last executing test programs: 10m26.350806988s ago: executing program 3 (id=706): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000280)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0xff, 0x0, 0x5, 0x200, 0x2, 0x8, 0x8000, 0x3, 0x3b8}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000040)={'syzkaller0\x00', 0x0}) sendto$packet(r4, &(0x7f0000000180)="05", 0x5dc, 0x4009, &(0x7f0000000140)={0x11, 0xf6, r5, 0x1, 0x0, 0x6, @multicast}, 0x14) 10m25.993581734s ago: executing program 3 (id=711): setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000300)={@in={{0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x27}}}, 0x0, 0x0, 0x1a, 0x0, "bb02a3c364ca41d6357e544508474204000b5aa201ecffffffffffffff0f0000000000000034a632ab7193fcf19b2df3ee050000000000000041d269776df1228328cf0a007bbe6c0000000000b800"}, 0xd8) r0 = socket$kcm(0x23, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x2, 0x6, 0x620, 0x0, 0x540, 0x540, 0x540, 0x1d0, 0x610, 0x610, 0x610, 0x610, 0x610, 0x6, 0x0, {[{{@ipv6={@mcast1, @private1, [], [0xffffffff, 0xff000000], 'pimreg0\x00', 'macvtap0\x00', {}, {}, 0x21}, 0x0, 0x188, 0x1d0, 0x0, {0x7a00000010000000}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @local, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @private2}}, @common=@inet=@multiport={{0x50}, {0x0, 0x0, [0x0, 0x80]}}]}, @DNPT={0x48, 'DNPT\x00', 0x0, {@ipv4=@private=0xa000000, @ipv4=@empty, 0xa, 0x30, 0x1}}}, {{@uncond, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@ipv6={@ipv4={'\x00', '\xff\xff', @loopback}, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, [0x0, 0x0, 0x0, 0xffffff00], [], '\x00', 'bond_slave_0\x00', {}, {}, 0x2f, 0x9}, 0x0, 0xa8, 0xe0, 0x48000000}, @common=@inet=@SET3={0x38, 'SET\x00', 0x3, {{0x0, 0x6, 0x5}, {0xffffffffffffffff, 0x6, 0x1}, {0x0, 0x4, 0x2}, 0xfffffffe}}}, {{@uncond, 0x0, 0xa8, 0xf0}, @SNPT={0x48, 'SNPT\x00', 0x0, {@ipv4, @ipv4=@loopback, 0x0, 0xfe}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @HL={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x680) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000240)=0x6, 0x4) listen(r0, 0x8) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r1, &(0x7f0000000380)=ANY=[@ANYBLOB="1c0000f500000000000000862dfdff"], 0x78) 10m23.59410732s ago: executing program 3 (id=721): socket$inet_udp(0x2, 0x2, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) bpf$MAP_CREATE(0x0, 0x0, 0x0) socket(0x40000000015, 0x5, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0) socket(0x10, 0x803, 0x0) socket$nl_route(0x10, 0x3, 0x0) pipe(&(0x7f00000002c0)={0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000500)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400", @ANYRES32=r1, @ANYBLOB="060015000700fdff0c00168008000100", @ANYRES32=r0], 0x38}}, 0x10) 10m23.345579208s ago: executing program 3 (id=725): bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000140)=@bpf_lsm={0x6, 0x3, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)={{0x14, 0x10, 0x1, 0x0, 0x0, {0xa}}, [@NFT_MSG_NEWTABLE={0xc4, 0x0, 0xa, 0x201, 0x0, 0x0, {0x5, 0x0, 0x4}, [@NFTA_TABLE_USERDATA={0xae, 0x6, "7220c41382d2bd4fcd007de01b329303aaa2ec6f4418f7f611e63220d38b5379307c2c6c73dda9cc5079259fe9088ca8985b7c6460bd15338261e0a1553e4954e1921304ed0931a5b661d52159835da7aa857c8d7eaa98a2591d55ba7d0a7c507e85683c0323594a843c282abf29ce6e1e3fcfc50fbe251280c9c9d3bff60920689234ce3ed2f0339e10c2a525dfe71315c2a23594829ab645be9f14818120703432e55ad49cc53a587d"}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xec}, 0x1, 0x0, 0x0, 0x40}, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x1, 0xb, &(0x7f0000000100)=ANY=[@ANYBLOB="180800ec0c000000020000000000000018e8ffff1f"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x6, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x94) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000100)=ANY=[@ANYRES8, @ANYRES32, @ANYBLOB="0000000000000000400012800c0001"], 0x68}}, 0x0) r1 = socket$igmp6(0xa, 0x3, 0x2) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f00000002c0)={'syzkaller1\x00', @link_local}) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r1, 0x8983, &(0x7f0000000300)={0x0, 'syzkaller1\x00'}) write$tun(r0, &(0x7f0000000100)=ANY=[@ANYBLOB="06000000bbbbbbbbbbbbaaaaaaaaaabb88f5"], 0x72) 10m22.913829937s ago: executing program 3 (id=731): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x20, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @netfilter=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x99ee}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000500)={r1, 0x0, 0x2d, 0x0, @val=@netfilter={0xa, 0x4, 0xfff7ff1f, 0x1}}, 0x20) getsockopt$inet6_int(r0, 0x29, 0xb, &(0x7f0000000300), &(0x7f0000000340)=0x4) bind$inet6(r0, &(0x7f00000002c0)={0xa, 0x4e22, 0x0, @local, 0xb}, 0x1c) listen(r0, 0x2) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000940)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5", 0x4) r3 = accept4(r2, 0x0, 0x0, 0x800) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) syz_emit_ethernet(0x4e, &(0x7f0000000600)={@local, @broadcast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x18, 0x6, 0xff, @local, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x6, 0xc2, 0x0, 0x0, 0x0, {[@fastopen={0x1e, 0x3}]}}}}}}}}, 0x0) 10m22.734431307s ago: executing program 3 (id=733): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) r1 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000002580)=[{&(0x7f0000000180)=ANY=[@ANYBLOB="1400000026000100000000000000000006"], 0x14}], 0x1}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0xa, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000d80)={0x18, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="1801000021"], 0x0, 0x40, 0x0, 0x0, 0x0, 0xb4a02fe0ce239f93, '\x00', 0x0, 0x2}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xe, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x59, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, r2, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r3, 0x2000000, 0xe, 0x0, &(0x7f0000000040)="630b008646dc3f0adf33c9f7b986", 0x0, 0xcf25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x80}, 0x50) bind$alg(0xffffffffffffffff, &(0x7f0000000140)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_ctr_aes128\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) 10m7.728697431s ago: executing program 32 (id=733): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) r1 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000002580)=[{&(0x7f0000000180)=ANY=[@ANYBLOB="1400000026000100000000000000000006"], 0x14}], 0x1}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0xa, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000d80)={0x18, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="1801000021"], 0x0, 0x40, 0x0, 0x0, 0x0, 0xb4a02fe0ce239f93, '\x00', 0x0, 0x2}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xe, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x59, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, r2, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r3, 0x2000000, 0xe, 0x0, &(0x7f0000000040)="630b008646dc3f0adf33c9f7b986", 0x0, 0xcf25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x80}, 0x50) bind$alg(0xffffffffffffffff, &(0x7f0000000140)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_ctr_aes128\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) 4m42.170659788s ago: executing program 2 (id=3427): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000fff500000000000000000a20000000000a01010000000000000000010000000900010073797a30000000002c000000030a01020000000000000000010000000900010073797a30000000000900030073797a312000000038000000030a01040000000000000000010000010900010073797a30000000000c0002"], 0xac}, 0x1, 0x0, 0x0, 0x8040}, 0x0) 4m41.965761153s ago: executing program 2 (id=3431): r0 = socket(0x400000000010, 0x3, 0x2) connect$inet6(r0, 0x0, 0x0) (async) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0xfffffffd}, 0x1c) (async) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000000200)=0x8, 0x4) (async) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(r2, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4) (async) bind$inet6(r2, &(0x7f0000000140)={0xa, 0x4e22, 0xfffffffc, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, 0x1c) (async) listen(r2, 0x0) listen(0xffffffffffffffff, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r3, 0x0) (async, rerun: 64) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) (rerun: 64) listen(r4, 0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r5, 0x0) (async, rerun: 64) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) (rerun: 64) listen(r6, 0x0) (async) ioctl$XFS_IOC_SWAPEXT(r6, 0xc0c0586d, &(0x7f0000000540)={0x0, r3, r3, 0x3, 0x269f, '\x00', {0x8, 0x8, 0x8, 0xc, 0x9, 0x6, 0x7, 0x4, {0x7, 0xff}, {0x1, 0x6}, {0x6, 0x52}, 0x100000000, 0x3, 0x1, 0x7ff, 0x10000, 0x6, 0x6, 0x40, 0x4, 0x5, '\x00', 0x5, 0x9, 0xfff, 0xaa}}) (async) r7 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r7, &(0x7f0000000140)=[{&(0x7f0000000080)="580000001400192340834b80040d8c560a067f0200ff000000000000000058000b4824ca945f64009400ff0325010ebc000000000000008000f0fffeffe809005300fff5dd00000010000100080c10000000000000000000", 0x58}], 0x1) (async) recvfrom(r7, 0x0, 0x0, 0x0, 0x0, 0x0) (async) sendmsg$NFNL_MSG_CTHELPER_NEW(r7, &(0x7f0000000200)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000280)={&(0x7f0000000100)=ANY=[@ANYBLOB="7c00608b053ac95c41c46bb384910000000901030000000000000000070000080900010073797a30000000004c00020014000180080001007f00000108000200ac1414bb06000340002200000c000280050001002100000014ffffffff0c000280ca3075000000080003400000"], 0x7c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4040000) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000080)=@ccm_128={{0x304}, "22378daa2335e9a3", "817473ee47c2a35519f13c2cddbf9724", "377795a0", "575503ab8f0b2d02"}, 0x28) r8 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000600)=ANY=[@ANYRESDEC=r1], &(0x7f00000002c0)='GPL\x00'}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x17, 0xf, &(0x7f00000001c0)=ANY=[@ANYRESHEX=r5, @ANYRES32=r8, @ANYBLOB="0000000000000000b702000014fa0000b7030000000000008500000083000000bf"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x34, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, 0x94) (async) socket$inet_udp(0x2, 0x2, 0x0) (async) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb010789005e107538e486dd6317ce22000000fffe80"], 0xfdef) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r9, &(0x7f0000001040)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=@newtaction={0x9c, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x88, 0x1, [@m_ctinfo={0x84, 0x1, 0x0, 0x0, {{0xb}, {0x2c, 0x2, 0x0, 0x1, [@TCA_CTINFO_ZONE={0x0, 0x4, 0x3}, @TCA_CTINFO_PARMS_DSCP_MASK={0x8, 0x5, 0x3f}, @TCA_CTINFO_ZONE={0x6}]}, {0x2f, 0x6, "33541d0489594b4602cdb251d51976d8de3a41e138eb1cbd77cef105188ded03d0cd0bc9469799f0357b80"}, {0xc}, {0xc, 0x8, {0x3}}}}]}]}, 0x43}, 0x1, 0x0, 0x0, 0x8000}, 0x0) 4m41.725600568s ago: executing program 2 (id=3433): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000e00)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="1c000000190001000000000000000000802000000004fe0504000000"], 0x1c}}, 0x0) 4m41.501358564s ago: executing program 2 (id=3436): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'cbcmac(khazad)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d49100dc6626c892b6bc436a", 0x10) r1 = accept4(r0, 0x0, 0x0, 0x0) sendmsg$IPVS_CMD_SET_SERVICE(r1, 0x0, 0x8080) 4m41.408225166s ago: executing program 2 (id=3438): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000180)=@newlink={0x4c, 0x10, 0x439, 0x70bd2c, 0xffffffea, {0x0, 0x0, 0xe403, 0x0, 0x40083, 0x715cb}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @sit={{0x8}, {0x20, 0x2, 0x0, 0x1, [@IFLA_IPTUN_6RD_PREFIX={0x14, 0xb, @remote}, @IFLA_IPTUN_REMOTE={0x8, 0x3, @dev={0xac, 0x14, 0x14, 0x21}}]}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8000}, 0x4040) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r1 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0x4) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x32, &(0x7f00000000c0)=r1, 0x4) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000007c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000000900010073797a30000000004c000000090a010400000000000000000700000008000a40000000000900020073797a31000000000900010073797a3000000000080005400000002110001180"], 0xd4}}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000020000030900010073797a310000000018010000030a010400000000000000000100ffff0900030073797a31000000002000048008000140000000051400030076657468315f6d6163767461700000000900010073797a310000"], 0x160}, 0x1, 0x0, 0x0, 0x10}, 0x0) 4m41.079229524s ago: executing program 2 (id=3446): r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) getsockopt$inet_int(r1, 0x0, 0xd, 0x0, &(0x7f0000000080)) sendmsg$netlink(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000002580)=[{&(0x7f0000000180)=ANY=[@ANYBLOB="1400000026000100000000000000000006"], 0x14}], 0x1}, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE(r0, 0x50009401, &(0x7f0000001200)={{r1}, "1aa0e44e40b5d5bef104e5643c80b5f3351351a83e7e9f7fb578c1ae367d1ade7f86d2cd4942b37412989e693bd4ceb3b621ad27ee1a8a8fbb38a5ea6ccb13007bf7b9410b043973d536450f3a03c51590975a37fd8af83d01f50e41f6b1576a1d0faa581808b7e727179a428981ca87bde44fcb8488bf8f87cde80ef2148945715875dca8e80a8108de78f5452a1ba0eaf37da291b4c10f4a4d1c192173b1734da7095b481800a4abb697de44a1b3264b1e2f5c2ba676e5382613cf8b95e10e21ce9c44e67341bc01036c53b613d0ef1e74b20bd4458a5150a7d3c7a491190bb4d08fe2b8abb48b9f9b51663b2a89822bbb1d5cf1a6aa3b700b3928d978fc9e71ca1e28f322914110031fcd503103860539d68dde2a0d76ef45713c2784b48730785ca7d8647c93b2b162ca7f16fd77c1ef7851a3dd9e203bad7d0ec4990ea549ce906fda0bde33b0a2ae84efce7d47c76e53ed897ad76a8eddf649dc42739677c6d9dbc2921d4f6278ede8b0cff36d0f63646de6a2038de984ab8b4cae055cca56da19d8447ee60c714bbe3c81a3d04804230b529e3493f337eb51c7311279e839d3575a7ae06cc17f92c01f4d5a1866a7a50f12bea61de2d3748288d5cd4316a42c2ae0473cb0705552478ddedff01cbd42c7c755560bf3ae84d14784dd79fa60214e1d416ab0a96fb6e74fa68b85a4191e0b82af44b25a0183bf6a8643fda3b3617a9c01ea9a9074d4dcada43e21cda8d0b69fe4aa0a668bbd6f3328a99f777ed63abbce2ff2b80e402bebf1c18ac17016e091108ba1cfc314a214e63a4535ef81d5bd532082ba4639b207b9fe30f3512051157ad578a56a45d2b31c8297e7acbd94a25f38c96f744232c99135a9aac86e175a6111d2c823262366cbad73f3e230adb09916162588eee75f1b62bb7e777dc93363d3391fb25bb7894f811ec701462f0f8c1109ca394625548d46a2114370d1e152b7e162d0c1897276b7782711ffbd18c9a6ce347c16fd04535c8b286670b0b29fd7c47e5863445c16235049929aebafd1d75fe96ba4cafc6325c86d7802b303df50b4fec689d75a0119d92dad7567238254ef68f2dfc7611eac8e1bd2108d2112e623c1a44460728eb360ef6aecb62ae0a1ab0dd3df74820418c8142a8aab7f462080998bd6e5bc04fc765a5153cf8c469b2a3c202a50cc9e696500534b727b688e918df36e122a04586ffb11791474a6bce57bc4379504b6a287d0bd399cbeb0d5270fe1b069b77e1866210670477bd6f4c3842aeda63a63436f626b33d48b4eba52c4a397b2806ec1ac8a0ee758d4129683dcce374a860697498d1befcfaae7f69fe7c0822368c723be69eb1f3363ffa21a5a4fb9725865e4c7db8b7ee65f1c578f53e00863ac09af27e2027f48f53086e435c916a0c5ffe66c556c9dec89e464ca97d5bc6cfb0edc0e0140cf5d2de34c12349187a825b4198081d2bd8725caa036c2dc74679c2f62c33348fcf0d45ec3567813ecd13e517fd01e3231b30c80ec945a92a526f9607d13283578a7ece9f6c9ef5072268b488aa090795cd57fd0f8f62bc0e094d6109b0c1961cee87465021f0562cf1bb769252518cbc819f81eb0237138346abead561906a6f8f56aeea28d364f0c9c5b7908dad638e701570778c38798cd028c74a9795ee340f128abd17498fd569f6c7f9fb4fdaa5ffcd3aa8a3bee21a0eb66089e7ff54aaf922ee2b065132af24cb49e71cd87d702799474d26a3d80721f3e06d8d7a90c382e8076327d1842c7687e0ec52e9f60cbb3abc86aa5979081a0f0471eae6d9b9cac799aee2f03defb10f942b0ee527212b0afe5c5aee2f51af91fdc2d4091808fd551cb98d5b3d8d978bbf9ba8a29a3f8af90ac2241afdc5748e862a1c862b81de185e3e0d6ffff5da1891e28ea8b2be87c863d9ef58f7827cc27a521b74e05e07f57d4bf61e80a8741b2839eb7df29eef0fb5a89c3c449c241aa6aca14900582f2fa9acabef750adb66fd6756a449152783b8a6e3c190d34c9a057ef632b2a087347f332b5e4b1e999a0f6daa9ccaa56bc59b63c5e67070f81a3c4ef9ac677bed4a38f90050025b7a4a209906e3d2fe66e42040abf47c493aacacd0492d4f71e7e50893856952b26ad8381753b43dce1c47d3ac9f620b0f448d640ba4f3c86b8a0c5424c4773cedb07a78790abc95c6b46936f39d6ef860163d81d0019d971a575af52ff1ffd9b68735e03a408cc0f67eff1a85becb5bb3c86826b209c8da9ecede01690570bc67c1d48cfcef73500a5a6c6e9ae77abbb6b58af662d2a2b5a88165fd24fd28616214d814125a28a0b8c064af70a823d5d7224701547d2ffdc19c34ebeb101d7b01b00932a3be846c1b98f73e62e25519c76a617ece99e9fbc393e6232545e8c8b33c0122bf87fdd88ff874440e95d75c546bfa93c03f30b9b92ca225cd642c13722c6ebc8ea07668f90b7f254b2013e34907552f82397153525505ce592410e5360ee23d3a8dbcbbbf97686c84dbfef622db3212cfbd41e84ce09704eae61f4774f61c776f5b8f99c828b4a4f7d3a6814ba420f450786f578ef9a2944d54d00e2d2b60149eb87f1dceb3aea82bd3ca070bba67a36db4d15053ee7662425742e7d23bb954799c0fc595d98b64abc28e88c666c64667d3b92d2ac1e40b418b255a6cc659a60547f9c3d0b38fb248131c8a00f4029ae81b62319e1ded1e3cdbe5b17d62e1d2b9f7176f88baa70700061dd2ef9046235f29da164a33e7253bc2d24ae3d00c53fd774c98838c07b0127e3d7b4585b6534e24785be08575b03a1d268fc06f94348f4e21cfa8b8d25ab209a8c8379cd31b5dd7a0ce9828a51bc13aa51ebebff4cc863672867ae61dbcb21ab4e431c01461237d405d32f4069b87d3271d8fcceaafcd6c77e754027c0adac166903f8f225b611bc2fb870261bda557e6020b95c4ba0b344b6dbe7319e34031c11938c9c8405dcbf7f105b3bc422d85368c71d3e27ef711e2af6c9bb212f1b462423c5fafb5097d546b5f922da03922ff7c3940ef4f5114798fe19408e7a8a0838560aa4829b792df142b3bb8afa447ecd30146e44cdb74ec68b09d3862dcf827a979e58993ec82d1a62e66cc100c70b285a4b41d3302c289e470a692821cb68e99007ec66f26903cf519f9892cbd4adfaf901da9c8ad76c5311c4524e6686df2fdb21770e8a1af4be36bed94cd7acf74ba8830cf76c9d243cc678f5717fe16446c89102ec3566032461a610932f2aae3782042e2c3f92145c045a73805316f2f7b798a60badefe262113f628396ef6d4d8ccae4bb0fbe784bbf6f627acddc94b2f0950b546f37c979db2c44173075126f7282af702ce1a77b7886e10412e2c7b5967a3f6a23c490a3f8003909d0910fbd73848d71f1089072c9404472583efa44b105a453fb7c06bf8798428463c88aea0b0d0bed6d236b09dd7d9d3d4837e4ee88d68ea41f1bcd5304726ff7aca1fd009e5233a032fec48678fa9db77d28b0988fc7b0a7516cbffa4a654b1e41d3200fb5f5a14cbb720641da899abd13fc9c4e0a392b891e41fa8634f096351c24e1f705093ea3aefb90ed4ae12e494c388a2544ace641ea0a3e88df04eb492ead061383c95642c3aa2f8b5d212212bb13026290de69620f8617d3645bb67722257eeffeb0dbefff8f0cdcee9f650ea3307cf1c659fb99988acb62cd4ac11f8d772e809ef0e1d3b7d66030283d071038dcc4568c73c8c2a701e67aaab9f099824453a0b264253b41ea4305e41fc0e6b6e6fa12b666aa4483ad3749e2ef5b1fc8d69e1afd0d5144073f32e2a7b936778880da1e77a89111c92da27b651942c0159b9fab0bc6fe7d163e46c41cc0939f12f2c621c6984d833708457a809bd4a049ac1f732c9dbba5b99804bd148bf4c6a8490c771959773dc6e96449f49514950192cacd62787ef9416c0886900876c4049f9e78955ea27d6bdb16f3d3b7a22f115760e5718680176e12a88693492c0d159697961a703049acc779802bf5b4ede6690dfb646a7bf4397bd92997b6aa1cfd01545a1075bf650af34e439bc7eb3cbb9b7b2475d3506737bcc691dbc3bc4101f2bef612a0dc1739bbfbc1d738d1373ae613475abaa00855bc5dead51d3a44af753b0b38596fd22b234d544547a356d6243486dc9b21ba03fbf8f7b8456a29fc5d898fb00962c07bd0b90e0febd067ec9af04da02718bef270a81b02461d54a2dd5135264a312142a7e23ec455c9633021b039a6540a3e8bc87a0ebac50d2ddf44f1d179d0f0b721c0588c555610588f333417842547e56032f341c692d25ccde58052a4f11d9e140ebf0df8ffff2265029f3ccac8ffd57c30628eed716e1f58c1eff0ac212ed2832d0df3ebdf676ee135a54c8bbcbdebbcb208530ac5b3c8ea82b817358ff4993634020e192eecc641dff85a634f196d619be19924c911377445c0c0d05b143b717645a696c70deaee070541bf69e3a0c1684658e3f94a8c4a3c49a325c41daf8e6c8fc2468b955c692e6439bb13486f6237ff3bf4aa5547875215fbdfd734b944ce5dc6427964f8a12add278091dc1a97dc01e14c16fb0943b0f17cc069e9c0bfd8eb53d4f3e09f98f67d039a4b85720c85adc65e843c7f4a2a3467a050988decc3115cfe16e5d6037d5eeedeca14f7f754a200468ccd99d86a52acbf1637101302ad585a0953e8f76c908c19a36f34dd5ad2dccd8b9f12152b2466d5184c36ddc1aae329c212b7cc78351c8d67c7e76b88eb217fe0a610b8edadbfa602f983d420fbfce91e5bb45bb44f1b90b38935063fba921690f2f165e0578eb906cd8449788eb550c6f9238fd52b32465172834d1afcd8efc3d42280869d20b2efb28f673be9714e98e630f65737ad0ea0b8572b68962779f1a7925ebe8875af7b795263b17b9b03dfe710e203768acf303f6c760b603989feba65ea5f21efc85da916d5929ed81a1d4e36f057f84b3761713e7c1cc3c0710f379015d401b55c0a1db1955adaf30e02db12a37fb01102c10a9b89e4bbcaa26940e1338c0d0ff7408a90c7b063b1eb17f3ba34c8b7f3d3d8d42981bb1eb09e785df5c548a2b6d74ac5b1dbbf99973297efcf34c565cabae057d8ff57d065a837f0f1fbbd49aeec7d1fe8a7c41541788f383543ed0532e4ede85ab5c862c28fbb7b289adb06f40cad529d43c64cb29216b358f4051c2256b8db49b4ac067c26bee551e57fc5d7547523f6b05b0de8b85731b55726d328dd6fdb6e416f8ff4370161d1b3ae6f6c3c023aef8b2e77af5565b8e8725719ecc5c8e8dbed444a9f6514175c56a3c347e6e36bb1e2bbb2f60096e8a96df0a1e059abfe6b7f1cea81d165aa987239fb1d0f551000ab0bdf0a4b066ba1be790dbcc9a57a80e89596ce9e63496265b97b90e9377b4f6ae7abfd430661e10b11b38da0d45a216cc892afc8e721376b2545785cbd9893026c0ff2a47e18f6eb434c3d025cbdd1368986f81b6e163afa682d051a526d449b10b4cf7b8e0df36f5aac27790175163d4ac45ccd462811a09699c5481bfefb5d6320bdcbe2a473952a681f977be12ff816a21a3e3128c884186bf23ba2efb80b5f8f303f3976b2c91a9b533f1b5c8e7e9c7c8cc85e67e9a305e5792bd6f3b08f3d6c781393b5bc8503c90020c538402e46c08d4048561dc8c9e5d2f2924d32537cf99a665e38a63181d50a995967b9cbde94a2b9d4b869300a1153d00b3b65a6688d381ab896a0f0aae709bdc8ac3c69413258fbf299ca5f47ef"}) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3be", 0x6) r3 = accept4(r2, 0x0, 0x0, 0x800) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000a00), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000480)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_WIPHY(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="000425bd7000fcdbdf040200010008003f0036000000080061"], 0x24}, 0x1, 0x0, 0x0, 0x4008001}, 0x20000000) sendmsg$NL80211_CMD_SET_COALESCE(r5, &(0x7f0000000200)={0x0, 0xffffffffffffff8c, &(0x7f0000000b00)={&(0x7f0000000040)={0x28, r6, 0x1, 0x0, 0x0, {{0x2}, {@val={0x8, 0x3, r7}, @void}}}, 0x28}}, 0x0) sendmsg$NL80211_CMD_ASSOCIATE(r3, &(0x7f0000000400)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000200)={0x1a0, r4, 0x100, 0x70bd28, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r7}, @val={0xc, 0x99, {0x2, 0x4c}}}}, [@NL80211_ATTR_VHT_CAPABILITY={0x10, 0x9d, {0x800, {0x8, 0x1, 0x4, 0xb9}}}, @NL80211_ATTR_HT_CAPABILITY_MASK={0x1e, 0x94, {0x80, 0x0, 0x3, 0x0, {0x2, 0x166, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x300, 0x4, 0x3}}, @NL80211_ATTR_FILS_KEK={0x28, 0xf2, "5020dddbbe3ecaf4a8f72a36b6cf25c4ac2db8345f995d14eb069117321bae24b0eba9c5"}, @NL80211_ATTR_USE_RRM={0x4}, @NL80211_ATTR_HT_CAPABILITY={0x1e, 0x1f, {0x800, 0x1, 0x7, 0x0, {0x7, 0x91, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x1, 0xc5, 0xe}}, @NL80211_ATTR_DISABLE_VHT={0x4}, @NL80211_ATTR_PREV_BSSID={0xa, 0x4f, @from_mac=@broadcast}, @crypto_settings=[@NL80211_ATTR_PMK={0x32, 0xfe, "4edbc66f85542b626055a0d4b29a7b861000d78ef5d728c49801a652832bd009726604ff263323ccdc6d21471ff4"}, @NL80211_ATTR_CONTROL_PORT_OVER_NL80211={0x4}, @NL80211_ATTR_SAE_PASSWORD={0x7c, 0x115, "1df037904a89c4d5eca4167c928f02a6473f6af3e14d47fae9595f4f8979f2509132478fb0069b5be79e249f9c3926f013a8fcb0c00efe9c0afc632195d92f39eeb373f8df01702c4da1f27243282130b7c0932d160c8b82f282c2984c1295244d1f64730ddbf5f1db7c84f4daf1e19040e417ee80fb7450"}, @NL80211_ATTR_WPA_VERSIONS={0x8, 0x4b, 0x4}, @NL80211_ATTR_CIPHER_SUITE_GROUP={0x8, 0x4a, 0xfac02}, @NL80211_ATTR_CIPHER_SUITE_GROUP={0x8, 0x4a, 0xfac00}, @NL80211_ATTR_CONTROL_PORT_NO_PREAUTH={0x4}, @NL80211_ATTR_CONTROL_PORT_NO_PREAUTH={0x4}], @chandef_params=[@NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x9}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x4}], @NL80211_ATTR_USE_MFP={0x8, 0x42, 0x2}]}, 0x1a0}, 0x1, 0x0, 0x0, 0x4000000}, 0x40) 4m26.045706029s ago: executing program 33 (id=3446): r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) getsockopt$inet_int(r1, 0x0, 0xd, 0x0, &(0x7f0000000080)) sendmsg$netlink(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000002580)=[{&(0x7f0000000180)=ANY=[@ANYBLOB="1400000026000100000000000000000006"], 0x14}], 0x1}, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE(r0, 0x50009401, &(0x7f0000001200)={{r1}, "1aa0e44e40b5d5bef104e5643c80b5f3351351a83e7e9f7fb578c1ae367d1ade7f86d2cd4942b37412989e693bd4ceb3b621ad27ee1a8a8fbb38a5ea6ccb13007bf7b9410b043973d536450f3a03c51590975a37fd8af83d01f50e41f6b1576a1d0faa581808b7e727179a428981ca87bde44fcb8488bf8f87cde80ef2148945715875dca8e80a8108de78f5452a1ba0eaf37da291b4c10f4a4d1c192173b1734da7095b481800a4abb697de44a1b3264b1e2f5c2ba676e5382613cf8b95e10e21ce9c44e67341bc01036c53b613d0ef1e74b20bd4458a5150a7d3c7a491190bb4d08fe2b8abb48b9f9b51663b2a89822bbb1d5cf1a6aa3b700b3928d978fc9e71ca1e28f322914110031fcd503103860539d68dde2a0d76ef45713c2784b48730785ca7d8647c93b2b162ca7f16fd77c1ef7851a3dd9e203bad7d0ec4990ea549ce906fda0bde33b0a2ae84efce7d47c76e53ed897ad76a8eddf649dc42739677c6d9dbc2921d4f6278ede8b0cff36d0f63646de6a2038de984ab8b4cae055cca56da19d8447ee60c714bbe3c81a3d04804230b529e3493f337eb51c7311279e839d3575a7ae06cc17f92c01f4d5a1866a7a50f12bea61de2d3748288d5cd4316a42c2ae0473cb0705552478ddedff01cbd42c7c755560bf3ae84d14784dd79fa60214e1d416ab0a96fb6e74fa68b85a4191e0b82af44b25a0183bf6a8643fda3b3617a9c01ea9a9074d4dcada43e21cda8d0b69fe4aa0a668bbd6f3328a99f777ed63abbce2ff2b80e402bebf1c18ac17016e091108ba1cfc314a214e63a4535ef81d5bd532082ba4639b207b9fe30f3512051157ad578a56a45d2b31c8297e7acbd94a25f38c96f744232c99135a9aac86e175a6111d2c823262366cbad73f3e230adb09916162588eee75f1b62bb7e777dc93363d3391fb25bb7894f811ec701462f0f8c1109ca394625548d46a2114370d1e152b7e162d0c1897276b7782711ffbd18c9a6ce347c16fd04535c8b286670b0b29fd7c47e5863445c16235049929aebafd1d75fe96ba4cafc6325c86d7802b303df50b4fec689d75a0119d92dad7567238254ef68f2dfc7611eac8e1bd2108d2112e623c1a44460728eb360ef6aecb62ae0a1ab0dd3df74820418c8142a8aab7f462080998bd6e5bc04fc765a5153cf8c469b2a3c202a50cc9e696500534b727b688e918df36e122a04586ffb11791474a6bce57bc4379504b6a287d0bd399cbeb0d5270fe1b069b77e1866210670477bd6f4c3842aeda63a63436f626b33d48b4eba52c4a397b2806ec1ac8a0ee758d4129683dcce374a860697498d1befcfaae7f69fe7c0822368c723be69eb1f3363ffa21a5a4fb9725865e4c7db8b7ee65f1c578f53e00863ac09af27e2027f48f53086e435c916a0c5ffe66c556c9dec89e464ca97d5bc6cfb0edc0e0140cf5d2de34c12349187a825b4198081d2bd8725caa036c2dc74679c2f62c33348fcf0d45ec3567813ecd13e517fd01e3231b30c80ec945a92a526f9607d13283578a7ece9f6c9ef5072268b488aa090795cd57fd0f8f62bc0e094d6109b0c1961cee87465021f0562cf1bb769252518cbc819f81eb0237138346abead561906a6f8f56aeea28d364f0c9c5b7908dad638e701570778c38798cd028c74a9795ee340f128abd17498fd569f6c7f9fb4fdaa5ffcd3aa8a3bee21a0eb66089e7ff54aaf922ee2b065132af24cb49e71cd87d702799474d26a3d80721f3e06d8d7a90c382e8076327d1842c7687e0ec52e9f60cbb3abc86aa5979081a0f0471eae6d9b9cac799aee2f03defb10f942b0ee527212b0afe5c5aee2f51af91fdc2d4091808fd551cb98d5b3d8d978bbf9ba8a29a3f8af90ac2241afdc5748e862a1c862b81de185e3e0d6ffff5da1891e28ea8b2be87c863d9ef58f7827cc27a521b74e05e07f57d4bf61e80a8741b2839eb7df29eef0fb5a89c3c449c241aa6aca14900582f2fa9acabef750adb66fd6756a449152783b8a6e3c190d34c9a057ef632b2a087347f332b5e4b1e999a0f6daa9ccaa56bc59b63c5e67070f81a3c4ef9ac677bed4a38f90050025b7a4a209906e3d2fe66e42040abf47c493aacacd0492d4f71e7e50893856952b26ad8381753b43dce1c47d3ac9f620b0f448d640ba4f3c86b8a0c5424c4773cedb07a78790abc95c6b46936f39d6ef860163d81d0019d971a575af52ff1ffd9b68735e03a408cc0f67eff1a85becb5bb3c86826b209c8da9ecede01690570bc67c1d48cfcef73500a5a6c6e9ae77abbb6b58af662d2a2b5a88165fd24fd28616214d814125a28a0b8c064af70a823d5d7224701547d2ffdc19c34ebeb101d7b01b00932a3be846c1b98f73e62e25519c76a617ece99e9fbc393e6232545e8c8b33c0122bf87fdd88ff874440e95d75c546bfa93c03f30b9b92ca225cd642c13722c6ebc8ea07668f90b7f254b2013e34907552f82397153525505ce592410e5360ee23d3a8dbcbbbf97686c84dbfef622db3212cfbd41e84ce09704eae61f4774f61c776f5b8f99c828b4a4f7d3a6814ba420f450786f578ef9a2944d54d00e2d2b60149eb87f1dceb3aea82bd3ca070bba67a36db4d15053ee7662425742e7d23bb954799c0fc595d98b64abc28e88c666c64667d3b92d2ac1e40b418b255a6cc659a60547f9c3d0b38fb248131c8a00f4029ae81b62319e1ded1e3cdbe5b17d62e1d2b9f7176f88baa70700061dd2ef9046235f29da164a33e7253bc2d24ae3d00c53fd774c98838c07b0127e3d7b4585b6534e24785be08575b03a1d268fc06f94348f4e21cfa8b8d25ab209a8c8379cd31b5dd7a0ce9828a51bc13aa51ebebff4cc863672867ae61dbcb21ab4e431c01461237d405d32f4069b87d3271d8fcceaafcd6c77e754027c0adac166903f8f225b611bc2fb870261bda557e6020b95c4ba0b344b6dbe7319e34031c11938c9c8405dcbf7f105b3bc422d85368c71d3e27ef711e2af6c9bb212f1b462423c5fafb5097d546b5f922da03922ff7c3940ef4f5114798fe19408e7a8a0838560aa4829b792df142b3bb8afa447ecd30146e44cdb74ec68b09d3862dcf827a979e58993ec82d1a62e66cc100c70b285a4b41d3302c289e470a692821cb68e99007ec66f26903cf519f9892cbd4adfaf901da9c8ad76c5311c4524e6686df2fdb21770e8a1af4be36bed94cd7acf74ba8830cf76c9d243cc678f5717fe16446c89102ec3566032461a610932f2aae3782042e2c3f92145c045a73805316f2f7b798a60badefe262113f628396ef6d4d8ccae4bb0fbe784bbf6f627acddc94b2f0950b546f37c979db2c44173075126f7282af702ce1a77b7886e10412e2c7b5967a3f6a23c490a3f8003909d0910fbd73848d71f1089072c9404472583efa44b105a453fb7c06bf8798428463c88aea0b0d0bed6d236b09dd7d9d3d4837e4ee88d68ea41f1bcd5304726ff7aca1fd009e5233a032fec48678fa9db77d28b0988fc7b0a7516cbffa4a654b1e41d3200fb5f5a14cbb720641da899abd13fc9c4e0a392b891e41fa8634f096351c24e1f705093ea3aefb90ed4ae12e494c388a2544ace641ea0a3e88df04eb492ead061383c95642c3aa2f8b5d212212bb13026290de69620f8617d3645bb67722257eeffeb0dbefff8f0cdcee9f650ea3307cf1c659fb99988acb62cd4ac11f8d772e809ef0e1d3b7d66030283d071038dcc4568c73c8c2a701e67aaab9f099824453a0b264253b41ea4305e41fc0e6b6e6fa12b666aa4483ad3749e2ef5b1fc8d69e1afd0d5144073f32e2a7b936778880da1e77a89111c92da27b651942c0159b9fab0bc6fe7d163e46c41cc0939f12f2c621c6984d833708457a809bd4a049ac1f732c9dbba5b99804bd148bf4c6a8490c771959773dc6e96449f49514950192cacd62787ef9416c0886900876c4049f9e78955ea27d6bdb16f3d3b7a22f115760e5718680176e12a88693492c0d159697961a703049acc779802bf5b4ede6690dfb646a7bf4397bd92997b6aa1cfd01545a1075bf650af34e439bc7eb3cbb9b7b2475d3506737bcc691dbc3bc4101f2bef612a0dc1739bbfbc1d738d1373ae613475abaa00855bc5dead51d3a44af753b0b38596fd22b234d544547a356d6243486dc9b21ba03fbf8f7b8456a29fc5d898fb00962c07bd0b90e0febd067ec9af04da02718bef270a81b02461d54a2dd5135264a312142a7e23ec455c9633021b039a6540a3e8bc87a0ebac50d2ddf44f1d179d0f0b721c0588c555610588f333417842547e56032f341c692d25ccde58052a4f11d9e140ebf0df8ffff2265029f3ccac8ffd57c30628eed716e1f58c1eff0ac212ed2832d0df3ebdf676ee135a54c8bbcbdebbcb208530ac5b3c8ea82b817358ff4993634020e192eecc641dff85a634f196d619be19924c911377445c0c0d05b143b717645a696c70deaee070541bf69e3a0c1684658e3f94a8c4a3c49a325c41daf8e6c8fc2468b955c692e6439bb13486f6237ff3bf4aa5547875215fbdfd734b944ce5dc6427964f8a12add278091dc1a97dc01e14c16fb0943b0f17cc069e9c0bfd8eb53d4f3e09f98f67d039a4b85720c85adc65e843c7f4a2a3467a050988decc3115cfe16e5d6037d5eeedeca14f7f754a200468ccd99d86a52acbf1637101302ad585a0953e8f76c908c19a36f34dd5ad2dccd8b9f12152b2466d5184c36ddc1aae329c212b7cc78351c8d67c7e76b88eb217fe0a610b8edadbfa602f983d420fbfce91e5bb45bb44f1b90b38935063fba921690f2f165e0578eb906cd8449788eb550c6f9238fd52b32465172834d1afcd8efc3d42280869d20b2efb28f673be9714e98e630f65737ad0ea0b8572b68962779f1a7925ebe8875af7b795263b17b9b03dfe710e203768acf303f6c760b603989feba65ea5f21efc85da916d5929ed81a1d4e36f057f84b3761713e7c1cc3c0710f379015d401b55c0a1db1955adaf30e02db12a37fb01102c10a9b89e4bbcaa26940e1338c0d0ff7408a90c7b063b1eb17f3ba34c8b7f3d3d8d42981bb1eb09e785df5c548a2b6d74ac5b1dbbf99973297efcf34c565cabae057d8ff57d065a837f0f1fbbd49aeec7d1fe8a7c41541788f383543ed0532e4ede85ab5c862c28fbb7b289adb06f40cad529d43c64cb29216b358f4051c2256b8db49b4ac067c26bee551e57fc5d7547523f6b05b0de8b85731b55726d328dd6fdb6e416f8ff4370161d1b3ae6f6c3c023aef8b2e77af5565b8e8725719ecc5c8e8dbed444a9f6514175c56a3c347e6e36bb1e2bbb2f60096e8a96df0a1e059abfe6b7f1cea81d165aa987239fb1d0f551000ab0bdf0a4b066ba1be790dbcc9a57a80e89596ce9e63496265b97b90e9377b4f6ae7abfd430661e10b11b38da0d45a216cc892afc8e721376b2545785cbd9893026c0ff2a47e18f6eb434c3d025cbdd1368986f81b6e163afa682d051a526d449b10b4cf7b8e0df36f5aac27790175163d4ac45ccd462811a09699c5481bfefb5d6320bdcbe2a473952a681f977be12ff816a21a3e3128c884186bf23ba2efb80b5f8f303f3976b2c91a9b533f1b5c8e7e9c7c8cc85e67e9a305e5792bd6f3b08f3d6c781393b5bc8503c90020c538402e46c08d4048561dc8c9e5d2f2924d32537cf99a665e38a63181d50a995967b9cbde94a2b9d4b869300a1153d00b3b65a6688d381ab896a0f0aae709bdc8ac3c69413258fbf299ca5f47ef"}) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3be", 0x6) r3 = accept4(r2, 0x0, 0x0, 0x800) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000a00), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000480)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_WIPHY(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="000425bd7000fcdbdf040200010008003f0036000000080061"], 0x24}, 0x1, 0x0, 0x0, 0x4008001}, 0x20000000) sendmsg$NL80211_CMD_SET_COALESCE(r5, &(0x7f0000000200)={0x0, 0xffffffffffffff8c, &(0x7f0000000b00)={&(0x7f0000000040)={0x28, r6, 0x1, 0x0, 0x0, {{0x2}, {@val={0x8, 0x3, r7}, @void}}}, 0x28}}, 0x0) sendmsg$NL80211_CMD_ASSOCIATE(r3, &(0x7f0000000400)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000200)={0x1a0, r4, 0x100, 0x70bd28, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r7}, @val={0xc, 0x99, {0x2, 0x4c}}}}, [@NL80211_ATTR_VHT_CAPABILITY={0x10, 0x9d, {0x800, {0x8, 0x1, 0x4, 0xb9}}}, @NL80211_ATTR_HT_CAPABILITY_MASK={0x1e, 0x94, {0x80, 0x0, 0x3, 0x0, {0x2, 0x166, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x300, 0x4, 0x3}}, @NL80211_ATTR_FILS_KEK={0x28, 0xf2, "5020dddbbe3ecaf4a8f72a36b6cf25c4ac2db8345f995d14eb069117321bae24b0eba9c5"}, @NL80211_ATTR_USE_RRM={0x4}, @NL80211_ATTR_HT_CAPABILITY={0x1e, 0x1f, {0x800, 0x1, 0x7, 0x0, {0x7, 0x91, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x1, 0xc5, 0xe}}, @NL80211_ATTR_DISABLE_VHT={0x4}, @NL80211_ATTR_PREV_BSSID={0xa, 0x4f, @from_mac=@broadcast}, @crypto_settings=[@NL80211_ATTR_PMK={0x32, 0xfe, "4edbc66f85542b626055a0d4b29a7b861000d78ef5d728c49801a652832bd009726604ff263323ccdc6d21471ff4"}, @NL80211_ATTR_CONTROL_PORT_OVER_NL80211={0x4}, @NL80211_ATTR_SAE_PASSWORD={0x7c, 0x115, "1df037904a89c4d5eca4167c928f02a6473f6af3e14d47fae9595f4f8979f2509132478fb0069b5be79e249f9c3926f013a8fcb0c00efe9c0afc632195d92f39eeb373f8df01702c4da1f27243282130b7c0932d160c8b82f282c2984c1295244d1f64730ddbf5f1db7c84f4daf1e19040e417ee80fb7450"}, @NL80211_ATTR_WPA_VERSIONS={0x8, 0x4b, 0x4}, @NL80211_ATTR_CIPHER_SUITE_GROUP={0x8, 0x4a, 0xfac02}, @NL80211_ATTR_CIPHER_SUITE_GROUP={0x8, 0x4a, 0xfac00}, @NL80211_ATTR_CONTROL_PORT_NO_PREAUTH={0x4}, @NL80211_ATTR_CONTROL_PORT_NO_PREAUTH={0x4}], @chandef_params=[@NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x9}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x4}], @NL80211_ATTR_USE_MFP={0x8, 0x42, 0x2}]}, 0x1a0}, 0x1, 0x0, 0x0, 0x4000000}, 0x40) 2m31.452682509s ago: executing program 6 (id=5013): bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x5, &(0x7f0000000080)=ANY=[@ANYBLOB="560a0000000000006111bc00000000001800"/29], &(0x7f0000000000)='GPL\x00'}, 0x94) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000200)={0xffffffffffffffff}) ioctl$SIOCX25GFACILITIES(r0, 0x89e2, &(0x7f00000003c0)) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000001900)) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000640)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000240)="05090a7010db3fbb8cfa6f0035e7832141386bd9d7be5cd90c8fdd123809ae8b32db03e4f1373a42962b6f48bdad0b8255bde953e067d375a7a66637065c3578", 0x40) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup/syz1\x00', 0x200002, 0x0) write$cgroup_type(0xffffffffffffffff, &(0x7f0000000180), 0x9) r3 = openat$cgroup_procs(r2, &(0x7f00000002c0)='cgroup.threads\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f0000000c40), 0x12) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) write$cgroup_pid(r3, &(0x7f0000000080), 0x12) 2m31.23802222s ago: executing program 6 (id=5016): bpf$BPF_BTF_GET_FD_BY_ID(0x13, 0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0xc, &(0x7f0000000040)={0x80}, 0x10) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000940)={&(0x7f00000000c0)=@ipv6_getaddr={0x18, 0x16, 0x1, 0x0, 0xfffffffc, {0xa, 0x0, 0x0, 0xfe}}, 0x18}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) clock_gettime(0x0, &(0x7f0000000000)={0x0, 0x0}) nanosleep(&(0x7f0000000280)={r0, r1+10000000}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xe, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x59, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000d80)={0x18, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="1801000021"], 0x0, 0x40, 0x0, 0x0, 0x0, 0xb4a02fe0ce239f93, '\x00', 0x0, 0x2}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xe, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r2], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x59, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, r3, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r4, 0x2000000, 0xe, 0x0, &(0x7f0000000040)="630b008646dc3f0adf33c9f7b986", 0x0, 0xcf25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x80}, 0x50) 2m30.207079766s ago: executing program 6 (id=5028): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0xffe0}, {0xffff, 0xffff}, {0x10}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0xe, 0x3, 0x1, 0x1}}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x51}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000700)=@newqdisc={0x6c, 0x24, 0xd0f, 0x200000, 0x0, {0x60, 0x0, 0x0, r2, {0x1}, {0xffff, 0xffff}, {0x0, 0xfff3}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x3c, 0x2, [@TCA_GRED_PARMS={0x38, 0x1, {0x8, 0x5, 0x404, 0x9, 0x81, 0x101, 0x86a4, 0xc40, 0x7fffffff, 0xfffffffd, 0x1, 0x16, 0x9, 0x6, 0xca11, 0xffff}}]}}]}, 0x6c}, 0x1, 0x0, 0x0, 0x845}, 0x24008004) r3 = socket(0x400000000010, 0x3, 0x0) r4 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0xa30e, 0x1, 0xfffffffa}}}}]}, 0x44}}, 0x0) r6 = socket$kcm(0x29, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r6, 0x89e2, &(0x7f0000000200)={0xffffffffffffffff}) ioctl$SIOCX25GFACILITIES(r7, 0x89e2, &(0x7f00000003c0)) close(r7) sendmsg$nl_route_sched(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000440)=@newtfilter={0x5c, 0x2c, 0xd3f, 0x70bd24, 0x25dfdbfc, {0x0, 0x0, 0x0, r5, {0xfff3, 0xffe0}, {}, {0x7, 0x2}}, [@filter_kind_options=@f_flower={{0xb}, {0x2c, 0x2, [@TCA_FLOWER_KEY_ENC_IPV6_SRC={0x14, 0x1f, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @TCA_FLOWER_KEY_ENC_IPV6_SRC_MASK={0x14, 0x20, [0xffffff00, 0x0, 0xffffff00, 0xff000000]}]}}]}, 0x5c}, 0x1, 0x0, 0x0, 0x8848}, 0x20004804) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f0000000080)={0x1, [0x0]}, &(0x7f00000000c0)=0x8) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r3, 0x84, 0x22, &(0x7f0000000100)={0x5, 0x8001, 0x0, 0x464, r8}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000001700)=ANY=[@ANYBLOB="b702000004000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0f800000000b7060000ffffffff1d6405000000000065040400210000000404000001e37c60b7040000000000006a0a00fe000000008500000032000000850000000000000095000000000000000ce0de7621e5e832249c04112cf7af2b75d0d1f034b1b3fb6bd3ce8fa62c7941272ff49142d860010ab162aa2264ab67e55a00000000000000edfe0969a9ddc125b686a1e83c8790c893d713b3295dad0ea697181d1e85b64126b5d72f204754d1d4a93f24215dee354e93cfc3f50ff23f8432c72012f021c84c59a9d4c142f439d3040cfee621589fb3a2f1407c7cbed48e7026f8d52d4bca2608c79aa4a73732028f88ce07ed1075da4a2ef44e3d8b88873f0b1de87dfb6d15936ec0a27cb554def9e27396df6b7851ffa26237ea6730880f06371beb3b290b7d8629a6f0373fefa0acb60888fc14ad2b83ca03ac2aee792482ced58af4140cc4ce3efef26e00c5b2200a91cb80c6065a697d6fc8aa8b65aee0783b04cff0218ce82c9687b4474da89c474c23727555fc5e5f8ad0f2f7a261140440fce1f12cc6df312accd011d888384283092d987c40bbb46f68c2431b97906f00000000349834fa147bd5923bbd4e606708034931a8f1a89bdf77093a0000427aab8e21e1a33d3fe093547532fce6549dd648ad233e05a7b3ea178007c1c32e871ac81f287c4aabbd153390b16d1d41ee433e3a54ea9ee82cf14f3a4cc523ee000000000009e106d6b5289f0000000000000000000000f7bc9f46cb71f6b889d37807865e3b4e9916dd0f72c9d58ea333b90f8886dcbf5ddda0e42ca08e3303632401f2f5212b40c0e88c957fd767dbfc80b07ad668b4f6f92fb209d7c2dbac597843c8eb7bf92fe6d0bb0b72549795c2ed19e441eb69869844152ba9da0588e42cdbc5fcd245ce5e3ef0dca64931276702a312db7956f0a75eb9caa17d47a6331c7c963cbf86a845ce27c26b7136d3e7207318b1df7a6320c64f18ccd926eaeddcde8d5006d6c38db117fb1115221a66169172720ccca770bff37e59511b2606138377eda44b2f288b491ab8aae0e11a98303b0e407e0f9d21f4a3ebbd3fabf6da9a1a1f869a339fab465d8322b7280b0734fd115a19b33c8644fff71b3c62f2e1b827e2663e06a751182e968c8ab05fb1d0115d4b11d944f2c06acc023a02b7416a9a10218d21503cda13bb5df6c992e52e1c01793b728eac000058ab3b3900d279297dadc127e2f38fc60c23af2e1fefa5a83456647191ba1953d335f59aa261fe79613df6bf43884e9649691e32680d75a541c27ffe74f9d13340f2cf1c7dc2b7db01213216cd4ecfd30efe137641471987289b7e23482e026b26eacd1b97443e2ea2d1d6e31a01ee0ae7fa195a2152b2338b086423a3883f2ce3e2f84e04f4d52c985eac4b46336908599564b47db0e6aa97ee51a360f4382fd99745725d44c77d097f69d19fe86f71c38a0226d44ebe0ecbd959f14b540745cd03b8c9f02b825ba45ca85706c73115f70871db9d2a1bc2a517b39f9648123917a5db07ba4e27f961373767e1ea8f7cc558e483abef1a9923c5cfa2081e430680950b7d7c377726b557ad31fdee17ba7057741f39d29d8ab295222f96297a777bb235416e72c84afef2bdb08fb375147b028b89f15af45bc8976b91158c13c9876daa71e7db0f5a17376be39ea79ce1246c547c740e31c64e5d293e0e5a544dd166010061d6ccae46c173b8e11721e4bce22c96af00000021f80ac6c3971006db853e3c40a5417d6eac09eb0e01ac6bd4c6dacdcb1d6d2ef9c8bdea91c984022821e961236d08f8b9072ec6cb5d5a68833fd5b4e80a5ac2bc6ff323f5ce612b59ce8177956c1affcc8baf4c8b59ab959aff9a7bd81f7c7c1f1bb92ddbeed6bce8041c7f0c1c584e6ae027678ce3cfbfea938aecc3c5119c5875b7fb35dc20f5c7aaae1e276104f607a73fe501c1045873a2b1eb80e95c87f099d98028dc82bdc7ef08c871fb3061c3c5ebd613e6e5e8cf099bb6e8c0441a133c85138b36a02c47fbedf7ed1d3ce74c9ec2c676c0b2d4b5eca61dbf5769b483c2a9f6bec666dae4e81960e9bad7f17cfc3d5bcc7b7f437110ca8ffa908c12086b2227eb202a8d56e0925ba994b05c98c39de44d25932449ddf08e5377814a40877eab4440ca01b3f50d2014a61a7d32105254b424238122386424efa3a7041254f686a5faac120942287f75e8e3db569ce47b120059d774a37e11d013be50cd2cbb00f6d2a23af61ec7d30bb7dc33a92f900b6ff1d29dc61cc40b846040dbafd00c6bcfbcf7af8ea5b4bd9593f73c6c95dd6d59483763debf02ea36803976b6cc145338e1"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xfffffffffffffffe}, 0x48) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r9, 0x6, 0xe, &(0x7f0000000f80)={@in={{0x2, 0x4e22, @local}}, 0x0, 0x0, 0x0, 0x0, "8aac4f23c59b321a1738763829f40de6514263b9b0b7023fb22bdc015174daab26ae82d6f820dd0320e82bc93d0f02bbce4b9f19d856884d638b771a2941e8ac694cb91fd1796fd3f40eb831690c6382"}, 0xd8) r10 = socket$netlink(0x10, 0x3, 0x0) r11 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000002c00)=ANY=[@ANYBLOB="bf16000000000000b70700000900f0ff4070000000000000500000000000000095000000000000002ba728041598d6fbd30cb599e8c73d24a3aa81d36bb3019c13bd23212fb56fa54f26fb0b71d0e6adfefc41d86bd917487960717142fa9ea4318123741c0a0e168c1886d0d4d94f2f4e345c652ebc1626e3a2a2ad35806150ae0209e62f51ee988e6e0dc8ce974a22a550d6fd70800c86ae3b3e05df3ceb9fc474c2a100c788b277beee1cbf9b0a4def23d410f6296b32a8343881dcc7b1b85f3c3d44aeaccd3641110bec4e90a6341965c39e4b3449abe802f5ab3e89cf6c662ed4048d3b3e22278d00031e5388ee6f867ddd58211d6ececb0cd2b6d357b8580218ce740068725837074e468ee23fd2f73902ebcfcf49822775985bf31b715f5888b2c81f96a810b946855c9fc52ac17cbc97a616811a4c2dc3470009b966abaf41939aeca3e7b00c2e9d5db7a34fe2a29ac88c360a878a2b9ab9440c1961e80477166f3f847e855cdddc941d996d61ea0ce23b37e9d21c849d1e1e53087a3b109012e3a3ecbd219265048bf5c72b7ba2806b73323301b4bc94d0e4afde44867d71049a7c89bc615e215571ac910d80a58b5169576ff9906c34d2342806960b6bcb00000000000000000000000000113ee640b9ed1e04a0bfb125204d30990361bf45ef45277a167cd2c2e6ce9138143aa5ea7ee6f7c6d8b00437e070b004c5aa90766538b4fe45a16f14b270904d36eaa87508ac6d46639b3971ac6a88dc531fcc5ffc6b76b334795d88156336a9a452a9022485bb572dacb7aa25f748bc75918a16d9d5ae21004cd799ac4951beb2c6c9b5baf60081b86cc2e31c49f4ea055fb3639036c95c69b1ae60e685d486dbd1d5e7d0daacd73acfc80b9c9c92"], &(0x7f0000000140)='GPL\x00'}, 0x48) r12 = socket$netlink(0x10, 0x3, 0x9) setsockopt$sock_attach_bpf(r12, 0x1, 0x32, &(0x7f00000002c0)=r11, 0x4) sendmsg$NL80211_CMD_SET_CHANNEL(r12, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, 0x0, 0x400, 0x70bd2a, 0x25dfdbfc, {{}, {@val={0x8}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x20000084}, 0x20004054) sendmsg$nl_route(r10, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB="120000001c000100030000000000000007"], 0x30}}, 0x0) syz_extract_tcp_res$synack(&(0x7f0000000000), 0x1, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000240), 0xffffffffffffffff) r13 = socket(0x10, 0x3, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r6, 0x89e2, &(0x7f0000000380)={r13}) 2m29.73478231s ago: executing program 6 (id=5033): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(0x4) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f00000000c0)=0x1, 0x4) connect$inet(r1, &(0x7f0000000080)={0x2, 0x0, @loopback}, 0x10) ioctl$F2FS_IOC_RESERVE_COMPRESS_BLOCKS(0xffffffffffffffff, 0x8008f513, &(0x7f00000003c0)) sendmmsg$inet(r1, &(0x7f0000002bc0)=[{{0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000540)='*', 0x1}, {&(0x7f0000000340)='\x00', 0x1}, {&(0x7f0000001980)='k', 0x1}, {&(0x7f0000000580)="ff", 0x1}, {&(0x7f0000000140)='m', 0x1}, {&(0x7f0000000200)='d', 0x1}, {&(0x7f0000000180)="0f", 0x1}, {&(0x7f0000000380)='9', 0x1}, {&(0x7f0000000400)="b5", 0x1}, {&(0x7f0000000240)="d1", 0x1}], 0xa}}], 0x1, 0x4000000) setsockopt$sock_int(r1, 0x1, 0x20, &(0x7f0000000000)=0x7fffffff, 0x4) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000000c0), 0x4) 2m29.526645s ago: executing program 6 (id=5035): r0 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_ERR_FILTER(r0, 0x65, 0x7, &(0x7f00000001c0)=0x8, 0x4) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000200)=@delnexthop={0x18, 0x69, 0x503}, 0x18}}, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000340)={'pim6reg1\x00', 0x0}) sendmsg$can_raw(r0, &(0x7f0000000440)={&(0x7f0000000400)={0x1d, r3}, 0x10, &(0x7f00000003c0)={&(0x7f0000000540)=@canfd={{0x2, 0x0, 0x1, 0x1}, 0x8, 0x2, 0x0, 0x0, "45b8ab632c55e11ef507b0e9637481bbdcabbf83377540e837eb80365989538a6b88f008c1d6b5f5fbb966edf5628991370c1b724199ba37e0addc5637e0fe6a"}, 0x48}}, 0x840) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="240000001e00010000d2c1138d6f949a1b0c"], 0x24}}, 0x0) 2m29.153673756s ago: executing program 6 (id=5042): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_EVENTS(r0, 0x84, 0xb, &(0x7f0000000040)={0x0, 0x2, 0x3, 0x1, 0x8, 0x0, 0x8, 0xc, 0x0, 0x8, 0xff}, 0xe) shutdown(r0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000002c0)=[@in={0x2, 0x0, @local}]}, &(0x7f0000000440)=0x10) setsockopt$inet_sctp6_SCTP_AUTH_DEACTIVATE_KEY(r0, 0x84, 0x23, &(0x7f0000000140)={r1, 0xf371}, 0x8) r2 = socket(0x2b, 0x80801, 0x1) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000001ac0)={&(0x7f0000000000)={0x14, 0x26, 0x1, 0xf0bd26, 0x25dfdbfd, {0x5}}, 0x14}, 0x1, 0x0, 0x0, 0x4000d}, 0x20000000) ioctl$sock_SIOCBRDELBR(r2, 0x89a1, &(0x7f0000000200)='bridge0\x00') 2m13.489830648s ago: executing program 34 (id=5042): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_EVENTS(r0, 0x84, 0xb, &(0x7f0000000040)={0x0, 0x2, 0x3, 0x1, 0x8, 0x0, 0x8, 0xc, 0x0, 0x8, 0xff}, 0xe) shutdown(r0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000002c0)=[@in={0x2, 0x0, @local}]}, &(0x7f0000000440)=0x10) setsockopt$inet_sctp6_SCTP_AUTH_DEACTIVATE_KEY(r0, 0x84, 0x23, &(0x7f0000000140)={r1, 0xf371}, 0x8) r2 = socket(0x2b, 0x80801, 0x1) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000001ac0)={&(0x7f0000000000)={0x14, 0x26, 0x1, 0xf0bd26, 0x25dfdbfd, {0x5}}, 0x14}, 0x1, 0x0, 0x0, 0x4000d}, 0x20000000) ioctl$sock_SIOCBRDELBR(r2, 0x89a1, &(0x7f0000000200)='bridge0\x00') 9.954378839s ago: executing program 0 (id=6441): r0 = socket(0xa, 0x3, 0x11) setsockopt$inet6_int(r0, 0x29, 0x4d, &(0x7f0000000040)=0x7, 0x4) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, 0x0}, 0x12}], 0x1, 0x20, 0x0) 9.006472099s ago: executing program 0 (id=6452): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@ipv4_delrule={0x30, 0x21, 0x105, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, [@FRA_GENERIC_POLICY=@FRA_OIFNAME={0x14, 0x11, 'pimreg\x00'}]}, 0x30}}, 0x0) 8.710783084s ago: executing program 0 (id=6455): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000002100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000040900020073797a310000000008000a40fffffffc200011800e000100636f6e6e6c696d697400"], 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) 8.522827831s ago: executing program 0 (id=6457): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_BSS(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x24, 0x0, 0xe85c7ec7f74c3d05, 0x70bd28, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_BSS_HT_OPMODE={0x6, 0x6d, 0xa85c}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000005}, 0x8084) 8.337823256s ago: executing program 0 (id=6461): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000400)=ANY=[@ANYBLOB="4400000010001fff000000000100000000000000", @ANYRES32=0x0, @ANYBLOB="00000000000000001c0012800e0001006970366772657461700000000900028004001200080001"], 0x44}, 0x1, 0x0, 0x0, 0x40000}, 0x0) 8.085250236s ago: executing program 0 (id=6465): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0900000004000000ff0f000003"], 0x48) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000001c00)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000f91f20207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000060000001811", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r2, r1}, 0x41) sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=ANY=[@ANYBLOB="1c000000020303000000000000080000000000000800010001"], 0x1c}, 0x1, 0x0, 0x0, 0x400c000}, 0x0) socket(0x10, 0x80002, 0x0) r3 = openat$ppp(0xffffffffffffff9c, 0x0, 0x101842, 0x0) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r4, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) ioctl$SIOCX25SFACILITIES(0xffffffffffffffff, 0x89e3, &(0x7f0000000080)={0x44, 0x800000, 0x8, 0x7, 0x2}) write$bt_hci(r4, &(0x7f0000000080)=ANY=[], 0x6) ioctl$PPPIOCNEWUNIT(r3, 0xc004743e, 0x0) ioctl$PPPIOCSACTIVE(r3, 0x40047459, &(0x7f0000000080)={0xfffffffffffffe43, 0x0}) bpf$OBJ_PIN_PROG(0x6, &(0x7f0000000240)=@o_path={&(0x7f0000000140)='./file0\x00', 0xffffffffffffffff, 0x4000, r3}, 0x18) readv(r3, &(0x7f00000002c0)=[{&(0x7f0000000300)=""/61, 0x3d}], 0x1) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000001240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="ac41ec498e66efbb406cc14cf16550e34b1e252f922679c3f1c0eca330292c075c4fc4a1c5913252ec2f992c2b9196a2cc9763b7e3db26a5e2d1a1b1314a369be04124421666d1d825ba7cceb3c1fa2fd3b1aa2f9f3380be3b7ab4620102be991cf876028a9ef36578524557ce3c05576e0e010f77c15c038d529935f631ad3fa9c69d4bec7190b3f8a2e46ce1f31eedf5f2b2bb4869", @ANYRESOCT=r3], 0x184}}, 0x20040800) ioctl$ifreq_SIOCGIFINDEX_team(r4, 0x8933, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-blowfish-asm\x00'}, 0x58) sendmsg$alg(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000380)=[{&(0x7f00000024c0)="438dc77642449e6e17553493f7aeb57e36375ae9e2b947bee5b08bc1af2ca68b357310dce47d455f52765e1a97c5da42a110cfc487f25a4407c4ba", 0x3b}], 0x1, &(0x7f0000000180)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18, 0x4008011}, 0x4040004) recvmmsg(0xffffffffffffffff, &(0x7f0000002340)=[{{0x0, 0x0, &(0x7f0000000280)=[{&(0x7f00000001c0)=""/11, 0xb}], 0x1}, 0x2}, {{0x0, 0x0, &(0x7f0000000a00)=[{0x0}, {&(0x7f0000000780)=""/248, 0xf8}], 0x2}, 0xfff}], 0x2, 0x2021, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$nl_rdma(0x10, 0x3, 0x14) r6 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) writev(r6, &(0x7f0000000100)=[{&(0x7f0000000000)="5886", 0x2}, {0x0}], 0x2) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)={0x38, 0x1403, 0x1, 0x70bd2a, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x89}, 0x24048800) sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x1c}}, 0xc000800) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r7, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x560, 0x0, 0xc8, 0x8, 0x0, 0x5803, 0x490, 0x2e8, 0x2e8, 0x490, 0x2e8, 0x3, 0x0, {[{{@ipv6={@remote, @mcast1, [], [], 'erspan0\x00', 'geneve1\x00', {0xff}}, 0x0, 0x2c0, 0x2f0, 0x0, {0x0, 0x2000000000000}, [@common=@unspec=@string={{0xc0}, {0x0, 0x0, 'kmp\x00', "cfcaf80c672f61cd17ae5119b5135c2aee68d23a465cd431e1ecef50c3234e082555f67222476147864fa03182f5cf11d8c348cbd06dc8de1dcbde7d4e252c3394fed47bf78c70f607b0178fa5ea335019ac07a602061c96baebc989f1f34a214e67262c1fe4b124e0f7323a587d2a1fcfe36bbf12eca0a7b66c60c527bac2b5", 0x3, 0x2}}, @common=@inet=@policy={{0x158}, {[{@ipv6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', [0x0, 0xffffffff, 0xff000000, 0xffffff00], @ipv4=@rand_addr=0x64010102, [0x0, 0xffffffff, 0xffffffff, 0xff000000], 0x4d4, 0x3503, 0x3c, 0x0, 0x1, 0x4}, {@ipv4=@dev={0xac, 0x14, 0x14, 0x38}, [0x0, 0xffffff00, 0xffffff00, 0xff000000], @ipv6=@loopback, [0xffffff00, 0xff, 0xff000000, 0xff000000], 0x4d5, 0x0, 0x0, 0x0, 0x2, 0x2}, {@ipv6=@private1, [0x0, 0xff, 0xff, 0xff], @ipv6=@mcast2, [0xff, 0x0, 0xffffff00, 0xffffff00], 0x4d4, 0x3504, 0x2, 0x0, 0x14, 0x9}, {@ipv6=@local, [0xff, 0xffffffff, 0xffffffff], @ipv4=@empty, [0xffffff00, 0xff], 0x4d3, 0x3505, 0x62, 0x0, 0x7, 0x8}], 0xd9884bcd73343275, 0x1}}]}, @common=@unspec=@CONNMARK={0x30}}, {{@ipv6={@mcast1, @loopback, [0xff, 0xffffff00, 0xffffff00, 0xffffff00], [0x0, 0x0, 0xff000000, 0xff], 'sit0\x00', 'caif0\x00', {}, {}, 0x67, 0x3, 0x0, 0x20}, 0x0, 0x138, 0x1a0, 0x0, {}, [@common=@unspec=@rateest={{0x68}, {'bond0\x00', 'veth1_virt_wifi\x00', 0x0, 0x1}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x0, 0x0, 0x0, 0x0, 'netbios-ns\x00', 'syz0\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5c0) 5.562197244s ago: executing program 5 (id=6493): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000002c0)={'wlan0\x00'}) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(r0, 0x0, 0x24000846) 5.350209215s ago: executing program 5 (id=6494): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000380)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000004740)={0x44, r1, 0x1, 0x70bd2a, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_MESH_ID={0xa}, @NL80211_ATTR_TX_RATES={0x1c, 0x5a, 0x0, 0x1, [@NL80211_BAND_5GHZ={0x18, 0x1, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0x7, 0x7f, 0x4, 0x6, 0x1, 0x4, 0x4, 0xb6]}}]}]}]}, 0x44}}, 0x0) 5.086791836s ago: executing program 5 (id=6496): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_KEY(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01002cbd7000ffffffff0b00000008000300", @ANYRES32=r2, @ANYBLOB="34005080050002000600000009000a000000000000000000110001008e0000001d00d183000000000000000008000700"], 0x5c}}, 0x40) 4.637715764s ago: executing program 5 (id=6500): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000840)=@newtclass={0x24, 0x28, 0x1, 0x70bd2a, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0xe}, {0xffe0}, {0xa, 0x4}}}, 0x24}, 0x1, 0x0, 0x0, 0x3c048881}, 0x4c084) 4.306547815s ago: executing program 5 (id=6503): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000002c0)={'wlan0\x00'}) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20028805}, 0x24000846) 4.040890301s ago: executing program 5 (id=6506): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e22, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x2006}, 0x1c) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e22, 0x6, @ipv4={'\x00', '\xff\xff', @empty}, 0x4c}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000100)='vlan0\x00', 0x10) sendmmsg$inet(r0, &(0x7f0000002680)=[{{0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f00000006c0)="01562db1d027d65d0ee6dce1905b044d7812c979bed95e7832eb61f4bc9643e0f6084cefff0acb09b3028b646bc8513fc0289afdb8e024c746c69c20bedc1961858af6f1a4d732205066012769afcab13859bf1b9524aeed391c4745ce27f553da682de74851a6a31a025656a93357842c0445c3231ba92ede7a6e00497f08e013e7c218da0196e479345958c2", 0x8d}], 0x1}}, {{0x0, 0x0, &(0x7f0000002b40)=[{&(0x7f0000000000)="0085cd2f30", 0x5}], 0x1}}, {{0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000480)='=', 0x1}], 0x1}}], 0x3, 0x119e75c40273a52f) 941.450726ms ago: executing program 4 (id=6536): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000002080)=ANY=[@ANYBLOB="020000000400000006000000050000000010"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000001070000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000001900007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffd98, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x12, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_GET_PROG_INFO(0xa, &(0x7f0000000740)={r1, 0x0, 0x0}, 0x10) 790.103302ms ago: executing program 1 (id=6538): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) listen(r0, 0x10040) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040)='syz_tun\x00', 0x10) syz_emit_ethernet(0x39, &(0x7f0000000180)={@local, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x2b, 0xfffe, 0x0, 0x95, 0x6, 0x0, @rand_addr=0x64010101, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0x4, 0x8, 0x0, 0x1000}, {"c766ca"}}}}}}, 0x0) 789.89959ms ago: executing program 4 (id=6539): sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000600)={0x0}, 0x1, 0x0, 0x0, 0x4028055}, 0x0) r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000b00), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000540)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_KEY(r1, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000180)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="010800000000000000000c00000008000300", @ANYRES32=r2, @ANYBLOB="0a000600080211000001000030005080110015004abee339084eeef16f162471f400000008000700"], 0x58}}, 0x800) 635.60018ms ago: executing program 7 (id=6541): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={0x0}}, 0x0) 634.503163ms ago: executing program 4 (id=6542): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'syzkaller0\x00', 0x7101}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r1, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x0, 0x8}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000001540)=@newtfilter={0x484, 0x2c, 0xd27, 0x70bd25, 0x25dfdbff, {0x0, 0x0, 0x0, r1, {0x0, 0x1}, {}, {0x8, 0x4}}, [@filter_kind_options=@f_bpf={{0x8}, {0x458, 0x2, [@TCA_BPF_FD={0x8, 0x6, r0}, @TCA_BPF_FLAGS={0x8, 0x8, 0x1}, @TCA_BPF_POLICE={0x444, 0x2, [@TCA_POLICE_RATE={0x404, 0x2, [0x7, 0x4, 0x4c0a, 0x7ff, 0x9, 0x5, 0x661f, 0xce4, 0x5, 0xd1, 0x5, 0x2, 0x7, 0x0, 0x0, 0x8001, 0x9098, 0x8, 0xa, 0x0, 0x2, 0x34f, 0x3d7ed312, 0x3, 0x5, 0x5, 0x2, 0x7ff, 0xe7, 0x7, 0x7, 0x8, 0x5, 0xfffff47b, 0x998, 0x5, 0xfffffff7, 0xb, 0x7ff, 0xff, 0x1, 0x8, 0x5, 0x2b2, 0x7, 0x4, 0x6, 0x10, 0x3, 0x121, 0x8, 0x7, 0x8000, 0x80000000, 0x0, 0x4, 0x4000000, 0x200, 0x100, 0x7ff, 0x8, 0x8001, 0x9ef8, 0xfffffffe, 0x6, 0x7ff, 0xd, 0x401, 0x6, 0x8000, 0x13, 0x2, 0x5, 0x9, 0x3, 0xfffffff4, 0x7, 0x4, 0x0, 0x9, 0x5, 0xffffffff, 0x0, 0xffff, 0x9, 0x2e, 0x90000000, 0x0, 0x3, 0x40000002, 0x1, 0x0, 0x0, 0x7f, 0x7, 0x7, 0xfffffffb, 0x1, 0x8, 0x5983, 0x4, 0x0, 0x1, 0xa, 0x2, 0x33b7, 0x5, 0x5, 0xa, 0x3, 0x35, 0x6, 0x0, 0xdf, 0x9, 0x3, 0x5, 0x5, 0x7, 0x3, 0xfffffff7, 0x3ce, 0x7, 0x7, 0x6, 0x10000, 0x9, 0xb, 0x0, 0x7, 0x3, 0x200, 0x5, 0x2f, 0xfffffffb, 0x9c7e, 0x6, 0x0, 0x4, 0x1, 0x6, 0x2, 0x0, 0x95, 0x4, 0x1, 0x3, 0x8, 0x0, 0x5e7c14df, 0x1, 0x4, 0x13c0, 0x3, 0xe, 0xddd3000, 0x40, 0x7, 0x80, 0x8, 0x80000000, 0x3f, 0x3, 0x2, 0xb4a9, 0x400, 0x60f, 0x8, 0x3, 0x3, 0xcba9, 0x7, 0x1, 0x9, 0xa3f0, 0x0, 0x5, 0x4, 0xfffffff8, 0x10001, 0x7, 0x1, 0x4f0a, 0xe, 0x81, 0x5, 0xffff, 0x1000001, 0x32c, 0x5, 0x5c, 0x6, 0x7, 0xa3, 0x0, 0x8001, 0xfffff255, 0x1, 0x5, 0x80000001, 0xa, 0x4, 0x78962c2e, 0xffff, 0x9, 0x8, 0x6, 0xff, 0x1, 0x10000, 0x5, 0x5, 0x6, 0x0, 0x1, 0x32, 0x8, 0x0, 0x5, 0x8, 0x2246, 0x10000, 0x8, 0x3, 0xfffffff6, 0x9, 0x6, 0x7, 0x9, 0x2, 0x3ef, 0x1, 0xadc2, 0x6, 0x0, 0x3, 0x5, 0x1, 0xb6, 0x7, 0x3, 0xfffffffc, 0x6, 0x3, 0x3ff, 0xd, 0x4, 0x6, 0xa2, 0x5fd751c9, 0xfffffff3, 0x3, 0x9, 0x9, 0x7fffffff, 0x1]}, @TCA_POLICE_TBF={0x3c, 0x1, {0x2, 0x2, 0x5, 0x4, 0xfffffffa, {0x3, 0x0, 0x5, 0xb, 0x2, 0x100}, {0x4, 0x2, 0xd, 0xb, 0x7}, 0x10, 0x2, 0x7}}]}]}}]}, 0x484}}, 0x0) 623.528411ms ago: executing program 1 (id=6543): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xb, &(0x7f0000000100)=@framed={{0x18, 0x8, 0x0, 0x0, 0x8}, [@printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xd}}]}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000000)=r0, 0x4) sendmsg$IPSET_CMD_DEL(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)={0x14, 0xa, 0x6, 0x3, 0x0, 0x0, {0x0, 0x0, 0x2}}, 0x14}, 0x1, 0x0, 0x0, 0x4008010}, 0x404c840) 475.298482ms ago: executing program 7 (id=6544): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, 0x0, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000780)=ANY=[@ANYBLOB="74000000090601020000000000000000030000000900020073797a310000000005000100070000004c0007801800018014000240fe8000000000000000000000000000aa1800148014000240fc000000000000000000000000000000060004404e1f0000050007008400000006000540"], 0x74}, 0x1, 0x0, 0x0, 0x10040003}, 0x0) r1 = socket$netlink(0x10, 0x3, 0xc) sendmmsg(r1, &(0x7f00000002c0), 0x40000000000009f, 0x0) 460.716591ms ago: executing program 1 (id=6545): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f00000003c0), r0) sendmsg$NL802154_CMD_NEW_SEC_DEVKEY(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000680)={0x34, r1, 0x1, 0xfffffffd, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_SEC_DEVKEY={0x18, 0x2f, 0x0, 0x1, [@NL802154_DEVKEY_ATTR_FRAME_COUNTER={0x8}, @NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc, 0x2, {0xaaaaaaaaaaaa0302}}]}]}, 0x34}, 0x1, 0x0, 0x0, 0xd49920d352514f42}, 0x4000040) 455.508883ms ago: executing program 4 (id=6546): socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000003c0)={0xffffffffffffffff}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000f80), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_STATION(r1, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000001040)={&(0x7f0000000480)={0x40, r2, 0xb97534d5fe9704cf, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_STA_SUPPORTED_RATES={0x6, 0x13, [{0x48}, {0x16}]}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_STA_AID={0x6, 0x10, 0x580}, @NL80211_ATTR_STA_LISTEN_INTERVAL={0x6}]}, 0x40}, 0x1, 0x0, 0x0, 0xc0}, 0x0) 429.259305ms ago: executing program 7 (id=6547): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000040)={0x1c, 0x25, 0x101, 0x70bd25, 0xfefffffb, {0x18}, [@typed={0x8, 0x3, 0x0, 0x0, @binary='G\x00\x00\x00'}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4048957}, 0x28040) 319.582007ms ago: executing program 4 (id=6548): r0 = socket$kcm(0x1e, 0x1, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(r0, 0x89e1, &(0x7f0000000080)) 297.520557ms ago: executing program 7 (id=6549): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x44, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="01000000120000007f00000001"], 0x48) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000180)={r0, &(0x7f0000000280), &(0x7f00000000c0)=@tcp6, 0x2}, 0x20) 270.582769ms ago: executing program 1 (id=6550): sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)={0x4c, 0x2, 0x6, 0x201, 0x0, 0x0, {0xa, 0x0, 0x7}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_TYPENAME={0x13, 0x3, 'hash:net,iface\x00'}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x2}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x7}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40800}, 0x10) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x88, 0x24, 0xf0b, 0x70bd2e, 0x0, {0x0, 0x0, 0x12, 0x0, {0xd, 0xc}, {0x5, 0xe}, {0xd}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x7, [0x4, 0x7, 0x45, 0x10, 0xff, 0x1d, 0x9, 0x8, 0xc, 0x5, 0xf, 0xd, 0x2, 0x6, 0xc, 0xd], 0x1, [0x200, 0xc, 0x101, 0x7, 0x486, 0x40, 0x8, 0x5, 0x8, 0x2a, 0x9, 0x134e, 0xfffc, 0x6, 0x8, 0xba], [0x3, 0x9, 0x3, 0x0, 0x3, 0x0, 0xc5d4, 0x3, 0x3, 0x48aa, 0xffff, 0x7, 0x5, 0x4, 0x6, 0x6]}}}}]}, 0x88}, 0x1, 0x0, 0x0, 0xc004841}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="d8000000100081044e81f782db44b904021d080010000000e8fe55a1180015000600142603600e120500210000000401a8001600a40001402000", 0x3a}], 0x1}, 0x0) r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="d8000000100081044e81f782db44b904021d080010000000e8fe55a1180015000600142603600e120500211d", 0x2c}], 0x1}, 0x0) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0xfe33) 174.718742ms ago: executing program 7 (id=6551): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x80000}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x1, 0x13, &(0x7f0000000140)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x10}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}], {{}, {}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x13, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) 107.326767ms ago: executing program 7 (id=6552): sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000600)={0x0}, 0x1, 0x0, 0x0, 0x4028055}, 0x0) r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000b00), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000540)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_KEY(r1, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000180)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="010800000000000000000c00000008000300", @ANYRES32=r2, @ANYBLOB="0a000600080211000001000030005080110015004abee339084eeef16f162471f400000008000700"], 0x58}}, 0x800) 107.207444ms ago: executing program 4 (id=6553): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x109a42, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'rose0\x00', 0x112}) ioctl$TUNSETPERSIST(r0, 0x400454cb, 0x5) close(r0) 103.517853ms ago: executing program 1 (id=6554): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r0, 0x89a2, &(0x7f0000000000)={'bridge0\x00', @random="0100000000ff"}) 0s ago: executing program 1 (id=6555): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'syzkaller0\x00', 0x7101}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r1, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x0, 0x8}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000001540)=@newtfilter={0x484, 0x2c, 0xd27, 0x70bd25, 0x25dfdbff, {0x0, 0x0, 0x0, r1, {0x0, 0x1}, {}, {0x8, 0x4}}, [@filter_kind_options=@f_bpf={{0x8}, {0x458, 0x2, [@TCA_BPF_FD={0x8, 0x6, r0}, @TCA_BPF_FLAGS={0x8, 0x8, 0x1}, @TCA_BPF_POLICE={0x444, 0x2, [@TCA_POLICE_RATE={0x404, 0x2, [0x7, 0x4, 0x4c0a, 0x7ff, 0x9, 0x5, 0x661f, 0xce4, 0x5, 0xd1, 0x5, 0x2, 0x7, 0x0, 0x0, 0x8001, 0x9098, 0x8, 0xa, 0x0, 0x2, 0x34f, 0x3d7ed312, 0x3, 0x5, 0x5, 0x2, 0x7ff, 0xe7, 0x7, 0x7, 0x8, 0x5, 0xfffff47b, 0x998, 0x5, 0xfffffff7, 0xb, 0x7ff, 0xff, 0x1, 0x8, 0x5, 0x2b2, 0x7, 0x4, 0x6, 0x10, 0x3, 0x121, 0x8, 0x7, 0x8000, 0x80000000, 0x0, 0x4, 0x4000000, 0x200, 0x100, 0x7ff, 0x8, 0x8001, 0x9ef8, 0xfffffffe, 0x6, 0x7ff, 0xd, 0x401, 0x6, 0x8000, 0x13, 0x2, 0x5, 0x9, 0x3, 0xfffffff4, 0x7, 0x4, 0x0, 0x9, 0x5, 0xffffffff, 0x0, 0xffff, 0x9, 0x2e, 0x90000000, 0x0, 0x3, 0x40000002, 0x1, 0x0, 0x0, 0x7f, 0x7, 0x7, 0xfffffffb, 0x1, 0x8, 0x5983, 0x4, 0x0, 0x1, 0xa, 0x2, 0x33b7, 0x5, 0x5, 0xa, 0x3, 0x35, 0x6, 0x0, 0xdf, 0x9, 0x3, 0x5, 0x5, 0x7, 0x3, 0xfffffff7, 0x3ce, 0x7, 0x7, 0x6, 0x10000, 0x9, 0xb, 0x0, 0x7, 0x3, 0x200, 0x5, 0x2f, 0xfffffffb, 0x9c7e, 0x6, 0x0, 0x4, 0x1, 0x6, 0x2, 0x0, 0x95, 0x4, 0x1, 0x3, 0x8, 0x0, 0x5e7c14df, 0x1, 0x4, 0x13c0, 0x3, 0xe, 0xddd3000, 0x40, 0x7, 0x80, 0x8, 0x80000000, 0x3f, 0x3, 0x2, 0xb4a9, 0x400, 0x60f, 0x8, 0x3, 0x3, 0xcba9, 0x7, 0x1, 0x9, 0xa3f0, 0x0, 0x5, 0x4, 0xfffffff8, 0x10001, 0x7, 0x1, 0x4f0a, 0xe, 0x81, 0x5, 0xffff, 0x1000001, 0x32c, 0x5, 0x5c, 0x6, 0x7, 0xa3, 0x0, 0x8001, 0xfffff255, 0x1, 0x5, 0x80000001, 0xa, 0x4, 0x78962c2e, 0xffff, 0x9, 0x8, 0x6, 0xff, 0x1, 0x10000, 0x5, 0x5, 0x6, 0x0, 0x1, 0x32, 0x8, 0x0, 0x5, 0x8, 0x2246, 0x10000, 0x8, 0x3, 0xfffffff6, 0x9, 0x6, 0x7, 0x9, 0x2, 0x3ef, 0x1, 0xadc2, 0x6, 0x0, 0x3, 0x5, 0x1, 0xb6, 0x7, 0x3, 0xfffffffc, 0x6, 0x3, 0x3ff, 0xd, 0x4, 0x6, 0xa2, 0x5fd751c9, 0xfffffff3, 0x3, 0x9, 0x9, 0x7fffffff, 0x1]}, @TCA_POLICE_TBF={0x3c, 0x1, {0x2, 0x2, 0x5, 0x4, 0xfffffffa, {0x3, 0x0, 0x5, 0xb, 0x2, 0x100}, {0x4, 0x2, 0xd, 0xb, 0x7}, 0x10, 0x2, 0x7}}]}]}}]}, 0x484}}, 0x0) kernel console output (not intermixed with test programs): [ 683.025070][T23731] syzkaller0: entered allmulticast mode [ 684.034948][T18219] net_ratelimit: 143 callbacks suppressed [ 684.034971][T18219] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 684.049296][T18219] bond8: (slave ip6gretap1): failed to get link speed/duplex [ 684.164092][T18214] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 684.171935][T18214] bond8: (slave ip6gretap1): failed to get link speed/duplex [ 684.193252][ C0] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 684.199811][ C0] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 684.293400][T18219] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 684.301250][T18219] bond8: (slave ip6gretap1): failed to get link speed/duplex [ 684.413158][T18221] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 684.421131][T18221] bond8: (slave ip6gretap1): failed to get link speed/duplex [ 684.754051][ T4952] Bluetooth: hci1: command tx timeout [ 685.379361][T23706] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 685.415735][T23738] netlink: 'syz.0.5246': attribute type 1 has an invalid length. [ 685.444429][T23620] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 685.512499][T23620] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 685.528975][T23620] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 685.552693][T23620] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 685.627554][T23620] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 685.662431][T23620] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 685.682795][T23749] netlink: 4 bytes leftover after parsing attributes in process `syz.5.5247'. [ 685.684031][T23620] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 685.717300][T23620] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 685.727718][T23746] netlink: 'syz.5.5247': attribute type 3 has an invalid length. [ 685.756361][T23758] syzkaller0: entered promiscuous mode [ 685.762098][T23758] syzkaller0: entered allmulticast mode [ 685.959358][ T1316] ieee802154 phy0 wpan0: encryption failed: -22 [ 685.975798][T23620] 8021q: adding VLAN 0 to HW filter on device bond0 [ 686.020543][T23620] 8021q: adding VLAN 0 to HW filter on device team0 [ 686.059448][T18221] bridge0: port 1(bridge_slave_0) entered blocking state [ 686.066739][T18221] bridge0: port 1(bridge_slave_0) entered forwarding state [ 686.104437][ T3393] bridge0: port 2(bridge_slave_1) entered blocking state [ 686.113328][ T3393] bridge0: port 2(bridge_slave_1) entered forwarding state [ 686.647809][T23800] netlink: 4 bytes leftover after parsing attributes in process `syz.5.5264'. [ 686.655175][T23797] syzkaller1: entered promiscuous mode [ 686.676675][T23797] syzkaller1: entered allmulticast mode [ 686.787021][T23805] netlink: 8 bytes leftover after parsing attributes in process `syz.5.5266'. [ 686.838881][ T4952] Bluetooth: hci1: command tx timeout [ 687.219996][T23830] block nbd1: NBD_DISCONNECT [ 687.322764][T23620] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 687.762350][T23861] syzkaller0: entered promiscuous mode [ 687.781383][T23861] syzkaller0: entered allmulticast mode [ 687.803729][T23861] FAULT_INJECTION: forcing a failure. [ 687.803729][T23861] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 687.835920][T23861] CPU: 1 UID: 0 PID: 23861 Comm: syz.4.5283 Not tainted syzkaller #0 PREEMPT(full) [ 687.835948][T23861] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 687.835960][T23861] Call Trace: [ 687.835969][T23861] [ 687.835979][T23861] dump_stack_lvl+0xe8/0x150 [ 687.836019][T23861] should_fail_ex+0x412/0x560 [ 687.836047][T23861] _copy_from_user+0x2d/0xb0 [ 687.836073][T23861] ___sys_sendmsg+0x1c6/0x360 [ 687.836102][T23861] ? __lock_acquire+0x6b5/0x2cf0 [ 687.836129][T23861] ? __pfx____sys_sendmsg+0x10/0x10 [ 687.836204][T23861] ? __fget_files+0x2a/0x420 [ 687.836228][T23861] ? __fget_files+0x3a0/0x420 [ 687.836263][T23861] __x64_sys_sendmsg+0x1bd/0x2a0 [ 687.836295][T23861] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 687.836334][T23861] ? __pfx_ksys_write+0x10/0x10 [ 687.836371][T23861] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 687.836393][T23861] do_syscall_64+0x174/0xf80 [ 687.836422][T23861] ? trace_irq_disable+0x3b/0x140 [ 687.836451][T23861] ? clear_bhb_loop+0x40/0x90 [ 687.836475][T23861] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 687.836496][T23861] RIP: 0033:0x7fdf6d59ce59 [ 687.836516][T23861] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 687.836532][T23861] RSP: 002b:00007fdf6e52f028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 687.836552][T23861] RAX: ffffffffffffffda RBX: 00007fdf6d815fa0 RCX: 00007fdf6d59ce59 [ 687.836567][T23861] RDX: 0000000000004005 RSI: 0000200000000280 RDI: 0000000000000008 [ 687.836580][T23861] RBP: 00007fdf6e52f090 R08: 0000000000000000 R09: 0000000000000000 [ 687.836592][T23861] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 687.836602][T23861] R13: 00007fdf6d816038 R14: 00007fdf6d815fa0 R15: 00007fffca620698 [ 687.836633][T23861] [ 688.225064][T23620] veth0_vlan: entered promiscuous mode [ 688.255633][T23620] veth1_vlan: entered promiscuous mode [ 688.345773][T23855] bond15: option fail_over_mac: invalid value (16) [ 688.360272][T23855] bond15 (unregistering): Released all slaves [ 688.422311][T23620] veth0_macvtap: entered promiscuous mode [ 688.449010][T23620] veth1_macvtap: entered promiscuous mode [ 688.472657][T23620] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 688.500957][T23620] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 688.513221][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 688.556286][ T135] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 688.574691][ T3393] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 688.762211][ T3393] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 688.784557][ T3393] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 688.913853][ T4952] Bluetooth: hci1: command tx timeout [ 689.044119][T18214] net_ratelimit: 117 callbacks suppressed [ 689.044143][T18214] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 689.087502][ T3393] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 689.096738][T18214] bond8: (slave ip6gretap1): failed to get link speed/duplex [ 689.114189][ T3393] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 689.234619][T18208] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 689.254451][ T3393] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 689.265487][T18208] bond8: (slave ip6gretap1): failed to get link speed/duplex [ 689.265790][T23908] netlink: 204 bytes leftover after parsing attributes in process `syz.4.5297'. [ 689.291097][ T3393] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 689.403155][T18208] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 689.421781][T18208] bond8: (slave ip6gretap1): failed to get link speed/duplex [ 689.543342][ T135] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 689.588543][T23929] netlink: 'syz.1.5302': attribute type 1 has an invalid length. [ 689.613271][ T135] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 689.619133][T23929] netlink: 'syz.1.5302': attribute type 2 has an invalid length. [ 689.630412][T23933] netlink: 212360 bytes leftover after parsing attributes in process `syz.0.5303'. [ 689.635728][T23934] bond_slave_1: entered promiscuous mode [ 689.640592][ T995] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 689.663341][ T135] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 689.675621][T23934] bond_slave_1: entered allmulticast mode [ 690.371522][T23969] netlink: 808 bytes leftover after parsing attributes in process `syz.7.5309'. [ 690.462196][T23974] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5314'. [ 692.181373][T23905] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 692.566904][T24000] ip6_vti0: entered promiscuous mode [ 692.585594][T24000] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5321'. [ 692.596201][T24002] netlink: 81 bytes leftover after parsing attributes in process `syz.7.5323'. [ 692.749983][T24008] netlink: 'syz.1.5325': attribute type 1 has an invalid length. [ 692.797690][T24011] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5327'. [ 692.848103][T24015] netlink: 60 bytes leftover after parsing attributes in process `syz.1.5329'. [ 693.021745][T24030] Cannot find set identified by id 3 to match [ 693.092048][T24034] netlink: 16 bytes leftover after parsing attributes in process `syz.4.5335'. [ 693.229193][T24041] syzkaller0: entered promiscuous mode [ 693.240760][T24041] syzkaller0: entered allmulticast mode [ 693.324721][T24045] syzkaller1: entered promiscuous mode [ 693.330504][T24045] syzkaller1: entered allmulticast mode [ 693.337668][T24048] FAULT_INJECTION: forcing a failure. [ 693.337668][T24048] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 693.351463][T24048] CPU: 0 UID: 0 PID: 24048 Comm: syz.1.5340 Not tainted syzkaller #0 PREEMPT(full) [ 693.351487][T24048] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 693.351497][T24048] Call Trace: [ 693.351504][T24048] [ 693.351512][T24048] dump_stack_lvl+0xe8/0x150 [ 693.351536][T24048] should_fail_ex+0x412/0x560 [ 693.351558][T24048] _copy_to_user+0x31/0xb0 [ 693.351581][T24048] simple_read_from_buffer+0xe1/0x170 [ 693.351610][T24048] proc_fail_nth_read+0x1bb/0x230 [ 693.351636][T24048] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 693.351660][T24048] ? rw_verify_area+0x2a6/0x4d0 [ 693.351678][T24048] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 693.351698][T24048] vfs_read+0x20c/0xa70 [ 693.351741][T24048] ? __pfx___mutex_lock+0x10/0x10 [ 693.351762][T24048] ? __pfx_vfs_read+0x10/0x10 [ 693.351789][T24048] ? __fget_files+0x2a/0x420 [ 693.351816][T24048] ? __fget_files+0x3a0/0x420 [ 693.351837][T24048] ? __fget_files+0x2a/0x420 [ 693.351870][T24048] ksys_read+0x150/0x270 [ 693.351896][T24048] ? __pfx_ksys_read+0x10/0x10 [ 693.351932][T24048] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 693.351953][T24048] do_syscall_64+0x174/0xf80 [ 693.351978][T24048] ? trace_irq_disable+0x3b/0x140 [ 693.352005][T24048] ? clear_bhb_loop+0x40/0x90 [ 693.352029][T24048] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 693.352049][T24048] RIP: 0033:0x7f8b4415d68e [ 693.352068][T24048] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 693.352086][T24048] RSP: 002b:00007f8b44f75fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 693.352106][T24048] RAX: ffffffffffffffda RBX: 00007f8b44f766c0 RCX: 00007f8b4415d68e [ 693.352120][T24048] RDX: 000000000000000f RSI: 00007f8b44f760a0 RDI: 0000000000000005 [ 693.352133][T24048] RBP: 00007f8b44f76090 R08: 0000000000000000 R09: 0000000000000000 [ 693.352145][T24048] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 693.352156][T24048] R13: 00007f8b44416038 R14: 00007f8b44415fa0 R15: 00007ffd5217d078 [ 693.352191][T24048] [ 693.758365][T24055] netlink: 180 bytes leftover after parsing attributes in process `syz.7.5342'. [ 693.800835][T24055] IPv6: NLM_F_CREATE should be specified when creating new route [ 693.880350][T24067] FAULT_INJECTION: forcing a failure. [ 693.880350][T24067] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 693.900671][T24067] CPU: 1 UID: 0 PID: 24067 Comm: syz.1.5346 Not tainted syzkaller #0 PREEMPT(full) [ 693.900700][T24067] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 693.900711][T24067] Call Trace: [ 693.900730][T24067] [ 693.900740][T24067] dump_stack_lvl+0xe8/0x150 [ 693.900769][T24067] should_fail_ex+0x412/0x560 [ 693.900795][T24067] _copy_from_user+0x2d/0xb0 [ 693.900819][T24067] ___sys_sendmsg+0x1c6/0x360 [ 693.900844][T24067] ? __lock_acquire+0x6b5/0x2cf0 [ 693.900868][T24067] ? __pfx____sys_sendmsg+0x10/0x10 [ 693.900931][T24067] ? __fget_files+0x2a/0x420 [ 693.900953][T24067] ? __fget_files+0x3a0/0x420 [ 693.900985][T24067] __x64_sys_sendmsg+0x1bd/0x2a0 [ 693.901016][T24067] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 693.901052][T24067] ? rcu_is_watching+0x15/0xb0 [ 693.901085][T24067] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 693.901112][T24067] do_syscall_64+0x174/0xf80 [ 693.901138][T24067] ? trace_irq_disable+0x3b/0x140 [ 693.901168][T24067] ? clear_bhb_loop+0x40/0x90 [ 693.901192][T24067] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 693.901211][T24067] RIP: 0033:0x7f8b4419ce59 [ 693.901230][T24067] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 693.901246][T24067] RSP: 002b:00007f8b44f76028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 693.901267][T24067] RAX: ffffffffffffffda RBX: 00007f8b44415fa0 RCX: 00007f8b4419ce59 [ 693.901281][T24067] RDX: 0000000000000040 RSI: 0000200000000280 RDI: 0000000000000004 [ 693.901293][T24067] RBP: 00007f8b44f76090 R08: 0000000000000000 R09: 0000000000000000 [ 693.901305][T24067] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 693.901315][T24067] R13: 00007f8b44416038 R14: 00007f8b44415fa0 R15: 00007ffd5217d078 [ 693.901348][T24067] [ 694.090930][T18214] net_ratelimit: 92 callbacks suppressed [ 694.090954][T18214] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 694.104527][T18214] bond8: (slave ip6gretap1): failed to get link speed/duplex [ 694.181519][ T8528] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 694.237459][ T135] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 694.343245][ T3327] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 694.393106][T18219] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 694.433737][T18214] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 694.449113][T18214] bond8: (slave ip6gretap1): failed to get link speed/duplex [ 694.583351][T18208] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 694.610741][T18208] bond8: (slave ip6gretap1): failed to get link speed/duplex [ 694.728071][T24101] netlink: 'syz.5.5355': attribute type 12 has an invalid length. [ 694.732303][T24099] syzkaller1: entered promiscuous mode [ 694.751708][T24099] syzkaller1: entered allmulticast mode [ 694.858358][T24101] bond15: option primary_reselect: invalid value (255) [ 694.885881][T24109] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5357'. [ 694.919858][T24101] bond15 (unregistering): Released all slaves [ 694.929898][T24109] netlink: 176 bytes leftover after parsing attributes in process `syz.1.5357'. [ 694.946746][T24109] netlink: 'syz.1.5357': attribute type 5 has an invalid length. [ 694.960505][T24109] netlink: 'syz.1.5357': attribute type 1 has an invalid length. [ 695.033965][T24111] netlink: 28 bytes leftover after parsing attributes in process `syz.1.5357'. [ 695.137411][T24122] netlink: 'syz.0.5359': attribute type 1 has an invalid length. [ 695.143499][T24109] bond9: entered promiscuous mode [ 695.150800][T24109] 8021q: adding VLAN 0 to HW filter on device bond9 [ 695.274111][T24114] syzkaller0: entered promiscuous mode [ 695.288285][T24114] syzkaller0: entered allmulticast mode [ 698.382462][T24159] FAULT_INJECTION: forcing a failure. [ 698.382462][T24159] name failslab, interval 1, probability 0, space 0, times 0 [ 698.436235][T24159] CPU: 1 UID: 0 PID: 24159 Comm: syz.0.5368 Not tainted syzkaller #0 PREEMPT(full) [ 698.436264][T24159] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 698.436277][T24159] Call Trace: [ 698.436285][T24159] [ 698.436294][T24159] dump_stack_lvl+0xe8/0x150 [ 698.436325][T24159] should_fail_ex+0x412/0x560 [ 698.436357][T24159] should_failslab+0xa8/0x100 [ 698.436380][T24159] __kmalloc_noprof+0xe8/0x760 [ 698.436409][T24159] ? rds_info_getsockopt+0x1ee/0x4a0 [ 698.436436][T24159] ? __might_fault+0xaf/0x130 [ 698.436466][T24159] rds_info_getsockopt+0x1ee/0x4a0 [ 698.436501][T24159] ? __pfx_rds_info_getsockopt+0x10/0x10 [ 698.436531][T24159] ? __might_fault+0xaf/0x130 [ 698.436561][T24159] ? rds_getsockopt+0x31d/0x500 [ 698.436584][T24159] ? __pfx_rds_getsockopt+0x10/0x10 [ 698.436608][T24159] do_sock_getsockopt+0x51d/0x7e0 [ 698.436643][T24159] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 698.436689][T24159] ? __fget_files+0x3a0/0x420 [ 698.436720][T24159] ? __fget_files+0x2a/0x420 [ 698.436752][T24159] __x64_sys_getsockopt+0x1a4/0x240 [ 698.436787][T24159] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 698.436809][T24159] do_syscall_64+0x174/0xf80 [ 698.436838][T24159] ? trace_irq_disable+0x3b/0x140 [ 698.436867][T24159] ? clear_bhb_loop+0x40/0x90 [ 698.436891][T24159] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 698.436911][T24159] RIP: 0033:0x7f9866d9ce59 [ 698.436931][T24159] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 698.436948][T24159] RSP: 002b:00007f9867d28028 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 698.436969][T24159] RAX: ffffffffffffffda RBX: 00007f9867015fa0 RCX: 00007f9866d9ce59 [ 698.436983][T24159] RDX: 0000000000002713 RSI: 0000200000000114 RDI: 0000000000000003 [ 698.436995][T24159] RBP: 00007f9867d28090 R08: 0000200000000000 R09: 0000000000000000 [ 698.437008][T24159] R10: 0000200000c35fff R11: 0000000000000246 R12: 0000000000000001 [ 698.437020][T24159] R13: 00007f9867016038 R14: 00007f9867015fa0 R15: 00007ffd79a3d598 [ 698.437053][T24159] [ 698.665682][T24168] netlink: 8 bytes leftover after parsing attributes in process `syz.7.5371'. [ 698.846228][T24178] xt_hashlimit: invalid interval [ 698.920689][T18006] IPVS: ip_vs_send_async error -101 [ 699.113400][T18214] net_ratelimit: 184 callbacks suppressed [ 699.113424][T18214] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 699.135826][T24203] netlink: 24 bytes leftover after parsing attributes in process `syz.1.5378'. [ 699.153408][T18214] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 699.182365][T24199] syzkaller0: entered promiscuous mode [ 699.188018][T18221] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 699.199990][T24199] syzkaller0: entered allmulticast mode [ 699.214125][T18214] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 699.226433][T18214] bond8: (slave ip6gretap1): failed to get link speed/duplex [ 699.344653][T24214] FAULT_INJECTION: forcing a failure. [ 699.344653][T24214] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 699.345043][T18221] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 699.368181][T24213] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5381'. [ 699.380306][T24213] xt_TCPMSS: Only works on TCP SYN packets [ 699.386057][T24214] CPU: 0 UID: 0 PID: 24214 Comm: syz.0.5383 Not tainted syzkaller #0 PREEMPT(full) [ 699.386083][T24214] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 699.386094][T24214] Call Trace: [ 699.386101][T24214] [ 699.386110][T24214] dump_stack_lvl+0xe8/0x150 [ 699.386136][T24214] should_fail_ex+0x412/0x560 [ 699.386161][T24214] prepare_alloc_pages+0x22a/0x650 [ 699.386196][T24214] __alloc_frozen_pages_noprof+0x12f/0x380 [ 699.386230][T24214] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 699.386262][T24214] ? __pfx_policy_nodemask+0x10/0x10 [ 699.386295][T24214] ? __lock_acquire+0x6b5/0x2cf0 [ 699.386320][T24214] alloc_pages_mpol+0x235/0x490 [ 699.386347][T24214] alloc_pages_noprof+0xac/0x2a0 [ 699.386370][T24214] pte_alloc_one+0x22/0x370 [ 699.386403][T24214] __pte_alloc+0x25/0x1a0 [ 699.386435][T24214] do_pte_missing+0x2cd2/0x33f0 [ 699.386485][T24214] handle_mm_fault+0x1bd9/0x3170 [ 699.386510][T24214] ? mt_find+0x186/0x630 [ 699.386543][T24214] ? handle_mm_fault+0xee/0x3170 [ 699.386576][T24214] ? __pfx_handle_mm_fault+0x10/0x10 [ 699.386626][T24214] __get_user_pages+0x1683/0x2720 [ 699.386680][T24214] __gup_longterm_locked+0xdcf/0x1630 [ 699.386711][T24214] ? gup_fast_fallback+0x181/0x20d0 [ 699.386731][T24214] ? sanity_check_pinned_pages+0x7af/0x870 [ 699.386760][T24214] gup_fast_fallback+0x1d84/0x20d0 [ 699.386808][T24214] ? rcu_is_watching+0x15/0xb0 [ 699.386830][T24214] ? __pfx_gup_fast_fallback+0x10/0x10 [ 699.386853][T24214] ? is_valid_gup_args+0x11f/0x200 [ 699.386876][T24214] ? pin_user_pages_fast+0x4d/0xb0 [ 699.386899][T24214] rds_info_getsockopt+0x20e/0x4a0 [ 699.386931][T24214] ? __pfx_rds_info_getsockopt+0x10/0x10 [ 699.386967][T24214] ? __might_fault+0xaf/0x130 [ 699.386992][T24214] ? rds_getsockopt+0x31d/0x500 [ 699.387013][T24214] ? __pfx_rds_getsockopt+0x10/0x10 [ 699.387034][T24214] do_sock_getsockopt+0x51d/0x7e0 [ 699.387066][T24214] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 699.387106][T24214] ? __fget_files+0x3a0/0x420 [ 699.387126][T24214] ? __fget_files+0x2a/0x420 [ 699.387153][T24214] __x64_sys_getsockopt+0x1a4/0x240 [ 699.387183][T24214] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 699.387203][T24214] do_syscall_64+0x174/0xf80 [ 699.387226][T24214] ? trace_irq_disable+0x3b/0x140 [ 699.387250][T24214] ? clear_bhb_loop+0x40/0x90 [ 699.387272][T24214] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 699.387289][T24214] RIP: 0033:0x7f9866d9ce59 [ 699.387307][T24214] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 699.387322][T24214] RSP: 002b:00007f9867d28028 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 699.387342][T24214] RAX: ffffffffffffffda RBX: 00007f9867015fa0 RCX: 00007f9866d9ce59 [ 699.387354][T24214] RDX: 0000000000002713 RSI: 0000200000000114 RDI: 0000000000000003 [ 699.387366][T24214] RBP: 00007f9867d28090 R08: 0000200000000000 R09: 0000000000000000 [ 699.387377][T24214] R10: 0000200000c35fff R11: 0000000000000246 R12: 0000000000000001 [ 699.387388][T24214] R13: 00007f9867016038 R14: 00007f9867015fa0 R15: 00007ffd79a3d598 [ 699.387418][T24214] [ 699.396277][ C0] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 699.396452][ C0] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 699.479351][T18214] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 699.707632][T24228] netlink: 'syz.1.5387': attribute type 39 has an invalid length. [ 699.763113][T18219] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 702.534314][T24207] syzkaller0: entered promiscuous mode [ 702.539854][T24207] syzkaller0: entered allmulticast mode [ 702.920778][T24261] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5394'. [ 703.042634][T24264] gretap3: entered promiscuous mode [ 703.051018][T24264] batman_adv: batadv0: Adding interface: gretap3 [ 703.065505][T24264] batman_adv: batadv0: The MTU of interface gretap3 is too small (1462) to handle the transport of batman-adv packets. If you experience problems getting traffic through try increasing the MTU to 1500. [ 703.101007][T24264] batman_adv: batadv0: Not using interface gretap3 (retrying later): interface not active [ 703.160959][T24273] macvlan2: entered promiscuous mode [ 703.166786][T24273] macvlan2: entered allmulticast mode [ 703.364538][T24284] IPVS: length: 104 != 24 [ 703.376968][T24284] netlink: 52 bytes leftover after parsing attributes in process `syz.4.5401'. [ 703.618260][T24296] FAULT_INJECTION: forcing a failure. [ 703.618260][T24296] name failslab, interval 1, probability 0, space 0, times 0 [ 703.651573][T24296] CPU: 0 UID: 0 PID: 24296 Comm: syz.7.5406 Not tainted syzkaller #0 PREEMPT(full) [ 703.651602][T24296] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 703.651614][T24296] Call Trace: [ 703.651622][T24296] [ 703.651632][T24296] dump_stack_lvl+0xe8/0x150 [ 703.651661][T24296] should_fail_ex+0x412/0x560 [ 703.651689][T24296] should_failslab+0xa8/0x100 [ 703.651709][T24296] __kmalloc_noprof+0xe8/0x760 [ 703.651734][T24296] ? tomoyo_encode+0x28b/0x550 [ 703.651768][T24296] tomoyo_encode+0x28b/0x550 [ 703.651801][T24296] tomoyo_realpath_from_path+0x58d/0x5d0 [ 703.651828][T24296] ? tomoyo_domain+0xd7/0x130 [ 703.651851][T24296] ? tomoyo_path_number_perm+0x219/0x630 [ 703.651889][T24296] tomoyo_path_number_perm+0x246/0x630 [ 703.651917][T24296] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 703.651938][T24296] ? __lock_acquire+0x6b5/0x2cf0 [ 703.651984][T24296] ? __mutex_unlock_slowpath+0x1be/0x6f0 [ 703.652028][T24296] ? __fget_files+0x2a/0x420 [ 703.652054][T24296] ? __fget_files+0x2a/0x420 [ 703.652076][T24296] ? __fget_files+0x3a0/0x420 [ 703.652098][T24296] ? __fget_files+0x2a/0x420 [ 703.652126][T24296] security_file_ioctl+0xc3/0x2a0 [ 703.652152][T24296] __se_sys_ioctl+0x47/0x170 [ 703.652181][T24296] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 703.652201][T24296] do_syscall_64+0x174/0xf80 [ 703.652226][T24296] ? trace_irq_disable+0x3b/0x140 [ 703.652252][T24296] ? clear_bhb_loop+0x40/0x90 [ 703.652276][T24296] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 703.652294][T24296] RIP: 0033:0x7f5f3ab9ce59 [ 703.652313][T24296] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 703.652330][T24296] RSP: 002b:00007f5f3babb028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 703.652351][T24296] RAX: ffffffffffffffda RBX: 00007f5f3ae15fa0 RCX: 00007f5f3ab9ce59 [ 703.652365][T24296] RDX: 0000200000000040 RSI: 0000000000008914 RDI: 0000000000000004 [ 703.652377][T24296] RBP: 00007f5f3babb090 R08: 0000000000000000 R09: 0000000000000000 [ 703.652388][T24296] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 703.652400][T24296] R13: 00007f5f3ae16038 R14: 00007f5f3ae15fa0 R15: 00007fffb73aad88 [ 703.652435][T24296] [ 703.652649][T24296] ERROR: Out of memory at tomoyo_realpath_from_path. [ 704.004688][T24296] syzkaller1: entered promiscuous mode [ 704.027460][T24296] syzkaller1: entered allmulticast mode [ 704.123489][ T135] net_ratelimit: 186 callbacks suppressed [ 704.123514][ T135] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 704.124937][T24304] xt_socket: unknown flags 0x50 [ 704.148886][T18211] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 704.185371][T18214] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 704.194392][ T5737] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 704.195769][T18214] bond8: (slave ip6gretap1): failed to get link speed/duplex [ 704.317070][T24314] syzkaller1: entered promiscuous mode [ 704.329965][T18211] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 704.357958][T24314] syzkaller1: entered allmulticast mode [ 704.365096][T18214] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 704.389668][T18214] bond8: (slave ip6gretap1): failed to get link speed/duplex [ 704.524637][T18214] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 704.563226][T18214] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 704.599481][T24331] RDS: rds_bind could not find a transport for ::ffff:172.30.1.5, load rds_tcp or rds_rdma? [ 704.679927][T24334] netlink: 52 bytes leftover after parsing attributes in process `syz.4.5415'. [ 704.865605][T24338] netlink: 40 bytes leftover after parsing attributes in process `syz.4.5419'. [ 704.903000][T24342] netlink: 36 bytes leftover after parsing attributes in process `syz.0.5420'. [ 704.949313][T24336] bridge0: port 2(bridge_slave_1) entered disabled state [ 705.246729][T24358] netlink: 68 bytes leftover after parsing attributes in process `syz.0.5422'. [ 705.287018][T24358] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5422'. [ 705.316021][T24354] netlink: 52 bytes leftover after parsing attributes in process `syz.0.5422'. [ 705.390433][T24362] netlink: 4 bytes leftover after parsing attributes in process `syz.7.5425'. [ 705.402677][T24354] syzkaller0: entered promiscuous mode [ 705.408717][T24362] netlink: 4 bytes leftover after parsing attributes in process `syz.7.5425'. [ 705.433365][T24354] syzkaller0: entered allmulticast mode [ 705.505595][T18214] netdevsim netdevsim7 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 705.522125][T18214] netdevsim netdevsim7 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 705.551836][T18214] netdevsim netdevsim7 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 705.571856][T18214] netdevsim netdevsim7 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 706.222326][T24385] syzkaller0: entered promiscuous mode [ 706.238347][T24385] syzkaller0: entered allmulticast mode [ 707.161461][T24433] netlink: 'syz.0.5443': attribute type 1 has an invalid length. [ 709.133122][T18211] net_ratelimit: 184 callbacks suppressed [ 709.133147][T18211] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 709.184217][T18211] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 709.214321][T18219] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 709.234494][T18211] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 709.253231][T18211] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 709.274045][ T3393] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 709.293328][ T3393] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 709.320109][ T3393] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 709.353147][T18219] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 709.375156][ T3393] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 709.699265][T24433] workqueue: Failed to create a rescuer kthread for wq "bond21": -EINTR [ 709.714220][T24434] bond19: (slave veth0_to_bond): Releasing active interface [ 710.161425][T24462] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5452'. [ 710.258050][T24466] netlink: 72 bytes leftover after parsing attributes in process `syz.0.5452'. [ 710.556852][T24465] syzkaller0: entered promiscuous mode [ 710.584873][T24465] syzkaller0: entered allmulticast mode [ 710.687090][T24490] netlink: 4 bytes leftover after parsing attributes in process `syz.5.5460'. [ 711.305591][T24514] syzkaller1: entered promiscuous mode [ 711.323623][T24514] syzkaller1: entered allmulticast mode [ 711.407821][T24532] FAULT_INJECTION: forcing a failure. [ 711.407821][T24532] name failslab, interval 1, probability 0, space 0, times 0 [ 711.422099][T24532] CPU: 0 UID: 0 PID: 24532 Comm: syz.1.5473 Not tainted syzkaller #0 PREEMPT(full) [ 711.422134][T24532] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 711.422147][T24532] Call Trace: [ 711.422166][T24532] [ 711.422175][T24532] dump_stack_lvl+0xe8/0x150 [ 711.422204][T24532] should_fail_ex+0x412/0x560 [ 711.422232][T24532] should_failslab+0xa8/0x100 [ 711.422252][T24532] __kmalloc_node_track_caller_noprof+0xeb/0x7b0 [ 711.422276][T24532] ? __kasan_kmalloc+0x93/0xb0 [ 711.422300][T24532] ? __request_module+0x2ec/0x630 [ 711.422320][T24532] ? __kmalloc_cache_noprof+0x31c/0x660 [ 711.422347][T24532] kstrdup+0x42/0x100 [ 711.422367][T24532] __request_module+0x2ec/0x630 [ 711.422392][T24532] ? __pfx___request_module+0x10/0x10 [ 711.422415][T24532] ? apparmor_capable+0x126/0x170 [ 711.422445][T24532] ? capable+0x88/0xe0 [ 711.422463][T24532] ? dev_load+0x21/0x1f0 [ 711.422490][T24532] devinet_ioctl+0x138/0x1b30 [ 711.422527][T24532] ? __pfx_devinet_ioctl+0x10/0x10 [ 711.422557][T24532] ? get_user_ifreq+0x12b/0x180 [ 711.422580][T24532] inet_ioctl+0x42a/0x560 [ 711.422602][T24532] ? __pfx_inet_ioctl+0x10/0x10 [ 711.422645][T24532] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 711.422682][T24532] sock_do_ioctl+0x101/0x320 [ 711.422707][T24532] ? __pfx_sock_do_ioctl+0x10/0x10 [ 711.422725][T24532] ? __mutex_unlock_slowpath+0x1be/0x6f0 [ 711.422762][T24532] sock_ioctl+0x5c6/0x7f0 [ 711.422785][T24532] ? __pfx_sock_ioctl+0x10/0x10 [ 711.422805][T24532] ? __fget_files+0x2a/0x420 [ 711.422825][T24532] ? __fget_files+0x3a0/0x420 [ 711.422847][T24532] ? __fget_files+0x2a/0x420 [ 711.422882][T24532] ? bpf_lsm_file_ioctl+0x9/0x20 [ 711.422910][T24532] ? __pfx_sock_ioctl+0x10/0x10 [ 711.422928][T24532] __se_sys_ioctl+0xfc/0x170 [ 711.422954][T24532] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 711.422975][T24532] do_syscall_64+0x174/0xf80 [ 711.423002][T24532] ? trace_irq_disable+0x3b/0x140 [ 711.423028][T24532] ? clear_bhb_loop+0x40/0x90 [ 711.423052][T24532] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 711.423072][T24532] RIP: 0033:0x7f8b4419ce59 [ 711.423092][T24532] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 711.423109][T24532] RSP: 002b:00007f8b423f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 711.423131][T24532] RAX: ffffffffffffffda RBX: 00007f8b44416090 RCX: 00007f8b4419ce59 [ 711.423145][T24532] RDX: 0000200000000040 RSI: 0000000000008914 RDI: 0000000000000004 [ 711.423157][T24532] RBP: 00007f8b423f6090 R08: 0000000000000000 R09: 0000000000000000 [ 711.423170][T24532] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 711.423182][T24532] R13: 00007f8b44416128 R14: 00007f8b44416090 R15: 00007ffd5217d078 [ 711.423215][T24532] [ 711.424381][T24528] macsec1: entered promiscuous mode [ 711.581504][T24538] block nbd0: Unsupported socket: should be TCP or UNIX. [ 711.602696][T24528] batadv0: entered promiscuous mode [ 711.730629][T24528] 8021q: adding VLAN 0 to HW filter on device macsec1 [ 711.732885][T24542] netlink: 204 bytes leftover after parsing attributes in process `syz.7.5477'. [ 711.748448][T24528] batadv0: left promiscuous mode [ 711.876597][T24532] syzkaller1: entered promiscuous mode [ 711.880243][T24548] netlink: 'syz.7.5479': attribute type 1 has an invalid length. [ 711.882246][T24532] syzkaller1: entered allmulticast mode [ 711.989860][T24548] 8021q: adding VLAN 0 to HW filter on device bond1 [ 712.205410][T24548] bond1: (slave geneve2): making interface the new active one [ 712.239008][T24548] bond1: (slave geneve2): Enslaving as an active interface with an up link [ 712.414035][T24569] FAULT_INJECTION: forcing a failure. [ 712.414035][T24569] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 712.463682][T24569] CPU: 1 UID: 0 PID: 24569 Comm: syz.0.5484 Not tainted syzkaller #0 PREEMPT(full) [ 712.463711][T24569] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 712.463722][T24569] Call Trace: [ 712.463731][T24569] [ 712.463739][T24569] dump_stack_lvl+0xe8/0x150 [ 712.463768][T24569] should_fail_ex+0x412/0x560 [ 712.463794][T24569] _copy_to_user+0x31/0xb0 [ 712.463819][T24569] simple_read_from_buffer+0xe1/0x170 [ 712.463849][T24569] proc_fail_nth_read+0x1bb/0x230 [ 712.463878][T24569] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 712.463906][T24569] ? rw_verify_area+0x2a6/0x4d0 [ 712.463932][T24569] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 712.463958][T24569] vfs_read+0x20c/0xa70 [ 712.463989][T24569] ? __pfx___mutex_lock+0x10/0x10 [ 712.464010][T24569] ? __pfx_vfs_read+0x10/0x10 [ 712.464037][T24569] ? __fget_files+0x2a/0x420 [ 712.464065][T24569] ? __fget_files+0x3a0/0x420 [ 712.464087][T24569] ? __fget_files+0x2a/0x420 [ 712.464118][T24569] ksys_read+0x150/0x270 [ 712.464146][T24569] ? __pfx_ksys_read+0x10/0x10 [ 712.464181][T24569] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 712.464203][T24569] do_syscall_64+0x174/0xf80 [ 712.464229][T24569] ? trace_irq_disable+0x3b/0x140 [ 712.464257][T24569] ? clear_bhb_loop+0x40/0x90 [ 712.464282][T24569] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 712.464302][T24569] RIP: 0033:0x7f9866d5d68e [ 712.464322][T24569] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 712.464350][T24569] RSP: 002b:00007f9867d06fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 712.464372][T24569] RAX: ffffffffffffffda RBX: 00007f9867d076c0 RCX: 00007f9866d5d68e [ 712.464387][T24569] RDX: 000000000000000f RSI: 00007f9867d070a0 RDI: 0000000000000005 [ 712.464398][T24569] RBP: 00007f9867d07090 R08: 0000000000000000 R09: 0000000000000000 [ 712.464411][T24569] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 712.464422][T24569] R13: 00007f9867016128 R14: 00007f9867016090 R15: 00007ffd79a3d598 [ 712.464456][T24569] [ 713.075665][T24591] syzkaller0: entered promiscuous mode [ 713.091410][T24591] syzkaller0: entered allmulticast mode [ 713.187020][T24603] --map-set only usable from mangle table [ 713.188048][T24600] netlink: 28 bytes leftover after parsing attributes in process `syz.4.5497'. [ 713.251507][T24601] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5496'. [ 713.260663][T24606] netlink: 8 bytes leftover after parsing attributes in process `syz.5.5495'. [ 713.404734][T24611] vxcan2: entered allmulticast mode [ 713.614769][T24611] netlink: 'syz.7.5499': attribute type 4 has an invalid length. [ 713.783133][T24619] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5500'. [ 714.180176][ T3393] net_ratelimit: 153 callbacks suppressed [ 714.180198][ T3393] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 714.201979][T24624] bridge0: port 1(bridge_slave_0) entered disabled state [ 714.229076][T24632] netlink: 120 bytes leftover after parsing attributes in process `syz.4.5505'. [ 714.243016][ T3393] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 714.262551][ T3393] bond8: (slave ip6gretap1): failed to get link speed/duplex [ 714.403957][T18211] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 714.454476][T18211] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 714.475434][T18211] bond8: (slave ip6gretap1): failed to get link speed/duplex [ 714.512196][T24647] xt_cgroup: xt_cgroup: no path or classid specified [ 714.603782][T18211] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 714.636659][T18211] bond8: (slave ip6gretap1): failed to get link speed/duplex [ 714.757974][ T5737] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 714.773978][T18219] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 715.179078][T24688] netlink: 204 bytes leftover after parsing attributes in process `syz.1.5521'. [ 715.271352][T24690] veth1_macvtap: left promiscuous mode [ 715.302587][T24690] macsec0: entered promiscuous mode [ 715.328572][T24690] macsec0: entered allmulticast mode [ 715.487140][T24698] mac80211_hwsim hwsim5 syzkaller0: left promiscuous mode [ 715.547890][T24698] mac80211_hwsim hwsim5 syzkaller0: left allmulticast mode [ 715.626786][T24648] infiniband syz0: set down [ 715.646370][T24648] infiniband syz0: added bridge_slave_1 [ 715.718852][T24648] workqueue: Failed to create a rescuer kthread for wq "ib_mad1": -EINTR [ 715.726346][T24648] infiniband syz0: Couldn't open port 1 [ 715.767835][T24648] smbdirect: ib_dev[syz0]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000 [ 715.790606][T24648] smbdirect: ib_dev[syz0]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32 [ 715.811144][T24648] smbdirect: ib_dev[syz0]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005 [ 715.901609][T24648] RDS/IB: syz0: added [ 715.906540][T24648] smc: adding ib device syz0 with port count 1 [ 715.942580][T24648] smc: ib device syz0 port 1 has no pnetid [ 715.998562][T24726] netlink: 68 bytes leftover after parsing attributes in process `syz.7.5532'. [ 716.085779][T24730] netlink: 52 bytes leftover after parsing attributes in process `syz.0.5535'. [ 716.144826][T24733] block nbd1: NBD_DISCONNECT [ 716.277875][T24739] netlink: 'syz.1.5537': attribute type 1 has an invalid length. [ 716.489265][T24748] netlink: 'syz.0.5540': attribute type 1 has an invalid length. [ 716.523679][T24748] netlink: 'syz.0.5540': attribute type 3 has an invalid length. [ 716.553497][T24748] netlink: 224 bytes leftover after parsing attributes in process `syz.0.5540'. [ 716.675254][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 716.706876][T24753] veth1_to_bond: entered allmulticast mode [ 716.730164][T24752] veth1_to_bond: left allmulticast mode [ 717.120515][T24766] syzkaller0: entered promiscuous mode [ 717.127002][T24766] syzkaller0: entered allmulticast mode [ 717.318553][T24768] netlink: 256 bytes leftover after parsing attributes in process `syz.0.5547'. [ 717.347973][T24768] netlink: 'syz.0.5547': attribute type 9 has an invalid length. [ 717.380267][T24770] netlink: 52 bytes leftover after parsing attributes in process `syz.1.5548'. [ 717.408443][T24768] syzkaller0: entered promiscuous mode [ 717.434651][T24768] syzkaller0: entered allmulticast mode [ 717.523380][T24768] ipt_rpfilter: unknown options [ 717.808982][T24782] x_tables: unsorted entry at hook 2 [ 717.848509][T24784] x_tables: unsorted entry at hook 2 [ 718.003555][T24788] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 718.005086][T24790] netlink: 68 bytes leftover after parsing attributes in process `syz.0.5555'. [ 718.036150][T24788] veth1_to_bond: entered allmulticast mode [ 718.061403][T24787] veth1_to_bond: left allmulticast mode [ 718.323982][T24807] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5559'. [ 719.236682][T18208] net_ratelimit: 99 callbacks suppressed [ 719.236708][T18208] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 719.272147][T18208] bond8: (slave ip6gretap1): failed to get link speed/duplex [ 719.323702][T24836] syzkaller0: entered promiscuous mode [ 719.333447][T24836] syzkaller0: entered allmulticast mode [ 719.372577][T24836] syzkaller1: entered promiscuous mode [ 719.390587][T24836] syzkaller1: entered allmulticast mode [ 719.396529][ T3393] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 719.433163][ T3393] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 719.473193][T18208] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 719.513384][T18208] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 719.554848][ T3393] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 719.603153][ T3393] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 719.623204][ T3393] bond8: (slave ip6gretap1): failed to get link speed/duplex [ 719.696932][T24847] netlink: 52 bytes leftover after parsing attributes in process `syz.1.5572'. [ 719.754827][ T3393] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 719.850799][T24849] bridge_slave_0: left allmulticast mode [ 719.858522][T24849] bridge_slave_0: left promiscuous mode [ 719.867239][T24849] bridge0: port 1(bridge_slave_0) entered disabled state [ 719.894603][T24849] bridge_slave_1: left allmulticast mode [ 719.903741][T24849] bridge_slave_1: left promiscuous mode [ 719.917709][T24849] bridge0: port 2(bridge_slave_1) entered disabled state [ 719.935956][T24852] netlink: 68 bytes leftover after parsing attributes in process `syz.1.5575'. [ 719.959920][T24849] bond0: (slave bond_slave_0): Releasing backup interface [ 719.982286][T24849] bond0: (slave bond_slave_1): Releasing backup interface [ 720.021724][T24849] team0: Port device team_slave_0 removed [ 720.054500][T24849] team0: Port device team_slave_1 removed [ 720.071200][T24849] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 720.081237][T24849] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 720.092257][T24849] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 720.100729][T24849] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 720.435212][T24870] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5581'. [ 720.594313][T24878] netlink: 'syz.4.5583': attribute type 33 has an invalid length. [ 720.636135][T24878] bond12: option broadcast_neighbor: mode dependency failed, not supported in mode balance-rr(0) [ 720.657330][T24878] bond12 (unregistering): Released all slaves [ 720.679724][T24876] netlink: 'syz.7.5582': attribute type 1 has an invalid length. [ 720.712694][T24876] 8021q: adding VLAN 0 to HW filter on device bond2 [ 720.808222][T24876] bond2: (slave gretap1): making interface the new active one [ 720.833937][T24876] bond2: (slave gretap1): Enslaving as an active interface with an up link [ 721.308147][T24907] Cannot find set identified by id 3 to match [ 721.476929][T24909] netlink: 8 bytes leftover after parsing attributes in process `syz.5.5594'. [ 721.496093][T24911] netlink: 68 bytes leftover after parsing attributes in process `syz.4.5595'. [ 721.642062][T24926] mac80211_hwsim hwsim5 syzkaller0: entered promiscuous mode [ 721.656596][T24926] mac80211_hwsim hwsim5 syzkaller0: entered allmulticast mode [ 722.126108][T24948] block nbd0: Unsupported socket: should be TCP or UNIX. [ 722.165281][T24951] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5608'. [ 722.185917][T24951] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5608'. [ 722.238961][T24951] netlink: 52 bytes leftover after parsing attributes in process `syz.0.5608'. [ 722.597560][T24964] netlink: 4 bytes leftover after parsing attributes in process `syz.5.5613'. [ 722.957096][T24976] netlink: 12 bytes leftover after parsing attributes in process `syz.5.5619'. [ 723.218421][T24995] netlink: 52 bytes leftover after parsing attributes in process `syz.5.5623'. [ 723.566718][T25013] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5630'. [ 723.600262][T25014] workqueue: Failed to create a rescuer kthread for wq "nfc5_nci_cmd_wq": -EINTR [ 723.694852][T25026] bond0: option active_slave: mode dependency failed, not supported in mode balance-rr(0) [ 723.778881][T25026] xt_hashlimit: size too large, truncated to 1048576 [ 723.997042][T25036] block nbd0: Unsupported socket: should be TCP or UNIX. [ 724.253261][ T3327] net_ratelimit: 109 callbacks suppressed [ 724.253285][ T3327] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 724.290067][ T3327] bond8: (slave ip6gretap1): failed to get link speed/duplex [ 724.414404][ T3327] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 724.440504][ T3327] bond8: (slave ip6gretap1): failed to get link speed/duplex [ 724.575490][ T3393] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 724.634078][ T3393] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 724.661534][ T3393] bond8: (slave ip6gretap1): failed to get link speed/duplex [ 724.677597][T25064] Cannot find set identified by id 3 to match [ 724.793851][ T3327] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 724.830867][T25066] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 724.845473][T18211] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 725.218732][T25082] bond21: (slave gre0): Device is not bonding slave [ 725.237213][T25082] bond21: option active_slave: invalid value (gre0) [ 725.252341][T25082] bond21 (unregistering): Released all slaves [ 725.662467][T25113] syzkaller0: entered promiscuous mode [ 725.675896][T25113] syzkaller0: entered allmulticast mode [ 725.752818][T25124] netlink: 'syz.0.5662': attribute type 11 has an invalid length. [ 725.794098][T25124] __nla_validate_parse: 7 callbacks suppressed [ 725.794120][T25124] netlink: 132 bytes leftover after parsing attributes in process `syz.0.5662'. [ 725.851516][T25131] batadv0: Caught tx_queue_len zero misconfig [ 725.869043][T25131] netlink: 40 bytes leftover after parsing attributes in process `syz.4.5664'. [ 726.082027][T25141] netlink: 52 bytes leftover after parsing attributes in process `syz.4.5668'. [ 726.264747][T25155] netlink: 207952 bytes leftover after parsing attributes in process `syz.5.5673'. [ 726.413864][T25162] syzkaller0: entered promiscuous mode [ 726.419583][T25162] syzkaller0: entered allmulticast mode [ 726.546422][T25166] tipc: Enabling of bearer rejected, already enabled [ 726.618502][T25168] block nbd5: NBD_DISCONNECT [ 726.635970][T25170] netlink: 204 bytes leftover after parsing attributes in process `syz.1.5680'. [ 726.726461][T25173] ve: renamed from ip6_vti0 (while UP) [ 726.891771][T25179] netlink: 36 bytes leftover after parsing attributes in process `syz.5.5684'. [ 727.221567][T25194] netlink: 204 bytes leftover after parsing attributes in process `syz.1.5692'. [ 727.238631][T25196] netlink: 'syz.4.5693': attribute type 21 has an invalid length. [ 727.398013][T25203] netlink: 64 bytes leftover after parsing attributes in process `syz.5.5695'. [ 727.402562][T25205] Cannot find set identified by id 3 to match [ 727.441684][T25203] netlink: 64 bytes leftover after parsing attributes in process `syz.5.5695'. [ 727.493246][T25213] PF_CAN: dropped non conform CAN XL skbuff: dev type 280, len 40 [ 727.509814][T25213] netlink: 'syz.1.5696': attribute type 2 has an invalid length. [ 727.522669][T25213] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5696'. [ 727.613753][T25221] netlink: 'syz.0.5702': attribute type 29 has an invalid length. [ 728.154568][T25252] syzkaller0: entered promiscuous mode [ 728.160239][T25252] syzkaller0: entered allmulticast mode [ 728.704223][T25276] FAULT_INJECTION: forcing a failure. [ 728.704223][T25276] name failslab, interval 1, probability 0, space 0, times 0 [ 728.733477][T25276] CPU: 1 UID: 0 PID: 25276 Comm: syz.5.5720 Not tainted syzkaller #0 PREEMPT(full) [ 728.733505][T25276] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 728.733517][T25276] Call Trace: [ 728.733525][T25276] [ 728.733534][T25276] dump_stack_lvl+0xe8/0x150 [ 728.733563][T25276] should_fail_ex+0x412/0x560 [ 728.733591][T25276] should_failslab+0xa8/0x100 [ 728.733611][T25276] __kmalloc_noprof+0xe8/0x760 [ 728.733637][T25276] ? tomoyo_encode+0x28b/0x550 [ 728.733672][T25276] tomoyo_encode+0x28b/0x550 [ 728.733707][T25276] tomoyo_realpath_from_path+0x58d/0x5d0 [ 728.733741][T25276] ? tomoyo_domain+0xd7/0x130 [ 728.733767][T25276] ? tomoyo_path_number_perm+0x219/0x630 [ 728.733794][T25276] tomoyo_path_number_perm+0x246/0x630 [ 728.733823][T25276] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 728.733848][T25276] ? __lock_acquire+0x6b5/0x2cf0 [ 728.733895][T25276] ? __mutex_unlock_slowpath+0x1be/0x6f0 [ 728.733940][T25276] ? __fget_files+0x2a/0x420 [ 728.733968][T25276] ? __fget_files+0x2a/0x420 [ 728.733991][T25276] ? __fget_files+0x3a0/0x420 [ 728.734013][T25276] ? __fget_files+0x2a/0x420 [ 728.734042][T25276] security_file_ioctl+0xc3/0x2a0 [ 728.734070][T25276] __se_sys_ioctl+0x47/0x170 [ 728.734098][T25276] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 728.734121][T25276] do_syscall_64+0x174/0xf80 [ 728.734149][T25276] ? trace_irq_disable+0x3b/0x140 [ 728.734178][T25276] ? clear_bhb_loop+0x40/0x90 [ 728.734204][T25276] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 728.734224][T25276] RIP: 0033:0x7f0419f9ce59 [ 728.734244][T25276] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 728.734260][T25276] RSP: 002b:00007f041ae3a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 728.734282][T25276] RAX: ffffffffffffffda RBX: 00007f041a215fa0 RCX: 00007f0419f9ce59 [ 728.734296][T25276] RDX: 0000200000000000 RSI: 0000000000008953 RDI: 0000000000000003 [ 728.734309][T25276] RBP: 00007f041ae3a090 R08: 0000000000000000 R09: 0000000000000000 [ 728.734321][T25276] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 728.734332][T25276] R13: 00007f041a216038 R14: 00007f041a215fa0 R15: 00007ffea56b9a78 [ 728.734367][T25276] [ 728.734390][T25276] ERROR: Out of memory at tomoyo_realpath_from_path. [ 729.283122][ T3393] net_ratelimit: 107 callbacks suppressed [ 729.283144][ T3393] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 729.371074][ T10] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 729.380910][T18208] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 729.383086][T25306] FAULT_INJECTION: forcing a failure. [ 729.383086][T25306] name failslab, interval 1, probability 0, space 0, times 0 [ 729.416997][ T135] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 729.421551][T25306] CPU: 0 UID: 0 PID: 25306 Comm: syz.0.5732 Not tainted syzkaller #0 PREEMPT(full) [ 729.421575][T25306] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 729.421586][T25306] Call Trace: [ 729.421594][T25306] [ 729.421602][T25306] dump_stack_lvl+0xe8/0x150 [ 729.421637][T25306] should_fail_ex+0x412/0x560 [ 729.421662][T25306] should_failslab+0xa8/0x100 [ 729.421683][T25306] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 729.421708][T25306] ? __alloc_skb+0x1d0/0x7d0 [ 729.421730][T25306] ? __local_bh_enable_ip+0xd0/0x130 [ 729.421754][T25306] __alloc_skb+0x1d0/0x7d0 [ 729.421781][T25306] __ip_append_data+0x2b70/0x3e40 [ 729.421819][T25306] ? __lock_acquire+0x6b5/0x2cf0 [ 729.421838][T25306] ? __pfx_raw_getfrag+0x10/0x10 [ 729.421861][T25306] ? ipv4_mtu+0x23/0x650 [ 729.421899][T25306] ? __pfx___ip_append_data+0x10/0x10 [ 729.421918][T25306] ? ipv4_mtu+0x53b/0x650 [ 729.421940][T25306] ? ipv4_mtu+0x23/0x650 [ 729.421964][T25306] ? __pfx_ipv4_mtu+0x10/0x10 [ 729.421987][T25306] ? ip_setup_cork+0x57e/0xa50 [ 729.422008][T25306] ip_append_data+0x10d/0x190 [ 729.422031][T25306] ? __pfx_raw_getfrag+0x10/0x10 [ 729.422050][T25306] raw_sendmsg+0x14be/0x1a50 [ 729.422093][T25306] ? __pfx_raw_sendmsg+0x10/0x10 [ 729.422134][T25306] ? aa_sk_perm+0x6d5/0x900 [ 729.422165][T25306] ? __pfx_aa_sk_perm+0x10/0x10 [ 729.422186][T25306] ? tomoyo_socket_sendmsg_permission+0x215/0x300 [ 729.422214][T25306] ? sock_rps_record_flow+0x19/0x350 [ 729.422236][T25306] ? inet_sendmsg+0x2f4/0x370 [ 729.422252][T25306] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 729.422278][T25306] ____sys_sendmsg+0x80a/0x9f0 [ 729.422312][T25306] ? __pfx_____sys_sendmsg+0x10/0x10 [ 729.422346][T25306] ? import_iovec+0x73/0xa0 [ 729.422370][T25306] ___sys_sendmsg+0x2a5/0x360 [ 729.422393][T25306] ? __lock_acquire+0x6b5/0x2cf0 [ 729.422415][T25306] ? __pfx____sys_sendmsg+0x10/0x10 [ 729.422481][T25306] ? __fget_files+0x2a/0x420 [ 729.422500][T25306] ? __fget_files+0x3a0/0x420 [ 729.422531][T25306] __x64_sys_sendmsg+0x1bd/0x2a0 [ 729.422558][T25306] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 729.422592][T25306] ? __pfx_ksys_write+0x10/0x10 [ 729.422631][T25306] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 729.422651][T25306] do_syscall_64+0x174/0xf80 [ 729.422675][T25306] ? trace_irq_disable+0x3b/0x140 [ 729.422698][T25306] ? clear_bhb_loop+0x40/0x90 [ 729.422720][T25306] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 729.422737][T25306] RIP: 0033:0x7f9866d9ce59 [ 729.422756][T25306] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 729.422770][T25306] RSP: 002b:00007f9867d28028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 729.422790][T25306] RAX: ffffffffffffffda RBX: 00007f9867015fa0 RCX: 00007f9866d9ce59 [ 729.422802][T25306] RDX: 0000000000000000 RSI: 0000200000001000 RDI: 0000000000000003 [ 729.422813][T25306] RBP: 00007f9867d28090 R08: 0000000000000000 R09: 0000000000000000 [ 729.422824][T25306] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 729.422834][T25306] R13: 00007f9867016038 R14: 00007f9867015fa0 R15: 00007ffd79a3d598 [ 729.422864][T25306] [ 729.826471][T25314] netdevsim netdevsim0 netdevsim0: entered promiscuous mode [ 729.863338][ T135] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 729.909942][ T135] bond8: (slave ip6gretap1): failed to get link speed/duplex [ 729.943836][T25330] FAULT_INJECTION: forcing a failure. [ 729.943836][T25330] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 730.017302][T25330] CPU: 0 UID: 0 PID: 25330 Comm: syz.1.5736 Not tainted syzkaller #0 PREEMPT(full) [ 730.017330][T25330] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 730.017342][T25330] Call Trace: [ 730.017350][T25330] [ 730.017359][T25330] dump_stack_lvl+0xe8/0x150 [ 730.017390][T25330] should_fail_ex+0x412/0x560 [ 730.017418][T25330] _copy_from_user+0x2d/0xb0 [ 730.017444][T25330] arp_ioctl+0x14c/0x490 [ 730.017468][T25330] ? __pfx_arp_ioctl+0x10/0x10 [ 730.017510][T25330] inet_ioctl+0x3c4/0x560 [ 730.017534][T25330] ? __pfx_inet_ioctl+0x10/0x10 [ 730.017577][T25330] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 730.017614][T25330] sock_do_ioctl+0x101/0x320 [ 730.017640][T25330] ? __pfx_sock_do_ioctl+0x10/0x10 [ 730.017658][T25330] ? __mutex_unlock_slowpath+0x1be/0x6f0 [ 730.017696][T25330] sock_ioctl+0x5c6/0x7f0 [ 730.017719][T25330] ? __pfx_sock_ioctl+0x10/0x10 [ 730.017741][T25330] ? __fget_files+0x2a/0x420 [ 730.017770][T25330] ? __fget_files+0x3a0/0x420 [ 730.017792][T25330] ? __fget_files+0x2a/0x420 [ 730.017819][T25330] ? bpf_lsm_file_ioctl+0x9/0x20 [ 730.017856][T25330] ? __pfx_sock_ioctl+0x10/0x10 [ 730.017876][T25330] __se_sys_ioctl+0xfc/0x170 [ 730.017904][T25330] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 730.017927][T25330] do_syscall_64+0x174/0xf80 [ 730.017954][T25330] ? trace_irq_disable+0x3b/0x140 [ 730.017982][T25330] ? clear_bhb_loop+0x40/0x90 [ 730.018007][T25330] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 730.018027][T25330] RIP: 0033:0x7f8b4419ce59 [ 730.018047][T25330] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 730.018062][T25330] RSP: 002b:00007f8b44f76028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 730.018083][T25330] RAX: ffffffffffffffda RBX: 00007f8b44415fa0 RCX: 00007f8b4419ce59 [ 730.018097][T25330] RDX: 0000200000000000 RSI: 0000000000008953 RDI: 0000000000000003 [ 730.018110][T25330] RBP: 00007f8b44f76090 R08: 0000000000000000 R09: 0000000000000000 [ 730.018121][T25330] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 730.018132][T25330] R13: 00007f8b44416038 R14: 00007f8b44415fa0 R15: 00007ffd5217d078 [ 730.018164][T25330] [ 730.254773][ T135] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 730.283314][ T135] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 730.323604][ T135] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 730.337953][ T135] bond8: (slave ip6gretap1): failed to get link speed/duplex [ 730.536581][T25339] bond12 (unregistering): Released all slaves [ 730.592599][T25346] vlan0: default FDB implementation only supports local addresses [ 730.842488][T25363] Cannot find set identified by id 3 to match [ 730.864120][T25365] __nla_validate_parse: 7 callbacks suppressed [ 730.864140][T25365] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5745'. [ 730.920916][T25368] ip6t_REJECT: TCP_RESET illegal for non-tcp [ 730.944620][T25361] netlink: 8 bytes leftover after parsing attributes in process `syz.5.5743'. [ 732.344322][T25435] bond3: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 732.369840][T25435] bond3: (slave lo): Enslaving as an active interface with an up link [ 732.394566][T25442] netlink: 'syz.0.5771': attribute type 1 has an invalid length. [ 732.436450][T25447] netlink: 12 bytes leftover after parsing attributes in process `syz.5.5772'. [ 732.504414][T25451] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5773'. [ 732.517276][T25442] 8021q: adding VLAN 0 to HW filter on device bond21 [ 732.562228][T25459] Cannot find set identified by id 3 to match [ 732.634326][T25451] bond10: option xmit_hash_policy: invalid value (64) [ 732.645682][T25451] bond10 (unregistering): Released all slaves [ 732.768115][T25442] bond21: (slave geneve2): making interface the new active one [ 732.785462][T25442] bond21: (slave geneve2): Enslaving as an active interface with an up link [ 733.029003][T25472] can: request_module (can-proto-0) failed. [ 733.113848][T25486] tipc: Enabled bearer , priority 10 [ 733.378255][T25499] syzkaller1: entered promiscuous mode [ 733.396877][T25499] syzkaller1: entered allmulticast mode [ 733.581571][T25515] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5794'. [ 733.621277][T25520] netlink: 20 bytes leftover after parsing attributes in process `syz.0.5795'. [ 733.648087][T25520] netlink: 'syz.0.5795': attribute type 12 has an invalid length. [ 733.812174][T25529] netlink: 44 bytes leftover after parsing attributes in process `syz.1.5798'. [ 733.824845][T25531] syzkaller0: entered promiscuous mode [ 733.831816][T25531] syzkaller0: entered allmulticast mode [ 733.903530][T25537] sctp: [Deprecated]: syz.7.5801 (pid 25537) Use of int in max_burst socket option. [ 733.903530][T25537] Use struct sctp_assoc_value instead [ 734.080344][T25544] sctp: [Deprecated]: syz.4.5803 (pid 25544) Use of struct sctp_assoc_value in delayed_ack socket option. [ 734.080344][T25544] Use struct sctp_sack_info instead [ 734.200879][T25546] vlan2: entered allmulticast mode [ 734.207612][T25550] block nbd0: Unsupported socket: should be TCP or UNIX. [ 734.223607][T25546] bond0: entered allmulticast mode [ 734.240185][T25546] netdevsim netdevsim5 netdevsim1: entered allmulticast mode [ 734.294489][T18216] net_ratelimit: 101 callbacks suppressed [ 734.294515][T18216] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 734.353148][ C0] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 734.353313][T18216] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 734.361376][ C0] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 734.397635][T18216] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 734.435561][T18216] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 734.449848][T18216] bond8: (slave ip6gretap1): failed to get link speed/duplex [ 734.565686][T18221] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 734.594047][ T995] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 734.602221][ T995] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 734.898463][T25581] netlink: 528 bytes leftover after parsing attributes in process `syz.5.5813'. [ 735.668570][T25620] nftables ruleset with unbound set [ 735.753338][T25625] set match dimension is over the limit! [ 736.019877][T25646] FAULT_INJECTION: forcing a failure. [ 736.019877][T25646] name failslab, interval 1, probability 0, space 0, times 0 [ 736.035305][T25646] CPU: 0 UID: 0 PID: 25646 Comm: syz.0.5837 Not tainted syzkaller #0 PREEMPT(full) [ 736.035335][T25646] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 736.035347][T25646] Call Trace: [ 736.035357][T25646] [ 736.035366][T25646] dump_stack_lvl+0xe8/0x150 [ 736.035398][T25646] should_fail_ex+0x412/0x560 [ 736.035426][T25646] should_failslab+0xa8/0x100 [ 736.035449][T25646] __kmalloc_noprof+0xe8/0x760 [ 736.035478][T25646] ? kernfs_fop_write_iter+0x158/0x540 [ 736.035506][T25646] kernfs_fop_write_iter+0x158/0x540 [ 736.035544][T25646] vfs_write+0x61d/0xb90 [ 736.035583][T25646] ? __pfx_vfs_write+0x10/0x10 [ 736.035634][T25646] ? __fget_files+0x2a/0x420 [ 736.035668][T25646] ksys_write+0x150/0x270 [ 736.035698][T25646] ? __pfx_ksys_write+0x10/0x10 [ 736.035733][T25646] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 736.035752][T25646] do_syscall_64+0x174/0xf80 [ 736.035778][T25646] ? trace_irq_disable+0x3b/0x140 [ 736.035805][T25646] ? clear_bhb_loop+0x40/0x90 [ 736.035828][T25646] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 736.035845][T25646] RIP: 0033:0x7f9866d9ce59 [ 736.035864][T25646] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 736.035879][T25646] RSP: 002b:00007f9867d28028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 736.035900][T25646] RAX: ffffffffffffffda RBX: 00007f9867015fa0 RCX: 00007f9866d9ce59 [ 736.035913][T25646] RDX: 0000000000000012 RSI: 0000200000000080 RDI: 0000000000000005 [ 736.035925][T25646] RBP: 00007f9867d28090 R08: 0000000000000000 R09: 0000000000000000 [ 736.035936][T25646] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 736.035947][T25646] R13: 00007f9867016038 R14: 00007f9867015fa0 R15: 00007ffd79a3d598 [ 736.035980][T25646] [ 736.271925][T25656] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5842'. [ 736.281151][T25656] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5842'. [ 736.291774][T25656] netlink: 'syz.1.5842': attribute type 3 has an invalid length. [ 736.515204][T18006] IPVS: ip_vs_send_async error -101 [ 736.859424][T25690] netlink: 'syz.1.5854': attribute type 6 has an invalid length. [ 736.913092][ T5652] Bluetooth: hci1: command 0x0405 tx timeout [ 736.937992][T25693] bond3: (slave lo): Releasing backup interface [ 736.953631][T25687] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5854'. [ 736.963331][T25693] bond3: (slave lo): last VLAN challenged slave left bond - VLAN blocking is removed [ 737.348550][T25709] bond11: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 737.405867][T25709] bond11: (slave lo): Enslaving as an active interface with an up link [ 737.522257][T25720] netlink: 'syz.0.5866': attribute type 11 has an invalid length. [ 737.525781][T25724] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5867'. [ 737.549864][T25720] netlink: 224 bytes leftover after parsing attributes in process `syz.0.5866'. [ 737.702813][T25731] bond11: (slave lo): Releasing backup interface [ 737.715851][T25731] bond11: (slave lo): last VLAN challenged slave left bond - VLAN blocking is removed [ 737.828581][T25733] syzkaller0: entered promiscuous mode [ 737.837343][T25733] syzkaller0: entered allmulticast mode [ 738.858675][T25788] netlink: 4 bytes leftover after parsing attributes in process `syz.7.5887'. [ 738.873652][T25789] netlink: 4 bytes leftover after parsing attributes in process `syz.7.5887'. [ 739.196952][T25802] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5892'. [ 739.252117][T25805] netlink: 48 bytes leftover after parsing attributes in process `syz.5.5893'. [ 739.295669][T25801] bridge1: entered promiscuous mode [ 739.310442][T25801] bridge1: entered allmulticast mode [ 739.318664][T18221] net_ratelimit: 117 callbacks suppressed [ 739.318684][T18221] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 739.353470][T18221] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 739.365999][T25810] syzkaller1: entered promiscuous mode [ 739.372379][T25810] syzkaller1: entered allmulticast mode [ 739.388429][T18221] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 739.423382][T18216] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 739.435193][T18216] bond8: (slave ip6gretap1): failed to get link speed/duplex [ 739.573081][T18221] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 739.617078][T18221] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 739.644329][T18221] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 739.669962][T18221] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 739.714665][T18221] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 739.807189][T25826] netlink: 80 bytes leftover after parsing attributes in process `syz.7.5901'. [ 739.936453][T25835] netlink: 'syz.4.5902': attribute type 2 has an invalid length. [ 740.290987][T25852] SET target dimension over the limit! [ 740.674929][T18006] IPVS: ip_vs_send_async error -101 [ 740.724699][T25877] tipc: Enabling of bearer rejected, already enabled [ 740.882573][T25882] Cannot find set identified by id 3 to match [ 741.338337][T25910] netlink: 'syz.1.5931': attribute type 1 has an invalid length. [ 741.441803][T25917] netlink: 'syz.4.5932': attribute type 1 has an invalid length. [ 741.451158][T25910] workqueue: Failed to create a rescuer kthread for wq "bond12": -EINTR [ 741.515788][T25917] 8021q: adding VLAN 0 to HW filter on device bond12 [ 741.578952][T25924] bond12: (slave veth0_to_bond): Enslaving as an active interface with a down link [ 741.750696][T25934] __nla_validate_parse: 7 callbacks suppressed [ 741.750732][T25934] netlink: 204 bytes leftover after parsing attributes in process `syz.5.5939'. [ 741.787176][T25932] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5936'. [ 741.888517][T25940] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5942'. [ 741.961366][T25940] bond12: option all_slaves_active: invalid value (222) [ 741.998559][T25940] bond12 (unregistering): Released all slaves [ 742.225019][T25956] vlan1: entered promiscuous mode [ 742.236295][T25956] hsr0: entered promiscuous mode [ 742.253493][T25956] vlan1: entered allmulticast mode [ 742.258789][T25956] hsr0: entered allmulticast mode [ 742.264555][T25956] hsr_slave_0: entered allmulticast mode [ 742.270416][T25956] hsr_slave_1: entered allmulticast mode [ 742.414503][T25958] bond22: option fail_over_mac: invalid value (16) [ 742.437637][T25974] IPVS: set_ctl: invalid protocol: 59 0.0.0.0:20002 [ 742.451275][T25958] bond22 (unregistering): Released all slaves [ 742.600874][T25970] netlink: 212368 bytes leftover after parsing attributes in process `syz.7.5953'. [ 742.845460][T25996] xt_hashlimit: size too large, truncated to 1048576 [ 744.324634][ T3393] net_ratelimit: 156 callbacks suppressed [ 744.324660][ T3393] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 744.363188][T18208] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 744.384823][ T3327] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 744.418284][ T3327] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 744.449824][ T3393] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 744.481960][ T3327] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 744.503857][ T3327] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 744.526159][ T3327] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 744.553219][ T3327] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 744.573635][ T3393] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 744.839848][T18006] IPVS: ip_vs_send_async error -101 [ 746.336381][T26013] Cannot find set identified by id 3 to match [ 746.423288][T26017] netlink: 12 bytes leftover after parsing attributes in process `syz.5.5966'. [ 746.520368][T26023] syzkaller0: entered promiscuous mode [ 746.534414][T26023] syzkaller0: entered allmulticast mode [ 746.618787][T26028] netlink: 16 bytes leftover after parsing attributes in process `syz.5.5971'. [ 746.835286][T26040] netlink: 'syz.0.5975': attribute type 1 has an invalid length. [ 746.843670][T26040] netlink: 'syz.0.5975': attribute type 1 has an invalid length. [ 747.026772][T26053] netlink: 24 bytes leftover after parsing attributes in process `syz.0.5978'. [ 747.042016][T26055] set match dimension is over the limit! [ 747.358415][T26075] netlink: 'syz.5.5986': attribute type 5 has an invalid length. [ 747.397120][ T1316] ieee802154 phy0 wpan0: encryption failed: -22 [ 747.470487][T26082] netlink: 'syz.4.5988': attribute type 1 has an invalid length. [ 747.618026][T26090] netlink: 'syz.5.5990': attribute type 16 has an invalid length. [ 747.649880][T26090] netlink: 8 bytes leftover after parsing attributes in process `syz.5.5990'. [ 747.729283][T26100] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5994'. [ 747.851778][T26107] netlink: 'syz.0.5994': attribute type 4 has an invalid length. [ 747.871795][T26107] netlink: 156 bytes leftover after parsing attributes in process `syz.0.5994'. [ 747.881926][T26110] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5996'. [ 748.538432][T26137] mapping of prio or/and queue is allowed only from OUTPUT/FORWARD/POSTROUTING chains [ 748.747845][T26150] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6010'. [ 748.810813][T26156] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6012'. [ 748.960398][T26163] netlink: 'syz.4.6015': attribute type 1 has an invalid length. [ 749.063749][T26163] 8021q: adding VLAN 0 to HW filter on device bond13 [ 749.142603][T26167] bond12: (slave veth0_to_bond): Releasing active interface [ 749.168386][T26167] bond13: (slave veth0_to_bond): Enslaving as an active interface with a down link [ 749.271311][T26173] mac80211_hwsim hwsim5 syzkaller0: left promiscuous mode [ 749.304273][T26173] mac80211_hwsim hwsim5 syzkaller0: left allmulticast mode [ 749.437557][T18219] net_ratelimit: 150 callbacks suppressed [ 749.437580][T18219] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 749.503562][T18216] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 749.512095][T26179] syzkaller0: entered promiscuous mode [ 749.536286][T26179] syzkaller0: entered allmulticast mode [ 749.555090][T18211] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 749.584615][ T3393] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 749.603024][ T3393] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 749.611060][ T3393] bond8: (slave ip6gretap1): failed to get link speed/duplex [ 749.734025][ T3393] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 749.759662][ T3393] bond8: (slave ip6gretap1): failed to get link speed/duplex [ 749.797104][T18696] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 749.883903][T18216] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 750.080831][T26221] netlink: 48 bytes leftover after parsing attributes in process `syz.4.6034'. [ 750.090089][T26220] netlink: 'syz.1.6031': attribute type 10 has an invalid length. [ 750.190406][T26220] team0 (unregistering): Port device team_slave_0 removed [ 750.210121][T26220] team0 (unregistering): Port device team_slave_1 removed [ 750.237870][T26228] netlink: 'syz.4.6036': attribute type 1 has an invalid length. [ 750.479189][T26243] netlink: 196 bytes leftover after parsing attributes in process `syz.7.6041'. [ 750.509958][T26243] netlink: 196 bytes leftover after parsing attributes in process `syz.7.6041'. [ 750.807943][T26256] netlink: 'syz.1.6044': attribute type 16 has an invalid length. [ 750.971725][T26256] netdevsim netdevsim1 netdevsim0: left promiscuous mode [ 751.091039][T26256] ipvlan0: left promiscuous mode [ 751.112868][T26256] bond6: left promiscuous mode [ 751.128233][T26256] bond6: left allmulticast mode [ 751.145597][T26256] vlan1: left promiscuous mode [ 751.158806][T26256] geneve1: left promiscuous mode [ 751.170354][T26274] xt_physdev: --physdev-out and --physdev-is-out only supported in the FORWARD and POSTROUTING chains with bridged traffic [ 751.184279][T26256] vlan1: left allmulticast mode [ 751.189753][T26256] geneve1: left allmulticast mode [ 751.220483][T26256] bond8: left allmulticast mode [ 751.247663][T26256] batadv0: entered promiscuous mode [ 751.262630][T26256] 8021q: adding VLAN 0 to HW filter on device macsec1 [ 751.277066][T26256] bond9: left promiscuous mode [ 751.295631][T26256] gretap3: left promiscuous mode [ 751.307450][T26256] batman_adv: batadv0: Interface activated: gretap3 [ 751.334259][T26256] 8021q: adding VLAN 0 to HW filter on device bond10 [ 751.350103][T26256] 8021q: adding VLAN 0 to HW filter on device bond11 [ 751.479196][T26276] tipc: Started in network mode [ 751.492861][T26276] tipc: Node identity 42d3d1feff58, cluster identity 4711 [ 751.508233][T26276] tipc: Enabled bearer , priority 0 [ 751.521678][T26276] syzkaller0: entered promiscuous mode [ 751.528155][T26276] syzkaller0: entered allmulticast mode [ 751.559800][T26276] tipc: Resetting bearer [ 751.588706][T26275] tipc: Resetting bearer [ 751.652568][T26275] tipc: Disabling bearer [ 751.673747][T18221] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 751.685934][T18221] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 751.695958][T26292] bridge0: port 1(veth1_to_bridge) entered blocking state [ 751.706633][ T8529] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 751.742258][T26292] bridge0: port 1(veth1_to_bridge) entered disabled state [ 751.750551][T26292] veth1_to_bridge: entered allmulticast mode [ 751.759482][T26292] veth1_to_bridge: entered promiscuous mode [ 751.767409][T26292] bridge0: port 1(veth1_to_bridge) entered blocking state [ 751.774757][T26292] bridge0: port 1(veth1_to_bridge) entered listening state [ 751.954031][T18221] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 751.963064][T26299] Cannot find set identified by id 3 to match [ 751.969430][T18221] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 751.994525][ T10] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 752.005847][T18696] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 752.134120][T18696] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 752.211121][T26315] __nla_validate_parse: 4 callbacks suppressed [ 752.211143][T26315] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6063'. [ 752.262594][T26315] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6063'. [ 752.284041][ T995] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 752.340602][T26320] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6063'. [ 752.416328][T26324] x_tables: ip6_tables: CLASSIFY target: used from hooks PREROUTING, but only usable from FORWARD/OUTPUT/POSTROUTING [ 752.599874][T26338] gretap0: entered promiscuous mode [ 752.620847][T26338] netlink: 8 bytes leftover after parsing attributes in process `syz.7.6070'. [ 752.640850][T26338] gretap0: left promiscuous mode [ 752.746479][T26343] Cannot find set identified by id 3 to match [ 752.784808][T26345] netlink: 16 bytes leftover after parsing attributes in process `syz.7.6073'. [ 752.870916][T26352] set match dimension is over the limit! [ 752.913419][ T10] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 753.179812][T26369] netlink: 4 bytes leftover after parsing attributes in process `syz.7.6080'. [ 753.414876][T26381] tipc: Enabled bearer , priority 0 [ 753.631716][T26382] syzkaller0: entered promiscuous mode [ 753.638486][T26382] syzkaller0: entered allmulticast mode [ 753.649057][T26382] tipc: Resetting bearer [ 753.677996][T26380] tipc: Resetting bearer [ 753.959199][T26399] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6090'. [ 754.463999][ T3327] net_ratelimit: 161 callbacks suppressed [ 754.464017][ T3327] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 754.503260][T18219] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 754.525298][T18219] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 754.565307][ T135] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 754.599943][T18211] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 754.648226][T18208] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 754.685908][ T3327] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 754.720470][T18211] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 754.754058][T18211] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 754.776249][ T3327] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 755.543901][ T4952] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 755.559668][ T4952] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 755.582318][ T4952] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 755.644061][ T4952] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 755.651966][ T4952] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 757.468825][T26380] tipc: Disabling bearer [ 757.487736][T26399] workqueue: Failed to create a rescuer kthread for wq "bond15": -EINTR [ 757.711247][T26432] netlink: 8 bytes leftover after parsing attributes in process `syz.7.6098'. [ 757.737953][ T5652] Bluetooth: hci7: command tx timeout [ 757.766564][T26436] FAULT_INJECTION: forcing a failure. [ 757.766564][T26436] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 757.829415][T26436] CPU: 0 UID: 0 PID: 26436 Comm: syz.4.6100 Not tainted syzkaller #0 PREEMPT(full) [ 757.829444][T26436] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 757.829456][T26436] Call Trace: [ 757.829464][T26436] [ 757.829473][T26436] dump_stack_lvl+0xe8/0x150 [ 757.829503][T26436] should_fail_ex+0x412/0x560 [ 757.829531][T26436] _copy_from_user+0x2d/0xb0 [ 757.829557][T26436] ___sys_sendmsg+0x1c6/0x360 [ 757.829582][T26436] ? __lock_acquire+0x6b5/0x2cf0 [ 757.829618][T26436] ? __pfx____sys_sendmsg+0x10/0x10 [ 757.829683][T26436] ? __fget_files+0x2a/0x420 [ 757.829707][T26436] ? __fget_files+0x3a0/0x420 [ 757.829741][T26436] __x64_sys_sendmsg+0x1bd/0x2a0 [ 757.829773][T26436] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 757.829809][T26436] ? __pfx_ksys_write+0x10/0x10 [ 757.829846][T26436] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 757.829864][T26436] do_syscall_64+0x174/0xf80 [ 757.829888][T26436] ? trace_irq_disable+0x3b/0x140 [ 757.829916][T26436] ? clear_bhb_loop+0x40/0x90 [ 757.829941][T26436] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 757.829960][T26436] RIP: 0033:0x7fdf6d59ce59 [ 757.829980][T26436] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 757.829997][T26436] RSP: 002b:00007fdf6e52f028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 757.830019][T26436] RAX: ffffffffffffffda RBX: 00007fdf6d815fa0 RCX: 00007fdf6d59ce59 [ 757.830033][T26436] RDX: 0000000000000084 RSI: 0000200000000100 RDI: 0000000000000003 [ 757.830046][T26436] RBP: 00007fdf6e52f090 R08: 0000000000000000 R09: 0000000000000000 [ 757.830058][T26436] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 757.830070][T26436] R13: 00007fdf6d816038 R14: 00007fdf6d815fa0 R15: 00007fffca620698 [ 757.830102][T26436] [ 758.577317][T26458] bond13: (slave veth0_to_bond): Releasing active interface [ 758.775426][T26465] vlan3: entered allmulticast mode [ 758.786184][T26465] bond0: entered allmulticast mode [ 759.061809][T26477] syzkaller0: entered promiscuous mode [ 759.078621][T26480] validate_nla: 1 callbacks suppressed [ 759.078642][T26480] netlink: 'syz.4.6113': attribute type 1 has an invalid length. [ 759.104669][T26477] syzkaller0: entered allmulticast mode [ 759.180870][T26467] netlink: 24 bytes leftover after parsing attributes in process `syz.4.6113'. [ 759.219688][T26483] netlink: 28 bytes leftover after parsing attributes in process `syz.7.6117'. [ 759.230663][T26483] netlink: 28 bytes leftover after parsing attributes in process `syz.7.6117'. [ 759.368357][T26481] tipc: Enabled bearer , priority 0 [ 759.410264][T26476] tipc: Resetting bearer [ 759.483407][T18211] net_ratelimit: 179 callbacks suppressed [ 759.483440][T18211] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 759.525929][T26476] tipc: Disabling bearer [ 759.543116][ T3327] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 759.553443][ T10] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 759.573788][T18211] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 759.608512][T18211] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 759.634093][T18208] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 759.663060][ T135] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 759.716651][ T135] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 759.729206][ T5652] Bluetooth: hci6: command 0x0406 tx timeout [ 759.763961][ T3327] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 759.793674][ T4952] Bluetooth: hci7: command tx timeout [ 759.808939][ T3327] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 760.137387][T26508] netlink: 'syz.7.6125': attribute type 13 has an invalid length. [ 760.474677][T26528] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6126'. [ 760.583835][T26514] ip6t_REJECT: TCP_RESET illegal for non-tcp [ 760.640498][T26531] netlink: 'syz.5.6130': attribute type 10 has an invalid length. [ 760.672349][T26531] 8021q: adding VLAN 0 to HW filter on device team0 [ 760.714853][T26531] team0: entered allmulticast mode [ 760.739531][T26531] bond0: (slave team0): Enslaving as an active interface with an up link [ 760.931620][T26537] syzkaller0: entered promiscuous mode [ 760.938557][T26537] syzkaller0: entered allmulticast mode [ 761.070022][T26537] tipc: Enabled bearer , priority 0 [ 761.140426][T26536] tipc: Resetting bearer [ 761.226571][T26554] FAULT_INJECTION: forcing a failure. [ 761.226571][T26554] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 761.245445][T26554] CPU: 0 UID: 0 PID: 26554 Comm: syz.7.6137 Not tainted syzkaller #0 PREEMPT(full) [ 761.245474][T26554] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 761.245486][T26554] Call Trace: [ 761.245495][T26554] [ 761.245504][T26554] dump_stack_lvl+0xe8/0x150 [ 761.245534][T26554] should_fail_ex+0x412/0x560 [ 761.245561][T26554] _copy_from_user+0x2d/0xb0 [ 761.245587][T26554] kstrtouint_from_user+0xd6/0x180 [ 761.245620][T26554] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 761.245657][T26554] proc_fail_nth_write+0x8e/0x210 [ 761.245682][T26554] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 761.245712][T26554] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 761.245738][T26554] vfs_write+0x29a/0xb90 [ 761.245774][T26554] ? __pfx_vfs_write+0x10/0x10 [ 761.245801][T26554] ? __fget_files+0x2a/0x420 [ 761.245828][T26554] ? __fget_files+0x3a0/0x420 [ 761.245848][T26554] ? __fget_files+0x2a/0x420 [ 761.245879][T26554] ksys_write+0x150/0x270 [ 761.245908][T26554] ? __pfx_ksys_write+0x10/0x10 [ 761.245942][T26554] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 761.245964][T26554] do_syscall_64+0x174/0xf80 [ 761.245990][T26554] ? trace_irq_disable+0x3b/0x140 [ 761.246015][T26554] ? clear_bhb_loop+0x40/0x90 [ 761.246039][T26554] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 761.246057][T26554] RIP: 0033:0x7f5f3ab5d68e [ 761.246078][T26554] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 761.246094][T26554] RSP: 002b:00007f5f3babafe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 761.246115][T26554] RAX: ffffffffffffffda RBX: 00007f5f3babb6c0 RCX: 00007f5f3ab5d68e [ 761.246130][T26554] RDX: 0000000000000001 RSI: 00007f5f3babb0a0 RDI: 0000000000000003 [ 761.246142][T26554] RBP: 00007f5f3babb090 R08: 0000000000000000 R09: 0000000000000000 [ 761.246154][T26554] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 761.246165][T26554] R13: 00007f5f3ae16038 R14: 00007f5f3ae15fa0 R15: 00007fffb73aad88 [ 761.246200][T26554] [ 761.248243][T26536] tipc: Disabling bearer [ 761.761258][T26420] bridge0: port 1(bridge_slave_0) entered blocking state [ 761.789272][T26420] bridge0: port 1(bridge_slave_0) entered disabled state [ 761.811918][T26420] bridge_slave_0: entered allmulticast mode [ 761.833339][T26577] netlink: 204 bytes leftover after parsing attributes in process `syz.7.6146'. [ 761.835816][T26420] bridge_slave_0: entered promiscuous mode [ 761.855721][T26420] bridge0: port 2(bridge_slave_1) entered blocking state [ 761.863514][T26420] bridge0: port 2(bridge_slave_1) entered disabled state [ 761.871092][T26420] bridge_slave_1: entered allmulticast mode [ 761.881171][T26420] bridge_slave_1: entered promiscuous mode [ 761.883508][ T4952] Bluetooth: hci7: command tx timeout [ 761.896543][T26569] tipc: Enabled bearer , priority 0 [ 761.939446][T26575] IPVS: set_ctl: invalid protocol: 103 10.1.1.1:20001 [ 761.950898][T26570] syzkaller0: entered promiscuous mode [ 761.958909][T26570] syzkaller0: entered allmulticast mode [ 761.965575][T26570] tipc: Resetting bearer [ 762.117014][T26420] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 762.126868][T26582] netlink: 256 bytes leftover after parsing attributes in process `syz.0.6145'. [ 762.145510][T26420] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 762.186938][T26582] netlink: 'syz.0.6145': attribute type 1 has an invalid length. [ 762.259610][T26568] tipc: Resetting bearer [ 762.289176][T26592] netlink: 8 bytes leftover after parsing attributes in process `syz.7.6151'. [ 763.393144][ C0] ip6_tnl_xmit_ctl: 2 callbacks suppressed [ 763.393166][ C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 763.964002][ T4952] Bluetooth: hci7: command tx timeout [ 764.513962][ T3327] net_ratelimit: 197 callbacks suppressed [ 764.513986][ T3327] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 764.543206][ T3327] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 764.593959][T18211] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 764.633236][T18211] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 764.657001][ T3393] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 764.683142][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 764.703100][ T3327] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 764.723310][ T3393] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 764.743510][ T3393] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 764.764453][ T995] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 764.773839][ T3393] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 765.610231][T26568] tipc: Disabling bearer [ 765.621809][T26420] team0: Port device team_slave_0 added [ 765.652729][T26420] team0: Port device team_slave_1 added [ 765.691940][T26420] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 765.699478][T26420] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 765.732885][T26420] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 765.771498][T26420] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 765.782414][T26420] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 765.852809][T26420] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 766.031986][T26612] syzkaller0: entered promiscuous mode [ 766.062455][T26612] syzkaller0: entered allmulticast mode [ 766.182212][T26420] hsr_slave_0: entered promiscuous mode [ 766.212143][T26420] hsr_slave_1: entered promiscuous mode [ 766.222304][T26628] netlink: 204 bytes leftover after parsing attributes in process `syz.5.6158'. [ 766.241093][T26420] debugfs: 'hsr0' already exists in 'hsr' [ 766.248506][T26420] Cannot create hsr debugfs directory [ 766.260633][T26612] tipc: Enabled bearer , priority 0 [ 766.329649][T26609] tipc: Resetting bearer [ 766.431811][T26609] tipc: Disabling bearer [ 766.668500][T26642] FAULT_INJECTION: forcing a failure. [ 766.668500][T26642] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 766.685937][T26642] CPU: 1 UID: 0 PID: 26642 Comm: syz.0.6165 Not tainted syzkaller #0 PREEMPT(full) [ 766.685964][T26642] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 766.685976][T26642] Call Trace: [ 766.685985][T26642] [ 766.685993][T26642] dump_stack_lvl+0xe8/0x150 [ 766.686022][T26642] should_fail_ex+0x412/0x560 [ 766.686049][T26642] _copy_from_user+0x2d/0xb0 [ 766.686072][T26642] ___sys_sendmsg+0x1c6/0x360 [ 766.686098][T26642] ? __lock_acquire+0x6b5/0x2cf0 [ 766.686124][T26642] ? __pfx____sys_sendmsg+0x10/0x10 [ 766.686189][T26642] ? __fget_files+0x2a/0x420 [ 766.686211][T26642] ? __fget_files+0x3a0/0x420 [ 766.686244][T26642] __x64_sys_sendmsg+0x1bd/0x2a0 [ 766.686275][T26642] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 766.686312][T26642] ? __pfx_ksys_write+0x10/0x10 [ 766.686345][T26642] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 766.686365][T26642] do_syscall_64+0x174/0xf80 [ 766.686391][T26642] ? trace_irq_disable+0x3b/0x140 [ 766.686420][T26642] ? clear_bhb_loop+0x40/0x90 [ 766.686444][T26642] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 766.686464][T26642] RIP: 0033:0x7f9866d9ce59 [ 766.686483][T26642] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 766.686500][T26642] RSP: 002b:00007f9867d28028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 766.686522][T26642] RAX: ffffffffffffffda RBX: 00007f9867015fa0 RCX: 00007f9866d9ce59 [ 766.686536][T26642] RDX: 0000000004000810 RSI: 00002000000002c0 RDI: 0000000000000004 [ 766.686549][T26642] RBP: 00007f9867d28090 R08: 0000000000000000 R09: 0000000000000000 [ 766.686570][T26642] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 766.686582][T26642] R13: 00007f9867016038 R14: 00007f9867015fa0 R15: 00007ffd79a3d598 [ 766.686620][T26642] [ 766.700963][T26645] FAULT_INJECTION: forcing a failure. [ 766.700963][T26645] name failslab, interval 1, probability 0, space 0, times 0 [ 766.900175][T26645] CPU: 0 UID: 0 PID: 26645 Comm: syz.5.6167 Not tainted syzkaller #0 PREEMPT(full) [ 766.900203][T26645] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 766.900215][T26645] Call Trace: [ 766.900223][T26645] [ 766.900232][T26645] dump_stack_lvl+0xe8/0x150 [ 766.900262][T26645] should_fail_ex+0x412/0x560 [ 766.900287][T26645] should_failslab+0xa8/0x100 [ 766.900309][T26645] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 766.900332][T26645] ? __alloc_skb+0x186/0x7d0 [ 766.900369][T26645] ? __alloc_skb+0x1d0/0x7d0 [ 766.900383][T26645] ? __local_bh_enable_ip+0xd0/0x130 [ 766.900399][T26645] __alloc_skb+0x1d0/0x7d0 [ 766.900414][T26645] ? netlink_ack_tlv_len+0x6c/0x210 [ 766.900432][T26645] netlink_ack+0x146/0xa50 [ 766.900447][T26645] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 766.900461][T26645] ? ref_tracker_free+0x693/0x840 [ 766.900476][T26645] ? __pfx_ref_tracker_free+0x10/0x10 [ 766.900495][T26645] netlink_rcv_skb+0x2b6/0x4b0 [ 766.900511][T26645] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 766.900527][T26645] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 766.900550][T26645] ? netlink_deliver_tap+0x2e/0x1b0 [ 766.900565][T26645] ? netlink_deliver_tap+0x2e/0x1b0 [ 766.900584][T26645] netlink_unicast+0x75c/0x8e0 [ 766.900607][T26645] netlink_sendmsg+0x813/0xb40 [ 766.900629][T26645] ? __pfx_netlink_sendmsg+0x10/0x10 [ 766.900647][T26645] ? aa_sock_msg_perm+0xf1/0x1b0 [ 766.900665][T26645] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 766.900683][T26645] ____sys_sendmsg+0x972/0x9f0 [ 766.900699][T26645] ? __might_fault+0xaf/0x130 [ 766.900718][T26645] ? __pfx_____sys_sendmsg+0x10/0x10 [ 766.900740][T26645] ? import_iovec+0x73/0xa0 [ 766.900756][T26645] ___sys_sendmsg+0x2a5/0x360 [ 766.900772][T26645] ? __lock_acquire+0x6b5/0x2cf0 [ 766.900787][T26645] ? __pfx____sys_sendmsg+0x10/0x10 [ 766.900823][T26645] ? __fget_files+0x2a/0x420 [ 766.900837][T26645] ? __fget_files+0x3a0/0x420 [ 766.900857][T26645] __x64_sys_sendmsg+0x1bd/0x2a0 [ 766.900875][T26645] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 766.900897][T26645] ? __pfx_ksys_write+0x10/0x10 [ 766.900919][T26645] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 766.900931][T26645] do_syscall_64+0x174/0xf80 [ 766.900948][T26645] ? trace_irq_disable+0x3b/0x140 [ 766.900965][T26645] ? clear_bhb_loop+0x40/0x90 [ 766.900979][T26645] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 766.900991][T26645] RIP: 0033:0x7f0419f9ce59 [ 766.901003][T26645] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 766.901014][T26645] RSP: 002b:00007f041ae3a028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 766.901028][T26645] RAX: ffffffffffffffda RBX: 00007f041a215fa0 RCX: 00007f0419f9ce59 [ 766.901037][T26645] RDX: 0000000000000000 RSI: 0000200000000140 RDI: 0000000000000003 [ 766.901045][T26645] RBP: 00007f041ae3a090 R08: 0000000000000000 R09: 0000000000000000 [ 766.901052][T26645] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 766.901059][T26645] R13: 00007f041a216038 R14: 00007f041a215fa0 R15: 00007ffea56b9a78 [ 766.901077][T26645] [ 767.392583][T26660] set match dimension is over the limit! [ 767.655904][T26420] netdevsim netdevsim1 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 767.684511][T26676] FAULT_INJECTION: forcing a failure. [ 767.684511][T26676] name failslab, interval 1, probability 0, space 0, times 0 [ 767.706078][T26420] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 767.734268][T26676] CPU: 1 UID: 0 PID: 26676 Comm: syz.5.6176 Not tainted syzkaller #0 PREEMPT(full) [ 767.734303][T26676] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 767.734324][T26676] Call Trace: [ 767.734332][T26676] [ 767.734341][T26676] dump_stack_lvl+0xe8/0x150 [ 767.734371][T26676] should_fail_ex+0x412/0x560 [ 767.734397][T26676] should_failslab+0xa8/0x100 [ 767.734419][T26676] __kmalloc_noprof+0xe8/0x760 [ 767.734446][T26676] ? bpf_test_init+0x9f/0x150 [ 767.734476][T26676] bpf_test_init+0x9f/0x150 [ 767.734505][T26676] bpf_prog_test_run_xdp+0x529/0x1160 [ 767.734548][T26676] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 767.734577][T26676] ? __fget_files+0x2a/0x420 [ 767.734601][T26676] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 767.734626][T26676] bpf_prog_test_run+0x2c7/0x340 [ 767.734649][T26676] __sys_bpf+0x643/0x950 [ 767.734678][T26676] ? __pfx___sys_bpf+0x10/0x10 [ 767.734720][T26676] ? ksys_write+0x242/0x270 [ 767.734748][T26676] ? __pfx_ksys_write+0x10/0x10 [ 767.734780][T26676] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 767.734801][T26676] __x64_sys_bpf+0x7c/0x90 [ 767.734828][T26676] do_syscall_64+0x174/0xf80 [ 767.734855][T26676] ? trace_irq_disable+0x3b/0x140 [ 767.734879][T26676] ? clear_bhb_loop+0x40/0x90 [ 767.734903][T26676] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 767.734921][T26676] RIP: 0033:0x7f0419f9ce59 [ 767.734941][T26676] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 767.734959][T26676] RSP: 002b:00007f041ae3a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 767.734981][T26676] RAX: ffffffffffffffda RBX: 00007f041a215fa0 RCX: 00007f0419f9ce59 [ 767.734995][T26676] RDX: 0000000000000038 RSI: 0000200000000600 RDI: 000000000000000a [ 767.735008][T26676] RBP: 00007f041ae3a090 R08: 0000000000000000 R09: 0000000000000000 [ 767.735021][T26676] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 767.735033][T26676] R13: 00007f041a216038 R14: 00007f041a215fa0 R15: 00007ffea56b9a78 [ 767.735067][T26676] [ 768.251920][T26420] netdevsim netdevsim1 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 768.289345][T26420] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 768.312144][T26693] netlink: 20 bytes leftover after parsing attributes in process `syz.0.6181'. [ 768.442353][T26699] netlink: 24 bytes leftover after parsing attributes in process `syz.4.6184'. [ 768.509395][T26699] netlink: 24 bytes leftover after parsing attributes in process `syz.4.6184'. [ 768.547822][T26420] netdevsim netdevsim1 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 768.558473][T26420] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 768.794757][T26420] netdevsim netdevsim1 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 768.806907][T26420] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 769.533165][ T3327] net_ratelimit: 167 callbacks suppressed [ 769.533187][ T3327] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 769.584573][ T3327] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 769.608060][T26420] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 769.624110][ T3327] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 769.630866][T26420] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 769.653784][ T3327] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 769.660254][T26420] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 769.698916][ T3393] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 769.713865][T26420] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 769.734045][T18211] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 769.773623][T18211] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 769.805084][T18221] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 769.854413][T18221] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 769.873947][T18221] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 773.263723][T26420] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 773.275164][T26420] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 773.359031][T26420] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 773.401456][T26420] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 773.780749][T26420] 8021q: adding VLAN 0 to HW filter on device bond0 [ 773.825891][T26420] 8021q: adding VLAN 0 to HW filter on device team0 [ 773.857100][ T3393] bridge0: port 1(bridge_slave_0) entered blocking state [ 773.864415][ T3393] bridge0: port 1(bridge_slave_0) entered forwarding state [ 773.895243][ T3393] bridge0: port 2(bridge_slave_1) entered blocking state [ 773.902531][ T3393] bridge0: port 2(bridge_slave_1) entered forwarding state [ 774.126517][T26816] RDS: rds_bind could not find a transport for fe80::aa, load rds_tcp or rds_rdma? [ 774.634619][ T3327] net_ratelimit: 187 callbacks suppressed [ 774.634642][ T3327] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 774.647459][T26420] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 774.674947][T18221] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 774.723832][ T3327] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 774.755199][T18211] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 774.772741][T18211] bond8: (slave ip6gretap1): failed to get link speed/duplex [ 774.848985][T26847] netlink: 8 bytes leftover after parsing attributes in process `syz.5.6241'. [ 774.870685][T26847] netlink: 8 bytes leftover after parsing attributes in process `syz.5.6241'. [ 774.894840][ T3327] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 774.923209][T18216] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 774.969070][T26420] veth0_vlan: entered promiscuous mode [ 774.987854][T18221] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 775.010146][T18221] bond8: (slave ip6gretap1): failed to get link speed/duplex [ 775.066340][T26420] veth1_vlan: entered promiscuous mode [ 775.144609][T18208] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 775.156126][T26420] veth0_macvtap: entered promiscuous mode [ 775.217307][T26420] veth1_macvtap: entered promiscuous mode [ 775.272352][T26852] syzkaller1: entered promiscuous mode [ 775.284276][T26852] syzkaller1: entered allmulticast mode [ 775.438815][T26420] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 775.471315][T26420] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 775.519641][ T3327] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 775.539352][ T3327] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 775.582149][ T3327] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 775.621535][ T3327] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 775.669884][T26874] netlink: 20 bytes leftover after parsing attributes in process `syz.0.6252'. [ 775.699906][T26873] netlink: 6 bytes leftover after parsing attributes in process `syz.7.6253'. [ 775.888329][T18208] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 775.898948][T26882] netlink: 'syz.7.6256': attribute type 10 has an invalid length. [ 775.936938][T18208] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 776.077508][ T3327] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 776.101586][ T3327] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 776.355815][T26902] sctp: [Deprecated]: syz.1.6096 (pid 26902) Use of struct sctp_assoc_value in delayed_ack socket option. [ 776.355815][T26902] Use struct sctp_sack_info instead [ 776.711826][ T4952] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 776.729245][ T4952] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 776.747481][ T4952] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 776.764059][ T4952] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 776.771852][ T4952] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 776.910642][T26918] syzkaller1: entered promiscuous mode [ 776.922689][T26918] syzkaller1: entered allmulticast mode [ 777.396670][ T3393] netdevsim netdevsim4 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 777.412185][ T3393] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 777.454333][T26931] netlink: 16 bytes leftover after parsing attributes in process `syz.7.6276'. [ 777.752327][ T3393] netdevsim netdevsim4 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 777.786128][ T3393] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 778.048714][ T3393] netdevsim netdevsim4 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 778.077906][ T3393] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 778.172329][T26965] sit0: entered allmulticast mode [ 778.201682][T26965] sit0: entered promiscuous mode [ 778.357502][ T3393] netdevsim netdevsim4  (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 778.377748][ T3393] netdevsim netdevsim4  (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 778.789045][T18214] netdevsim netdevsim4 eth5: set [1, 0] type 2 family 0 port 6081 - 0 [ 778.833533][ T4952] Bluetooth: hci0: command tx timeout [ 778.890118][T18214] netdevsim netdevsim4 eth6: set [1, 0] type 2 family 0 port 6081 - 0 [ 779.021818][T18214] netdevsim netdevsim4 eth7: set [1, 0] type 2 family 0 port 6081 - 0 [ 779.215898][T18211] netdevsim netdevsim4 eth8: set [1, 0] type 2 family 0 port 6081 - 0 [ 779.323747][ T3393] veth7: left allmulticast mode [ 779.340413][ T3393] veth7: left promiscuous mode [ 779.359262][ T3393] bridge1: port 1(veth7) entered disabled state [ 779.394176][ C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 779.644078][T18211] net_ratelimit: 149 callbacks suppressed [ 779.644102][T18211] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 779.709394][T18208] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 779.743163][T18216] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 779.797846][ T3327] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 779.855087][T18208] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 779.903296][T18208] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 779.943974][ T3327] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 779.985852][ T3327] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 780.026714][T18208] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 780.055730][T18221] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 780.636372][ T3393] bond0 (unregistering): (slave bond1): Releasing backup interface [ 780.646676][ T3393] bond0 (unregistering): Released all slaves [ 780.658274][ T3393] bond1 (unregistering): Released all slaves [ 780.680052][ T3393] bond2 (unregistering): Released all slaves [ 780.695620][ T3393] bond3 (unregistering): Released all slaves [ 780.712374][ T3393] bond4 (unregistering): Released all slaves [ 780.735501][ T3393] bond5 (unregistering): Released all slaves [ 780.756650][ T3393] bond6 (unregistering): Released all slaves [ 780.778573][ T3393] bond7 (unregistering): Released all slaves [ 780.797062][ T3393] bond8 (unregistering): Released all slaves [ 780.812014][ T3393] bond9 (unregistering): Released all slaves [ 780.830700][ T3393] bond10 (unregistering): Released all slaves [ 780.862362][ T3393] bond11 (unregistering): Released all slaves [ 780.877536][ T3393] bond12 (unregistering): Released all slaves [ 780.896009][ T3393] bond13 (unregistering): Released all slaves [ 780.913478][ T4952] Bluetooth: hci0: command tx timeout [ 780.922401][ T3393] bond14 (unregistering): Released all slaves [ 781.171356][ T5298] 8021q: adding VLAN 0 to HW filter on device eth5 [ 781.705732][ T3393] : left promiscuous mode [ 781.723362][T27062] netlink: 16 bytes leftover after parsing attributes in process `syz.1.6326'. [ 781.860148][T27060] netlink: 104 bytes leftover after parsing attributes in process `syz.0.6328'. [ 781.907657][T27062] netlink: 16 bytes leftover after parsing attributes in process `syz.1.6326'. [ 781.955466][ C1] bridge0: port 1(veth1_to_bridge) entered learning state [ 782.123895][ T3393] tipc: Left network mode [ 782.468204][T27096] netlink: 36 bytes leftover after parsing attributes in process `syz.0.6336'. [ 782.497577][T27096] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6336'. [ 782.509145][T27096] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6336'. [ 782.593240][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 782.631645][T27080] syzkaller0: entered promiscuous mode [ 782.649282][T27080] syzkaller0: entered allmulticast mode [ 782.746162][T27102] netlink: 8 bytes leftover after parsing attributes in process `syz.5.6337'. [ 782.954319][ T3393] IPVS: stopping master sync thread 18006 ... [ 782.996467][ T4952] Bluetooth: hci0: command tx timeout [ 783.011763][ T3393] IPVS: stopping backup sync thread 20692 ... [ 784.663303][T18208] net_ratelimit: 194 callbacks suppressed [ 784.663329][T18208] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 784.703079][ T3327] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 784.723748][ T3327] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 784.763330][T18208] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 784.796993][ T3327] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 784.823187][T18208] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 784.848497][ T3327] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 784.873413][ T3327] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 784.904898][ T3327] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 784.925505][T18216] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 785.081910][ T4952] Bluetooth: hci0: command tx timeout [ 786.220559][T27107] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6339'. [ 786.231014][ T5298] 8021q: adding VLAN 0 to HW filter on device eth6 [ 789.665771][T18216] net_ratelimit: 223 callbacks suppressed [ 789.665797][T18216] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 789.693286][T18214] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 789.743085][T18214] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 789.793970][ T995] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 789.815610][ T135] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 789.863726][T18221] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 789.909961][ T135] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 789.976627][T18214] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 790.023125][T18221] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 790.051086][T26909] bridge0: port 1(bridge_slave_0) entered blocking state [ 790.067130][T26909] bridge0: port 1(bridge_slave_0) entered disabled state [ 790.078406][T26909] bridge_slave_0: entered allmulticast mode [ 790.080414][T18221] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 790.087533][T26909] bridge_slave_0: entered promiscuous mode [ 790.101969][T26909] bridge0: port 2(bridge_slave_1) entered blocking state [ 790.109984][T26909] bridge0: port 2(bridge_slave_1) entered disabled state [ 790.134651][T26909] bridge_slave_1: entered allmulticast mode [ 790.156188][T26909] bridge_slave_1: entered promiscuous mode [ 790.585579][T26909] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 790.605839][T26909] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 791.227859][T26909] team0: Port device team_slave_0 added [ 791.273469][T26909] team0: Port device team_slave_1 added [ 791.641053][T27206] xt_hashlimit: size too large, truncated to 1048576 [ 791.845520][T26909] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 791.860593][T26909] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 791.934481][T26909] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 792.062748][ T5298] 8021q: adding VLAN 0 to HW filter on device eth7 [ 792.314440][T26909] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 792.329163][T26909] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 792.376204][T26909] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 794.698450][ T3335] net_ratelimit: 205 callbacks suppressed [ 794.698474][ T3335] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 794.734405][T18208] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 794.763197][T18208] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 794.793626][T18208] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 794.815643][T18208] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 794.843092][ T13] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 794.851121][T27248] netlink: 44 bytes leftover after parsing attributes in process `syz.5.6389'. [ 794.892066][ T3335] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 794.915004][T18211] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 794.946884][T18211] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 794.973095][T18211] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 796.158532][T27261] netlink: 8 bytes leftover after parsing attributes in process `syz.7.6394'. [ 796.268458][T26909] hsr_slave_0: entered promiscuous mode [ 796.316468][T26909] hsr_slave_1: entered promiscuous mode [ 796.361467][T26909] debugfs: 'hsr0' already exists in 'hsr' [ 796.391611][T26909] Cannot create hsr debugfs directory [ 796.550539][ T3393] hsr_slave_0: left promiscuous mode [ 796.586673][ T3393] hsr_slave_1: left promiscuous mode [ 796.686347][ T3393] veth1_macvtap: left promiscuous mode [ 796.934820][ T3393] pim6reg (unregistering): left allmulticast mode [ 797.522436][T18214] smc: removing ib device syz0 [ 797.759943][ T5298] 8021q: adding VLAN 0 to HW filter on device eth8 [ 798.299199][T18214] smbdirect: ib_dev[syz0] removed [ 799.721330][T18208] net_ratelimit: 208 callbacks suppressed [ 799.721355][T18208] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 799.788908][T18216] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 799.837298][T18219] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 799.870019][T18219] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 799.902232][T18219] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 799.933848][T18216] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 799.964354][T18216] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 799.997623][T18216] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 800.023578][T18216] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 800.063561][T18216] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 803.147788][T27367] xt_hashlimit: size too large, truncated to 1048576 [ 803.160701][T26909] netdevsim netdevsim4 eth8 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 803.506333][T26909] netdevsim netdevsim4 eth7 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 803.624472][T27388] netlink: 'syz.0.6436': attribute type 29 has an invalid length. [ 803.656390][ T3393] IPVS: stop unused estimator thread 0... [ 803.672474][T27388] netlink: 'syz.0.6436': attribute type 29 has an invalid length. [ 803.824172][T26909] netdevsim netdevsim4 eth6 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 804.035782][T26909] netdevsim netdevsim4 eth5 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 804.561759][T26909] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 804.605986][T26909] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 804.627345][T26909] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 804.659911][T26909] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 804.680027][T26909] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 804.719405][T26909] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 804.733604][ T13] net_ratelimit: 175 callbacks suppressed [ 804.733627][ T13] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 804.740269][T26909] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 804.754569][ C0] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 804.754684][ C0] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 804.803997][ T13] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 804.851648][T26909] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 804.863406][T18216] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 804.912560][T18216] bond8: (slave ip6gretap1): failed to get link speed/duplex [ 805.053267][T18216] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 805.117660][ T13] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 805.165907][T27444] syzkaller0: entered promiscuous mode [ 805.175114][T18211] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 805.202400][T27444] syzkaller0: entered allmulticast mode [ 805.203408][T18211] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 805.360072][T27459] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6455'. [ 805.540185][T26909] 8021q: adding VLAN 0 to HW filter on device bond0 [ 805.617551][T26909] 8021q: adding VLAN 0 to HW filter on device team0 [ 805.673919][T18208] bridge0: port 1(bridge_slave_0) entered blocking state [ 805.681181][T18208] bridge0: port 1(bridge_slave_0) entered forwarding state [ 805.734690][T18208] bridge0: port 2(bridge_slave_1) entered blocking state [ 805.742016][T18208] bridge0: port 2(bridge_slave_1) entered forwarding state [ 805.772144][T27474] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6461'. [ 805.919894][T27479] batadv_slave_0: entered promiscuous mode [ 806.076526][T27484] Bluetooth: MGMT ver 1.23 [ 806.086547][ T8528] IPVS: starting estimator thread 0... [ 806.147301][T27484] lo speed is unknown, defaulting to 1000 [ 806.192430][T27484] lo speed is unknown, defaulting to 1000 [ 806.203690][T27488] IPVS: using max 25 ests per chain, 60000 per kthread [ 806.278142][T27484] lo speed is unknown, defaulting to 1000 [ 807.551913][T26909] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 807.574517][T27484] infiniband syz0: set down [ 807.600487][T27484] infiniband syz0: added lo [ 807.611963][ T8528] lo speed is unknown, defaulting to 1000 [ 807.676777][T27484] workqueue: Failed to create a rescuer kthread for wq "ib_mad1": -EINTR [ 807.698857][T27484] infiniband syz0: Couldn't open port 1 [ 807.748834][T27484] smbdirect: ib_dev[syz0]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000 [ 807.802208][T27484] smbdirect: ib_dev[syz0]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32 [ 807.868987][T27484] smbdirect: ib_dev[syz0]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005 [ 807.931391][T27484] RDS/IB: syz0: added [ 807.940624][T27484] smc: adding ib device syz0 with port count 1 [ 807.967224][T27484] smc: ib device syz0 port 1 has no pnetid [ 807.996432][ T9] lo speed is unknown, defaulting to 1000 [ 808.020843][T27484] lo speed is unknown, defaulting to 1000 [ 808.578666][T26909] veth0_vlan: entered promiscuous mode [ 808.645010][T26909] veth1_vlan: entered promiscuous mode [ 808.752833][T26909] veth0_macvtap: entered promiscuous mode [ 808.781994][T26909] veth1_macvtap: entered promiscuous mode [ 808.847200][ T1316] ieee802154 phy0 wpan0: encryption failed: -22 [ 808.886350][T26909] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 808.987808][T26909] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 809.025267][T27484] lo speed is unknown, defaulting to 1000 [ 809.047442][T18208] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 809.074522][T18208] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 809.099927][T27595] netlink: 12 bytes leftover after parsing attributes in process `syz.5.6496'. [ 809.115988][T18211] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 809.149032][T18211] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 809.531824][T18211] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 809.580985][T18211] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 809.744865][T18216] net_ratelimit: 124 callbacks suppressed [ 809.744887][T18216] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 809.794064][ T8530] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 809.813673][T18211] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 809.863474][T18211] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 809.923530][ T13] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 809.926678][T18216] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 809.958227][ T13] bond8: (slave ip6gretap1): failed to get link speed/duplex [ 809.990250][T18216] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 810.001718][T27622] bridge_slave_0: Caught tx_queue_len zero misconfig [ 810.093828][T18211] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 810.108597][T18211] bond8: (slave ip6gretap1): failed to get link speed/duplex [ 810.253292][T18216] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 810.278500][T18216] bond8: (slave ip6gretap1): failed to get link speed/duplex [ 810.296494][T27484] lo speed is unknown, defaulting to 1000 [ 810.731966][T27648] netlink: 12 bytes leftover after parsing attributes in process `syz.7.6513'. [ 811.100794][T27484] lo speed is unknown, defaulting to 1000 [ 811.593792][ T5652] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 811.625146][ T5652] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 811.635521][ T5652] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 811.647657][ T5652] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 811.669221][ T5652] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 812.033209][ C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 812.034593][ C1] bridge0: port 1(veth1_to_bridge) entered forwarding state [ 812.048277][ C1] bridge0: topology change detected, propagating [ 812.304710][T27699] netlink: 16 bytes leftover after parsing attributes in process `syz.4.6528'. [ 812.401741][T27484] lo speed is unknown, defaulting to 1000 [ 812.784626][T27710] syzkaller0: entered promiscuous mode [ 812.813926][T27710] syzkaller0: entered allmulticast mode [ 813.242086][T27729] netlink: 16 bytes leftover after parsing attributes in process `syz.4.6539'. [ 813.284708][T27733] netlink: 'syz.7.6540': attribute type 3 has an invalid length. [ 813.455569][T27671] lo speed is unknown, defaulting to 1000 [ 813.713990][ T5652] Bluetooth: hci2: command tx timeout [ 813.970286][ T30] INFO: task syz.6.5042:23058 blocked for more than 143 seconds. [ 813.981181][ T30] Not tainted syzkaller #0 [ 813.987440][ T30] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 814.006922][ T30] task:syz.6.5042 state:D stack:26584 pid:23058 tgid:23056 ppid:18152 task_flags:0x400040 flags:0x00080002 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 814.031872][ T30] Call Trace: [ 814.042803][ T30] [ 814.049342][ T30] __schedule+0x1821/0x5740 [ 814.058906][ T30] ? __lock_acquire+0x6b5/0x2cf0 [ 814.070432][ T30] ? __pfx___schedule+0x10/0x10 [ 814.082661][ T30] ? schedule+0x90/0x360 [ 814.107295][ T30] schedule+0x164/0x360 [ 814.127012][ T30] schedule_preempt_disabled+0x13/0x30 [ 814.155807][ T30] __mutex_lock+0x7f7/0x1550 [ 814.176055][ T30] ? __mutex_lock+0x608/0x1550 [ 814.207605][ T30] ? nfsd_nl_version_get_doit+0x17c/0xc40 [ 814.247477][ T30] ? __pfx___mutex_lock+0x10/0x10 [ 814.279338][ T30] ? __nlmsg_put+0xef/0x1b0 [ 814.284440][ T30] ? genlmsg_put+0x137/0x2e0 [ 814.295330][ T30] nfsd_nl_version_get_doit+0x17c/0xc40 [ 814.304587][ T30] ? __nla_parse+0x40/0x60 [ 814.309100][ T30] ? __pfx_nfsd_nl_version_get_doit+0x10/0x10 [ 814.317668][ T30] ? genl_family_rcv_msg_attrs_parse+0x20b/0x2f0 [ 814.326764][ T30] ? genl_family_rcv_msg_attrs_parse+0x265/0x2f0 [ 814.335076][ T30] genl_family_rcv_msg_doit+0x22a/0x330 [ 814.340664][ T30] ? __asan_memcpy+0x40/0x70 [ 814.346619][ T30] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 814.352792][ T30] genl_rcv_msg+0x61c/0x7a0 [ 814.357591][ T30] ? __pfx_genl_rcv_msg+0x10/0x10 [ 814.362700][ T30] ? __pfx_nfsd_nl_version_get_doit+0x10/0x10 [ 814.369295][ T30] ? __pfx_ref_tracker_free+0x10/0x10 [ 814.374930][ T30] netlink_rcv_skb+0x232/0x4b0 [ 814.379855][ T30] ? __pfx_genl_rcv_msg+0x10/0x10 [ 814.385098][ T30] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 814.390452][ T30] ? down_read+0x270/0x2e0 [ 814.395192][ T30] ? genl_rcv+0xd/0x40 [ 814.399286][ T30] genl_rcv+0x28/0x40 [ 814.403693][ T30] netlink_unicast+0x75c/0x8e0 [ 814.408540][ T30] netlink_sendmsg+0x813/0xb40 [ 814.413525][ T30] ? __pfx_netlink_sendmsg+0x10/0x10 [ 814.418983][ T30] ? aa_sock_msg_perm+0xf1/0x1b0 [ 814.424409][ T30] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 814.429755][ T30] ____sys_sendmsg+0x972/0x9f0 [ 814.437041][ T30] ? __might_fault+0xaf/0x130 [ 814.441832][ T30] ? __pfx_____sys_sendmsg+0x10/0x10 [ 814.447302][ T30] ? import_iovec+0x73/0xa0 [ 814.451850][ T30] ___sys_sendmsg+0x2a5/0x360 [ 814.457427][ T30] ? __lock_acquire+0x6b5/0x2cf0 [ 814.462569][ T30] ? __pfx____sys_sendmsg+0x10/0x10 [ 814.468009][ T30] ? futex_wake+0x4ac/0x580 [ 814.472586][ T30] ? __fget_files+0x2a/0x420 [ 814.477442][ T30] ? __fget_files+0x3a0/0x420 [ 814.482171][ T30] __x64_sys_sendmsg+0x1bd/0x2a0 [ 814.487427][ T30] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 814.493079][ T30] ? rcu_is_watching+0x15/0xb0 [ 814.497904][ T30] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 814.504150][ T30] do_syscall_64+0x174/0xf80 [ 814.508796][ T30] ? trace_irq_disable+0x3b/0x140 [ 814.514801][ T30] ? clear_bhb_loop+0x40/0x90 [ 814.519546][ T30] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 814.527975][ T30] RIP: 0033:0x7fb29919ce59 [ 814.532454][ T30] RSP: 002b:00007fb29a033028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 814.541935][ T30] RAX: ffffffffffffffda RBX: 00007fb299415fa0 RCX: 00007fb29919ce59 [ 814.550550][ T30] RDX: 0000000020000000 RSI: 0000200000000140 RDI: 0000000000000005 [ 814.558855][ T30] RBP: 00007fb299232d6f R08: 0000000000000000 R09: 0000000000000000 [ 814.568085][ T30] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 814.576592][ T30] R13: 00007fb299416038 R14: 00007fb299415fa0 R15: 00007ffd5d799008 [ 814.584960][ T30] [ 814.588148][ T30] [ 814.588148][ T30] Showing all locks held in the system: [ 814.598322][ T30] 1 lock held by rcu_exp_gp_kthr/18: [ 814.603924][ T30] #0: ffff8880b863aee0 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x31/0x150 [ 814.614416][ T30] 1 lock held by khungtaskd/30: [ 814.619296][ T30] #0: ffffffff8e95cca0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 814.629786][ T30] 2 locks held by getty/5396: [ 814.634841][ T30] #0: ffff888031e660a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 814.646287][ T30] #1: ffffc900032332e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45c/0x13a0 [ 814.666858][T27484] lo speed is unknown, defaulting to 1000 [ 814.693039][ T30] 3 locks held by kworker/u9:5/5652: [ 814.703515][ T30] #0: ffff8880387fc140 ((wq_completion)hci1){+.+.}-{0:0}, at: process_scheduled_works+0xa35/0x1860 [ 814.733259][ T30] #1: ffffc90003b3fc40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa70/0x1860 [ 814.752466][ T30] #2: ffff888053adcea0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x1d3/0x400 [ 814.753514][ T10] net_ratelimit: 112 callbacks suppressed [ 814.753528][ T10] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 814.765265][ T30] 2 locks held by syz.2.3446/17623: [ 814.783782][ T3393] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 814.810162][ T30] #0: ffffffff8fe36f88 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 814.819035][ T30] #1: ffffffff8ec8b0e0 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_nl_listener_set_doit+0x141/0x1670 [ 814.823071][ T3393] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 814.829836][ T30] 2 locks held by syz.6.5042/23058: [ 814.865198][ T30] #0: ffffffff8fe36f88 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 814.873945][ T30] #1: ffffffff8ec8b0e0 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_nl_version_get_doit+0x17c/0xc40 [ 814.874910][ T13] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 814.885054][ T30] 6 locks held by syz.0.6465/27484: [ 814.898856][ T30] 1 lock held by syz-executor/27671: [ 814.905497][ T30] #0: ffffffff8fdb8928 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x4f7/0x730 [ 814.916110][ T30] 1 lock held by syz.4.6553/27762: [ 814.921291][ T30] #0: ffffffff8e962fa8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x38d/0x770 [ 814.932426][ T13] bond8: (slave ip6gretap1): failed to get link speed/duplex [ 814.941491][ T30] [ 814.945111][ T30] ============================================= [ 814.945111][ T30] [ 814.955407][ T30] NMI backtrace for cpu 0 [ 814.955428][ T30] CPU: 0 UID: 0 PID: 30 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 814.955449][ T30] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 814.955460][ T30] Call Trace: [ 814.955469][ T30] [ 814.955478][ T30] dump_stack_lvl+0xe8/0x150 [ 814.955507][ T30] nmi_cpu_backtrace+0x274/0x2d0 [ 814.955532][ T30] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 814.955556][ T30] nmi_trigger_cpumask_backtrace+0x17a/0x300 [ 814.955583][ T30] sys_info+0x135/0x170 [ 814.955602][ T30] watchdog+0xfd3/0x1030 [ 814.955638][ T30] ? watchdog+0x1c9/0x1030 [ 814.955671][ T30] kthread+0x389/0x470 [ 814.955697][ T30] ? __pfx_watchdog+0x10/0x10 [ 814.955722][ T30] ? __pfx_kthread+0x10/0x10 [ 814.955748][ T30] ret_from_fork+0x514/0xb70 [ 814.955771][ T30] ? __pfx_ret_from_fork+0x10/0x10 [ 814.955791][ T30] ? __switch_to+0xc79/0x1410 [ 814.955821][ T30] ? __pfx_kthread+0x10/0x10 [ 814.955847][ T30] ret_from_fork_asm+0x1a/0x30 [ 814.955887][ T30] [ 814.955895][ T30] Sending NMI from CPU 0 to CPUs 1: [ 815.043937][ T13] bond8: (slave ip6gretap1): link status up, enabling it in 0 ms [ 815.046546][ C1] NMI backtrace for cpu 1 [ 815.046573][ C1] CPU: 1 UID: 0 PID: 13 Comm: kworker/u8:1 Not tainted syzkaller #0 PREEMPT(full) [ 815.046592][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 815.046602][ C1] Workqueue: bond8 bond_mii_monitor [ 815.046625][ C1] RIP: 0010:io_serial_out+0x7c/0xc0 [ 815.046649][ C1] Code: 04 81 fc 44 89 f9 d3 e5 49 83 c6 40 4c 89 f0 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 f7 e8 ec 56 ec fc 41 03 2e 89 d8 89 ea ee <5b> 41 5c 41 5e 41 5f 5d c3 cc cc cc cc cc 44 89 f9 80 e1 07 38 c1 [ 815.046662][ C1] RSP: 0018:ffffc900001271f0 EFLAGS: 00000002 [ 815.046676][ C1] RAX: 0000000000000035 RBX: 0000000000000035 RCX: 0000000000000000 [ 815.046687][ C1] RDX: 00000000000003f8 RSI: 0000000000000000 RDI: 0000000000000020 [ 815.046697][ C1] RBP: 00000000000003f8 R08: ffff888025c50237 R09: 1ffff11004b8a046 [ 815.046708][ C1] R10: dffffc0000000000 R11: ffffffff8544c1e0 R12: dffffc0000000000 [ 815.046719][ C1] R13: ffffffff9a4759a9 R14: ffffffff9a78bac0 R15: 0000000000000000 [ 815.046730][ C1] FS: 0000000000000000(0000) GS:ffff8881253a1000(0000) knlGS:0000000000000000 [ 815.046742][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 815.046753][ C1] CR2: 000055ed71f61ee8 CR3: 0000000079110000 CR4: 00000000003526f0 [ 815.046770][ C1] Call Trace: [ 815.046777][ C1] [ 815.046786][ C1] serial8250_console_write+0x140c/0x1ba0 [ 815.046816][ C1] ? __pfx_serial8250_console_write+0x10/0x10 [ 815.046836][ C1] ? console_flush_all+0x123/0xb20 [ 815.046861][ C1] ? do_raw_spin_unlock+0xf5/0x210 [ 815.046882][ C1] ? console_flush_all+0x123/0xb20 [ 815.046902][ C1] console_flush_all+0x718/0xb20 [ 815.046923][ C1] ? console_flush_all+0x123/0xb20 [ 815.046946][ C1] ? __pfx_console_flush_all+0x10/0x10 [ 815.046967][ C1] ? is_printk_cpu_sync_owner+0x32/0x40 [ 815.046990][ C1] console_unlock+0xd1/0x1c0 [ 815.047008][ C1] ? vprintk_emit+0x2cf/0x560 [ 815.047026][ C1] ? __pfx_console_unlock+0x10/0x10 [ 815.047044][ C1] ? vprintk_emit+0x200/0x560 [ 815.047062][ C1] ? vprintk_emit+0x455/0x560 [ 815.047080][ C1] ? vprintk_emit+0x2cf/0x560 [ 815.047097][ C1] ? vprintk_emit+0x2cf/0x560 [ 815.047115][ C1] vprintk_emit+0x485/0x560 [ 815.047135][ C1] ? __pfx_vprintk_emit+0x10/0x10 [ 815.047152][ C1] ? __lock_acquire+0x6b5/0x2cf0 [ 815.047171][ C1] _printk+0xdd/0x130 [ 815.047194][ C1] ? __pfx__printk+0x10/0x10 [ 815.047213][ C1] ? __lock_acquire+0x6b5/0x2cf0 [ 815.047229][ C1] ? __netdev_printk+0x36f/0x480 [ 815.047249][ C1] netdev_info+0x11e/0x180 [ 815.047271][ C1] ? __pfx_netdev_info+0x10/0x10 [ 815.047290][ C1] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 815.047317][ C1] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 815.047337][ C1] ? ___ratelimit+0x58c/0x8d0 [ 815.047359][ C1] bond_mii_monitor+0xb76/0x2fd0 [ 815.047378][ C1] ? bond_mii_monitor+0x167/0x2fd0 [ 815.047397][ C1] ? __pfx_bond_mii_monitor+0x10/0x10 [ 815.047416][ C1] ? do_raw_spin_lock+0x12b/0x2f0 [ 815.047434][ C1] ? lock_acquire+0x106/0x350 [ 815.047450][ C1] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 815.047472][ C1] ? process_scheduled_works+0xa70/0x1860 [ 815.047488][ C1] ? process_scheduled_works+0xa70/0x1860 [ 815.047507][ C1] ? process_scheduled_works+0xa70/0x1860 [ 815.047521][ C1] ? process_scheduled_works+0xa70/0x1860 [ 815.047537][ C1] process_scheduled_works+0xb5d/0x1860 [ 815.047566][ C1] ? __pfx_process_scheduled_works+0x10/0x10 [ 815.047585][ C1] ? assign_work+0x3d5/0x5e0 [ 815.047601][ C1] worker_thread+0xa53/0xfc0 [ 815.047631][ C1] kthread+0x389/0x470 [ 815.047650][ C1] ? __pfx_worker_thread+0x10/0x10 [ 815.047664][ C1] ? __pfx_kthread+0x10/0x10 [ 815.047683][ C1] ret_from_fork+0x514/0xb70 [ 815.047700][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 815.047716][ C1] ? __switch_to+0xc79/0x1410 [ 815.047738][ C1] ? __pfx_kthread+0x10/0x10 [ 815.047756][ C1] ret_from_fork_asm+0x1a/0x30 [ 815.047782][ C1] [ 815.230420][ T30] Kernel panic - not syncing: hung_task: blocked tasks [ 815.230443][ T30] CPU: 0 UID: 0 PID: 30 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 815.230463][ T30] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 815.230474][ T30] Call Trace: [ 815.230482][ T30] [ 815.230490][ T30] vpanic+0x56c/0xa60 [ 815.230517][ T30] ? __pfx___schedule+0x10/0x10 [ 815.230543][ T30] ? __pfx_vpanic+0x10/0x10 [ 815.230572][ T30] panic+0xc5/0xd0 [ 815.230592][ T30] ? __pfx_panic+0x10/0x10 [ 815.230613][ T30] ? preempt_schedule_thunk+0x16/0x30 [ 815.230643][ T30] ? nmi_trigger_cpumask_backtrace+0x2bb/0x300 [ 815.230669][ T30] watchdog+0x102c/0x1030 [ 815.230701][ T30] ? watchdog+0x1c9/0x1030 [ 815.230730][ T30] kthread+0x389/0x470 [ 815.230753][ T30] ? __pfx_watchdog+0x10/0x10 [ 815.230775][ T30] ? __pfx_kthread+0x10/0x10 [ 815.230798][ T30] ret_from_fork+0x514/0xb70 [ 815.230820][ T30] ? __pfx_ret_from_fork+0x10/0x10 [ 815.230839][ T30] ? __switch_to+0xc79/0x1410 [ 815.230867][ T30] ? __pfx_kthread+0x10/0x10 [ 815.230890][ T30] ret_from_fork_asm+0x1a/0x30 [ 815.230926][ T30] [ 815.233377][ T30] Kernel Offset: disabled