0x85, 0x0, 0x0, 0x7b}]}, &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 102.753834ms ago: executing program 1 (id=12479): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=@base={0xa, 0x7, 0x2, 0x8}, 0x50) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000dc0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x14, 0x10, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000001000000850000008600000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x10, &(0x7f0000000180)=ANY=[], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) setsockopt$sock_attach_bpf(r2, 0x1, 0x32, &(0x7f00000000c0)=r4, 0x4) sendmsg$unix(r3, &(0x7f00000006c0)={0x0, 0x0, 0x0}, 0x0) 0s ago: executing program 1 (id=12480): bpf$ENABLE_STATS(0x20, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000002010000850000004300000095"], 0x0, 0x400000, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1a, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r1}, 0xc) kernel console output (not intermixed with test programs): 63][T13494] RSP: 002b:00007fe8a476ffe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1794.157386][T13494] RAX: ffffffffffffffda RBX: 00007fe8a47706c0 RCX: 00007fe8a395d68e [ 1794.157404][T13494] RDX: 0000000000000001 RSI: 00007fe8a47700a0 RDI: 0000000000000004 [ 1794.157418][T13494] RBP: 00007fe8a4770090 R08: 0000000000000000 R09: 0000000000000000 [ 1794.157432][T13494] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1794.157446][T13494] R13: 00007fe8a3c16038 R14: 00007fe8a3c15fa0 R15: 00007ffd3e2d5aa8 [ 1794.157483][T13494] [ 1794.406372][T30426] bond2: (slave gretap0): failed to get link speed/duplex [ 1794.804751][ T4478] Bluetooth: hci1: command tx timeout [ 1795.244389][T13524] netlink: 8 bytes leftover after parsing attributes in process `syz.0.11625'. [ 1795.260205][T13524] netlink: 8 bytes leftover after parsing attributes in process `syz.0.11625'. [ 1795.501864][T13532] netlink: 'syz.0.11625': attribute type 83 has an invalid length. [ 1795.757170][T13533] sch_tbf: peakrate 7 is lower than or equals to rate 6829859379779001161 ! [ 1795.774852][ T12] vlan2: left allmulticast mode [ 1795.779991][ T12] geneve0: left allmulticast mode [ 1795.804780][ T12] vlan2: left promiscuous mode [ 1795.813336][ T12] geneve0: left promiscuous mode [ 1795.824093][ T12] bridge0: port 3(vlan2) entered disabled state [ 1795.834269][ T12] bridge_slave_1: left allmulticast mode [ 1795.840064][ T12] bridge_slave_1: left promiscuous mode [ 1795.846495][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 1795.858625][ T12] bridge_slave_0: left allmulticast mode [ 1795.865904][ T12] bridge_slave_0: left promiscuous mode [ 1795.871866][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 1795.919181][ T12] pimreg: left allmulticast mode [ 1795.950310][T13540] FAULT_INJECTION: forcing a failure. [ 1795.950310][T13540] name failslab, interval 1, probability 0, space 0, times 0 [ 1795.965829][T13540] CPU: 0 UID: 0 PID: 13540 Comm: syz.5.11627 Not tainted syzkaller #0 PREEMPT(full) [ 1795.965859][T13540] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1795.965874][T13540] Call Trace: [ 1795.965882][T13540] [ 1795.965893][T13540] dump_stack_lvl+0xe8/0x150 [ 1795.965924][T13540] should_fail_ex+0x412/0x560 [ 1795.965951][T13540] ? sock_alloc_inode+0x2c/0x190 [ 1795.965985][T13540] should_failslab+0xa8/0x100 [ 1795.966009][T13540] kmem_cache_alloc_lru_noprof+0x87/0x640 [ 1795.966049][T13540] ? __pfx_sock_alloc_inode+0x10/0x10 [ 1795.966079][T13540] sock_alloc_inode+0x2c/0x190 [ 1795.966110][T13540] ? __pfx_sock_alloc_inode+0x10/0x10 [ 1795.966149][T13540] alloc_inode+0x6a/0x1b0 [ 1795.966177][T13540] __sock_create+0x12d/0x9d0 [ 1795.966221][T13540] rfcomm_dlc_open+0x364/0x1210 [ 1795.966351][T13540] ? reacquire_held_locks+0x104/0x190 [ 1795.966379][T13540] ? release_sock+0x2f/0x260 [ 1795.966412][T13540] ? __pfx_rfcomm_dlc_open+0x10/0x10 [ 1795.966446][T13540] ? __local_bh_enable_ip+0xd0/0x130 [ 1795.966472][T13540] rfcomm_sock_connect+0x2f7/0x640 [ 1795.966540][T13540] __sys_connect+0x312/0x450 [ 1795.966565][T13540] ? __pfx___sys_connect+0x10/0x10 [ 1795.966601][T13540] ? __pfx_ksys_write+0x10/0x10 [ 1795.966640][T13540] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1795.966665][T13540] __x64_sys_connect+0x7a/0x90 [ 1795.966689][T13540] do_syscall_64+0x174/0x580 [ 1795.966713][T13540] ? trace_irq_disable+0x3b/0x140 [ 1795.966746][T13540] ? clear_bhb_loop+0x40/0x90 [ 1795.966774][T13540] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1795.966796][T13540] RIP: 0033:0x7fe8a399ce59 [ 1795.966816][T13540] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1795.966835][T13540] RSP: 002b:00007fe8a4770028 EFLAGS: 00000246 ORIG_RAX: 000000000000002a [ 1795.966858][T13540] RAX: ffffffffffffffda RBX: 00007fe8a3c15fa0 RCX: 00007fe8a399ce59 [ 1795.966875][T13540] RDX: 000000000000000a RSI: 0000200000005dc0 RDI: 0000000000000004 [ 1795.966890][T13540] RBP: 00007fe8a4770090 R08: 0000000000000000 R09: 0000000000000000 [ 1795.966904][T13540] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1795.966919][T13540] R13: 00007fe8a3c16038 R14: 00007fe8a3c15fa0 R15: 00007ffd3e2d5aa8 [ 1795.966954][T13540] [ 1796.447917][T13548] netlink: 24 bytes leftover after parsing attributes in process `syz.1.11628'. [ 1796.459329][ T12] bond6 (unregistering): (slave gretap0): Removing an active aggregator [ 1796.469939][ T12] bond6 (unregistering): (slave gretap0): Releasing backup interface [ 1796.668521][ T12] team0: Port device bridge5 removed [ 1796.694436][ T12] team0: Port device bridge6 removed [ 1796.717166][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1796.729974][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1796.756695][ T12] bond0 (unregistering): Released all slaves [ 1796.771743][ T12] bond1 (unregistering): Released all slaves [ 1796.795942][ T12] bond2 (unregistering): Released all slaves [ 1796.807159][T13556] Bluetooth: hci1: expected 36 bytes, got 2 bytes [ 1796.822078][ T12] bond3 (unregistering): Released all slaves [ 1796.850658][ T12] bond4 (unregistering): Released all slaves [ 1796.879071][ T12] bond5 (unregistering): Released all slaves [ 1796.893836][ T4478] Bluetooth: hci1: command tx timeout [ 1796.958471][ T12] bond6 (unregistering): Released all slaves [ 1797.001278][ T12] bond7 (unregistering): Released all slaves [ 1797.052187][ T12] bond8 (unregistering): Released all slaves [ 1797.094891][ T12] bond9 (unregistering): Released all slaves [ 1797.139082][ T12] bond10 (unregistering): Released all slaves [ 1797.153214][T13559] Bluetooth: hci1: expected 36 bytes, got 2 bytes [ 1797.180808][ T12] bond11 (unregistering): Released all slaves [ 1797.202493][T13524] syzkaller1: entered promiscuous mode [ 1797.220095][T13524] syzkaller1: entered allmulticast mode [ 1797.297455][T30426] net_ratelimit: 8 callbacks suppressed [ 1797.297475][T30426] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1797.313972][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1797.326163][ T7329] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1797.415089][ T7329] bond2: (slave gretap0): failed to get link speed/duplex [ 1797.492456][ T12] tipc: Left network mode [ 1797.685948][ T1150] bond2: (slave gretap0): failed to get link speed/duplex [ 1797.855789][T30427] bond2: (slave gretap0): failed to get link speed/duplex [ 1797.964081][T30429] bond2: (slave gretap0): failed to get link speed/duplex [ 1798.041470][T13581] netlink: 12 bytes leftover after parsing attributes in process `syz.1.11636'. [ 1798.182977][T13581] netlink: 12 bytes leftover after parsing attributes in process `syz.1.11636'. [ 1798.289691][T13572] xfrm0 speed is unknown, defaulting to 1000 [ 1798.328700][ T9953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1798.491504][ T1150] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1798.562821][T13594] sch_tbf: peakrate 7 is lower than or equals to rate 6829859379779001161 ! [ 1798.644519][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1798.838789][T13604] netlink: 8 bytes leftover after parsing attributes in process `syz.5.11640'. [ 1798.901001][T13607] netlink: 8 bytes leftover after parsing attributes in process `syz.4.11641'. [ 1798.970785][ T4478] Bluetooth: hci1: command tx timeout [ 1799.077486][T13457] bridge0: port 1(bridge_slave_0) entered blocking state [ 1799.099584][T13457] bridge0: port 1(bridge_slave_0) entered disabled state [ 1799.114994][T13457] bridge_slave_0: entered allmulticast mode [ 1799.131058][T13457] bridge_slave_0: entered promiscuous mode [ 1799.151726][T13457] bridge0: port 2(bridge_slave_1) entered blocking state [ 1799.170527][T13457] bridge0: port 2(bridge_slave_1) entered disabled state [ 1799.187460][T13457] bridge_slave_1: entered allmulticast mode [ 1799.204291][T13457] bridge_slave_1: entered promiscuous mode [ 1799.356948][T13614] netlink: 'syz.0.11643': attribute type 1 has an invalid length. [ 1799.385934][T13614] netlink: 16 bytes leftover after parsing attributes in process `syz.0.11643'. [ 1799.451699][ T5294] 8021q: adding VLAN 0 to HW filter on device eth5 [ 1799.522543][T13457] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1799.557035][T13457] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1799.569367][T13627] netlink: 'syz.5.11645': attribute type 1 has an invalid length. [ 1799.730593][T13457] team0: Port device team_slave_0 added [ 1799.810271][T13642] netlink: 8 bytes leftover after parsing attributes in process `syz.4.11648'. [ 1799.853503][T13457] team0: Port device team_slave_1 added [ 1800.176010][T13457] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1800.205257][T13457] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1800.294242][T13457] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1800.343911][T13457] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1800.357007][T13457] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1800.387391][T13457] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1800.820928][T13457] hsr_slave_0: entered promiscuous mode [ 1800.839399][T13457] hsr_slave_1: entered promiscuous mode [ 1800.876574][T13457] debugfs: 'hsr0' already exists in 'hsr' [ 1800.891608][T13457] Cannot create hsr debugfs directory [ 1801.031957][T13682] FAULT_INJECTION: forcing a failure. [ 1801.031957][T13682] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1801.047171][ T4949] Bluetooth: hci1: command tx timeout [ 1801.071624][T13682] CPU: 1 UID: 0 PID: 13682 Comm: syz.0.11658 Not tainted syzkaller #0 PREEMPT(full) [ 1801.071652][T13682] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1801.071666][T13682] Call Trace: [ 1801.071674][T13682] [ 1801.071684][T13682] dump_stack_lvl+0xe8/0x150 [ 1801.071714][T13682] should_fail_ex+0x412/0x560 [ 1801.071743][T13682] _copy_to_user+0x31/0xb0 [ 1801.071772][T13682] bpf_verifier_vlog+0x3ba/0x8f0 [ 1801.071794][T13682] ? __sort_r+0x2a5e/0x3270 [ 1801.071859][T13682] __btf_verifier_log+0xe2/0x140 [ 1801.071899][T13682] ? __pfx___btf_verifier_log+0x10/0x10 [ 1801.071944][T13682] __btf_verifier_log_type+0x3c6/0x690 [ 1801.071990][T13682] ? __pfx___btf_verifier_log_type+0x10/0x10 [ 1801.072029][T13682] ? __pfx_sort+0x10/0x10 [ 1801.072059][T13682] ? __pfx_btf_sec_info_cmp+0x10/0x10 [ 1801.072089][T13682] btf_array_check_meta+0x1d9/0x2b0 [ 1801.072114][T13682] btf_parse_type_sec+0x446/0x24f0 [ 1801.072147][T13682] ? __pfx_btf_check_sec_info+0x10/0x10 [ 1801.072179][T13682] ? btf_parse_str_sec+0x265/0x310 [ 1801.072204][T13682] ? btf_parse_layout_sec+0x67/0x270 [ 1801.072231][T13682] btf_new_fd+0x444/0xd40 [ 1801.072269][T13682] ? __pfx_btf_new_fd+0x10/0x10 [ 1801.072298][T13682] ? bpf_token_put+0x143/0x160 [ 1801.072323][T13682] ? bpf_btf_load+0x126/0x190 [ 1801.072346][T13682] __sys_bpf+0x4e5/0x950 [ 1801.072380][T13682] ? __pfx___sys_bpf+0x10/0x10 [ 1801.072427][T13682] ? ksys_write+0x242/0x270 [ 1801.072463][T13682] ? __pfx_ksys_write+0x10/0x10 [ 1801.072497][T13682] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1801.072521][T13682] __x64_sys_bpf+0x7c/0x90 [ 1801.072551][T13682] do_syscall_64+0x174/0x580 [ 1801.072575][T13682] ? trace_irq_disable+0x3b/0x140 [ 1801.072607][T13682] ? clear_bhb_loop+0x40/0x90 [ 1801.072634][T13682] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1801.072656][T13682] RIP: 0033:0x7f769119ce59 [ 1801.072676][T13682] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1801.072695][T13682] RSP: 002b:00007f7692026028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1801.072718][T13682] RAX: ffffffffffffffda RBX: 00007f7691415fa0 RCX: 00007f769119ce59 [ 1801.072735][T13682] RDX: 0000000000000028 RSI: 00002000000001c0 RDI: 0000000000000012 [ 1801.072748][T13682] RBP: 00007f7692026090 R08: 0000000000000000 R09: 0000000000000000 [ 1801.072761][T13682] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1801.072774][T13682] R13: 00007f7691416038 R14: 00007f7691415fa0 R15: 00007fff54bc46b8 [ 1801.072808][T13682] [ 1801.623405][ T5294] 8021q: adding VLAN 0 to HW filter on device eth6 [ 1801.932379][ T12] hsr_slave_0: left promiscuous mode [ 1801.952878][ T12] hsr_slave_1: left promiscuous mode [ 1801.965699][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1801.999235][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1802.037587][ T12] team0 (unregistering): Port device batadv2 removed [ 1802.061414][ T12] team0 (unregistering): Port device batadv1 removed [ 1802.081550][ T12] pim6reg (unregistering): left allmulticast mode [ 1802.274962][ T12] team0 (unregistering): Port device team_slave_1 removed [ 1802.297525][ T12] team0 (unregistering): Port device team_slave_0 removed [ 1802.470377][T13715] tc_dump_action: action bad kind [ 1802.486979][T13727] IPVS: sync thread started: state = BACKUP, mcast_ifn = lo, syncid = 1, id = 0 [ 1802.544306][ T785] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 1802.598104][T13729] netlink: 'syz.5.11672': attribute type 1 has an invalid length. [ 1802.614127][ T9848] net_ratelimit: 9 callbacks suppressed [ 1802.614147][ T9848] bond2: (slave gretap0): failed to get link speed/duplex [ 1802.634483][T13729] netlink: 760 bytes leftover after parsing attributes in process `syz.5.11672'. [ 1802.764012][ T9848] bond2: (slave gretap0): failed to get link speed/duplex [ 1802.932642][T13739] netlink: 4 bytes leftover after parsing attributes in process `syz.0.11675'. [ 1802.956983][ T785] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 1803.039023][ T9848] bond2: (slave gretap0): failed to get link speed/duplex [ 1803.070631][T13746] netlink: 4 bytes leftover after parsing attributes in process `syz.4.11677'. [ 1803.114476][ T9848] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1803.128975][T30426] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1803.137355][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1803.210302][T13746] team_slave_0 (unregistering): left allmulticast mode [ 1803.235800][T13746] team0: Port device team_slave_0 removed [ 1803.364537][T13759] veth0: entered promiscuous mode [ 1803.391894][ T12] IPVS: stop unused estimator thread 0... [ 1803.404357][ T9848] bond2: (slave gretap0): failed to get link speed/duplex [ 1803.497927][ T9848] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 1803.822170][ T4949] block nbd4: Receive control failed (result -22) [ 1803.830827][ T7329] bond2: (slave gretap0): failed to get link speed/duplex [ 1803.868789][T13765] nbd4: detected capacity change from 0 to 32 [ 1803.920784][T13341] block nbd4: Dead connection, failed to find a fallback [ 1803.929375][T13341] block nbd4: shutting down sockets [ 1803.935201][T13341] blk_print_req_error: 27 callbacks suppressed [ 1803.935218][T13341] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1803.951150][T13341] buffer_io_error: 27 callbacks suppressed [ 1803.951165][T13341] Buffer I/O error on dev nbd4, logical block 0, async page read [ 1803.966402][T13341] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1803.986299][T13341] Buffer I/O error on dev nbd4, logical block 0, async page read [ 1804.014575][T30429] bond2: (slave gretap0): failed to get link speed/duplex [ 1804.015296][T13341] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1804.073677][T13341] Buffer I/O error on dev nbd4, logical block 0, async page read [ 1804.087590][T13341] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1804.099650][T13341] Buffer I/O error on dev nbd4, logical block 0, async page read [ 1804.107960][T13341] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1804.117480][T13341] Buffer I/O error on dev nbd4, logical block 0, async page read [ 1804.151599][T13341] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1804.193270][T13754] veth0: left promiscuous mode [ 1804.195109][T13341] Buffer I/O error on dev nbd4, logical block 0, async page read [ 1804.224592][T13341] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1804.234259][T13341] Buffer I/O error on dev nbd4, logical block 0, async page read [ 1804.242226][T13341] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1804.252415][ T9848] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1804.265452][T13341] Buffer I/O error on dev nbd4, logical block 0, async page read [ 1804.285785][T13779] lo: entered allmulticast mode [ 1804.297063][T13341] ldm_validate_partition_table(): Disk read failed. [ 1804.306918][T13341] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1804.319618][T13341] Buffer I/O error on dev nbd4, logical block 0, async page read [ 1804.340552][T13341] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1804.366226][T13341] Buffer I/O error on dev nbd4, logical block 0, async page read [ 1804.388158][T13341] Dev nbd4: unable to read RDB block 0 [ 1804.406565][T13457] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 1804.415918][T13341] nbd4: unable to read partition table [ 1804.441423][T13341] ldm_validate_partition_table(): Disk read failed. [ 1804.451836][T13457] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1804.462708][T13341] Dev nbd4: unable to read RDB block 0 [ 1804.472579][T13457] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 1804.481962][T13341] nbd4: unable to read partition table [ 1804.506518][T13457] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1804.549548][T13457] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 1804.611666][T13457] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1804.626613][ T7329] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 1804.651479][ T7329] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 1804.670877][T13457] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 1804.687160][T13797] netlink: 104 bytes leftover after parsing attributes in process `syz.4.11688'. [ 1804.707181][T13457] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1804.753245][T13804] netlink: 16 bytes leftover after parsing attributes in process `syz.1.11689'. [ 1804.896758][T13816] sctp: [Deprecated]: syz.4.11690 (pid 13816) Use of int in maxseg socket option. [ 1804.896758][T13816] Use struct sctp_assoc_value instead [ 1805.089069][T13821] netlink: 4 bytes leftover after parsing attributes in process `syz.4.11691'. [ 1805.226293][T13829] netlink: 272 bytes leftover after parsing attributes in process `syz.1.11692'. [ 1805.296073][ T4478] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 1805.684219][ T9956] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 1806.450660][T13867] FAULT_INJECTION: forcing a failure. [ 1806.450660][T13867] name failslab, interval 1, probability 0, space 0, times 0 [ 1806.463414][T13867] CPU: 1 UID: 0 PID: 13867 Comm: syz.1.11699 Not tainted syzkaller #0 PREEMPT(full) [ 1806.463439][T13867] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1806.463451][T13867] Call Trace: [ 1806.463459][T13867] [ 1806.463467][T13867] dump_stack_lvl+0xe8/0x150 [ 1806.463494][T13867] should_fail_ex+0x412/0x560 [ 1806.463519][T13867] should_failslab+0xa8/0x100 [ 1806.463540][T13867] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 1806.463572][T13867] ? __alloc_skb+0x186/0x7d0 [ 1806.463590][T13867] ? __alloc_skb+0x1d0/0x7d0 [ 1806.463615][T13867] ? __local_bh_enable_ip+0xd0/0x130 [ 1806.463639][T13867] __alloc_skb+0x1d0/0x7d0 [ 1806.463657][T13867] ? bpf_lsm_socket_getpeersec_dgram+0x9/0x20 [ 1806.463688][T13867] netlink_sendmsg+0x5d4/0xb40 [ 1806.463719][T13867] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1806.463745][T13867] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1806.463776][T13867] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1806.463803][T13867] ____sys_sendmsg+0x972/0x9f0 [ 1806.463825][T13867] ? __might_fault+0xaf/0x130 [ 1806.463856][T13867] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1806.463905][T13867] ? import_iovec+0x73/0xa0 [ 1806.463933][T13867] ___sys_sendmsg+0x2a5/0x360 [ 1806.463955][T13867] ? __lock_acquire+0x6b5/0x2cf0 [ 1806.463981][T13867] ? __pfx____sys_sendmsg+0x10/0x10 [ 1806.464047][T13867] ? __fget_files+0x2a/0x420 [ 1806.464088][T13867] ? __fget_files+0x3a0/0x420 [ 1806.464123][T13867] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1806.464150][T13867] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1806.464183][T13867] ? __pfx_ksys_write+0x10/0x10 [ 1806.464220][T13867] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1806.464242][T13867] do_syscall_64+0x174/0x580 [ 1806.464264][T13867] ? trace_irq_disable+0x3b/0x140 [ 1806.464295][T13867] ? clear_bhb_loop+0x40/0x90 [ 1806.464320][T13867] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1806.464340][T13867] RIP: 0033:0x7fca1019ce59 [ 1806.464359][T13867] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1806.464377][T13867] RSP: 002b:00007fca0e3f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1806.464398][T13867] RAX: ffffffffffffffda RBX: 00007fca10415fa0 RCX: 00007fca1019ce59 [ 1806.464413][T13867] RDX: 0000000004000000 RSI: 0000200000000100 RDI: 0000000000000004 [ 1806.464426][T13867] RBP: 00007fca0e3f6090 R08: 0000000000000000 R09: 0000000000000000 [ 1806.464439][T13867] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1806.464450][T13867] R13: 00007fca10416038 R14: 00007fca10415fa0 R15: 00007ffcfbf85f78 [ 1806.464482][T13867] [ 1807.837376][ T1150] net_ratelimit: 8 callbacks suppressed [ 1807.837397][ T1150] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1808.226574][T13859] netlink: 4 bytes leftover after parsing attributes in process `syz.0.11695'. [ 1808.356016][T30430] bond2: (slave gretap0): failed to get link speed/duplex [ 1808.457005][T13457] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1808.497755][T30426] bond2: (slave gretap0): failed to get link speed/duplex [ 1808.551758][T13457] 8021q: adding VLAN 0 to HW filter on device team0 [ 1808.606377][T30426] bridge0: port 1(bridge_slave_0) entered blocking state [ 1808.613644][T30426] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1808.638966][T13890] veth0: entered promiscuous mode [ 1808.657531][T30430] bond2: (slave gretap0): failed to get link speed/duplex [ 1808.672511][ T7329] bridge0: port 2(bridge_slave_1) entered blocking state [ 1808.679745][ T7329] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1808.773817][ T12] bond2: (slave gretap0): failed to get link speed/duplex [ 1808.887324][ T7329] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1808.895926][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1808.944444][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1808.956839][ T1150] bond2: (slave gretap0): failed to get link speed/duplex [ 1808.964136][T13905] FAULT_INJECTION: forcing a failure. [ 1808.964136][T13905] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1808.964171][T13905] CPU: 1 UID: 0 PID: 13905 Comm: syz.5.11706 Not tainted syzkaller #0 PREEMPT(full) [ 1808.964196][T13905] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1808.964208][T13905] Call Trace: [ 1808.964217][T13905] [ 1808.964226][T13905] dump_stack_lvl+0xe8/0x150 [ 1808.964256][T13905] should_fail_ex+0x412/0x560 [ 1808.964286][T13905] _copy_from_iter+0x1d3/0x1670 [ 1808.964315][T13905] ? sock_alloc_send_pskb+0x896/0x990 [ 1808.964350][T13905] ? __pfx__copy_from_iter+0x10/0x10 [ 1808.964384][T13905] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 1808.964492][T13905] skb_copy_datagram_from_iter+0xf5/0x710 [ 1808.964606][T13905] ? dev_get_by_index+0x22/0x2e0 [ 1808.964685][T13905] ? skb_put+0x11b/0x210 [ 1808.964778][T13905] packet_sendmsg+0x35b1/0x4fb0 [ 1808.964962][T13905] ? unwind_next_frame+0xa6/0x2550 [ 1808.965051][T13905] ? __pfx_packet_sendmsg+0x10/0x10 [ 1808.965114][T13905] ? aa_sk_perm+0x6d5/0x900 [ 1808.965216][T13905] ? __pfx_aa_sk_perm+0x10/0x10 [ 1808.965299][T13905] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 1808.965493][T13905] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1808.965617][T13905] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1808.965713][T13905] ____sys_sendmsg+0x972/0x9f0 [ 1808.965823][T13905] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1808.965946][T13905] ? import_iovec+0x73/0xa0 [ 1808.966021][T13905] ___sys_sendmsg+0x2a5/0x360 [ 1808.966085][T13905] ? __lock_acquire+0x6b5/0x2cf0 [ 1808.966166][T13905] ? __pfx____sys_sendmsg+0x10/0x10 [ 1808.966337][T13905] ? __fget_files+0x2a/0x420 [ 1808.966409][T13905] ? __fget_files+0x3a0/0x420 [ 1808.966519][T13905] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1808.966591][T13905] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1808.966687][T13905] ? __pfx_ksys_write+0x10/0x10 [ 1808.966797][T13905] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1808.966861][T13905] do_syscall_64+0x174/0x580 [ 1808.966931][T13905] ? trace_irq_disable+0x3b/0x140 [ 1808.967027][T13905] ? clear_bhb_loop+0x40/0x90 [ 1808.967098][T13905] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1808.967157][T13905] RIP: 0033:0x7fe8a399ce59 [ 1808.967209][T13905] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1808.967266][T13905] RSP: 002b:00007fe8a4770028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1808.967325][T13905] RAX: ffffffffffffffda RBX: 00007fe8a3c15fa0 RCX: 00007fe8a399ce59 [ 1808.967378][T13905] RDX: 0000000000004005 RSI: 0000200000000280 RDI: 0000000000000009 [ 1808.967424][T13905] RBP: 00007fe8a4770090 R08: 0000000000000000 R09: 0000000000000000 [ 1808.967463][T13905] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1808.967495][T13905] R13: 00007fe8a3c16038 R14: 00007fe8a3c15fa0 R15: 00007ffd3e2d5aa8 [ 1808.967570][T13905] [ 1809.054186][ C1] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 1809.207524][T30430] bond2: (slave gretap0): failed to get link speed/duplex [ 1809.401088][T13888] veth0: left promiscuous mode [ 1809.760165][T13928] netlink: 8 bytes leftover after parsing attributes in process `syz.5.11710'. [ 1809.976265][T13457] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1810.035719][T13457] veth0_vlan: entered promiscuous mode [ 1810.059254][T13457] veth1_vlan: entered promiscuous mode [ 1810.104434][T13457] veth0_macvtap: entered promiscuous mode [ 1810.119553][T13457] veth1_macvtap: entered promiscuous mode [ 1810.144212][T13457] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1810.162726][T13457] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1810.187424][ T12] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1810.196934][ T12] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1810.213504][ T12] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1810.224017][ T12] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1810.371664][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1810.392025][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1810.430094][T30426] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1810.439518][T30426] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1810.643868][ T4478] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 1810.840905][T13965] netlink: 68 bytes leftover after parsing attributes in process `syz.5.11714'. [ 1810.880272][T13965] netlink: 64 bytes leftover after parsing attributes in process `syz.5.11714'. [ 1811.151624][T13982] syzkaller1: entered promiscuous mode [ 1811.178987][T13982] syzkaller1: entered allmulticast mode [ 1811.188183][T13984] sock: sock_timestamping_bind_phc: sock not bind to device [ 1811.595427][T14004] veth0: entered promiscuous mode [ 1812.007796][T14029] FAULT_INJECTION: forcing a failure. [ 1812.007796][T14029] name failslab, interval 1, probability 0, space 0, times 0 [ 1812.020889][T14029] CPU: 0 UID: 0 PID: 14029 Comm: syz.3.11732 Not tainted syzkaller #0 PREEMPT(full) [ 1812.020916][T14029] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1812.020929][T14029] Call Trace: [ 1812.020938][T14029] [ 1812.020947][T14029] dump_stack_lvl+0xe8/0x150 [ 1812.020977][T14029] should_fail_ex+0x412/0x560 [ 1812.021013][T14029] should_failslab+0xa8/0x100 [ 1812.021037][T14029] __kmalloc_cache_noprof+0x88/0x660 [ 1812.021069][T14029] ? sctp_add_bind_addr+0x8c/0x370 [ 1812.021108][T14029] sctp_add_bind_addr+0x8c/0x370 [ 1812.021162][T14029] sctp_copy_local_addr_list+0x314/0x4f0 [ 1812.021200][T14029] ? sctp_copy_local_addr_list+0xa4/0x4f0 [ 1812.021235][T14029] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 1812.021271][T14029] ? sctp_v6_is_any+0x64/0x80 [ 1812.021296][T14029] ? sctp_copy_one_addr+0x93/0x360 [ 1812.021333][T14029] sctp_bind_addr_copy+0xb3/0x3c0 [ 1812.021368][T14029] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 1812.021402][T14029] sctp_connect_new_asoc+0x2ff/0x6b0 [ 1812.021443][T14029] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 1812.021493][T14029] ? sctp_inet6_send_verify+0x23a/0x300 [ 1812.021526][T14029] ? sctp_endpoint_lookup_assoc+0xd1/0x260 [ 1812.021557][T14029] __sctp_connect+0x5cb/0xdc0 [ 1812.021595][T14029] ? __pfx___sctp_connect+0x10/0x10 [ 1812.021620][T14029] ? security_sctp_bind_connect+0x7e/0x2c0 [ 1812.021668][T14029] ? __sctp_setsockopt_connectx+0xc7/0x190 [ 1812.021705][T14029] sctp_getsockopt_connectx3+0x227/0x360 [ 1812.021739][T14029] ? lock_sock_nested+0x6a/0x100 [ 1812.021774][T14029] ? __pfx_sctp_getsockopt_connectx3+0x10/0x10 [ 1812.021813][T14029] ? sctp_getsockopt+0x12f/0xb90 [ 1812.021843][T14029] ? __local_bh_enable_ip+0xd0/0x130 [ 1812.021884][T14029] sctp_getsockopt+0x984/0xb90 [ 1812.021908][T14029] ? __pfx_sock_common_getsockopt+0x10/0x10 [ 1812.021939][T14029] do_sock_getsockopt+0x51d/0x7e0 [ 1812.021969][T14029] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 1812.022009][T14029] ? __fget_files+0x3a0/0x420 [ 1812.022034][T14029] ? __fget_files+0x2a/0x420 [ 1812.022066][T14029] __x64_sys_getsockopt+0x1a4/0x240 [ 1812.022095][T14029] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1812.022118][T14029] do_syscall_64+0x174/0x580 [ 1812.022141][T14029] ? trace_irq_disable+0x3b/0x140 [ 1812.022172][T14029] ? clear_bhb_loop+0x40/0x90 [ 1812.022198][T14029] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1812.022218][T14029] RIP: 0033:0x7f971a79ce59 [ 1812.022236][T14029] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1812.022254][T14029] RSP: 002b:00007f971b5aa028 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 1812.022275][T14029] RAX: ffffffffffffffda RBX: 00007f971aa15fa0 RCX: 00007f971a79ce59 [ 1812.022289][T14029] RDX: 000000000000006f RSI: 0000000000000084 RDI: 0000000000000004 [ 1812.022302][T14029] RBP: 00007f971b5aa090 R08: 0000200000000040 R09: 0000000000000000 [ 1812.022316][T14029] R10: 0000200000000280 R11: 0000000000000246 R12: 0000000000000002 [ 1812.022329][T14029] R13: 00007f971aa16038 R14: 00007f971aa15fa0 R15: 00007ffe28f1d0f8 [ 1812.022362][T14029] [ 1812.457001][T14003] veth0: left promiscuous mode [ 1812.479985][T14026] Bluetooth: hci1: expected 36 bytes, got 2 bytes [ 1812.530468][ T785] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 1812.709921][T14037] netlink: 8 bytes leftover after parsing attributes in process `syz.4.11735'. [ 1812.721929][T14037] netlink: 11 bytes leftover after parsing attributes in process `syz.4.11735'. [ 1812.855914][T30429] net_ratelimit: 30 callbacks suppressed [ 1812.855933][T30429] bond2: (slave gretap0): failed to get link speed/duplex [ 1812.984825][T30430] bond2: (slave gretap0): failed to get link speed/duplex [ 1813.114307][ T785] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 1813.115939][T30430] bond2: (slave gretap0): failed to get link speed/duplex [ 1813.253670][T30426] bond2: (slave gretap0): failed to get link speed/duplex [ 1813.284076][T14057] netlink: 4 bytes leftover after parsing attributes in process `syz.1.11741'. [ 1813.294333][T14057] netlink: 'syz.1.11741': attribute type 1 has an invalid length. [ 1813.374529][T30430] bond2: (slave gretap0): failed to get link speed/duplex [ 1813.421108][T14067] netlink: 8 bytes leftover after parsing attributes in process `syz.1.11744'. [ 1813.496163][T30430] bond2: (slave gretap0): failed to get link speed/duplex [ 1813.525145][ T9953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1813.604261][ T4478] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 1813.613868][ T1150] bond2: (slave gretap0): failed to get link speed/duplex [ 1813.688331][T14078] syzkaller0: entered promiscuous mode [ 1813.716012][T14078] syzkaller0: entered allmulticast mode [ 1813.864138][T30426] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1814.075607][T30426] bond2: (slave gretap0): failed to get link speed/duplex [ 1814.376298][T14130] veth0: entered promiscuous mode [ 1815.199078][T14129] veth0: left promiscuous mode [ 1815.396596][T14148] FAULT_INJECTION: forcing a failure. [ 1815.396596][T14148] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1815.409792][T14148] CPU: 1 UID: 0 PID: 14148 Comm: syz.5.11764 Not tainted syzkaller #0 PREEMPT(full) [ 1815.409809][T14148] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1815.409818][T14148] Call Trace: [ 1815.409823][T14148] [ 1815.409829][T14148] dump_stack_lvl+0xe8/0x150 [ 1815.409850][T14148] should_fail_ex+0x412/0x560 [ 1815.409871][T14148] _copy_from_user+0x2d/0xb0 [ 1815.409889][T14148] kstrtouint_from_user+0xd6/0x180 [ 1815.409904][T14148] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 1815.409928][T14148] proc_fail_nth_write+0x8e/0x210 [ 1815.409947][T14148] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 1815.409967][T14148] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 1815.409986][T14148] vfs_write+0x29a/0xb90 [ 1815.410011][T14148] ? __pfx_vfs_write+0x10/0x10 [ 1815.410031][T14148] ? __fget_files+0x2a/0x420 [ 1815.410050][T14148] ? __fget_files+0x3a0/0x420 [ 1815.410065][T14148] ? __fget_files+0x2a/0x420 [ 1815.410087][T14148] ksys_write+0x150/0x270 [ 1815.410108][T14148] ? __pfx_ksys_write+0x10/0x10 [ 1815.410132][T14148] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1815.410147][T14148] do_syscall_64+0x174/0x580 [ 1815.410161][T14148] ? trace_irq_disable+0x3b/0x140 [ 1815.410182][T14148] ? clear_bhb_loop+0x40/0x90 [ 1815.410198][T14148] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1815.410211][T14148] RIP: 0033:0x7fe8a395d68e [ 1815.410223][T14148] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1815.410234][T14148] RSP: 002b:00007fe8a476ffe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1815.410248][T14148] RAX: ffffffffffffffda RBX: 00007fe8a47706c0 RCX: 00007fe8a395d68e [ 1815.410257][T14148] RDX: 0000000000000001 RSI: 00007fe8a47700a0 RDI: 0000000000000003 [ 1815.410266][T14148] RBP: 00007fe8a4770090 R08: 0000000000000000 R09: 0000000000000000 [ 1815.410274][T14148] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1815.410282][T14148] R13: 00007fe8a3c16038 R14: 00007fe8a3c15fa0 R15: 00007ffd3e2d5aa8 [ 1815.410303][T14148] [ 1815.751575][T14153] netlink: 40 bytes leftover after parsing attributes in process `syz.5.11765'. [ 1816.403935][ T4478] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 1816.764723][T14085] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1816.957210][T14159] netlink: 12 bytes leftover after parsing attributes in process `syz.4.11769'. [ 1817.026802][T14163] netlink: 24 bytes leftover after parsing attributes in process `syz.1.11770'. [ 1817.082449][T14166] FAULT_INJECTION: forcing a failure. [ 1817.082449][T14166] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 1817.102343][T14161] netlink: 4 bytes leftover after parsing attributes in process `syz.3.11768'. [ 1817.121801][T14161] netlink: 12 bytes leftover after parsing attributes in process `syz.3.11768'. [ 1817.141476][T14166] CPU: 1 UID: 0 PID: 14166 Comm: syz.0.11771 Not tainted syzkaller #0 PREEMPT(full) [ 1817.141518][T14166] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1817.141531][T14166] Call Trace: [ 1817.141540][T14166] [ 1817.141550][T14166] dump_stack_lvl+0xe8/0x150 [ 1817.141583][T14166] should_fail_ex+0x412/0x560 [ 1817.141622][T14166] prepare_alloc_pages+0x22a/0x650 [ 1817.141662][T14166] __alloc_frozen_pages_noprof+0x12f/0x380 [ 1817.141688][T14166] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 1817.141725][T14166] ? __pfx_policy_nodemask+0x10/0x10 [ 1817.141751][T14166] ? dst_release+0x72/0x1b0 [ 1817.141782][T14166] alloc_pages_mpol+0x235/0x490 [ 1817.141808][T14166] folio_alloc_mpol_noprof+0x39/0x160 [ 1817.141831][T14166] vma_alloc_folio_noprof+0xe1/0x1e0 [ 1817.141855][T14166] ? __pfx_vma_alloc_folio_noprof+0x10/0x10 [ 1817.141887][T14166] do_wp_page+0x118a/0x4cc0 [ 1817.141919][T14166] ? __pte_offset_map+0x29/0x240 [ 1817.141954][T14166] ? __pfx_do_wp_page+0x10/0x10 [ 1817.141977][T14166] ? do_raw_spin_lock+0x12b/0x2f0 [ 1817.142011][T14166] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 1817.142051][T14166] handle_mm_fault+0x1698/0x3170 [ 1817.142091][T14166] ? handle_mm_fault+0xf1/0x3170 [ 1817.142125][T14166] ? __pfx_handle_mm_fault+0x10/0x10 [ 1817.142165][T14166] ? __lock_acquire+0x6b5/0x2cf0 [ 1817.142191][T14166] ? lock_mm_and_find_vma+0xa7/0x340 [ 1817.142230][T14166] do_user_addr_fault+0x75b/0x1340 [ 1817.142269][T14166] exc_page_fault+0x6a/0xc0 [ 1817.142294][T14166] asm_exc_page_fault+0x26/0x30 [ 1817.142314][T14166] RIP: 0010:__put_user_4+0xd/0x20 [ 1817.142336][T14166] Code: 66 89 01 31 c9 0f 01 ca c3 cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 48 89 cb 48 c1 fb 3f 48 09 d9 0f 01 cb <89> 01 31 c9 0f 01 ca c3 cc cc cc cc 90 90 90 90 90 90 90 90 90 90 [ 1817.142353][T14166] RSP: 0018:ffffc900062c7c98 EFLAGS: 00050202 [ 1817.142371][T14166] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000200000007ff8 [ 1817.142385][T14166] RDX: 0000000000000000 RSI: ffffffff8e2239f3 RDI: ffffffff8c28b9e0 [ 1817.142399][T14166] RBP: ffffc900062c7eb0 R08: ffffffff8218909f R09: ffff88807b6d0f78 [ 1817.142414][T14166] R10: 00000000ffffff97 R11: 0000000000000000 R12: 1ffff92000c58f9c [ 1817.142428][T14166] R13: 0000000000040000 R14: 0000200000007fc0 R15: 00000000000003ff [ 1817.142449][T14166] ? __might_fault+0xaf/0x130 [ 1817.142484][T14166] __sys_sendmmsg+0x2b0/0x4e0 [ 1817.142514][T14166] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1817.142536][T14166] ? __mutex_unlock_slowpath+0x1be/0x6f0 [ 1817.142586][T14166] ? ksys_write+0x242/0x270 [ 1817.142618][T14166] ? __pfx_ksys_write+0x10/0x10 [ 1817.142654][T14166] __x64_sys_sendmmsg+0xa0/0xc0 [ 1817.142678][T14166] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1817.142700][T14166] do_syscall_64+0x174/0x580 [ 1817.142728][T14166] ? trace_irq_disable+0x3b/0x140 [ 1817.142776][T14166] ? clear_bhb_loop+0x40/0x90 [ 1817.142821][T14166] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1817.142843][T14166] RIP: 0033:0x7f769119ce59 [ 1817.142863][T14166] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1817.142882][T14166] RSP: 002b:00007f7692026028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1817.142903][T14166] RAX: ffffffffffffffda RBX: 00007f7691415fa0 RCX: 00007f769119ce59 [ 1817.142919][T14166] RDX: 000000000800001d RSI: 0000200000007fc0 RDI: 0000000000000003 [ 1817.142934][T14166] RBP: 00007f7692026090 R08: 0000000000000000 R09: 0000000000000000 [ 1817.142949][T14166] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1817.142962][T14166] R13: 00007f7691416038 R14: 00007f7691415fa0 R15: 00007fff54bc46b8 [ 1817.142999][T14166] [ 1817.843927][ C1] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 1817.903723][ T1150] net_ratelimit: 39 callbacks suppressed [ 1817.903744][ T1150] bond2: (slave gretap0): failed to get link speed/duplex [ 1817.988544][T14196] bond2: option ad_user_port_key: invalid value (65535) [ 1817.996678][T14196] bond2: option ad_user_port_key: allowed values 0 - 1023 [ 1818.007805][T14196] bond2 (unregistering): Released all slaves [ 1818.030740][T14202] openvswitch: netlink: IP tunnel dst address not specified [ 1818.047037][T14202] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1818.088980][ T12] bond2: (slave gretap0): failed to get link speed/duplex [ 1818.188984][T14207] netlink: 277 bytes leftover after parsing attributes in process `syz.3.11784'. [ 1818.233948][ T9848] bond2: (slave gretap0): failed to get link speed/duplex [ 1818.310022][T14212] netlink: 'syz.1.11786': attribute type 10 has an invalid length. [ 1818.343770][ T9848] bond2: (slave gretap0): failed to get link speed/duplex [ 1818.430641][T14217] FAULT_INJECTION: forcing a failure. [ 1818.430641][T14217] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1818.452552][T14217] CPU: 1 UID: 0 PID: 14217 Comm: syz.1.11788 Not tainted syzkaller #0 PREEMPT(full) [ 1818.452578][T14217] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1818.452590][T14217] Call Trace: [ 1818.452599][T14217] [ 1818.452608][T14217] dump_stack_lvl+0xe8/0x150 [ 1818.452636][T14217] should_fail_ex+0x412/0x560 [ 1818.452664][T14217] _copy_to_user+0x31/0xb0 [ 1818.452691][T14217] bpf_verifier_vlog+0x3ba/0x8f0 [ 1818.452713][T14217] ? __sort_r+0x2a5e/0x3270 [ 1818.452745][T14217] btf_verifier_log+0x11d/0x1a0 [ 1818.452780][T14217] ? __pfx_btf_verifier_log+0x10/0x10 [ 1818.452823][T14217] __btf_verifier_log_type+0x45b/0x690 [ 1818.452865][T14217] ? __pfx___btf_verifier_log_type+0x10/0x10 [ 1818.452902][T14217] ? __pfx_sort+0x10/0x10 [ 1818.452923][T14217] ? __pfx_btf_sec_info_cmp+0x10/0x10 [ 1818.452953][T14217] btf_array_check_meta+0x1d9/0x2b0 [ 1818.452975][T14217] btf_parse_type_sec+0x446/0x24f0 [ 1818.453006][T14217] ? __pfx_btf_check_sec_info+0x10/0x10 [ 1818.453037][T14217] ? btf_parse_str_sec+0x265/0x310 [ 1818.453059][T14217] ? btf_parse_layout_sec+0x67/0x270 [ 1818.453087][T14217] btf_new_fd+0x444/0xd40 [ 1818.453121][T14217] ? __pfx_btf_new_fd+0x10/0x10 [ 1818.453157][T14217] ? bpf_token_put+0x143/0x160 [ 1818.453180][T14217] ? bpf_btf_load+0x126/0x190 [ 1818.453201][T14217] __sys_bpf+0x4e5/0x950 [ 1818.453232][T14217] ? __pfx___sys_bpf+0x10/0x10 [ 1818.453275][T14217] ? ksys_write+0x242/0x270 [ 1818.453307][T14217] ? __pfx_ksys_write+0x10/0x10 [ 1818.453341][T14217] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1818.453363][T14217] __x64_sys_bpf+0x7c/0x90 [ 1818.453391][T14217] do_syscall_64+0x174/0x580 [ 1818.453413][T14217] ? trace_irq_disable+0x3b/0x140 [ 1818.453443][T14217] ? clear_bhb_loop+0x40/0x90 [ 1818.453468][T14217] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1818.453489][T14217] RIP: 0033:0x7fca1019ce59 [ 1818.453507][T14217] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1818.453525][T14217] RSP: 002b:00007fca0e3f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1818.453546][T14217] RAX: ffffffffffffffda RBX: 00007fca10415fa0 RCX: 00007fca1019ce59 [ 1818.453565][T14217] RDX: 0000000000000028 RSI: 00002000000001c0 RDI: 0000000000000012 [ 1818.453579][T14217] RBP: 00007fca0e3f6090 R08: 0000000000000000 R09: 0000000000000000 [ 1818.453592][T14217] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1818.453604][T14217] R13: 00007fca10416038 R14: 00007fca10415fa0 R15: 00007ffcfbf85f78 [ 1818.453634][T14217] [ 1818.522305][ T9848] bond2: (slave gretap0): failed to get link speed/duplex [ 1818.823922][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1818.862848][T14227] netlink: 4 bytes leftover after parsing attributes in process `syz.1.11790'. [ 1818.920517][T14233] netlink: 12 bytes leftover after parsing attributes in process `syz.1.11790'. [ 1819.174676][ T1150] bond2: (slave gretap0): failed to get link speed/duplex [ 1819.303853][ T9848] bond2: (slave gretap0): failed to get link speed/duplex [ 1819.451292][T14259] netlink: 4 bytes leftover after parsing attributes in process `syz.5.11796'. [ 1819.691369][T14265] FAULT_INJECTION: forcing a failure. [ 1819.691369][T14265] name failslab, interval 1, probability 0, space 0, times 0 [ 1819.736234][T14265] CPU: 1 UID: 0 PID: 14265 Comm: syz.3.11797 Not tainted syzkaller #0 PREEMPT(full) [ 1819.736273][T14265] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1819.736286][T14265] Call Trace: [ 1819.736294][T14265] [ 1819.736303][T14265] dump_stack_lvl+0xe8/0x150 [ 1819.736331][T14265] should_fail_ex+0x412/0x560 [ 1819.736356][T14265] should_failslab+0xa8/0x100 [ 1819.736378][T14265] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 1819.736404][T14265] ? __alloc_skb+0x186/0x7d0 [ 1819.736423][T14265] ? __alloc_skb+0x1d0/0x7d0 [ 1819.736440][T14265] ? __local_bh_enable_ip+0xd0/0x130 [ 1819.736464][T14265] __alloc_skb+0x1d0/0x7d0 [ 1819.736483][T14265] ? netlink_ack_tlv_len+0x6c/0x210 [ 1819.736509][T14265] netlink_ack+0x146/0xa50 [ 1819.736546][T14265] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1819.736565][T14265] ? ref_tracker_free+0x693/0x840 [ 1819.736591][T14265] ? __pfx_ref_tracker_free+0x10/0x10 [ 1819.736624][T14265] netlink_rcv_skb+0x2b6/0x4b0 [ 1819.736649][T14265] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1819.736672][T14265] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1819.736708][T14265] ? netlink_deliver_tap+0x2e/0x1b0 [ 1819.736731][T14265] ? netlink_deliver_tap+0x2e/0x1b0 [ 1819.736760][T14265] netlink_unicast+0x75c/0x8e0 [ 1819.736792][T14265] netlink_sendmsg+0x813/0xb40 [ 1819.736825][T14265] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1819.736853][T14265] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1819.736886][T14265] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1819.736917][T14265] ____sys_sendmsg+0x972/0x9f0 [ 1819.736941][T14265] ? __might_fault+0xaf/0x130 [ 1819.736974][T14265] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1819.737013][T14265] ? import_iovec+0x73/0xa0 [ 1819.737042][T14265] ___sys_sendmsg+0x2a5/0x360 [ 1819.737064][T14265] ? __lock_acquire+0x6b5/0x2cf0 [ 1819.737092][T14265] ? __pfx____sys_sendmsg+0x10/0x10 [ 1819.737151][T14265] ? __fget_files+0x2a/0x420 [ 1819.737176][T14265] ? __fget_files+0x3a0/0x420 [ 1819.737212][T14265] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1819.737238][T14265] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1819.737275][T14265] ? rcu_is_watching+0x15/0xb0 [ 1819.737308][T14265] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1819.737329][T14265] do_syscall_64+0x174/0x580 [ 1819.737351][T14265] ? trace_irq_disable+0x3b/0x140 [ 1819.737381][T14265] ? clear_bhb_loop+0x40/0x90 [ 1819.737405][T14265] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1819.737425][T14265] RIP: 0033:0x7f971a79ce59 [ 1819.737442][T14265] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1819.737459][T14265] RSP: 002b:00007f971b5aa028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1819.737479][T14265] RAX: ffffffffffffffda RBX: 00007f971aa15fa0 RCX: 00007f971a79ce59 [ 1819.737494][T14265] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000004 [ 1819.737507][T14265] RBP: 00007f971b5aa090 R08: 0000000000000000 R09: 0000000000000000 [ 1819.737520][T14265] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1819.737532][T14265] R13: 00007f971aa16038 R14: 00007f971aa15fa0 R15: 00007ffe28f1d0f8 [ 1819.737562][T14265] [ 1820.188227][T14272] Bluetooth: hci1: expected 36 bytes, got 2 bytes [ 1820.281793][T14281] FAULT_INJECTION: forcing a failure. [ 1820.281793][T14281] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1820.351349][T14281] CPU: 0 UID: 0 PID: 14281 Comm: syz.3.11803 Not tainted syzkaller #0 PREEMPT(full) [ 1820.351382][T14281] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1820.351396][T14281] Call Trace: [ 1820.351406][T14281] [ 1820.351416][T14281] dump_stack_lvl+0xe8/0x150 [ 1820.351448][T14281] should_fail_ex+0x412/0x560 [ 1820.351480][T14281] _copy_from_user+0x2d/0xb0 [ 1820.351509][T14281] __sys_bpf+0x229/0x950 [ 1820.351547][T14281] ? __pfx___sys_bpf+0x10/0x10 [ 1820.351599][T14281] ? ksys_write+0x242/0x270 [ 1820.351635][T14281] ? __pfx_ksys_write+0x10/0x10 [ 1820.351674][T14281] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1820.351699][T14281] __x64_sys_bpf+0x7c/0x90 [ 1820.351732][T14281] do_syscall_64+0x174/0x580 [ 1820.351757][T14281] ? trace_irq_disable+0x3b/0x140 [ 1820.351790][T14281] ? clear_bhb_loop+0x40/0x90 [ 1820.351819][T14281] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1820.351841][T14281] RIP: 0033:0x7f971a79ce59 [ 1820.351862][T14281] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1820.351883][T14281] RSP: 002b:00007f971b5aa028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1820.351907][T14281] RAX: ffffffffffffffda RBX: 00007f971aa15fa0 RCX: 00007f971a79ce59 [ 1820.351924][T14281] RDX: 0000000000000048 RSI: 0000200000000200 RDI: 0000000000000000 [ 1820.351939][T14281] RBP: 00007f971b5aa090 R08: 0000000000000000 R09: 0000000000000000 [ 1820.351962][T14281] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1820.351976][T14281] R13: 00007f971aa16038 R14: 00007f971aa15fa0 R15: 00007ffe28f1d0f8 [ 1820.352012][T14281] [ 1820.465239][T14280] netlink: 96 bytes leftover after parsing attributes in process `syz.5.11802'. [ 1820.626350][T14289] netlink: 'syz.3.11807': attribute type 1 has an invalid length. [ 1820.674737][T14293] netlink: 328 bytes leftover after parsing attributes in process `syz.0.11809'. [ 1820.756149][T14297] netlink: 4 bytes leftover after parsing attributes in process `syz.0.11810'. [ 1820.785693][T14297] netlink: 12 bytes leftover after parsing attributes in process `syz.0.11810'. [ 1820.840554][T14301] netlink: 'syz.1.11812': attribute type 1 has an invalid length. [ 1820.869588][T14301] netlink: 760 bytes leftover after parsing attributes in process `syz.1.11812'. [ 1820.986939][T14306] netlink: 8 bytes leftover after parsing attributes in process `syz.3.11813'. [ 1821.015044][T14306] netlink: 24 bytes leftover after parsing attributes in process `syz.3.11813'. [ 1821.106087][T14310] FAULT_INJECTION: forcing a failure. [ 1821.106087][T14310] name failslab, interval 1, probability 0, space 0, times 0 [ 1821.147760][T14310] CPU: 1 UID: 0 PID: 14310 Comm: syz.4.11815 Not tainted syzkaller #0 PREEMPT(full) [ 1821.147791][T14310] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1821.147806][T14310] Call Trace: [ 1821.147815][T14310] [ 1821.147825][T14310] dump_stack_lvl+0xe8/0x150 [ 1821.147856][T14310] should_fail_ex+0x412/0x560 [ 1821.147886][T14310] should_failslab+0xa8/0x100 [ 1821.147911][T14310] __kvmalloc_node_noprof+0x178/0x8a0 [ 1821.147946][T14310] ? bpf_test_run_xdp_live+0x1f2/0x1cf0 [ 1821.147983][T14310] bpf_test_run_xdp_live+0x1f2/0x1cf0 [ 1821.148017][T14310] ? bpf_dispatcher_change_prog+0xae0/0xd70 [ 1821.148059][T14310] ? __pfx_autoremove_wake_function+0x10/0x10 [ 1821.148096][T14310] ? __pfx_bpf_test_run_xdp_live+0x10/0x10 [ 1821.148146][T14310] ? 0xffffffffa02019e4 [ 1821.148195][T14310] ? __pfx_xdp_test_run_init_page+0x10/0x10 [ 1821.148234][T14310] ? _copy_from_user+0x94/0xb0 [ 1821.148262][T14310] ? bpf_test_init+0x113/0x150 [ 1821.148286][T14310] ? xdp_convert_md_to_buff+0x5b/0x330 [ 1821.148317][T14310] bpf_prog_test_run_xdp+0x81c/0x1160 [ 1821.148359][T14310] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 1821.148392][T14310] ? __fget_files+0x2a/0x420 [ 1821.148426][T14310] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 1821.148455][T14310] bpf_prog_test_run+0x2c7/0x340 [ 1821.148482][T14310] __sys_bpf+0x643/0x950 [ 1821.148519][T14310] ? __pfx___sys_bpf+0x10/0x10 [ 1821.148578][T14310] ? ksys_write+0x242/0x270 [ 1821.148614][T14310] ? __pfx_ksys_write+0x10/0x10 [ 1821.148653][T14310] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1821.148679][T14310] __x64_sys_bpf+0x7c/0x90 [ 1821.148711][T14310] do_syscall_64+0x174/0x580 [ 1821.148735][T14310] ? trace_irq_disable+0x3b/0x140 [ 1821.148769][T14310] ? clear_bhb_loop+0x40/0x90 [ 1821.148796][T14310] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1821.148818][T14310] RIP: 0033:0x7f2d8079ce59 [ 1821.148839][T14310] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1821.148859][T14310] RSP: 002b:00007f2d815a6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1821.148883][T14310] RAX: ffffffffffffffda RBX: 00007f2d80a15fa0 RCX: 00007f2d8079ce59 [ 1821.148899][T14310] RDX: 0000000000000050 RSI: 0000200000000180 RDI: 000000000000000a [ 1821.148914][T14310] RBP: 00007f2d815a6090 R08: 0000000000000000 R09: 0000000000000000 [ 1821.148928][T14310] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1821.148942][T14310] R13: 00007f2d80a16038 R14: 00007f2d80a15fa0 R15: 00007ffc64643f68 [ 1821.148976][T14310] [ 1821.721041][T14430] ip6_tunnel: ip6erspan0 xmit: Local address not yet configured! [ 1822.913808][ T1150] net_ratelimit: 28 callbacks suppressed [ 1822.913828][ T1150] bond2: (slave gretap0): failed to get link speed/duplex [ 1822.965803][ T9848] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1822.975630][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1823.093868][T30429] bond2: (slave gretap0): failed to get link speed/duplex [ 1823.227909][T30429] bond2: (slave gretap0): failed to get link speed/duplex [ 1823.366165][T30429] bond2: (slave gretap0): failed to get link speed/duplex [ 1823.666022][T30426] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1823.762117][ T1150] bond2: (slave gretap0): failed to get link speed/duplex [ 1823.896688][ T1150] bond2: (slave gretap0): failed to get link speed/duplex [ 1824.015444][T30429] bond2: (slave gretap0): failed to get link speed/duplex [ 1824.060481][T14400] Bluetooth: hci1: expected 36 bytes, got 2 bytes [ 1824.365081][T14393] infiniband syz1: set down [ 1824.374794][T14393] infiniband syz1: added bond0 [ 1824.444870][T14393] smbdirect: ib_dev[syz1]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000 [ 1824.527655][T14393] smbdirect: ib_dev[syz1]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32 [ 1824.612424][T14393] smbdirect: ib_dev[syz1]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005 [ 1824.771960][T14393] RDS/IB: syz1: added [ 1824.783297][T14393] smc: adding ib device syz1 with port count 1 [ 1824.804585][T14393] smc: ib device syz1 port 1 has no pnetid [ 1824.961423][T14423] __nla_validate_parse: 6 callbacks suppressed [ 1824.961445][T14423] netlink: 8 bytes leftover after parsing attributes in process `syz.0.11851'. [ 1825.142628][T14436] netlink: 'syz.3.11853': attribute type 1 has an invalid length. [ 1825.188315][T14437] netlink: 'syz.0.11854': attribute type 1 has an invalid length. [ 1825.230391][T14437] ip6gre1: entered promiscuous mode [ 1825.242439][T14437] ip6gre1: entered allmulticast mode [ 1825.259518][T30426] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 1825.297688][T16875] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 1825.306508][T30426] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 1825.369402][T14442] netlink: 'syz.3.11855': attribute type 1 has an invalid length. [ 1825.497938][T14442] bond1: entered promiscuous mode [ 1825.509515][T14442] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1826.095559][ T794] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 1826.170778][ T794] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 1827.984543][ T9848] net_ratelimit: 12 callbacks suppressed [ 1827.984565][ T9848] bond2: (slave gretap0): failed to get link speed/duplex [ 1828.117720][ T13] bond2: (slave gretap0): failed to get link speed/duplex [ 1828.183029][T14473] netlink: 24 bytes leftover after parsing attributes in process `syz.0.11861'. [ 1828.216839][ T13] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1828.256244][ T13] bond2: (slave gretap0): failed to get link speed/duplex [ 1828.281267][T14478] netlink: 260 bytes leftover after parsing attributes in process `syz.4.11864'. [ 1828.356997][T14481] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 1828.394097][ T13] bond2: (slave gretap0): failed to get link speed/duplex [ 1828.507900][T14487] netlink: 12 bytes leftover after parsing attributes in process `syz.4.11866'. [ 1828.523988][ T9848] bond2: (slave gretap0): failed to get link speed/duplex [ 1828.653702][ T13] bond2: (slave gretap0): failed to get link speed/duplex [ 1828.765484][T14494] netlink: 12 bytes leftover after parsing attributes in process `syz.5.11869'. [ 1828.785562][ T1150] bond2: (slave gretap0): failed to get link speed/duplex [ 1828.806928][T14494] netlink: 24 bytes leftover after parsing attributes in process `syz.5.11869'. [ 1828.907035][ T13] bond2: (slave gretap0): failed to get link speed/duplex [ 1829.043719][ T9848] bond2: (slave gretap0): failed to get link speed/duplex [ 1829.127165][T14505] xfrm0 speed is unknown, defaulting to 1000 [ 1829.228981][T14512] 8021q: adding VLAN 0 to HW filter on device ipvlan0 [ 1829.408634][T14519] netlink: 28 bytes leftover after parsing attributes in process `syz.0.11878'. [ 1829.444091][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 1829.530774][T14523] gretap2: entered promiscuous mode [ 1830.031648][T14540] sch_tbf: peakrate 7 is lower than or equals to rate 6829859379779001161 ! [ 1830.041084][T14536] netlink: 4 bytes leftover after parsing attributes in process `syz.0.11881'. [ 1830.198092][T14545] netlink: 'syz.0.11885': attribute type 1 has an invalid length. [ 1830.268380][T14547] netlink: 28 bytes leftover after parsing attributes in process `syz.3.11886'. [ 1830.365321][T14550] netlink: 8 bytes leftover after parsing attributes in process `syz.0.11887'. [ 1830.739093][T14562] tipc: Enabled bearer , priority 0 [ 1830.782145][T14565] syzkaller0: entered promiscuous mode [ 1830.798918][T14565] syzkaller0: entered allmulticast mode [ 1830.875549][T14564] syzkaller0: entered promiscuous mode [ 1830.887151][T14564] syzkaller0: entered allmulticast mode [ 1830.911803][T14557] tipc: Resetting bearer [ 1830.919845][T14564] FAULT_INJECTION: forcing a failure. [ 1830.919845][T14564] name failslab, interval 1, probability 0, space 0, times 0 [ 1830.955408][T14564] CPU: 1 UID: 0 PID: 14564 Comm: syz.3.11892 Not tainted syzkaller #0 PREEMPT(full) [ 1830.955436][T14564] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1830.955450][T14564] Call Trace: [ 1830.955460][T14564] [ 1830.955469][T14564] dump_stack_lvl+0xe8/0x150 [ 1830.955500][T14564] should_fail_ex+0x412/0x560 [ 1830.955530][T14564] should_failslab+0xa8/0x100 [ 1830.955554][T14564] __kmalloc_noprof+0xe8/0x760 [ 1830.955602][T14564] ? tipc_nl_compat_doit+0x1c8/0x650 [ 1830.955747][T14564] tipc_nl_compat_doit+0x1c8/0x650 [ 1830.955786][T14564] ? __pfx_tipc_nl_compat_doit+0x10/0x10 [ 1830.955826][T14564] ? apparmor_capable+0x126/0x170 [ 1830.955854][T14564] ? bpf_lsm_capable+0x9/0x20 [ 1830.955875][T14564] ? security_capable+0x7e/0x2c0 [ 1830.955927][T14564] tipc_nl_compat_recv+0x8d3/0xcf0 [ 1830.955958][T14564] ? __pfx_tipc_nl_compat_recv+0x10/0x10 [ 1830.955985][T14564] ? __mutex_trylock_common+0x158/0x260 [ 1830.956016][T14564] ? __pfx___mutex_trylock_common+0x10/0x10 [ 1830.956042][T14564] ? __pfx___tipc_nl_bearer_enable+0x10/0x10 [ 1830.956063][T14564] ? __pfx_tipc_nl_compat_bearer_enable+0x10/0x10 [ 1830.956103][T14564] ? genl_family_rcv_msg_attrs_parse+0xe9/0x2f0 [ 1830.956143][T14564] genl_family_rcv_msg_doit+0x22a/0x330 [ 1830.956181][T14564] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 1830.956235][T14564] genl_rcv_msg+0x61c/0x7a0 [ 1830.956272][T14564] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1830.956301][T14564] ? __pfx_tipc_nl_compat_recv+0x10/0x10 [ 1830.956331][T14564] ? __pfx_ref_tracker_free+0x10/0x10 [ 1830.956365][T14564] netlink_rcv_skb+0x232/0x4b0 [ 1830.956390][T14564] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1830.956422][T14564] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1830.956463][T14564] ? down_read+0x270/0x2e0 [ 1830.956486][T14564] ? genl_rcv+0xd/0x40 [ 1830.956517][T14564] genl_rcv+0x28/0x40 [ 1830.956543][T14564] netlink_unicast+0x75c/0x8e0 [ 1830.956582][T14564] netlink_sendmsg+0x813/0xb40 [ 1830.956617][T14564] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1830.956645][T14564] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1830.956677][T14564] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1830.956709][T14564] ____sys_sendmsg+0x972/0x9f0 [ 1830.956733][T14564] ? __might_fault+0xaf/0x130 [ 1830.956767][T14564] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1830.956805][T14564] ? import_iovec+0x73/0xa0 [ 1830.956834][T14564] ___sys_sendmsg+0x2a5/0x360 [ 1830.956857][T14564] ? __lock_acquire+0x6b5/0x2cf0 [ 1830.956885][T14564] ? __pfx____sys_sendmsg+0x10/0x10 [ 1830.956946][T14564] ? __fget_files+0x2a/0x420 [ 1830.956971][T14564] ? __fget_files+0x3a0/0x420 [ 1830.957007][T14564] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1830.957034][T14564] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1830.957069][T14564] ? __pfx_ksys_write+0x10/0x10 [ 1830.957108][T14564] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1830.957131][T14564] do_syscall_64+0x174/0x580 [ 1830.957152][T14564] ? trace_irq_disable+0x3b/0x140 [ 1830.957181][T14564] ? clear_bhb_loop+0x40/0x90 [ 1830.957207][T14564] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1830.957227][T14564] RIP: 0033:0x7f971a79ce59 [ 1830.957246][T14564] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1830.957263][T14564] RSP: 002b:00007f971b5aa028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1830.957285][T14564] RAX: ffffffffffffffda RBX: 00007f971aa15fa0 RCX: 00007f971a79ce59 [ 1830.957300][T14564] RDX: 0000000000000000 RSI: 00002000000002c0 RDI: 0000000000000005 [ 1830.957313][T14564] RBP: 00007f971b5aa090 R08: 0000000000000000 R09: 0000000000000000 [ 1830.957326][T14564] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1830.957338][T14564] R13: 00007f971aa16038 R14: 00007f971aa15fa0 R15: 00007ffe28f1d0f8 [ 1830.957371][T14564] [ 1831.018615][T14556] tipc: Resetting bearer [ 1831.408282][T14556] tipc: Disabling bearer [ 1831.714577][T14582] netlink: 4 bytes leftover after parsing attributes in process `syz.5.11895'. [ 1832.027309][T14589] bond6: option mode: invalid value (254) [ 1832.040689][T14589] bond6 (unregistering): Released all slaves [ 1832.218456][ T9956] bridge0: entered promiscuous mode [ 1832.283932][T14608] xt_TCPMSS: Only works on TCP SYN packets [ 1832.314064][T14594] 8021q: adding VLAN 0 to HW filter on device ipvlan0 [ 1832.872070][T14629] netlink: 4 bytes leftover after parsing attributes in process `syz.3.11909'. [ 1833.143672][ T1150] net_ratelimit: 23 callbacks suppressed [ 1833.143694][ T1150] bond2: (slave gretap0): failed to get link speed/duplex [ 1833.184662][T14631] xfrm0 speed is unknown, defaulting to 1000 [ 1833.373700][T30426] bond2: (slave gretap0): failed to get link speed/duplex [ 1833.382039][T14649] netlink: 47 bytes leftover after parsing attributes in process `syz.3.11915'. [ 1833.503660][ T7329] bond2: (slave gretap0): failed to get link speed/duplex [ 1834.308802][T14657] netlink: 4 bytes leftover after parsing attributes in process `syz.1.11917'. [ 1834.360260][T14658] netlink: 12 bytes leftover after parsing attributes in process `syz.1.11917'. [ 1835.273132][T14654] sch_tbf: peakrate 7 is lower than or equals to rate 6829859379779001161 ! [ 1835.354749][ T13] bond2: (slave gretap0): failed to get link speed/duplex [ 1835.471111][T14665] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1835.514054][T30429] bond2: (slave gretap0): failed to get link speed/duplex [ 1835.537794][T14671] v: renamed from ip6gre0 (while UP) [ 1835.666686][ T13] bond2: (slave gretap0): failed to get link speed/duplex [ 1835.763778][ C1] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 1835.855649][T30429] bond2: (slave gretap0): failed to get link speed/duplex [ 1835.975084][ T13] bond2: (slave gretap0): failed to get link speed/duplex [ 1836.026823][T14692] netlink: 4 bytes leftover after parsing attributes in process `syz.3.11928'. [ 1836.064028][T14692] netlink: 12 bytes leftover after parsing attributes in process `syz.3.11928'. [ 1836.140293][T14701] IPv6: addrconf: prefix option has invalid lifetime [ 1836.186810][T14701] netlink: 8 bytes leftover after parsing attributes in process `syz.1.11933'. [ 1836.742148][T14727] veth0: entered promiscuous mode [ 1836.773433][T14725] FAULT_INJECTION: forcing a failure. [ 1836.773433][T14725] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1836.808340][T14725] CPU: 0 UID: 0 PID: 14725 Comm: syz.1.11941 Not tainted syzkaller #0 PREEMPT(full) [ 1836.808382][T14725] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1836.808402][T14725] Call Trace: [ 1836.808416][T14725] [ 1836.808431][T14725] dump_stack_lvl+0xe8/0x150 [ 1836.808461][T14725] should_fail_ex+0x412/0x560 [ 1836.808489][T14725] _copy_to_user+0x31/0xb0 [ 1836.808517][T14725] simple_read_from_buffer+0xe1/0x170 [ 1836.808548][T14725] proc_fail_nth_read+0x1bb/0x230 [ 1836.808590][T14725] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1836.808621][T14725] ? rw_verify_area+0x2a6/0x4d0 [ 1836.808651][T14725] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1836.808679][T14725] vfs_read+0x20c/0xa70 [ 1836.808713][T14725] ? __pfx___mutex_lock+0x10/0x10 [ 1836.808739][T14725] ? __pfx_vfs_read+0x10/0x10 [ 1836.808770][T14725] ? __fget_files+0x2a/0x420 [ 1836.808800][T14725] ? __fget_files+0x3a0/0x420 [ 1836.808824][T14725] ? __fget_files+0x2a/0x420 [ 1836.808858][T14725] ksys_read+0x150/0x270 [ 1836.808890][T14725] ? __pfx_ksys_read+0x10/0x10 [ 1836.808929][T14725] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1836.808951][T14725] do_syscall_64+0x174/0x580 [ 1836.808973][T14725] ? trace_irq_disable+0x3b/0x140 [ 1836.809003][T14725] ? clear_bhb_loop+0x40/0x90 [ 1836.809029][T14725] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1836.809049][T14725] RIP: 0033:0x7fca1015d68e [ 1836.809067][T14725] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1836.809086][T14725] RSP: 002b:00007fca0e3f5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1836.809107][T14725] RAX: ffffffffffffffda RBX: 00007fca0e3f66c0 RCX: 00007fca1015d68e [ 1836.809122][T14725] RDX: 000000000000000f RSI: 00007fca0e3f60a0 RDI: 0000000000000005 [ 1836.809136][T14725] RBP: 00007fca0e3f6090 R08: 0000000000000000 R09: 0000000000000000 [ 1836.809148][T14725] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1836.809162][T14725] R13: 00007fca10416038 R14: 00007fca10415fa0 R15: 00007ffcfbf85f78 [ 1836.809194][T14725] [ 1837.443989][T14748] team0: Port device dummy0 removed [ 1837.461392][T14748] netlink: 'syz.1.11947': attribute type 10 has an invalid length. [ 1837.481487][T14748] netlink: 40 bytes leftover after parsing attributes in process `syz.1.11947'. [ 1837.507420][T14748] dummy0: entered promiscuous mode [ 1837.522267][T14726] veth0: left promiscuous mode [ 1837.529230][T14748] netlink: 132 bytes leftover after parsing attributes in process `syz.1.11947'. [ 1837.571049][T14748] netlink: 'syz.1.11947': attribute type 11 has an invalid length. [ 1837.586516][T14748] netlink: 140 bytes leftover after parsing attributes in process `syz.1.11947'. [ 1837.682553][T14757] netlink: 8 bytes leftover after parsing attributes in process `syz.4.11953'. [ 1837.693911][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 1837.843160][T14759] Bluetooth: hci1: expected 36 bytes, got 2 bytes [ 1837.961519][T14773] netlink: 12 bytes leftover after parsing attributes in process `syz.3.11960'. [ 1838.155181][ T1150] net_ratelimit: 15 callbacks suppressed [ 1838.155202][ T1150] bond2: (slave gretap0): failed to get link speed/duplex [ 1838.274038][ T1150] bond2: (slave gretap0): failed to get link speed/duplex [ 1838.379762][T14792] tipc: Enabled bearer , priority 0 [ 1838.388174][T14792] syzkaller0: entered promiscuous mode [ 1838.394073][T14792] syzkaller0: entered allmulticast mode [ 1838.407255][T14792] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 1838.429795][T14791] tipc: Resetting bearer [ 1838.461418][T14791] tipc: Disabling bearer [ 1838.475391][T14662] bond2: (slave gretap0): failed to get link speed/duplex [ 1838.583939][T14662] bond2: (slave gretap0): failed to get link speed/duplex [ 1838.701848][T14797] openvswitch: netlink: VXLAN extension 4 out of range max 1 [ 1838.711303][T14797] openvswitch: netlink: VXLAN extension 4 out of range max 1 [ 1838.719927][ T1150] bond2: (slave gretap0): failed to get link speed/duplex [ 1838.727486][ T4478] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 1838.853352][T14803] xfrm0 speed is unknown, defaulting to 1000 [ 1838.900255][T14802] Bluetooth: hci1: expected 36 bytes, got 2 bytes [ 1838.912093][ T1150] bond2: (slave gretap0): failed to get link speed/duplex [ 1839.036739][ T13] bond2: (slave gretap0): failed to get link speed/duplex [ 1839.090474][T14813] netlink: 36 bytes leftover after parsing attributes in process `syz.4.11973'. [ 1839.113864][T14813] netlink: 20 bytes leftover after parsing attributes in process `syz.4.11973'. [ 1839.163701][T30430] bond2: (slave gretap0): failed to get link speed/duplex [ 1839.733515][T14831] Bluetooth: hci1: expected 36 bytes, got 2 bytes [ 1839.760715][T14839] sch_tbf: burst 0 is lower than device syzkaller0 mtu (1500) ! [ 1839.924487][T14841] ipt_ECN: cannot use operation on non-tcp rule [ 1839.971861][T14843] Bluetooth: hci1: expected 36 bytes, got 2 bytes [ 1840.016200][T14841] netlink: 'syz.3.11984': attribute type 1 has an invalid length. [ 1840.024936][T14848] netlink: 'syz.0.11987': attribute type 5 has an invalid length. [ 1840.142426][T14851] gre0: left promiscuous mode [ 1840.302176][T14866] team0: entered promiscuous mode [ 1840.307704][T14866] team_slave_0: entered promiscuous mode [ 1840.313927][T14866] team_slave_1: entered promiscuous mode [ 1840.344399][T14866] batadv1: entered promiscuous mode [ 1840.442135][T14866] netlink: 'syz.1.11992': attribute type 58 has an invalid length. [ 1840.633371][T14881] sch_tbf: burst 88 is lower than device veth3 mtu (1514) ! [ 1840.657609][T14874] Bluetooth: hci1: expected 36 bytes, got 2 bytes [ 1841.131083][T14904] __nla_validate_parse: 11 callbacks suppressed [ 1841.131105][T14904] netlink: 8 bytes leftover after parsing attributes in process `syz.1.12004'. [ 1841.320170][T14909] netlink: 'syz.0.12005': attribute type 1 has an invalid length. [ 1841.468282][T14909] 8021q: adding VLAN 0 to HW filter on device bond7 [ 1841.649221][T14928] netlink: 'syz.1.12011': attribute type 3 has an invalid length. [ 1841.752024][T14934] netlink: 'syz.3.12013': attribute type 1 has an invalid length. [ 1842.013056][T14934] bond2: entered promiscuous mode [ 1842.052245][T14934] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1842.095186][T14947] netlink: 8 bytes leftover after parsing attributes in process `syz.5.12017'. [ 1842.405492][T14953] netlink: 16 bytes leftover after parsing attributes in process `syz.4.12019'. [ 1842.831178][T14976] veth0_to_batadv: entered allmulticast mode [ 1842.901420][T14980] netlink: 8 bytes leftover after parsing attributes in process `syz.0.12027'. [ 1842.926799][T14980] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1842.928881][T14982] netlink: 'syz.4.12026': attribute type 58 has an invalid length. [ 1842.934227][T14980] IPv6: NLM_F_CREATE should be set when creating new route [ 1842.942394][T14982] ip6_vti0: left promiscuous mode [ 1842.949393][T14980] IPv6: NLM_F_CREATE should be set when creating new route [ 1842.949422][T14980] IPv6: NLM_F_CREATE should be set when creating new route [ 1842.988527][T14985] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1843.072974][T14980] netlink: 'syz.0.12027': attribute type 1 has an invalid length. [ 1843.111145][T14982] xfrm0 speed is unknown, defaulting to 1000 [ 1843.264076][T14662] net_ratelimit: 26 callbacks suppressed [ 1843.264097][T14662] bond2: (slave gretap0): failed to get link speed/duplex [ 1843.337346][T14990] syzkaller1: entered promiscuous mode [ 1843.347387][T14990] syzkaller1: entered allmulticast mode [ 1843.506897][T15000] netlink: 4 bytes leftover after parsing attributes in process `syz.1.12033'. [ 1843.568834][T15002] netlink: 12 bytes leftover after parsing attributes in process `syz.1.12033'. [ 1843.703153][T14986] netlink: 'syz.4.12026': attribute type 4 has an invalid length. [ 1843.774851][ T1150] bond2: (slave gretap0): failed to get link speed/duplex [ 1843.918873][T14662] bond2: (slave gretap0): failed to get link speed/duplex [ 1843.991895][T15013] Bluetooth: hci1: expected 36 bytes, got 2 bytes [ 1844.043739][T30426] bond2: (slave gretap0): failed to get link speed/duplex [ 1844.163669][ T1150] bond2: (slave gretap0): failed to get link speed/duplex [ 1844.171567][T14994] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1844.603695][ T1150] bond2: (slave gretap0): failed to get link speed/duplex [ 1844.671180][T15029] xfrm0 speed is unknown, defaulting to 1000 [ 1844.738580][T14662] bond2: (slave gretap0): failed to get link speed/duplex [ 1844.873698][T14662] bond2: (slave gretap0): failed to get link speed/duplex [ 1844.994169][T30426] bond2: (slave gretap0): failed to get link speed/duplex [ 1845.087684][T15051] netlink: 12 bytes leftover after parsing attributes in process `syz.5.12046'. [ 1845.116236][T15051] x_tables: duplicate underflow at hook 1 [ 1845.123517][T15051] netlink: 8 bytes leftover after parsing attributes in process `syz.5.12046'. [ 1845.154767][T30426] bond2: (slave gretap0): failed to get link speed/duplex [ 1845.168357][T15052] syzkaller1: entered promiscuous mode [ 1845.187184][T15052] syzkaller1: entered allmulticast mode [ 1845.439885][T15055] Bluetooth: hci1: expected 36 bytes, got 2 bytes [ 1847.557849][T15034] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1847.804346][T15070] netlink: 4 bytes leftover after parsing attributes in process `syz.5.12053'. [ 1847.859937][T15071] bridge0: port 3(batadv2) entered blocking state [ 1847.886726][T15071] bridge0: port 3(batadv2) entered disabled state [ 1847.904550][T15071] batadv2: entered allmulticast mode [ 1847.912381][T15071] batadv2: entered promiscuous mode [ 1847.920884][T15077] batadv_slave_1: entered promiscuous mode [ 1847.948917][T15076] batadv_slave_1: left promiscuous mode [ 1847.962341][T15082] netlink: 7 bytes leftover after parsing attributes in process `syz.3.12058'. [ 1848.140073][T15091] netlink: 36 bytes leftover after parsing attributes in process `syz.4.12061'. [ 1848.150407][T15092] netlink: 20 bytes leftover after parsing attributes in process `syz.1.12060'. [ 1848.354571][T14662] net_ratelimit: 24 callbacks suppressed [ 1848.354671][ T13] batman_adv: batadv2: No IGMP Querier present - multicast optimizations disabled [ 1848.356753][T14662] bond2: (slave gretap0): failed to get link speed/duplex [ 1848.360376][ T13] batman_adv: batadv2: No MLD Querier present - multicast optimizations disabled [ 1848.448863][T15087] syzkaller1: entered promiscuous mode [ 1848.458024][T15087] syzkaller1: entered allmulticast mode [ 1848.532594][T15102] Bluetooth: hci1: expected 36 bytes, got 2 bytes [ 1848.564144][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1848.574405][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1848.584376][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1848.593791][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1848.650098][T15111] netlink: 4 bytes leftover after parsing attributes in process `syz.3.12068'. [ 1848.702549][T15113] netlink: 12 bytes leftover after parsing attributes in process `syz.3.12068'. [ 1848.718459][T15108] pimreg: entered allmulticast mode [ 1848.735309][T30426] bond2: (slave gretap0): failed to get link speed/duplex [ 1848.904272][T30429] bond2: (slave gretap0): failed to get link speed/duplex [ 1849.033892][T14662] bond2: (slave gretap0): failed to get link speed/duplex [ 1849.173797][T30429] bond2: (slave gretap0): failed to get link speed/duplex [ 1849.303760][ T1150] bond2: (slave gretap0): failed to get link speed/duplex [ 1849.329667][T15140] netlink: 4 bytes leftover after parsing attributes in process `syz.1.12074'. [ 1849.560890][ T4949] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1849.578265][ T4949] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1849.588273][ T4949] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1849.600064][ T4949] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1849.608296][ T4949] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1849.686883][T15146] netlink: 'syz.3.12077': attribute type 3 has an invalid length. [ 1849.706412][T15146] netlink: 'syz.3.12077': attribute type 3 has an invalid length. [ 1849.722915][T15146] netlink: 12 bytes leftover after parsing attributes in process `syz.3.12077'. [ 1850.000504][T15143] xfrm0 speed is unknown, defaulting to 1000 [ 1850.479900][T15143] bridge0: port 1(bridge_slave_0) entered blocking state [ 1850.487200][T15143] bridge0: port 1(bridge_slave_0) entered disabled state [ 1850.494745][T15143] bridge_slave_0: entered allmulticast mode [ 1850.502261][T15143] bridge_slave_0: entered promiscuous mode [ 1850.510246][T15143] bridge0: port 2(bridge_slave_1) entered blocking state [ 1850.517872][T15143] bridge0: port 2(bridge_slave_1) entered disabled state [ 1850.525302][T15143] bridge_slave_1: entered allmulticast mode [ 1850.532442][T15143] bridge_slave_1: entered promiscuous mode [ 1850.563237][T15143] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1850.576550][T15143] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1850.608103][T15143] team0: Port device team_slave_0 added [ 1850.616055][T15143] team0: Port device team_slave_1 added [ 1850.643030][T15143] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1850.650006][T15143] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1850.675938][T15143] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1850.693540][T15143] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1850.700569][T15143] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1850.726971][T15143] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1850.769938][T15143] hsr_slave_0: entered promiscuous mode [ 1850.776555][T15143] hsr_slave_1: entered promiscuous mode [ 1850.893456][T15143] netdevsim netdevsim4 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1850.964511][T15143] netdevsim netdevsim4 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1851.030309][T15143] netdevsim netdevsim4 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1851.092197][T15143] netdevsim netdevsim4 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1851.683771][ T4949] Bluetooth: hci3: command tx timeout [ 1851.772268][T15117] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1851.807414][T15143] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 1851.875958][T15143] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1851.896695][T15143] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 1851.940698][T15143] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1851.973519][T15143] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 1851.990634][T15143] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1851.999449][T15170] syzkaller1: entered promiscuous mode [ 1852.006519][T15173] netlink: 20 bytes leftover after parsing attributes in process `syz.0.12083'. [ 1852.007170][T15175] netlink: 20 bytes leftover after parsing attributes in process `syz.0.12083'. [ 1852.016344][T15170] syzkaller1: entered allmulticast mode [ 1852.040743][T15143] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 1852.055501][T15143] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1852.072818][T15173] ip6gre2: entered promiscuous mode [ 1852.079763][T15173] ip6gre2: entered allmulticast mode [ 1852.475929][T15143] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1852.538879][T15143] 8021q: adding VLAN 0 to HW filter on device team0 [ 1852.567459][T14662] bridge0: port 1(bridge_slave_0) entered blocking state [ 1852.574666][T14662] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1852.645841][T14662] bridge0: port 2(bridge_slave_1) entered blocking state [ 1852.653027][T14662] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1852.974299][T15212] __nla_validate_parse: 3 callbacks suppressed [ 1852.974320][T15212] netlink: 4 bytes leftover after parsing attributes in process `syz.1.12091'. [ 1853.030047][T15217] netlink: 12 bytes leftover after parsing attributes in process `syz.1.12091'. [ 1853.044806][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 1853.051148][ T1316] ip6_tunnel: ip6erspan0 xmit: Local address not yet configured! [ 1853.394289][T30426] net_ratelimit: 23 callbacks suppressed [ 1853.394310][T30426] bond2: (slave gretap0): failed to get link speed/duplex [ 1853.568035][T14662] bond2: (slave gretap0): failed to get link speed/duplex [ 1853.646756][T15244] xfrm0 speed is unknown, defaulting to 1000 [ 1853.713699][T14662] bond2: (slave gretap0): failed to get link speed/duplex [ 1853.765000][ T4949] Bluetooth: hci3: command tx timeout [ 1853.873944][T30426] bond2: (slave gretap0): failed to get link speed/duplex [ 1854.007797][T30429] bond2: (slave gretap0): failed to get link speed/duplex [ 1854.079841][T15143] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1854.134777][T30426] bond2: (slave gretap0): failed to get link speed/duplex [ 1854.142501][T15256] Bluetooth: hci1: expected 36 bytes, got 2 bytes [ 1854.264377][T30429] bond2: (slave gretap0): failed to get link speed/duplex [ 1854.379112][T15270] netlink: 20 bytes leftover after parsing attributes in process `syz.1.12102'. [ 1854.394263][T30429] bond2: (slave gretap0): failed to get link speed/duplex [ 1854.534782][T14662] bond2: (slave gretap0): failed to get link speed/duplex [ 1854.548218][T15274] netlink: 20 bytes leftover after parsing attributes in process `syz.1.12102'. [ 1854.609892][T15274] nbd: device at index 64 is going down [ 1854.683759][T14662] bond2: (slave gretap0): failed to get link speed/duplex [ 1854.946267][T13918] udevd[13918]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 1855.009988][T15292] netlink: 24 bytes leftover after parsing attributes in process `syz.5.12106'. [ 1855.086619][T15246] netlink: 32 bytes leftover after parsing attributes in process `syz.3.12097'. [ 1855.132224][T15143] veth0_vlan: entered promiscuous mode [ 1855.178826][T15143] veth1_vlan: entered promiscuous mode [ 1855.268037][T15143] veth0_macvtap: entered promiscuous mode [ 1855.311188][T15143] veth1_macvtap: entered promiscuous mode [ 1855.365817][T15143] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1855.390043][T15143] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1855.407832][T30426] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1855.425867][T30426] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1855.448240][T30426] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1855.471626][T30426] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1855.843759][ T4949] Bluetooth: hci3: command tx timeout [ 1855.919181][ T9848] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1855.940296][ T9848] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1856.048500][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1856.083844][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1856.421830][T15324] Bluetooth: hci1: expected 36 bytes, got 2 bytes [ 1856.694256][T15338] sctp: [Deprecated]: syz.1.12115 (pid 15338) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1856.694256][T15338] Use struct sctp_sack_info instead [ 1857.170812][T15341] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1857.197884][T15348] netlink: 40 bytes leftover after parsing attributes in process `syz.0.12116'. [ 1857.360814][T15341] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1857.661178][T15341] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1857.792570][T15341] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1857.800734][T15376] netlink: 16 bytes leftover after parsing attributes in process `syz.5.12125'. [ 1857.923607][ T4949] Bluetooth: hci3: command tx timeout [ 1858.059714][ T9848] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1858.087285][T30429] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1858.114923][T30429] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1858.139223][T30429] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1858.150531][T15393] veth0: entered promiscuous mode [ 1858.161456][T15392] veth0: left promiscuous mode [ 1858.311048][T15398] netlink: 8 bytes leftover after parsing attributes in process `syz.0.12133'. [ 1858.494573][ T13] net_ratelimit: 21 callbacks suppressed [ 1858.494597][ T13] bond2: (slave gretap0): failed to get link speed/duplex [ 1858.579579][T15401] netlink: 12 bytes leftover after parsing attributes in process `syz.4.12135'. [ 1858.765005][ T13] bond2: (slave gretap0): failed to get link speed/duplex [ 1858.930439][T15413] tipc: Started in network mode [ 1858.942825][T15413] tipc: Node identity 7a62e4bff3f4, cluster identity 4711 [ 1858.950345][T15413] tipc: Enabled bearer , priority 0 [ 1858.990753][T15413] syzkaller0: entered promiscuous mode [ 1858.999457][T15413] syzkaller0: entered allmulticast mode [ 1859.168974][T15412] tipc: Resetting bearer [ 1859.226071][T15412] tipc: Disabling bearer [ 1859.274274][ T9848] bond2: (slave gretap0): failed to get link speed/duplex [ 1859.383702][ T13] bond2: (slave gretap0): failed to get link speed/duplex [ 1859.436113][T15432] netlink: 'syz.4.12146': attribute type 58 has an invalid length. [ 1859.449490][T15432] netlink: 20 bytes leftover after parsing attributes in process `syz.4.12146'. [ 1859.493371][T15437] netlink: 4 bytes leftover after parsing attributes in process `syz.1.12147'. [ 1859.523659][T30430] bond2: (slave gretap0): failed to get link speed/duplex [ 1859.545308][T15441] netlink: 4 bytes leftover after parsing attributes in process `syz.3.12148'. [ 1859.644403][T30429] bond2: (slave gretap0): failed to get link speed/duplex [ 1859.653763][T15444] xt_bpf: check failed: parse error [ 1859.825543][T30429] bond2: (slave gretap0): failed to get link speed/duplex [ 1859.861070][T15458] netlink: 14 bytes leftover after parsing attributes in process `syz.1.12154'. [ 1860.003434][T15461] bond8: Removing last arp target with arp_interval on [ 1860.063825][T30429] bond2: (slave gretap0): failed to get link speed/duplex [ 1860.156939][T15467] netlink: 4 bytes leftover after parsing attributes in process `syz.3.12156'. [ 1860.194569][T30429] bond2: (slave gretap0): failed to get link speed/duplex [ 1860.213793][T15467] hsr_slave_0: left promiscuous mode [ 1860.229298][T15469] netlink: 4 bytes leftover after parsing attributes in process `syz.1.12157'. [ 1860.229319][T15467] hsr_slave_1: left promiscuous mode [ 1860.281786][T15473] netlink: 12 bytes leftover after parsing attributes in process `syz.1.12157'. [ 1860.319856][T15471] bridge0: port 3(dummy0) entered blocking state [ 1860.331825][T15471] bridge0: port 3(dummy0) entered disabled state [ 1860.339434][T15471] dummy0: entered allmulticast mode [ 1860.350690][T15471] dummy0: entered promiscuous mode [ 1860.356915][T15471] bridge0: port 3(dummy0) entered blocking state [ 1860.363410][T15471] bridge0: port 3(dummy0) entered forwarding state [ 1860.388370][ T30] audit: type=1800 audit(1780933990.385:18): pid=15449 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.12151" name="blkio.bfq.time_recursive" dev="tmpfs" ino=71 res=0 errno=0 [ 1860.428666][T15476] dummy0: left allmulticast mode [ 1860.438176][T15476] dummy0: left promiscuous mode [ 1860.446647][T15476] bridge0: port 3(dummy0) entered disabled state [ 1860.465380][T15481] netlink: 4 bytes leftover after parsing attributes in process `syz.0.12160'. [ 1860.576380][T15472] bridge0: port 2(bridge_slave_1) entered disabled state [ 1860.584124][T15472] bridge0: port 1(bridge_slave_0) entered disabled state [ 1860.731389][T15472] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1860.759293][T15472] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1860.838938][T15490] sch_tbf: peakrate 7 is lower than or equals to rate 6829859379779001161 ! [ 1860.852105][T30430] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1860.871670][T30430] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1860.890997][T30430] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1860.921708][T30430] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1860.953893][T30426] bond2: (slave gretap0): failed to get link speed/duplex [ 1861.032998][T15499] batadv_slave_1: entered promiscuous mode [ 1861.067510][T15496] batadv_slave_1: left promiscuous mode [ 1861.766964][T15538] xfrm0 speed is unknown, defaulting to 1000 [ 1862.052904][T15559] netlink: 'syz.4.12184': attribute type 1 has an invalid length. [ 1862.062673][T15553] syzkaller0: entered promiscuous mode [ 1862.077831][T15553] syzkaller0: entered allmulticast mode [ 1862.141924][T15561] tipc: Enabled bearer , priority 0 [ 1862.163372][T15561] syzkaller0: entered promiscuous mode [ 1862.175185][T15561] syzkaller0: entered allmulticast mode [ 1862.304737][T15566] FAULT_INJECTION: forcing a failure. [ 1862.304737][T15566] name failslab, interval 1, probability 0, space 0, times 0 [ 1862.327906][T15566] CPU: 1 UID: 0 PID: 15566 Comm: syz.5.12186 Not tainted syzkaller #0 PREEMPT(full) [ 1862.327936][T15566] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1862.327947][T15566] Call Trace: [ 1862.327954][T15566] [ 1862.327960][T15566] dump_stack_lvl+0xe8/0x150 [ 1862.327983][T15566] should_fail_ex+0x412/0x560 [ 1862.328003][T15566] should_failslab+0xa8/0x100 [ 1862.328020][T15566] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 1862.328041][T15566] ? __alloc_skb+0x1d0/0x7d0 [ 1862.328055][T15566] ? __local_bh_enable_ip+0xd0/0x130 [ 1862.328074][T15566] __alloc_skb+0x1d0/0x7d0 [ 1862.328092][T15566] sock_wmalloc+0xb2/0x130 [ 1862.328110][T15566] pppoe_sendmsg+0x2b4/0x7c0 [ 1862.328253][T15566] ? __pfx_aa_sk_perm+0x10/0x10 [ 1862.328291][T15566] ? __pfx_pppoe_sendmsg+0x10/0x10 [ 1862.328310][T15566] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1862.328333][T15566] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1862.328377][T15566] ____sys_sendmsg+0x972/0x9f0 [ 1862.328402][T15566] ? __might_fault+0xaf/0x130 [ 1862.328447][T15566] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1862.328471][T15566] ? import_iovec+0x73/0xa0 [ 1862.328491][T15566] ___sys_sendmsg+0x2a5/0x360 [ 1862.328507][T15566] ? __lock_acquire+0x6b5/0x2cf0 [ 1862.328526][T15566] ? __pfx____sys_sendmsg+0x10/0x10 [ 1862.328542][T15566] ? __lock_acquire+0x6b5/0x2cf0 [ 1862.328560][T15566] ? kstrtouint+0x6e/0xe0 [ 1862.328609][T15566] __sys_sendmmsg+0x27c/0x4e0 [ 1862.328630][T15566] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1862.328645][T15566] ? __mutex_unlock_slowpath+0x1be/0x6f0 [ 1862.328681][T15566] ? ksys_write+0x242/0x270 [ 1862.328704][T15566] ? __pfx_ksys_write+0x10/0x10 [ 1862.328730][T15566] __x64_sys_sendmmsg+0xa0/0xc0 [ 1862.328746][T15566] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1862.328762][T15566] do_syscall_64+0x174/0x580 [ 1862.328778][T15566] ? trace_irq_disable+0x3b/0x140 [ 1862.328800][T15566] ? clear_bhb_loop+0x40/0x90 [ 1862.328818][T15566] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1862.328832][T15566] RIP: 0033:0x7fe8a399ce59 [ 1862.328846][T15566] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1862.328858][T15566] RSP: 002b:00007fe8a4770028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1862.328873][T15566] RAX: ffffffffffffffda RBX: 00007fe8a3c15fa0 RCX: 00007fe8a399ce59 [ 1862.328884][T15566] RDX: 00000000000003e8 RSI: 0000200000002340 RDI: 0000000000000003 [ 1862.328893][T15566] RBP: 00007fe8a4770090 R08: 0000000000000000 R09: 0000000000000000 [ 1862.328902][T15566] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1862.328911][T15566] R13: 00007fe8a3c16038 R14: 00007fe8a3c15fa0 R15: 00007ffd3e2d5aa8 [ 1862.328933][T15566] [ 1862.841497][T15555] tipc: Resetting bearer [ 1862.949246][T15555] tipc: Disabling bearer [ 1863.576140][ T13] net_ratelimit: 18 callbacks suppressed [ 1863.576159][ T13] bond2: (slave gretap0): failed to get link speed/duplex [ 1863.711238][ T13] bond2: (slave gretap0): failed to get link speed/duplex [ 1863.770699][T15601] netlink: 'syz.4.12197': attribute type 11 has an invalid length. [ 1863.790879][T15601] __nla_validate_parse: 13 callbacks suppressed [ 1863.790898][T15601] netlink: 140 bytes leftover after parsing attributes in process `syz.4.12197'. [ 1863.823736][ T1150] bond2: (slave gretap0): failed to get link speed/duplex [ 1863.825967][T15602] openvswitch: netlink: Missing valid actions attribute. [ 1863.873415][T15602] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1863.874383][T15604] netlink: 'syz.3.12198': attribute type 10 has an invalid length. [ 1863.919500][T15604] team0: Port device dummy0 added [ 1863.934267][T30426] bond2: (slave gretap0): failed to get link speed/duplex [ 1864.057523][ T1150] bond2: (slave gretap0): failed to get link speed/duplex [ 1864.095088][T15606] netlink: 12 bytes leftover after parsing attributes in process `syz.1.12200'. [ 1864.184386][ T13] bond2: (slave gretap0): failed to get link speed/duplex [ 1864.211374][T15608] netlink: 4 bytes leftover after parsing attributes in process `syz.3.12199'. [ 1864.265600][T15615] netlink: 12 bytes leftover after parsing attributes in process `syz.3.12199'. [ 1864.463648][ T9848] bond2: (slave gretap0): failed to get link speed/duplex [ 1864.773797][T30429] bond2: (slave gretap0): failed to get link speed/duplex [ 1865.082700][T15633] netlink: 76 bytes leftover after parsing attributes in process `syz.1.12203'. [ 1865.373909][ T4478] Bluetooth: hci5: command 0x0405 tx timeout [ 1866.148229][T15648] netlink: 'syz.4.12208': attribute type 29 has an invalid length. [ 1867.363326][T15649] netlink: 132 bytes leftover after parsing attributes in process `syz.4.12208'. [ 1867.481829][T15655] netlink: 4 bytes leftover after parsing attributes in process `syz.4.12211'. [ 1867.496986][T15657] netlink: 272 bytes leftover after parsing attributes in process `syz.3.12210'. [ 1867.531855][T15657] FAULT_INJECTION: forcing a failure. [ 1867.531855][T15657] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1867.579451][T15660] netlink: 'syz.5.12212': attribute type 1 has an invalid length. [ 1867.603721][T15657] CPU: 1 UID: 0 PID: 15657 Comm: syz.3.12210 Not tainted syzkaller #0 PREEMPT(full) [ 1867.603748][T15657] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1867.603761][T15657] Call Trace: [ 1867.603769][T15657] [ 1867.603778][T15657] dump_stack_lvl+0xe8/0x150 [ 1867.603807][T15657] should_fail_ex+0x412/0x560 [ 1867.603840][T15657] _copy_from_user+0x2d/0xb0 [ 1867.603885][T15657] kstrtouint_from_user+0xd6/0x180 [ 1867.603929][T15657] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 1867.603971][T15657] proc_fail_nth_write+0x8e/0x210 [ 1867.604010][T15657] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 1867.604047][T15657] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 1867.604078][T15657] vfs_write+0x29a/0xb90 [ 1867.604121][T15657] ? __pfx_vfs_write+0x10/0x10 [ 1867.604156][T15657] ? __fget_files+0x2a/0x420 [ 1867.604189][T15657] ? __fget_files+0x3a0/0x420 [ 1867.604217][T15657] ? __fget_files+0x2a/0x420 [ 1867.604256][T15657] ksys_write+0x150/0x270 [ 1867.604291][T15657] ? __pfx_ksys_write+0x10/0x10 [ 1867.604334][T15657] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1867.604359][T15657] do_syscall_64+0x174/0x580 [ 1867.604384][T15657] ? trace_irq_disable+0x3b/0x140 [ 1867.604419][T15657] ? clear_bhb_loop+0x40/0x90 [ 1867.604447][T15657] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1867.604470][T15657] RIP: 0033:0x7f971a75d68e [ 1867.604490][T15657] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1867.604511][T15657] RSP: 002b:00007f971b5a9fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1867.604534][T15657] RAX: ffffffffffffffda RBX: 00007f971b5aa6c0 RCX: 00007f971a75d68e [ 1867.604551][T15657] RDX: 0000000000000001 RSI: 00007f971b5aa0a0 RDI: 0000000000000007 [ 1867.604565][T15657] RBP: 00007f971b5aa090 R08: 0000000000000000 R09: 0000000000000000 [ 1867.604579][T15657] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1867.604593][T15657] R13: 00007f971aa16038 R14: 00007f971aa15fa0 R15: 00007ffe28f1d0f8 [ 1867.604631][T15657] [ 1867.907501][T15660] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1868.613653][ T9848] net_ratelimit: 8 callbacks suppressed [ 1868.613671][ T9848] bond2: (slave gretap0): failed to get link speed/duplex [ 1868.756787][T15708] netlink: 12 bytes leftover after parsing attributes in process `syz.1.12228'. [ 1868.878087][T15717] xt_bpf: check failed: parse error [ 1869.110690][T15716] veth9: entered allmulticast mode [ 1869.166662][T15716] bond9: (slave veth9): Enslaving as an active interface with an up link [ 1869.201666][T15731] SET target dimension over the limit! [ 1869.220459][T15719] bond9 (unregistering): (slave veth9): Releasing backup interface [ 1869.243196][T15719] bond9 (unregistering): Released all slaves [ 1869.353872][T30430] bond2: (slave gretap0): failed to get link speed/duplex [ 1869.384014][T15738] netlink: 12 bytes leftover after parsing attributes in process `syz.5.12236'. [ 1869.418843][T15738] netlink: 8 bytes leftover after parsing attributes in process `syz.5.12236'. [ 1869.475051][ T9848] bond2: (slave gretap0): failed to get link speed/duplex [ 1869.604963][T30430] bond2: (slave gretap0): failed to get link speed/duplex [ 1869.723712][ T9848] bond2: (slave gretap0): failed to get link speed/duplex [ 1869.833683][T30430] bond2: (slave gretap0): failed to get link speed/duplex [ 1869.943649][T30430] bond2: (slave gretap0): failed to get link speed/duplex [ 1870.054074][ T13] bond2: (slave gretap0): failed to get link speed/duplex [ 1870.169635][T30430] bond2: (slave gretap0): failed to get link speed/duplex [ 1870.293649][T30430] bond2: (slave gretap0): failed to get link speed/duplex [ 1870.300962][ T785] IPVS: starting estimator thread 0... [ 1870.403750][T15756] IPVS: using max 28 ests per chain, 67200 per kthread [ 1870.963822][ C1] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 1872.008517][T15729] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1872.212613][T15770] netlink: 'syz.1.12247': attribute type 5 has an invalid length. [ 1872.223856][T15769] netlink: 224 bytes leftover after parsing attributes in process `syz.5.12244'. [ 1872.231348][T15770] netlink: 16 bytes leftover after parsing attributes in process `syz.1.12247'. [ 1872.266169][T15766] netlink: 204 bytes leftover after parsing attributes in process `syz.0.12246'. [ 1872.275909][T15766] netlink: 'syz.0.12246': attribute type 1 has an invalid length. [ 1872.294391][T15766] netlink: 232 bytes leftover after parsing attributes in process `syz.0.12246'. [ 1872.695689][T15785] tap0: tun_chr_ioctl cmd 1074025681 [ 1872.876532][T15789] netlink: 180 bytes leftover after parsing attributes in process `syz.4.12254'. [ 1872.888896][T15789] netlink: 8 bytes leftover after parsing attributes in process `syz.4.12254'. [ 1872.977184][T15795] netlink: 'syz.4.12256': attribute type 10 has an invalid length. [ 1873.025788][T15795] team0: Failed to send options change via netlink (err -105) [ 1873.033426][T15795] team0: Port device dummy0 added [ 1873.235170][T15808] netlink: 8 bytes leftover after parsing attributes in process `syz.0.12260'. [ 1873.280598][T15806] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 1873.317885][T15810] netlink: 'syz.5.12261': attribute type 1 has an invalid length. [ 1873.765939][T15828] netlink: 104 bytes leftover after parsing attributes in process `syz.1.12265'. [ 1873.798825][T15810] 8021q: adding VLAN 0 to HW filter on device bond3 [ 1873.828677][T30430] net_ratelimit: 26 callbacks suppressed [ 1873.828696][T30430] bond2: (slave gretap0): failed to get link speed/duplex [ 1873.992886][T15817] xfrm0 speed is unknown, defaulting to 1000 [ 1874.004530][T14662] bond2: (slave gretap0): failed to get link speed/duplex [ 1874.234846][T14662] bond2: (slave gretap0): failed to get link speed/duplex [ 1874.248384][T15851] sch_tbf: peakrate 7 is lower than or equals to rate 7 ! [ 1875.106033][T15873] netlink: 12 bytes leftover after parsing attributes in process `syz.1.12274'. [ 1875.158990][T15874] netlink: 16 bytes leftover after parsing attributes in process `syz.1.12274'. [ 1877.010585][T15819] Set syz1 is full, maxelem 65536 reached [ 1877.877952][T15855] netlink: 4 bytes leftover after parsing attributes in process `syz.5.12272'. [ 1877.945878][T15873] bond9: option ad_actor_system: mode dependency failed, not supported in mode balance-rr(0) [ 1877.974040][T15873] bond9 (unregistering): Released all slaves [ 1877.985788][T15877] netlink: 'syz.5.12275': attribute type 11 has an invalid length. [ 1878.019594][T15877] netlink: 140 bytes leftover after parsing attributes in process `syz.5.12275'. [ 1878.070123][T15879] openvswitch: netlink: Missing valid actions attribute. [ 1878.097567][T15879] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1878.107419][T30426] bond2: (slave gretap0): failed to get link speed/duplex [ 1878.199230][T15887] xt_ipcomp: unknown flags 1D [ 1878.234744][T30426] bond2: (slave gretap0): failed to get link speed/duplex [ 1878.373714][T14662] bond2: (slave gretap0): failed to get link speed/duplex [ 1878.385987][T15895] netlink: 272 bytes leftover after parsing attributes in process `syz.5.12279'. [ 1878.417656][T15895] netlink: 60 bytes leftover after parsing attributes in process `syz.5.12279'. [ 1878.455862][T15895] netlink: 20 bytes leftover after parsing attributes in process `syz.5.12279'. [ 1878.504436][T15889] netlink: 8 bytes leftover after parsing attributes in process `syz.5.12279'. [ 1878.519743][T14662] bond2: (slave gretap0): failed to get link speed/duplex [ 1878.593183][T15900] netlink: 12 bytes leftover after parsing attributes in process `syz.1.12282'. [ 1878.764962][T15905] netlink: 72 bytes leftover after parsing attributes in process `syz.0.12283'. [ 1878.898867][ T13] net_ratelimit: 2 callbacks suppressed [ 1878.898887][ T13] bond2: (slave gretap0): failed to get link speed/duplex [ 1879.044689][T14662] bond2: (slave gretap0): failed to get link speed/duplex [ 1879.164548][ T12] bond2: (slave gretap0): failed to get link speed/duplex [ 1879.294172][ T13] bond2: (slave gretap0): failed to get link speed/duplex [ 1879.423950][ T13] bond2: (slave gretap0): failed to get link speed/duplex [ 1879.545095][ T12] bond2: (slave gretap0): failed to get link speed/duplex [ 1879.668260][ T4478] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 1879.674147][ T13] bond2: (slave gretap0): failed to get link speed/duplex [ 1879.688527][ T4478] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 1879.715549][ T4478] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 1879.739346][ T4478] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 1879.748074][ T4478] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 1879.811353][ T9848] bond2: (slave gretap0): failed to get link speed/duplex [ 1879.958296][ T13] bond2: (slave gretap0): failed to get link speed/duplex [ 1880.194281][T30426] bond2: (slave gretap0): failed to get link speed/duplex [ 1880.219073][T15930] syzkaller0: entered promiscuous mode [ 1880.225790][T15930] syzkaller0: entered allmulticast mode [ 1880.238837][T15930] tipc: Enabled bearer , priority 0 [ 1880.262901][T15928] tipc: Resetting bearer [ 1880.330938][T15928] tipc: Disabling bearer [ 1880.634392][T15921] xfrm0 speed is unknown, defaulting to 1000 [ 1881.223132][T15970] netlink: 'syz.5.12299': attribute type 11 has an invalid length. [ 1881.380554][T15972] __nla_validate_parse: 5 callbacks suppressed [ 1881.380573][T15972] netlink: 12 bytes leftover after parsing attributes in process `syz.4.12300'. [ 1881.510178][T15972] veth3: entered allmulticast mode [ 1881.517991][T15974] netlink: 16 bytes leftover after parsing attributes in process `syz.5.12301'. [ 1881.542419][T15972] bond1: (slave veth3): Enslaving as an active interface with an up link [ 1881.569382][T15978] bond1 (unregistering): (slave veth3): Releasing backup interface [ 1881.580079][T15981] netlink: 32 bytes leftover after parsing attributes in process `syz.3.12303'. [ 1881.596820][T15978] bond1 (unregistering): Released all slaves [ 1881.643395][T15972] netlink: 4 bytes leftover after parsing attributes in process `syz.4.12300'. [ 1881.771242][T15984] batadv_slave_1: entered promiscuous mode [ 1881.844809][ T4949] Bluetooth: hci4: command tx timeout [ 1881.868168][T15983] batadv_slave_1: left promiscuous mode [ 1881.889567][T15987] tipc: Enabled bearer , priority 0 [ 1881.919938][T15987] syzkaller0: entered promiscuous mode [ 1881.949855][T15987] syzkaller0: entered allmulticast mode [ 1881.998887][T15997] netlink: 20 bytes leftover after parsing attributes in process `syz.4.12308'. [ 1882.057198][T15987] syzkaller0: MTU too low for tipc bearer [ 1882.076032][T15987] tipc: Disabling bearer [ 1882.331112][T16009] netlink: 28 bytes leftover after parsing attributes in process `syz.5.12312'. [ 1882.350708][T16007] tipc: Started in network mode [ 1882.356326][T16007] tipc: Node identity 12118ee9c6df, cluster identity 4711 [ 1882.364343][T16007] tipc: Enabled bearer , priority 0 [ 1882.389964][T16007] syzkaller0: entered promiscuous mode [ 1882.403971][T16007] syzkaller0: entered allmulticast mode [ 1882.509146][T16007] tipc: Resetting bearer [ 1882.557817][T16006] tipc: Resetting bearer [ 1882.636756][T16006] tipc: Disabling bearer [ 1882.658939][T15921] bridge0: port 1(bridge_slave_0) entered blocking state [ 1882.666559][T15921] bridge0: port 1(bridge_slave_0) entered disabled state [ 1882.674008][T15921] bridge_slave_0: entered allmulticast mode [ 1882.681975][T15921] bridge_slave_0: entered promiscuous mode [ 1882.695625][T15921] bridge0: port 2(bridge_slave_1) entered blocking state [ 1882.709468][T15921] bridge0: port 2(bridge_slave_1) entered disabled state [ 1882.722912][T15921] bridge_slave_1: entered allmulticast mode [ 1882.738286][T15921] bridge_slave_1: entered promiscuous mode [ 1882.809088][T15921] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1882.837660][T15921] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1882.932073][T15921] team0: Port device team_slave_0 added [ 1882.949571][T15921] team0: Port device team_slave_1 added [ 1883.011409][T15921] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1883.018965][T15921] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1883.048740][T15921] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1883.062779][T15921] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1883.086257][T15921] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1883.117960][T16034] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1883.123438][T15921] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1883.198562][T15921] hsr_slave_0: entered promiscuous mode [ 1883.208419][T15921] hsr_slave_1: entered promiscuous mode [ 1883.215501][T15921] debugfs: 'hsr0' already exists in 'hsr' [ 1883.221432][T15921] Cannot create hsr debugfs directory [ 1883.351110][T16038] xfrm0 speed is unknown, defaulting to 1000 [ 1883.750827][T16053] veth0: entered promiscuous mode [ 1883.835293][T16042] veth0: left promiscuous mode [ 1883.924059][ T4949] Bluetooth: hci4: command tx timeout [ 1884.000775][T15921] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1884.043640][T16060] netlink: 4 bytes leftover after parsing attributes in process `syz.5.12327'. [ 1884.044420][T14662] net_ratelimit: 16 callbacks suppressed [ 1884.044469][T14662] bond2: (slave gretap0): failed to get link speed/duplex [ 1884.069866][T16063] netlink: 8 bytes leftover after parsing attributes in process `syz.4.12328'. [ 1884.291958][T15921] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1884.405290][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 1884.593658][T14662] bond2: (slave gretap0): failed to get link speed/duplex [ 1884.664474][T16079] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input22 [ 1884.744360][T14430] ip6_tunnel: ip6erspan0 xmit: Local address not yet configured! [ 1884.762651][T15921] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1884.933686][ T9848] bond2: (slave gretap0): failed to get link speed/duplex [ 1885.012037][T15921] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1885.054806][T16094] netlink: 24 bytes leftover after parsing attributes in process `syz.4.12336'. [ 1885.204270][ T9848] bond2: (slave gretap0): failed to get link speed/duplex [ 1885.334019][ T13] bond2: (slave gretap0): failed to get link speed/duplex [ 1885.835325][ T13] bond2: (slave gretap0): failed to get link speed/duplex [ 1885.916908][T15921] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 1885.930878][T15921] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1885.958786][T15921] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 1885.970658][T15921] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1885.979406][T15921] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 1886.003671][ T4949] Bluetooth: hci4: command tx timeout [ 1886.014630][T15921] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1886.077453][T15921] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 1886.128241][T15921] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1886.206436][T30430] bond2: (slave gretap0): failed to get link speed/duplex [ 1886.406559][T16134] netlink: 4 bytes leftover after parsing attributes in process `syz.0.12348'. [ 1886.440468][T15921] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1886.456741][T16145] netlink: 12 bytes leftover after parsing attributes in process `syz.0.12348'. [ 1886.474193][ T13] bond2: (slave gretap0): failed to get link speed/duplex [ 1886.574488][T15921] 8021q: adding VLAN 0 to HW filter on device team0 [ 1886.609201][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 1886.616457][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1886.640635][T30430] bridge0: port 2(bridge_slave_1) entered blocking state [ 1886.647862][T30430] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1886.660899][T16154] netlink: 'syz.4.12355': attribute type 11 has an invalid length. [ 1886.693673][T30430] bond2: (slave gretap0): failed to get link speed/duplex [ 1886.834533][T30430] bond2: (slave gretap0): failed to get link speed/duplex [ 1886.899336][T16160] syzkaller0: entered promiscuous mode [ 1886.912133][T16160] syzkaller0: entered allmulticast mode [ 1887.202628][T16175] syzkaller0: entered promiscuous mode [ 1887.208593][T16175] syzkaller0: entered allmulticast mode [ 1887.293238][T16176] bridge0: port 2(bridge_slave_1) entered disabled state [ 1887.300998][T16176] bridge0: port 1(bridge_slave_0) entered disabled state [ 1887.317242][T16178] bridge0: port 2(bridge_slave_1) entered blocking state [ 1887.324706][T16178] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1887.332256][T16178] bridge0: port 1(bridge_slave_0) entered blocking state [ 1887.339510][T16178] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1887.355688][T16178] bridge0: entered promiscuous mode [ 1887.362112][T16178] bridge0: entered allmulticast mode [ 1887.476346][T16190] netlink: 12 bytes leftover after parsing attributes in process `syz.5.12364'. [ 1888.084875][ T4949] Bluetooth: hci4: command tx timeout [ 1888.360084][T16215] xt_addrtype: output interface limitation not valid in PREROUTING and INPUT [ 1888.369556][T16215] xt_addrtype: output interface limitation not valid in PREROUTING and INPUT [ 1888.378563][T16215] xt_addrtype: output interface limitation not valid in PREROUTING and INPUT [ 1888.391536][T16215] xt_addrtype: output interface limitation not valid in PREROUTING and INPUT [ 1888.401190][T16215] xt_addrtype: output interface limitation not valid in PREROUTING and INPUT [ 1888.702441][T16190] workqueue: Failed to create a rescuer kthread for wq "bond4": -EINTR [ 1888.748749][ T9848] netdevsim netdevsim0 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1888.799412][ T9848] netdevsim netdevsim0 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1888.834473][ T9848] netdevsim netdevsim0 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1888.870604][ T9848] netdevsim netdevsim0 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1889.068236][T16236] netlink: 8 bytes leftover after parsing attributes in process `syz.5.12372'. [ 1889.093084][T16227] netlink: 4 bytes leftover after parsing attributes in process `syz.4.12371'. [ 1889.107727][T16227] netlink: 12 bytes leftover after parsing attributes in process `syz.4.12371'. [ 1889.158034][ T12] net_ratelimit: 4 callbacks suppressed [ 1889.158053][ T12] bond2: (slave gretap0): failed to get link speed/duplex [ 1889.273964][T30429] bond2: (slave gretap0): failed to get link speed/duplex [ 1889.288947][T15921] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1889.335870][T15921] veth0_vlan: entered promiscuous mode [ 1889.348494][T15921] veth1_vlan: entered promiscuous mode [ 1889.380391][T15921] veth0_macvtap: entered promiscuous mode [ 1889.391197][T15921] veth1_macvtap: entered promiscuous mode [ 1889.409722][T15921] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1889.426720][T15921] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1889.441649][T30429] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1889.452263][T30429] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1889.464707][T30429] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1889.474443][T30429] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1889.524995][ T6889] bond2: (slave gretap0): failed to get link speed/duplex [ 1889.673893][T30429] bond2: (slave gretap0): failed to get link speed/duplex [ 1889.730698][T16224] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1889.916814][T16245] batadv1: entered promiscuous mode [ 1889.922291][T16245] batadv1: entered allmulticast mode [ 1889.957157][T16247] netlink: 20 bytes leftover after parsing attributes in process `syz.0.12375'. [ 1889.988732][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1890.007544][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1890.109397][T16250] netlink: 16 bytes leftover after parsing attributes in process `syz.3.12376'. [ 1890.116707][T30430] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1890.134431][ T6889] bond2: (slave gretap0): failed to get link speed/duplex [ 1890.148206][T30430] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1890.186250][T16250] netlink: 272 bytes leftover after parsing attributes in process `syz.3.12376'. [ 1890.243437][T16257] xfrm0 speed is unknown, defaulting to 1000 [ 1890.264473][T30430] bond2: (slave gretap0): failed to get link speed/duplex [ 1890.383632][T30430] bond2: (slave gretap0): failed to get link speed/duplex [ 1890.409812][T16265] netlink: 4 bytes leftover after parsing attributes in process `syz.1.12287'. [ 1890.546978][ T12] bond2: (slave gretap0): failed to get link speed/duplex [ 1890.674368][ T6889] bond2: (slave gretap0): failed to get link speed/duplex [ 1890.754233][T16263] netlink: 'syz.4.12379': attribute type 1 has an invalid length. [ 1890.806087][ T12] bond2: (slave gretap0): failed to get link speed/duplex [ 1890.866089][T16260] xfrm0 speed is unknown, defaulting to 1000 [ 1891.628134][T16304] __nla_validate_parse: 4 callbacks suppressed [ 1891.628154][T16304] netlink: 4 bytes leftover after parsing attributes in process `syz.1.12386'. [ 1891.656284][T16304] netlink: 12 bytes leftover after parsing attributes in process `syz.1.12386'. [ 1892.136391][T16313] sctp: [Deprecated]: syz.3.12390 (pid 16313) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1892.136391][T16313] Use struct sctp_sack_info instead [ 1892.879075][T16338] bridge0: port 2(bridge_slave_1) entered disabled state [ 1892.886828][T16338] bridge0: port 1(bridge_slave_0) entered disabled state [ 1893.072191][T16338] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1893.088624][T16338] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1893.537872][T16353] Bluetooth: hci1: expected 36 bytes, got 2 bytes [ 1895.700428][T30430] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1895.709515][T30430] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1895.736970][T30430] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1895.771407][T30430] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1895.794242][T30430] net_ratelimit: 9 callbacks suppressed [ 1895.794264][T30430] bond2: (slave gretap0): failed to get link speed/duplex [ 1895.885877][T16367] netlink: 36 bytes leftover after parsing attributes in process `syz.3.12404'. [ 1895.949230][T16364] xfrm0 speed is unknown, defaulting to 1000 [ 1895.955395][ T12] bond2: (slave gretap0): failed to get link speed/duplex [ 1896.052937][T16376] netlink: 12 bytes leftover after parsing attributes in process `syz.0.12406'. [ 1896.064528][T30430] bond2: (slave gretap0): failed to get link speed/duplex [ 1896.245108][T30430] bond2: (slave gretap0): failed to get link speed/duplex [ 1896.295293][T16382] Bluetooth: hci1: expected 36 bytes, got 2 bytes [ 1896.416162][T16376] veth5: entered allmulticast mode [ 1896.482502][T16376] bond8: (slave veth5): Enslaving as an active interface with an up link [ 1896.489609][T16385] netlink: 'syz.5.12408': attribute type 9 has an invalid length. [ 1896.519614][T16385] netlink: 212356 bytes leftover after parsing attributes in process `syz.5.12408'. [ 1896.568846][T16379] bond8 (unregistering): (slave veth5): Releasing backup interface [ 1896.596538][T16379] bond8 (unregistering): Released all slaves [ 1896.682554][T16385] netlink: 32 bytes leftover after parsing attributes in process `syz.5.12408'. [ 1896.906069][T16387] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1896.963840][T30426] bond2: (slave gretap0): failed to get link speed/duplex [ 1897.122961][T16399] netlink: zone id is out of range [ 1897.177355][T16399] netlink: zone id is out of range [ 1897.195676][T16387] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1897.207202][T16404] netlink: 'syz.3.12411': attribute type 1 has an invalid length. [ 1897.215331][T16399] netlink: zone id is out of range [ 1897.257844][T16399] netlink: zone id is out of range [ 1897.269293][T16399] netlink: zone id is out of range [ 1897.337973][T16404] 8021q: adding VLAN 0 to HW filter on device bond3 [ 1897.415966][T16406] bond3: (slave syz_tun): Enslaving as a backup interface with an up link [ 1897.588693][T16387] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1897.676567][T16417] netlink: 4 bytes leftover after parsing attributes in process `syz.0.12416'. [ 1897.715519][T16417] sch_tbf: burst 0 is lower than device syzkaller0 mtu (1500) ! [ 1897.890239][T16387] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1897.943486][T16421] Bluetooth: hci1: expected 36 bytes, got 2 bytes [ 1898.200286][T16430] netlink: 'syz.0.12422': attribute type 1 has an invalid length. [ 1898.290605][T16437] netlink: 16 bytes leftover after parsing attributes in process `syz.5.12424'. [ 1898.302955][T30430] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1898.317525][T16436] netlink: 64 bytes leftover after parsing attributes in process `syz.3.12425'. [ 1898.371292][T16430] 8021q: adding VLAN 0 to HW filter on device bond8 [ 1898.479040][T30430] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1898.518236][T30430] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1898.584495][T16444] syzkaller0: entered promiscuous mode [ 1898.597826][T16444] syzkaller0: entered allmulticast mode [ 1898.712791][T16448] netlink: 212348 bytes leftover after parsing attributes in process `syz.5.12427'. [ 1898.791214][ T6889] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1899.060739][T16457] Bluetooth: hci1: expected 36 bytes, got 2 bytes [ 1899.152284][T16465] Bluetooth: hci1: expected 36 bytes, got 2 bytes [ 1899.196209][T16469] netlink: 28 bytes leftover after parsing attributes in process `syz.3.12434'. [ 1899.216336][T16469] netlink: 'syz.3.12434': attribute type 1 has an invalid length. [ 1899.596580][T16486] netlink: 16 bytes leftover after parsing attributes in process `syz.0.12441'. [ 1899.703290][T16485] syzkaller0: entered promiscuous mode [ 1899.721038][T16485] syzkaller0: entered allmulticast mode [ 1899.917971][T16493] Bluetooth: hci1: expected 36 bytes, got 2 bytes [ 1900.171986][T16512] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input23 [ 1900.894500][T16551] net_ratelimit: 21 callbacks suppressed [ 1900.894522][T16551] bond2: (slave gretap0): failed to get link speed/duplex [ 1901.093701][ T7329] bond2: (slave gretap0): failed to get link speed/duplex [ 1901.160154][T16559] netlink: 'syz.4.12457': attribute type 1 has an invalid length. [ 1901.169365][T16559] netlink: 28 bytes leftover after parsing attributes in process `syz.4.12457'. [ 1901.184193][T16556] block nbd5: server does not support multiple connections per device. [ 1901.201503][T16556] block nbd5: shutting down sockets [ 1901.215256][ T13] bond2: (slave gretap0): failed to get link speed/duplex [ 1901.346153][T16562] syzkaller0: entered promiscuous mode [ 1901.362525][T16562] syzkaller0: entered allmulticast mode [ 1901.419901][T16569] netlink: 24 bytes leftover after parsing attributes in process `syz.3.12461'. [ 1901.444480][ T9848] bond2: (slave gretap0): failed to get link speed/duplex [ 1901.500801][T16573] syzkaller1: entered promiscuous mode [ 1901.507300][T16573] syzkaller1: entered allmulticast mode [ 1901.554358][T30430] bond2: (slave gretap0): failed to get link speed/duplex [ 1901.673899][T30430] bond2: (slave gretap0): failed to get link speed/duplex [ 1901.724507][T16573] xfrm0 speed is unknown, defaulting to 1000 [ 1901.779288][T16587] netlink: 12 bytes leftover after parsing attributes in process `syz.1.12465'. [ 1901.794329][ T13] bond2: (slave gretap0): failed to get link speed/duplex [ 1901.914065][ T7329] bond2: (slave gretap0): failed to get link speed/duplex [ 1901.985346][T16594] bridge_slave_1: left allmulticast mode [ 1902.001274][T16594] bridge_slave_1: left promiscuous mode [ 1902.013931][T16594] bridge0: port 2(bridge_slave_1) entered disabled state [ 1902.101122][T16594] bridge_slave_0: left allmulticast mode [ 1902.121859][T16594] bridge_slave_0: left promiscuous mode [ 1902.134285][T16594] bridge0: port 1(bridge_slave_0) entered disabled state [ 1902.213801][ T13] bond2: (slave gretap0): failed to get link speed/duplex [ 1902.327053][T30430] bond2: (slave gretap0): failed to get link speed/duplex [ 1902.519462][T16608] syzkaller0: entered promiscuous mode [ 1902.529912][T16608] syzkaller0: entered allmulticast mode [ 1902.764378][T16618] netlink: 272 bytes leftover after parsing attributes in process `syz.1.12476'. [ 1903.202720][T16628] [ 1903.205626][T16628] ============================= [ 1903.212095][T16628] WARNING: suspicious RCU usage [ 1903.217545][T16628] syzkaller #0 Not tainted [ 1903.221996][T16628] ----------------------------- [ 1903.227365][T16628] kernel/events/callchain.c:163 suspicious rcu_dereference_check() usage! [ 1903.236126][T16628] [ 1903.236126][T16628] other info that might help us debug this: [ 1903.236126][T16628] [ 1903.246428][T16628] [ 1903.246428][T16628] rcu_scheduler_active = 2, debug_locks = 1 [ 1903.254628][T16628] 1 lock held by syz.1.12480/16628: [ 1903.259854][T16628] #0: ffffffff8e95ce18 (rcu_tasks_trace_srcu_struct){....}-{0:0}, at: rcu_read_lock_trace+0x25/0x110 [ 1903.270962][T16628] [ 1903.270962][T16628] stack backtrace: [ 1903.276947][T16628] CPU: 1 UID: 0 PID: 16628 Comm: syz.1.12480 Not tainted syzkaller #0 PREEMPT(full) [ 1903.276972][T16628] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1903.276986][T16628] Call Trace: [ 1903.276994][T16628] [ 1903.277003][T16628] dump_stack_lvl+0xe8/0x150 [ 1903.277040][T16628] lockdep_rcu_suspicious+0x13f/0x1d0 [ 1903.277071][T16628] get_callchain_entry+0x2b6/0x3c0 [ 1903.277138][T16628] get_perf_callchain+0xd5/0x880 [ 1903.277180][T16628] ? __pfx_get_perf_callchain+0x10/0x10 [ 1903.277205][T16628] ? futex_unqueue+0x22/0x240 [ 1903.277228][T16628] ? futex_unqueue+0x22/0x240 [ 1903.277246][T16628] ? futex_unqueue+0x22/0x240 [ 1903.277272][T16628] __bpf_get_stack+0x445/0xab0 [ 1903.277305][T16628] ? __pfx___bpf_get_stack+0x10/0x10 [ 1903.277332][T16628] ? __lock_acquire+0x6b5/0x2cf0 [ 1903.277358][T16628] bpf_get_stack+0x33/0x50 [ 1903.277378][T16628] ? bpf_prog_e8e6327ccf46c9a7+0x46/0x4e [ 1903.277398][T16628] bpf_get_stack_raw_tp+0x1a9/0x220 [ 1903.277432][T16628] bpf_prog_e8e6327ccf46c9a7+0x46/0x4e [ 1903.277453][T16628] bpf_prog_run_pin_on_cpu+0x3b4/0x470 [ 1903.277487][T16628] bpf_prog_test_run_syscall+0x318/0x4c0 [ 1903.277517][T16628] ? __pfx_bpf_prog_test_run_syscall+0x10/0x10 [ 1903.277542][T16628] ? __fget_files+0x2a/0x420 [ 1903.277573][T16628] ? __pfx_bpf_prog_test_run_syscall+0x10/0x10 [ 1903.277600][T16628] bpf_prog_test_run+0x2c7/0x340 [ 1903.277624][T16628] __sys_bpf+0x643/0x950 [ 1903.277656][T16628] ? __pfx___sys_bpf+0x10/0x10 [ 1903.277706][T16628] ? rcu_is_watching+0x15/0xb0 [ 1903.277735][T16628] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1903.277757][T16628] __x64_sys_bpf+0x7c/0x90 [ 1903.277786][T16628] do_syscall_64+0x174/0x580 [ 1903.277809][T16628] ? trace_irq_disable+0x3b/0x140 [ 1903.277839][T16628] ? clear_bhb_loop+0x40/0x90 [ 1903.277864][T16628] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1903.277883][T16628] RIP: 0033:0x7fa93359ce59 [ 1903.277902][T16628] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1903.277916][T16628] RSP: 002b:00007fa9317f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1903.277933][T16628] RAX: ffffffffffffffda RBX: 00007fa933815fa0 RCX: 00007fa93359ce59 [ 1903.277944][T16628] RDX: 000000000000000c RSI: 00002000000004c0 RDI: 000000000000000a [ 1903.277955][T16628] RBP: 00007fa933632d6f R08: 0000000000000000 R09: 0000000000000000 [ 1903.277965][T16628] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1903.277974][T16628] R13: 00007fa933816038 R14: 00007fa933815fa0 R15: 00007ffea3e33708 [ 1903.277999][T16628] [ 1903.549140][T16521] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1905.974180][ T6889] net_ratelimit: 28 callbacks suppressed [ 1905.974203][ T6889] bond2: (slave gretap0): failed to get link speed/duplex [ 1906.094374][ T1150] bond2: (slave gretap0): failed to get link speed/duplex [ 1906.204001][T30430] bond2: (slave gretap0): failed to get link speed/duplex [ 1906.313900][T30430] bond2: (slave gretap0): failed to get link speed/duplex [ 1906.423647][T30430] bond2: (slave gretap0): failed to get link speed/duplex [ 1906.534106][ T1150] bond2: (slave gretap0): failed to get link speed/duplex [ 1906.645040][ T6889] bond2: (slave gretap0): failed to get link speed/duplex [ 1906.754127][T30430] bond2: (slave gretap0): failed to get link speed/duplex [ 1906.863994][T30430] bond2: (slave gretap0): failed to get link speed/duplex [ 1906.974250][ T6889] bond2: (slave gretap0): failed to get link speed/duplex [ 1911.045510][ T1150] net_ratelimit: 60 callbacks suppressed [ 1911.045531][ T1150] bond2: (slave gretap0): failed to get link speed/duplex [ 1911.173704][ T6889] bond2: (slave gretap0): failed to get link speed/duplex [ 1911.285612][ T9848] bond2: (slave gretap0): failed to get link speed/duplex [ 1911.393996][ T9848] bond2: (slave gretap0): failed to get link speed/duplex [ 1911.503731][ T6889] bond2: (slave gretap0): failed to get link speed/duplex [ 1911.613665][ T6889] bond2: (slave gretap0): failed to get link speed/duplex [ 1911.723664][ T1150] bond2: (slave gretap0): failed to get link speed/duplex [ 1911.834604][ T1150] bond2: (slave gretap0): failed to get link speed/duplex [ 1911.943695][T30430] bond2: (slave gretap0): failed to get link speed/duplex [ 1912.054675][T30430] bond2: (slave gretap0): failed to get link speed/duplex