last executing test programs: 2.780008746s ago: executing program 1 (id=1292): r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000004c0)={{{@in=@multicast1, @in=@broadcast, 0x0, 0x8001, 0x0, 0x0, 0xa, 0x0, 0x0, 0x4f}, {0x0, 0x0, 0x0, 0x800, 0x7}, {0x0, 0x0, 0xe6}, 0x0, 0x0, 0x0, 0x0, 0x2}, {{@in=@remote, 0x404d3, 0x2b}, 0x0, @in=@empty}}, 0xe8) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000940)={0x3, 0x4, &(0x7f0000000000)=@framed={{0x18, 0x2, 0x0, 0x0, 0xcd83, 0x0, 0x0, 0x0, 0xfffdfffd}, [@call={0x85, 0x0, 0x0, 0x28}]}, &(0x7f0000000900)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x8, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xa}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r1, 0x0, 0xe, 0x0, &(0x7f0000000100)="e09f547ed3f02dc1fd3d6487775b", 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r2 = socket$key(0xf, 0x3, 0x2) setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=ANY=[@ANYBLOB="020b000102"], 0x10}}, 0x0) sendmsg$key(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="0212000002"], 0x10}}, 0x0) close(r0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000380)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc000000000000000100000000000000ac1e000100000000000000000000000000000000000000000a0060"], 0xb8}}, 0x20040014) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0x2, 0x0, 0x25dfdbfe, {{@in6=@private0, @in=@multicast1, 0x0, 0x4, 0x0, 0x0, 0xa, 0x60, 0x80, 0x3b, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x4, 0xfffffffffffffffd}, {0xfffffffffffffffe, 0x4}, 0x9, 0x0, 0x0, 0x0, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x50) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0xcb23c9c9931e99e9, 0x0, 0x25dfdbfc, {{@in6=@private0, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa, 0x40, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0xaa3, 0xfffffffffffffff8, 0x4}, {0x0, 0x8}}}, 0xb8}}, 0x0) 2.720963018s ago: executing program 4 (id=1294): sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="6800000042000100000000000000000003010000060000002600010000112233445566778899aabb0200000088a80000000001170000010203040100070800000c0002000600"], 0x68}, 0x1, 0x0, 0x0, 0x880}, 0x20000400) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xe, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r2], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x59, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r3, 0x2000002, 0xe, 0xa00, &(0x7f0000000200)="df12c9f7b9a60000000000000000", 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) 2.675023589s ago: executing program 1 (id=1295): syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) socket$netlink(0x10, 0x3, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=@newlink={0x44, 0x10, 0x503, 0xffffffff, 0x0, {0x0, 0x0, 0x0, 0x0, 0x115, 0x10000}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bond={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BOND_MIIMON={0x8, 0x3, 0xce9}, @IFLA_BOND_ARP_VALIDATE={0x8, 0x9, 0x3}]}}}]}, 0x44}}, 0x28000000) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), r1) sendmsg$NLBL_MGMT_C_ADDDEF(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000480)={0x1c, r2, 0x1, 0x0, 0xfffffffe, {}, [@NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x5}]}, 0x1c}}, 0x0) syz_genetlink_get_family_id$net_dm(&(0x7f0000000280), r1) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240), 0xc0802, 0x0) unshare(0x20040600) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$smc(&(0x7f0000000100), r4) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000001880)=ANY=[], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10, 0xffffffffffffffff}, 0x94) sendmsg$SMC_PNETID_ADD(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000004c0)=ANY=[@ANYBLOB="303def085604f48847f6f518d4fefa62cc92d50a844b1b6de07969d71d7864aec11f328d1c82a19619f444ce3051587409c3f7ff3b7c52a3beb9eec98e8fe93e0fbd3dd6210af957769b4bc63782e743b45276dd947ae9f80684221ef8db047b5016d086b1007a1b31f66be5ac0354b27ed93e6a17af8369919a27b09fb2243c258986bfdf542ebafe251e422f102fbd0c", @ANYRES16=r5, @ANYBLOB="01000000000000000000020000000900010073797a3000000000140002006c6f00"/46], 0x34}}, 0x0) sendmsg$SMC_PNETID_DEL(r0, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f00000001c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="1c002000", @ANYRES16=r5, @ANYRES16=0x0], 0x1c}, 0x1, 0x0, 0x0, 0x20000890}, 0x40010) ioctl$PPPIOCNEWUNIT(r3, 0xc004743e, &(0x7f00000000c0)=0x1) ioctl$PPPIOCGNPMODE(r3, 0x4004743c, 0x0) sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000340)=0x14) socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet6_udp(0xa, 0x2, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000080)={'bridge0\x00'}) r7 = socket$kcm(0x1e, 0x4, 0x0) setsockopt$sock_attach_bpf(r7, 0x10f, 0x87, &(0x7f00000008c0), 0x43) unshare(0x0) r8 = socket$kcm(0x1e, 0x4, 0x0) setsockopt$sock_attach_bpf(r8, 0x10f, 0x87, &(0x7f00000008c0), 0x43) close(r8) 2.576635471s ago: executing program 2 (id=1296): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000040)={0x3, &(0x7f0000000140)=[{0x1d, 0x1, 0x1, 0x7ffff00c}, {0x28, 0x0, 0x0, 0xffffefff}, {0x6}]}, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$team(&(0x7f0000000040), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_team(r3, 0x8933, &(0x7f0000004700)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f0000000800)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="08020000", @ANYRES16=r2, @ANYBLOB="010026bd7000fcdbdf250100000008000100", @ANYRES32=r4, @ANYBLOB="a801028040000100240001006c625f706f72745f737461747300000000000000000000000000000000000000050003000b"], 0x208}, 0x1, 0x0, 0x0, 0x10}, 0x40) r5 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000400)={&(0x7f0000000240)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xa0, 0xa0, 0x5, [@type_tag={0x1, 0x0, 0x0, 0x12, 0x3}, @restrict={0x9, 0x0, 0x0, 0xb, 0x5}, @var={0xe, 0x0, 0x0, 0xe, 0x3, 0x2}, @func_proto={0x0, 0x6, 0x0, 0xd, 0x0, [{0x1, 0x1}, {0x5, 0x4}, {0x1, 0x3}, {0x1, 0x5}, {0x9}, {0x9, 0x5}]}, @ptr={0xb, 0x0, 0x0, 0x2, 0x4}, @typedef={0x3, 0x0, 0x0, 0x8, 0x2}, @ptr, @union={0x0, 0x1, 0x0, 0x5, 0x1, 0x3, [{0x0, 0x2, 0x401}]}]}, {0x0, [0x30, 0x2e, 0x2e]}}, &(0x7f0000000300)=""/242, 0xbd, 0xf2, 0x0, 0x8}, 0x28) bpf$MAP_CREATE(0x0, &(0x7f0000000440)=@bloom_filter={0x1e, 0x8000, 0x0, 0x1, 0x10, 0xffffffffffffffff, 0x1, '\x00', r4, r5, 0x3, 0x0, 0x3, 0x9}, 0x50) getpeername(r0, &(0x7f0000000080)=@hci, &(0x7f0000000100)=0x80) 2.247431901s ago: executing program 2 (id=1297): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000700)=ANY=[@ANYBLOB="14000000109747b566a1f91a0d4300010000000000000000000700000a20000000000a0103000060ee257e0000010000000900010073797a310000000030000000030a01020000000000000000010000000900030073797a3200000000040004800900010073797a310000000044000000050a01020000000000000000010020000c00024000000000000000010900010073797a3100000000180004801400030076657468315f6d6163767461700000001400000011000100000000"], 0xbc}, 0x1, 0x0, 0x0, 0x40000}, 0x0) getsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000000080)={0x0, 0x7, 0x2, [0x2, 0xffff]}, &(0x7f00000000c0)=0xc) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000180)={r1, 0x74, &(0x7f0000000100)=[@in6={0xa, 0x4e24, 0x7, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x3}, @in6={0xa, 0x4e23, 0x6, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x8001}, @in={0x2, 0x4e22, @multicast1}, @in={0x2, 0x4e21, @multicast2}, @in6={0xa, 0x4e21, 0x2, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x10001}]}, &(0x7f00000001c0)=0x10) 2.213012423s ago: executing program 1 (id=1298): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000700)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x7}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x301, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}]}, @NFT_MSG_NEWCHAIN={0x30, 0x3, 0xa, 0x201, 0x0, 0x4000000, {0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}, @NFTA_CHAIN_HOOK={0x4}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}]}, @NFT_MSG_DELCHAIN={0x44, 0x5, 0xa, 0x201, 0x0, 0x0, {0x1, 0x0, 0x2000}, [@NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x1}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_HOOK={0x18, 0x4, 0x0, 0x1, [@NFTA_HOOK_DEV={0x14, 0x3, 'veth1_macvtap\x00'}]}]}], {0x14}}, 0xbc}}, 0x0) 2.195340704s ago: executing program 2 (id=1299): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$sock_SIOCSPGRP(r3, 0x8902, &(0x7f0000000200)) ioctl$sock_FIOGETOWN(r3, 0x8903, &(0x7f0000002800)) r4 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@newqdisc={0x88, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0xffff}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0xa, [0x0, 0x0, 0x7], 0x0, [0x1, 0x2, 0xfffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5c4, 0x8000, 0x0, 0x0, 0x3dc], [0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000]}}}}]}, 0x88}}, 0x20000000) 1.968113176s ago: executing program 1 (id=1301): r0 = socket(0x10, 0x2, 0x0) sendmsg$nl_route(r0, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) getsockname$packet(r0, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0x14) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000100)=ANY=[@ANYBLOB="4000000010003904000000000000000080040000", @ANYRES32=r1, @ANYBLOB="01980000000000002000128008000100736974001400028006000e000600000008000100", @ANYRES32], 0x40}, 0x1, 0x0, 0x0, 0x80}, 0x0) (async) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000100)=ANY=[@ANYBLOB="4000000010003904000000000000000080040000", @ANYRES32=r1, @ANYBLOB="01980000000000002000128008000100736974001400028006000e000600000008000100", @ANYRES32], 0x40}, 0x1, 0x0, 0x0, 0x80}, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, 0x0, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) (async) r2 = socket$inet_sctp(0x2, 0x1, 0x84) writev(0xffffffffffffffff, 0x0, 0x0) (async) writev(0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(r2, 0x84, 0xd, &(0x7f0000000000)=@assoc_value, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x85, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(r0, 0x84, 0x73, 0x0, &(0x7f00000000c0)) (async) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(r0, 0x84, 0x73, 0x0, &(0x7f00000000c0)) socket$nl_xfrm(0x10, 0x3, 0x6) r3 = socket(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="5c00000012006bab9a3fe3d86e17aa0b046b876c1d0048380019000800004460bc06000000a701251e6182949a3651fbffffffd4d4938037e7c7a0a03400ac09c51c268811000096859fc57a00000000000000002571cd53b9851b30", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x8000) recvmsg$kcm(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000000100)=""/53, 0x35}, {&(0x7f0000000400)=""/206, 0xce}, {&(0x7f0000003980)=""/4088, 0xff8}, {&(0x7f0000000500)=""/116, 0x74}, {&(0x7f0000002980)=""/4090, 0xffa}, {&(0x7f00000007c0)=""/112, 0x70}, {&(0x7f0000000200)=""/24, 0x18}, {&(0x7f0000000580)=""/89, 0x59}], 0x8}, 0x12000) r5 = socket(0x9, 0x800, 0x100002) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r5) (async) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r5) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) sendmsg$nl_route_sched(r3, &(0x7f0000005840)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000300)=@newqdisc={0x48, 0x24, 0x8, 0x0, 0x2, {0x0, 0x0, 0x0, r6, {}, {0xffff, 0xffff}, {0x1}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x7fffffff, 0x1}}]}}]}, 0x48}}, 0x8d0) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r7, 0x29, 0x1a, &(0x7f0000000080)=0x2, 0x4) bind$inet6(r7, &(0x7f0000000540)={0xa, 0x4e22, 0x7, @empty, 0x200}, 0x1c) listen(r7, 0x0) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r8, &(0x7f00000000c0)={0xa, 0x6e22, 0x40000000, @ipv4={'\x00', '\xff\xff', @empty}, 0x20007}, 0x1c) (async) bind$inet6(r8, &(0x7f00000000c0)={0xa, 0x6e22, 0x40000000, @ipv4={'\x00', '\xff\xff', @empty}, 0x20007}, 0x1c) listen(r8, 0x0) (async) listen(r8, 0x0) r9 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(r9, 0x4058587a, &(0x7f0000000480)={{r2, &(0x7f0000000180)=')\x00', 0x100, &(0x7f0000000200)={@align=0x80000000, {0x5, 0x6, 0xc3}}, 0x3, &(0x7f0000000240)={@_ha_fsid}, &(0x7f0000000280)=0xffffffc8}, {[0xad, 0x5]}, 0x4, 0x7c, &(0x7f0000000400)=""/124}) (async) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(r9, 0x4058587a, &(0x7f0000000480)={{r2, &(0x7f0000000180)=')\x00', 0x100, &(0x7f0000000200)={@align=0x80000000, {0x5, 0x6, 0xc3}}, 0x3, &(0x7f0000000240)={@_ha_fsid}, &(0x7f0000000280)=0xffffffc8}, {[0xad, 0x5]}, 0x4, 0x7c, &(0x7f0000000400)=""/124}) 1.846338217s ago: executing program 2 (id=1303): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0xd, &(0x7f0000000580)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000610000008500000007000000180100002025642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000005000000b703000089cdc832850000000600000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1b, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) r3 = socket$igmp(0x2, 0x3, 0x2) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000140), 0xffffffffffffffff) syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), r4) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000240)={'wlan1\x00'}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000180)={'netdevsim0\x00', 0x0}) sendmsg$nl_xfrm(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000800)=ANY=[@ANYBLOB="00395c0100001a00130700000000ffdbdf25fe8000000000000000000000000000bbfe880000000000000000000000000101000400004e21000200000027210000000b736ea24d453c47faccebd6f70557ef68ed44ed9db8c804cde9556346f1f8e56af677943e2454ce945ff588c4686ea9948032dc19e7386795f58c4adcf42147d58774b3b3ed5c361550cb12acc58e023b34cb7f53d8a2bf235b6a7b8382fcbaf3f87ea05cc1fc53b6b6883150b3a703329e9e3c79ec298f1b471c361338ebc2995e793effe9be9f179f4365c98acc3002879000619096038aca7f19879cd3e099abfe781d440d421ce8f47caeb8984f1f13390f17507c883d6c16e4191512d77493a31edf0d7e240a39bcf5b1315733db03b30d", @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ac1414aa000000000000000000000000000004d232000000ac141438000000000000000000000000050000000000000000000000000000000000000000000000090000000000000001000000ffffffff0000000000000000010000800000000043050000000000000400000000000000ffffffffffffff7f000100000000000001000000000000000000000000000000000000002cbd7000053500000a000400540000000000000060001200726663343130362867636d2861657329290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000000080000000210466d38547aa140db9a200000000c538c7cb7a0c001c00", @ANYRES32=r5, @ANYBLOB="03000000"], 0x15c}, 0x1, 0x0, 0x0, 0x880}, 0x2014) r6 = socket(0x10, 0x803, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001a00)={0x18, 0x26, 0x301, 0x270bd24, 0x25dfdbff, {0x1}, [@nested={0x4, 0x166}]}, 0x18}, 0x1, 0x0, 0x0, 0x4008}, 0x0) sendmsg$IPVS_CMD_SET_INFO(r6, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYRESDEC=r3, @ANYRES32=r8, @ANYRES64=r8], 0x3c}, 0x1, 0x0, 0x0, 0xc0d9}, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000004c0)=ANY=[@ANYBLOB="9400000010001fff26bd70008000000000000000", @ANYRES32=0x0, @ANYBLOB="05160000740f0000140012800b00010067726574617000000400028008000a00", @ANYRES32=r8, @ANYBLOB="240024009a72dff18fcb62e5d231adfd8edf2a1ee10405947c1a0f639586af195b7fb36bca607d246fa121fbb228d1425e08001c00", @ANYRES32, @ANYBLOB="0800040000000000240012800b000100697036677265000014000280060011004e23000008000c000e000008"], 0x94}}, 0x4000) ioctl$BTRFS_IOC_SUBVOL_CREATE(r0, 0x5000940e, &(0x7f0000000b40)={{r6}, "03f935c9c7de20775407264a4b20d5236eb6e604a000e1596868db153bc1375620e639022291c33527d167931a2683b4253b3ea91f61550cb1e0347bf9e87a10ee1541588205ad888a7a1a5d3e0b64ea0e928af1b383bb7f102a29f436b05dbb79d12502de20f40dc969b00f820550f8bbb311bca6ae6e863bbfcd7440385e8c7d5c243b62c93511869a8593731dc339ac7b5416ef235db0975f13efb241bd7df82ad4fc4a4ce2289135746157e70876817b4181b7c7ad849aa1ce86ca0b05efe982051b0840764c12b967cd77a80adc33dbed3b52c68c9ece43889f88e87b3da8e4dda5d1e8f058846cbcbae7df8f5f45237df05d8c08603074e8b569c031b4c75327eca3872c4a66a93aefd9c2c71c34e7859ca6d2aed62d6e39ed9c41ea4f0ee5925ed870a1b6e3a18b36192661152fe25b96b0587fd76b3fe6cf0dd518e5c314641ea06fbf4e7539a486451e229527c7d210091da0edfbed9cf6bbcdc93ef99d92aa9a45d785450cd55c6f7977ef01b711569b31128ecaed4d7c135f7f1d130daf9247ba6270faf1b7780cf6c704665a2c239e065c40f7b08682699702a4ef50716cd57c520a1ffa7ecfe726d6e65ebf70c464e63d017bc1bee79da0bef941d5536b66096470b8494fd440b66b9f3365016715ee1b1972365669723a819267606ad2ac6cd18c98d87b55ba39ce19a72f72a805630f68e50812cd8572187cfe902ad4b606c0881b3d13008482b0f5498beb1ed0871a04dcc89329536be5fc42c7d24dfadbd151bf1a0c9560c39157ebe27cdfc915dd2f6dd95e1e97d4f9e3f6c301aa457ffbbf87e54095b45c0bcef0729b19b9f05701928c28779d4df9268e5d9199ef2a95f5f52238e81791f137f4dfa132aa7b9f40ee2121101ea7cf97d53bba34e75e67395f328167a39614a55952b7cef39dc713512e6cb0608707b61aa7b3af284c8fe6ba110dc48ecd811037794125ef90fb633548eeb57f45e14fb884c14fe459f4076b2cd040edee997aad5392f919d48fa03085be900c9f42e8fc58a164304affa2b3f8cac98635742e0dbb765af6091c68ecabc82e9678b7c7437c2bbdf4e88ca09d5a6a6ab48ee99af83f12e19c638b5a2ae9c4dd0b89719a784fa7f45e46d32cbe43960ad25e4719d72f032513877a9f9448b9957ddb003a3bc9874ec8b96e619b2a9446fe27333e0674b35e364ddf2b346f9aaa55e610d222175f3fa1e63bbdabcd7c023a64692d0d14f9386c9d00c2642e0fd42902e0ff1d873e79a24b3182e279573b377fbdfe7a31d16a8c6636d27946018f3dbb7bd8b9be70583eb2ec3d4df5b5b2cf831c2e7eecb8bdcdc9398ad45708c992580c7aadc924db6bc716416f0aa55e2ef734e307cada5d81f6e7bff4b8a9e3a06c0cac875ce5dab47c458a91e7fdcb87d4a3a843297c3f6a8c8af752397b336189da637e7f284bd648143b626a7bb0546c5f1686b44090a432e908615c41080a73882a704baa78eb00d443a479be05937729a5ff79b7bde37a5f466315ad094554f0ae794202af91e41412780f9d74ce4bf5a869ae718db1d722546aaef71ab917a331ce31496965f6d6fa69486f1e2d05db5a5e0e362fc6bbeb17853ff7cf6d2060acf5df61f4133deebfdd70c37097bb59cbe19966078f807b9f5c4197ee0f3062b4c27bdb16e98826bdb7badbb6eb498a6c4a55d82a4895b47eca766d52ffc8a9ab8b0f86a7e762be2ead0c40205a8390015a4ffbcf570a080462901bc305fe8e0a1ec1ffc1bce93047f1761f4c7ab41165fe3f2bd9777c9096b8fe985d528e8abe50f7d9a48cf973450960fe0a01e29911dcc0a518dcd2ac4984511ffbf635bc189a480424e998395534319c2ef6a3ed357e0245c44c7ba104c8630acba4d66026fda0dee807e31c133e2ddf333eb982fe6aef9df8b9ad4d00be413e33ec85133924956b65753e77c0aed519aca8a2b19c71e012e5cdf05100e42d267ba89e9f54aa050394769ae8aa5b1c49c92db53938dcf804757c8ddd83079705404c98f5959569e72ec1fde216c9f1879615436e692875da1264c9b45b2d5265319dfb1cac84a9957a108352604c4679a7b668f6b6c08547f245e725225dbde06a223b83ad8899c89e1b898deb7db9cc5343c3fc083cef2c8b28f3bbaa8df3055d08f68ccb246f98698c63bade8c6db067e16ebc08ab09b4a66ec684489d122a91620d5d47db019c10e0f2131b5429af4ef22a19c4e274a5861bd1582e0dde153c9b0250759163ddfa41920532ecc52e919f487ea35079e0487492da6f4db96140bc191c017e933b7341cee9b06a39f192a04b9b9aed64250f985f46d91cf0dd231f30cd21e81c59fde6a133f67aa233b9f2d2439fce61c2e60fd6e04cbf08258e1d1e64b27bdea8965a909f5593a50bd48c41405f4306f69905e4524cc5c00b40adb9743d9a71df3f093ac31da49d71923679557abbbad95b35fc9bd89f4315e7c71715eb96217a5a3033a70293202d78267b076447eea1581e9628ea2c15a7db83a577bf84170615134fb1736468aaf0a69262d720fd99e0ff40e28454f9bfb0308b1a481731b19b092df53254de328414f20eb896d6d0f31be9f775ac70edb54c80353786e136626f4b184aa42d2a8ff1ac684fb5bc3c5476d128bd31852380202906cf9b291e6c42e8d8e4d04cc36223562bf9c124ac1746ed186d018a34e7c85d6336e2f2890fa8d1b47b0ab91fd4c70d654b242ee0a67887a6fc59846ed78f53f9413fac49cac92be91e7a9e3b6448a01dcea218d76243a7905e97d1d8f75aa07a65f4af6c6bd87da50022de6cb4e25e55e61dad56ac305a3ba84bca181931d6cdff80be4f4ff61ea6f6f5e80d429c004ff1e49b97f6e80db7af9999617a111b109cce2f1d625500adf1dbb4abbd1ff10fa0345e2a6adfc8abdec5ca9947ecc23fe781b677aa6452a12ecacea175192641dacd5f24f6832e5052ef354954c097a096515f74eb7ca9d4752f78c3307849897227b26d5f552af5a63eaa8a32857e788dbe4d26c9b831afb52ae1ed05efdc31b1d84fd08c33c73076f6fadd256f819d06fb5e348d0a5a096d96b0d92612e12146ab8878a4e101ffc1591ff6bad61782f7ae012822387eba93c187160d1f0ef649ba1ff5be5da49b37d7dbdff87d65a19b62de8b19302c58fb9788637843f63a68c919bf04ca1f56c2f000028ce5af803e0276ab3c4e6451b54b7e840bec74759b6143a55f25d66a66fe1a772a6100b3cad08d31f28688634a54a46dedbb527a54a2c4c82347a84d72b2e7f45876942faa11149e33a4a3e54f7b365cd0c0423dfaa25a11ada7ff2a4072e0b5698d2e12d8fc47b9542a2a30e3731cad6fd0c7fce785f2b79381a493018ad75447d5f0080e892dc881ae069e5a0fe89b31c5e855998a582e250a9ab504aee9911d900a2549e38aebd9ba28f98554287ff1187e3934ddcb51507602d0b5dd836625a74819a728e1eae7f0fa4ba4ef84afe8673f6638b3eb569ff3603beb18e508363625de9272d88c37a736896b839b3d034fa85e63bf0ff6d207489a5985cc6f2cd5a72c1d5b532967d57e9b617b0fd4c9994bfba46ce31c24c4f460aa3ab956145ee5b5b547aa0e6f8a0ff4e4053a7ec0ca7ecf56e2a8ef759a16e6fa1b2d9cc78d36b76f030f2fa1a0eca86f501f9bd7b7cc7a4c5768c1ce8ee04b311994508da78d41beb9f2a907cc4df520297f23516adc20f674943da261e1daca7cd496bf8ae063ca16a2550d932f966eb536947339e5903d6cb497a7495ae56324a82f87f404cfd74f02039377abc97fd2505fab43d2e4f2a807806e070a7be8ba9d7d3f89b8148b9352b6cef94b77ff2ea1b3de6e31ba415a95414012e6a0894e7ab73466dfcc2585d9b40ed0a31565cd06eaf71268d7b7e14265bfffd8ac7f6661c0ad84ecae59c1f49c012c10b5310a5ef2820ef7edd7a5d3f80a69d540f58072caabe11c42a9a6950554a27e88223250c67622552e70d43c696b142647ccc0e432fb256c1a31356ec220a2f2117e827fa5e0bec89f8189c213fac0f6ae996f52ab8087370a7cc302a50f32df9596b09da03c021d29a3015e51cfde36b4f43aa0aa84511da7f084a586c42ac52b2f6eeac252110534068fdfc59db5e1a14855aa8f0a07688fa1510be73c4a2fa9619a8179efc932ff713161afaa92a2eb3c5f87b9ecd955aae13a625cab9938eeee05670d4d06869f9a7e4ae538738d4d02d682e889ce773f446e2216ef46b041af71e9ab7c1cbc78577eb4ffbea986a7c44f5f237a0237b1ba41cc1c20e7f95d01a8e553d92bbe218b2513451203fcc593b470849aca279f15b990bbe805b4792f792f5a31ea4854f695fc35f9b5dd69a0073a86fd9c01e7a149617410a29d91ca67fde781a484d0d9402b41c9693c4b974af2ab7b87eae5fad4b22ae9795c572aa8441c45cc82dc7760e02669039389cf4f06b2fe22b8d2704d10cedcded31bb92eb860750221748a99731b20da10bf475c0bb25089c9743815bf80668a5d50f267f18146d782b4e70a12d9761c9661c3f5eb0f217d0bf0b864db687cf888c214bc82d923c9f94c1e757804be8c74026bc39c27972e6a50b53dd457786709fb02396af6226f5eb4acf806ca604a2c146658a170a080ec93c7598147766973057a15ae0a674ce62a59c1c23b232b63e2179f2524dc91404ab4dddce13f5e7bfcf435684ff3cc8468f9abfad1cdcfa53ec7a93164c011b76ddad0490b059ccb4337a7f232996573b8c9e4af2074e84e1cf72c28ab6c6e52de91cedd2c6dd91f6d56f63d75b97375c28bcdcdbd93beb951d89c73effd620e2c820c6534c8e88cb5bc1f167dd4545128a7adb77ce202259fdc9d61b486e21c53a9f95b94bd12ec8e42c602ec7018284afdfb29b9415c39f6c0451372097ee2fe78e9b0220c55b22c11619628123ea6aef217b5aa47b3ac7dfcb566072a4171ead0c4fc3c2e83b8a3715585ee399d6370e09402710d59095151adc875fe8afe0005b7df43158ff38dafe7d2913ad27f5dc428092cda1855af6501ce9be3bdf7c864bb1d6dd45c1951e77fac732a6331dac8fec31554ccab7ed2761ef21d6a0bc9d71bc2ea177e1055afb055ad807d890eeb8fcf08b48c44909296ca6d34d1172dfa9500cf086d4650c5dc7f02d62a8fde03a414ef2f6a9fb322c67bd73fe1128b7c1c89b6c34837e9cb08f6a4da45b704c17e415eeaa6522cbcf7a51319d63cf3720822c71e7f94f007d985e3580ab2f693d53a24fdfa5e84d835727d735bfe221fb02612339db4639f0461593e8b5a595e58101a259fdf827c1813954aca1117fc02e591891ace65abb516dc094cb5fc8344df1c163f4200ff7d07d57802129b869f1568fb6aaafbb9422e0e4d803fe60b18915560abf0b6839af7f30f45c238c19f91852463da696be8daf165dd09163edcbfdbfa485e841583a644a194b4e7179d563c7c5dc8aeb73d6d40627c1eb8c1dee62234449276ae5121f62e6c1051686dd645722791bea541a131b91bfb71efbdd124fa6b4f5defea015c93167544bcdf86534eab6693e88b156ea3c44a0b3676ed56856886ff93fc6cb7b591b392d50b8947fbb6e989d3af2a3e798d8f05d7212996b06d9b8c1d2f84f252abe843c57101a8fe1d68b47b16aa2bf1e91d89f0ec6ebad0edef8c0012f45fbb4cb7dc66c48dd902b1549ba19295e8e99cf3b9c4b37fc793afb9ab030c699cbe269f5ff5ded89d2f03cd85c7016978eea04d1097af5957c535616b41"}) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_generic(0x10, 0x3, 0x10) socket$inet6_mptcp(0xa, 0x1, 0x106) socket$netlink(0x10, 0x3, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f00000002c0), 0xffffffffffffffff) socket$nl_route(0x10, 0x3, 0x0) socket(0x2, 0xa, 0x300) r9 = socket$netlink(0x10, 0x3, 0xc) sendmsg$RDMA_NLDEV_CMD_RES_GET(r9, &(0x7f0000000380)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000002c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB="1005000009142000d96031129ed08a7af6ede90d28bd7000ffdbdf25"], 0x10}, 0x1, 0x0, 0x0, 0x8}, 0x4000) sendmsg$IPSET_CMD_CREATE(r9, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={0x0}}, 0x0) sendmsg$IPSET_CMD_CREATE(r9, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=ANY=[@ANYBLOB="480000000206050000000000000000000200000005000100070000000900020073871631000000000d0003006c6973743a736574000000000500040000000000050005000200009550493fa3de93d300"], 0x48}}, 0x0) 1.536468875s ago: executing program 4 (id=1304): socket$nl_route(0x10, 0x3, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000d00), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_LINK_GET(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000700)=ANY=[@ANYBLOB='|\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="030700000000000000000800000068000480"], 0x7c}}, 0x0) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/cgroup\x00') close(0x3) r3 = socket(0x2, 0x80805, 0x0) close(r0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, 0x0) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x7a, &(0x7f0000000340)={r4, @in={{0x2, 0xce23, @broadcast}}}, &(0x7f0000000040)=0x84) setsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r3, 0x84, 0x75, &(0x7f0000000540)={0x0, 0x1}, 0x8) r5 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$inet6_udp_int(r5, 0x11, 0x67, &(0x7f0000000180)=0x7f, 0x4) connect$inet6(r5, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @multicast1}}, 0x1c) write(r5, &(0x7f0000000300)="89ba41c97928dec7cec15a160d3dba2553b519a795020072aed129d4b5247c983455b3d757e8b2333a64d9abf416fd83f942661c47bcdf71f7d07ba20d03474a4a4bce636ea8d2b882b2b49ef18e2a96e41f206d930eda2769c5ee6d5e3d541ce9a21c3ce5cb5fbdad9a45de0000000000000000000000000000f1d3b9821c18", 0x80) 1.424675041s ago: executing program 1 (id=1306): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000100)={0x50, 0x2, 0x6, 0x801, 0x0, 0x0, {0x7}, [@IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_TIMEOUT={0x8, 0x6, 0x1, 0x0, 0x5}]}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x2}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_TYPENAME={0xc, 0x3, 'hash:ip\x00'}]}, 0x50}, 0x1, 0x0, 0x0, 0x4000004}, 0x0) r4 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_TRAP_POLICER_SET(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x54, r4, 0x1, 0x70bd28, 0x25dfdbfe, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x8e, 0x2}, {0xc, 0x8f, 0x5}, {0xc, 0x90, 0x10000002}}]}, 0x54}, 0x1, 0x0, 0x0, 0x40c0050}, 0x24000000) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01000000000000000000010000001c00018006000100020000ac1414aa080006000e002000"], 0x30}, 0x1, 0x0, 0x0, 0xaa34a4cfdf933201}, 0x10) 1.278482784s ago: executing program 4 (id=1308): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=@deltaction={0x5c, 0x18, 0x1, 0x70bd2c, 0x25dfdc00, {0xa}, [@TCA_ACT_TAB={0x48, 0x1, [{0xc, 0xd, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x7}}, {0x14, 0x5, 0x0, 0x0, @TCA_ACT_KIND={0xf, 0x1, 'tunnel_key\x00'}}, {0xc, 0x9, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x6}}, {0xc, 0x18, 0x0, 0x0, @TCA_ACT_KIND={0x7, 0x1, 'xt\x00'}}, {0xc, 0x15, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ipt\x00'}}]}]}, 0x5c}, 0x1, 0x0, 0x0, 0x2000001}, 0x20040844) (async) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) (async) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_INITMSG(r1, 0x84, 0x2, &(0x7f00000000c0)={0xfffc, 0xc}, 0x8) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(r3, 0x1, 0x4c, 0x0, 0x0) (async) recvmsg$unix(r3, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x2000) recvfrom$unix(r3, &(0x7f00000002c0)=""/199, 0xc7, 0x2, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0xa, 0x0, 0x0, 0x0, 0x5, 0xb3, &(0x7f000000cf3d)=""/179, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6, 0x0, 0x0, 0x10, 0x0, 0x5}, 0x94) (async) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8923, 0x0) openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) (async) r4 = socket$kcm(0xa, 0x2, 0x0) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x18, 0x12, &(0x7f0000000780)=ANY=[@ANYBLOB="18080000d0ff00000000000000000000851000000600000018000000", @ANYRESDEC=r2, @ANYBLOB="00000000000000006608000000000000180000000000000000000000000000019500000000000000180100002020782500000000002020207b1af8ff00000000bfa1000000000000070100000008000000b50afdff0000000085fc618902cf4134e5fbecf33602000000060000009500"], &(0x7f0000000000)='GPL\x00', 0x2, 0xde, &(0x7f0000000340)=""/222, 0x0, 0xc}, 0x94) (async) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYRES32=0x0, @ANYRES64=r3], 0x34}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) (async) r6 = socket(0x2, 0x80805, 0x0) (async) r7 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$IP_VS_SO_SET_ADD(r7, 0x0, 0x482, &(0x7f00000001c0)={0x84, @rand_addr=0x64010105, 0x4e22, 0x3, 'lblc\x00', 0x1, 0x80005, 0x6f}, 0x2c) (async) setsockopt$IP_VS_SO_SET_ADDDEST(r6, 0x0, 0x487, &(0x7f0000000000)={{0x84, @private=0xa010102, 0x4e21, 0x3, 'lc\x00', 0x5, 0x8, 0x77}, {@remote, 0x4e20, 0x2, 0xcd}}, 0x44) (async) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000440)=ANY=[@ANYBLOB="8000"/17], 0x1c}}, 0x0) (async) sendmsg$sock(r4, &(0x7f00000000c0)={&(0x7f0000000580)=@in6={0x2, 0x4e21, 0x0, @dev}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) (async) setsockopt$IP_VS_SO_SET_FLUSH(r7, 0x0, 0x485, 0x0, 0x0) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x109001, 0x0) ioctl$TUNSETIFF(r8, 0x400454ca, &(0x7f0000000000)={'\x00', 0x2}) (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r9, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) recvmsg$unix(r6, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000a80)=[@cred={{0x1c}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x10}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x10}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x1b8}, 0x41) 1.267898015s ago: executing program 2 (id=1309): r0 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0xfffffffffffffea3, &(0x7f00000000c0)={&(0x7f0000000140)=@ipv6_newnexthop={0x1c, 0x68, 0x5fb9a818fb7378e9, 0x0, 0x0, {}, [@NHA_BLACKHOLE={0x4}]}, 0x1c}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(0xffffffffffffffff, 0x0, 0x0) (async) r1 = socket$nl_route(0x10, 0x3, 0x0) (async) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)=@ipv6_newrule={0x24, 0x18, 0x409, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, [@FIB_RULE_POLICY=@FRA_GOTO={0x8, 0x1e, 0x1}]}, 0x24}}, 0x80) (async) socket$packet(0x11, 0x3, 0x300) sendmsg$NFNL_MSG_ACCT_GET_CTRZERO(r0, &(0x7f0000000400)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000003c0)={0x0}, 0x1, 0x0, 0x0, 0x8004}, 0x14) (async) bpf$PROG_LOAD(0x5, 0x0, 0x0) (async) bpf$PROG_LOAD(0x5, 0x0, 0x0) (async) r3 = socket$inet6(0xa, 0x1, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000e00)=@newlink={0x40, 0x10, 0x503, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x115, 0x2081}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @gtp={{0x8}, {0x14, 0x2, 0x0, 0x1, [@IFLA_GTP_RESTART_COUNT={0x5, 0x6, 0x10}, @IFLA_GTP_PDP_HASHSIZE={0x8, 0x3, 0x20000000}]}}}]}, 0x40}}, 0x28000000) (async) setsockopt$inet_opts(r1, 0x0, 0x0, &(0x7f0000000240)="c6bf897ba9a02c853d18f23b590f9d97b78f737df47d75a060f6746dfc98d8ed0f5d3f58ff1a18b06b66cad7ac6ff308fb03e6dd09303e70fb8f7332ec09687a55c9f9b93858ca4aff1d87f1b45582edb9570597a5e8cce4964edada651598304f91b9167e94f5daf290a9e40431c3d0f5b0772c09ec4e109c8f0fb77e72ce4d", 0x80) setsockopt$sock_int(r3, 0x1, 0xf, &(0x7f0000001100)=0x3fa, 0x4) (async) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000300), r0) sendmsg$IPVS_CMD_SET_CONFIG(r0, &(0x7f0000000500)={&(0x7f0000000180), 0xc, &(0x7f00000004c0)={&(0x7f0000000440)={0x44, r5, 0x200, 0x70bd26, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x8000}, @IPVS_CMD_ATTR_DAEMON={0x28, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e23}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'syzkaller1\x00'}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000001}, 0x20000805) (async) setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x33, &(0x7f00000002c0)={0x1, &(0x7f0000000200)=[{0x6, 0x1}]}, 0x10) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e23, 0x10, @loopback, 0x80004}, 0x1c) (async) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=@newlink={0x48, 0x10, 0x401, 0x4000, 0x101, {0x0, 0x0, 0x0, 0x0, 0x20009, 0x6007}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @geneve={{0xb}, {0x18, 0x2, 0x0, 0x1, [@IFLA_GENEVE_REMOTE6={0x14, 0x7, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x10}}}]}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x20004010}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000380)={0x0, 0x0, 0x0}, 0x0) 1.226573027s ago: executing program 1 (id=1310): connect$can_bcm(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) r0 = socket(0x1, 0x1, 0x1) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000700)=ANY=[@ANYBLOB="1400000041080100ffff07000400dfff00000000"], 0x14}, 0x1, 0x0, 0x0, 0x400c841}, 0x4008094) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000012c0)={0x11, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000ffffffff0000000000008000d71a0000400002009500000000000000"], &(0x7f0000000040)='GPL\x00', 0x7}, 0x94) syz_genetlink_get_family_id$nbd(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(r2, &(0x7f00000027c0)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000002c0)=ANY=[@ANYRESHEX=r3], 0x3c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000) r4 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000100), 0xffffffffffffffff) r5 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r5, 0x107, 0x9, &(0x7f0000000200)=0xec, 0x4) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000680)={'syztnl1\x00', &(0x7f0000000600)={'syztnl0\x00', 0x0, 0x29, 0x1, 0x0, 0x8, 0x50, @private0={0xfc, 0x0, '\x00', 0x1}, @loopback, 0x7800, 0x20, 0xbd20, 0x5}}) connect$can_bcm(r5, &(0x7f00000006c0)={0x1d, r6}, 0x10) sendmsg$NLBL_UNLABEL_C_STATICLIST(r2, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000180)={&(0x7f0000000380)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="200026bd7000fedbdb25050000000000090000000000aa0000000000000000000000f921c3ba7fbb003fd59daa4730f960e46ebe405863ff707de7bd723d2f9496ae9c48e78de2cd05ac28906c6c98e61f25be0d8f7b08000000000000004cbaee52919f94eeec0630a06e19a0d662920ef694644a9645562f1b94988d850fb003976dc9e958fb2f7e4a98ef3a7bc5d6af317e0bec366d16464010bfc06607000400000000004fe9bdf879d0c31a24559c4c91a036422d7cb61469ab85ddd3cdcd51ec7c9b4fb72d9c58c4bdaf167d2502212253ee151222286fe48d65a4be"], 0x28}, 0x1, 0x0, 0x0, 0x8000}, 0xc000) r7 = socket$netlink(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000900)={0x6, 0x13, &(0x7f0000000040)=ANY=[], &(0x7f0000000100)='syzkaller\x00', 0xa, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$netlink(r7, 0xffffffffffffffff, 0x44) r8 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) syz_emit_ethernet(0x7a, &(0x7f0000001080)=ANY=[@ANYBLOB="0180c2000000aaaaaaaaaa008100000086dd60f57a1400403a00fe8000000000000000bbff02000000000000000000000000000102009078000000006050835900000000fc010000000000000000000000000000ff01000000000000000000000000000106000400"/122], 0x0) write$rfkill(r8, &(0x7f0000000080)={0x0, 0x0, 0x3, 0x1}, 0x8) r9 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_int(r9, 0x6, 0x19, &(0x7f00000001c0)=0x1, 0x4) bind$inet(r9, &(0x7f0000000100)={0x2, 0x4e24, @loopback}, 0x10) sendmmsg$inet(r9, &(0x7f0000004980)=[{{&(0x7f0000000000)={0x2, 0x4e24, @loopback}, 0x10, &(0x7f0000000300)=[{0x0}, {&(0x7f0000000240)="a85751ad519b201965da2ebcc4898c7f46cb0819b38bbf504fd2617bf9689f2cdbe63959901f5afb841befbb8787b77bc6855e836e2c277f600c31ff7ea5acf0a9525fa1c161d06b23b802aaf4716846d96af1654995ec32db50c7e056aa45212cd6", 0x62}], 0x2}}], 0x1, 0x20008000) setsockopt$inet_tcp_TLS_TX(r9, 0x6, 0x1, &(0x7f0000000080)=@gcm_256={{0xa82a02e4010a08bd}, "1a01c783a8bc563d", "e9a0bd986e338531d1157bc12d1fc364fdbaaa4d2954c1166835dbbe78286228", "bd69dbc7", "1d7265a045a85572"}, 0x38) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000005c0)={'syztnl0\x00', &(0x7f0000000540)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0xd, 0xdc, 0x5, @ipv4={'\x00', '\xff\xff', @loopback}, @private1, 0x1, 0x7800, 0x7, 0x7}}) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="060000e56b7f0004000000060000000800000030", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=r10, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x18, 0xd, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018150000ce999bb879eba7402ccbe51bfe96092f78d0d71fab4508402415e14bcd60a60651863ed16816645c355d2b987ffaf508d377896ce0366a245e0a38cbd228c8300ffd6da8137498038f7c0efc785d0cba9973e9ba11cc3305f72463b8e2cf5b6a0c6f3f32977c28037be4d250b354b7f197906613d2343e189cf3451a524b0bb49701ebbf3e22985763fa4df96e86ff20a367c3999d88d2159ac09e605eb02112771d57a0d699431e0f39036c7aaed25853d14586b3a2a49c10433ea71caf3ef7c19f", @ANYRES32=r9, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000005000000b7040000010000008500000015000000850000005000000095", @ANYRES8], &(0x7f0000000340)='syzkaller\x00', 0x1, 0x0, 0x0, 0x41100, 0x1, '\x00', 0x0, @fallback=0x2c, 0xffffffffffffffff, 0x0, 0x0, 0xfffffffffffffe09, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa}, 0x94) 1.100571185s ago: executing program 4 (id=1312): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x13, 0x13, &(0x7f0000000080)=ANY=[@ANYBLOB="18080000fa0000000000000000010000851000000600000018000000", @ANYRES32, @ANYBLOB="00000000000000006608000000000000180000000000000000000000000000009500000000000000360a020000000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b50a00000000000085000000060000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0x2, 0xff5c, &(0x7f00000001c0)=""/222, 0x41100, 0x8, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffff97}, 0x78) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='devices.list\x00', 0x275a, 0x0) write$cgroup_subtree(r2, &(0x7f0000000500)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r2, 0x0) r3 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_ifreq(r3, 0x8911, &(0x7f00000000c0)={'team_slave_1\x00', @ifru_hwaddr}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f0000000280)={'ipvlan1\x00', 0x400}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x2c0800, 0x0) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000340)={0x1, 0x58, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=@newlink={0x5c, 0x10, 0xffffffffffffffff, 0x70bd2b, 0x25dfdbbb, {0x0, 0x0, 0x0, r5, 0x50a10, 0x51a23}, [@IFLA_LINKINFO={0x34, 0x12, 0x0, 0x1, @ip6erspan={{0xe}, {0x20, 0x2, 0x0, 0x1, [@IFLA_GRE_OFLAGS={0x6, 0x3, 0x30}, @IFLA_GRE_REMOTE={0x14, 0x7, @private2={0xfc, 0x2, '\x00', 0x3}}]}}}, @IFLA_MTU={0x8, 0x4, 0x7fff}]}, 0x5c}, 0x1, 0x0, 0x0, 0x40000c0}, 0x9080) close(r4) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)) ioctl$SIOCSIFHWADDR(r4, 0x8943, &(0x7f0000002280)={'syzkaller0\x00'}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'dvmrp0\x00', 0x0}) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x4, 0x4, &(0x7f0000000700)=ANY=[@ANYBLOB="18000000ff0f000000000000000000008500000055000000"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x8, '\x00', r6, @fallback=0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_init_net_socket$x25(0x9, 0x5, 0x0) socket$xdp(0x2c, 0x3, 0x0) 1.005376615s ago: executing program 0 (id=1314): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000007"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0xc, 0xd, &(0x7f0000000140)=ANY=[@ANYBLOB="1800000000000000000000000000000018150000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b5af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001e000000850000000700700095"], &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 1.004953919s ago: executing program 2 (id=1315): r0 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000780)={0x6, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18020000f2ffffff0000000000000000850000001700000095"], &(0x7f00000005c0)='GPL\x00'}, 0x80) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000200)={r1, 0x4000000, 0xe, 0x0, &(0x7f0000000040)="976d9023d56482cd284a63da5397", 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000280)="bf049fd184f7b03c21d9bcddc4eef9ebb6a0da3eb91c5645", 0x0, 0x8000}, 0x50) r2 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x89e2, &(0x7f0000000040)={r0}) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000002c40)={0x10, 0x17, &(0x7f0000000140)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf09000000000000550901000074f6967d00000000000000180100002020702500000000002020207baaf8ff00000000bda100000000000027010000f8ffffffb702000008000000b7030000000000002500000006000000be91000000000000b502ecffffff00008500000005000000b70000000000000095"], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x12, r0, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="4c0000001800dd8d00000000000000000200000000000005000000000600150005"], 0x4c}}, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1000002, 0x28011, r0, 0x0) mmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x12, r0, 0x2000) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x5, 0x4, &(0x7f0000000340)=ANY=[@ANYBLOB="180000456d9dee5713be00020000008d261000040000009500000000000000d37fdedd955c81fcbe208cebace322c8d9c834e0455db87d6872de0d39d39d419965d76d83aea66bdfef4ef624f37900827e6c7815ecbd4356f650a0ae43b86962a812a33208dd2ed69584cf44706374479582758930bc60d410c871000000000000000000000016f75f698af74d37ef2826e8edd7874b128a2412688a9420df2e3a37d3861e321b4876150e1582942d31c9868428183b0bd6cf8656191e09b7bd4b0e8dbc44c21c2d1df01b35c4a888f42569e2e6f1673f"], &(0x7f0000000080)='GPL\x00', 0x1, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x35, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) shutdown(r5, 0x0) r6 = socket$kcm(0x10, 0x2, 0x0) unshare(0x26020480) pwritev(0xffffffffffffffff, 0x0, 0x0, 0xee, 0x4000004) r7 = socket$phonet_pipe(0x23, 0x5, 0x2) connect$phonet_pipe(r7, 0x0, 0x0) ioctl$SIOCPNENABLEPIPE(r7, 0x89ed, 0x0) sendmsg$NFQNL_MSG_VERDICT_BATCH(r0, &(0x7f0000000600)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000580)={&(0x7f0000000500)={0x48, 0x3, 0x3, 0x201, 0x0, 0x0, {0xa}, [@NFQA_VERDICT_HDR={0xc, 0x2, {0xffffffffffffffff, 0x5a}}, @NFQA_VERDICT_HDR={0xc, 0x2, {0xfffffffffffffffc, 0x6}}, @NFQA_MARK={0x8, 0x3, 0x1, 0x0, 0x8}, @NFQA_VERDICT_HDR={0xc, 0x2, {0xfffffffffffffffd, 0x2d0}}, @NFQA_MARK={0x8, 0x3, 0x1, 0x0, 0x6}]}, 0x48}, 0x1, 0x0, 0x0, 0x4001}, 0x24000011) sendmsg$kcm(r6, &(0x7f0000000940)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000003c0)="d8000000100081044e81f782db44b96d001d006a0f000000050000002900150006000e2603600e120900040044000000a80016000a0001400200000000000000b94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef52a98516277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f1aeb4edbb57a5025ccca9e00360db70100000040fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de643ec0dd6e4edef76874fbe0f32b1608621e9e0", 0xd8}], 0x1}, 0x20000080) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x3, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000070000000000000013d38000911171000000000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffff9}, 0x94) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000280)={'ip6tnl0\x00', &(0x7f0000000200)={'ip6tnl0\x00', 0x0, 0x2f, 0x9, 0x0, 0x0, 0x24, @mcast1, @private2={0xfc, 0x2, '\x00', 0x1}, 0x7800, 0x8000, 0x0, 0x3}}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000300)={r3, r8, 0x25, 0x0, @void}, 0x10) 897.411857ms ago: executing program 0 (id=1316): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_PMK(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)={0x1c, r2, 0x1, 0x70bd2b, 0x25dfdbff, {{}, {@val={0x8, 0x3, r3}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0xc884) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWSETELEM={0x50, 0xc, 0xa, 0x101, 0x0, 0x0, {0x2}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x24, 0x3, 0x0, 0x1, [{0x20, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0x10, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0xc, 0x1, '\x00\x00\x00\x00\x00\x00\x00\x00'}]}, @NFTA_SET_ELEM_KEY_END={0xc, 0xa, 0x0, 0x1, [@NFTA_DATA_VALUE={0x5, 0x1, 'H'}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0x78}}, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000691000/0x4000)=nil, 0x4000, 0x3, 0x28011, r5, 0x0) bind$inet6(r5, &(0x7f0000000080)={0xa, 0x4e20, 0x2277, @ipv4={'\x00', '\xff\xff', @remote}, 0x1a}, 0x1c) 817.013753ms ago: executing program 4 (id=1317): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="0c04000010000104000000000000000000480000", @ANYRES32=r0, @ANYBLOB, @ANYRES16=r0], 0x40c}}, 0x0) 757.066426ms ago: executing program 3 (id=1318): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000003840), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000002c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_DEL_KEY(r1, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000580)={0x3c, r2, 0x1, 0x70bd26, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_KEY_SEQ={0x7, 0xa, "e56ddb"}, @NL80211_ATTR_KEY_DEFAULT_MGMT={0x4}, @NL80211_ATTR_KEY_SEQ={0x4}, @NL80211_ATTR_KEY_IDX={0x5, 0x8, 0x5}, @NL80211_ATTR_KEY_TYPE={0x8, 0x37, 0x2}]}, 0x3c}, 0x1, 0x0, 0x0, 0xc000}, 0x8c0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_WDS_PEER(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x7c, r2, 0x800, 0x70bd2c, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @random="e7677ded374e"}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac=@device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac}, @NL80211_ATTR_MAC={0xa, 0x6, @random="43f25d271a47"}]}, 0x7c}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff}) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r7, &(0x7f0000000380)=[{&(0x7f0000013580)="0dd2e7c8926dc6acd0ae6c178054e95986faff9544de5fc4c30adf404da41181a77466ac5075905ea5f50134fdd517a957fe2ee59b61f9fe8d7aabe595ea23de2723e437af0423a56686a4c2d957be1a0ab922fbbd3cb1d8c6ab0d58440a327c8eb05d445b4ac5f20abe449e4084f8b996268d0564f67980d3ed3479e0edfe5cec7b4f89bface391c9c4c58ad123b91c33173c72326d1df18804a9ea20f9ece48f784d8ca2318e3d2b316666b5dfb7295c4915989d5bcb120e8fedaa97b93a137c256ce4", 0x20013644}, {&(0x7f0000013680)="c578381bf5113dad8319d9ea5294285ae9a90384ce23866477bef9de4399237d8b3522c9c194e71edaf3332a2f169682f9d8fa271683d4d441b710409e506333e0c3b64e52e8720734b6787f4a84f5bebb046649c6c697d978affd349031b2cd874c7a8961a586a9f2d62f945e7a5bf2f5f7a31684c0503704881d2578a2a98ac3ef4e4a4b0dcdb70db735d5c1652eed3848b2dd4131bb0eb7cfadfaf5", 0x9d}], 0x2, 0x0) tee(r6, r7, 0x2, 0x100000000000003) r8 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000200), r0) sendmsg$IPVS_CMD_SET_INFO(r6, &(0x7f0000000480)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f0000000300)={0x12c, r8, 0x200, 0x70bd2b, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_SERVICE={0x54, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x73}, @IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x87}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x8}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x5b}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@loopback}, @IPVS_SVC_ATTR_PE_NAME={0x8}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0xd, 0xe}}]}, @IPVS_CMD_ATTR_DAEMON={0x30, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'wlan0\x00'}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @initdev={0xac, 0x1e, 0x0, 0x0}}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e24}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x3cfd}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x2}, @IPVS_CMD_ATTR_DAEMON={0x2c, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @private0}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'veth1_to_team\x00'}]}, @IPVS_CMD_ATTR_SERVICE={0x44, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_AF={0x6, 0x1, 0x2}, @IPVS_SVC_ATTR_PE_NAME={0x8}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0xc, 0x13}}, @IPVS_SVC_ATTR_SCHED_NAME={0xa, 0x6, 'lblcr\x00'}, @IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x73}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x1}, @IPVS_SVC_ATTR_AF={0x6, 0x1, 0x2}]}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PE_NAME={0x8}]}]}, 0x12c}, 0x1, 0x0, 0x0, 0x40}, 0x40000) ioctl$sock_ifreq(r5, 0x8922, &(0x7f0000000080)={'dummy0\x00', @ifru_ivalue=0xfffffffd}) socket$nl_generic(0x10, 0x3, 0x10) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$nl80211(&(0x7f0000003840), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000002c0)={'wlan1\x00'}) (async) sendmsg$NL80211_CMD_DEL_KEY(r1, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000580)={0x3c, r2, 0x1, 0x70bd26, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_KEY_SEQ={0x7, 0xa, "e56ddb"}, @NL80211_ATTR_KEY_DEFAULT_MGMT={0x4}, @NL80211_ATTR_KEY_SEQ={0x4}, @NL80211_ATTR_KEY_IDX={0x5, 0x8, 0x5}, @NL80211_ATTR_KEY_TYPE={0x8, 0x37, 0x2}]}, 0x3c}, 0x1, 0x0, 0x0, 0xc000}, 0x8c0) (async) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan0\x00'}) (async) sendmsg$NL80211_CMD_SET_WDS_PEER(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x7c, r2, 0x800, 0x70bd2c, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @random="e7677ded374e"}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac=@device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac}, @NL80211_ATTR_MAC={0xa, 0x6, @random="43f25d271a47"}]}, 0x7c}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) (async) syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) (async) pipe(&(0x7f0000000080)) (async) pipe(&(0x7f0000000000)) (async) vmsplice(r7, &(0x7f0000000380)=[{&(0x7f0000013580)="0dd2e7c8926dc6acd0ae6c178054e95986faff9544de5fc4c30adf404da41181a77466ac5075905ea5f50134fdd517a957fe2ee59b61f9fe8d7aabe595ea23de2723e437af0423a56686a4c2d957be1a0ab922fbbd3cb1d8c6ab0d58440a327c8eb05d445b4ac5f20abe449e4084f8b996268d0564f67980d3ed3479e0edfe5cec7b4f89bface391c9c4c58ad123b91c33173c72326d1df18804a9ea20f9ece48f784d8ca2318e3d2b316666b5dfb7295c4915989d5bcb120e8fedaa97b93a137c256ce4", 0x20013644}, {&(0x7f0000013680)="c578381bf5113dad8319d9ea5294285ae9a90384ce23866477bef9de4399237d8b3522c9c194e71edaf3332a2f169682f9d8fa271683d4d441b710409e506333e0c3b64e52e8720734b6787f4a84f5bebb046649c6c697d978affd349031b2cd874c7a8961a586a9f2d62f945e7a5bf2f5f7a31684c0503704881d2578a2a98ac3ef4e4a4b0dcdb70db735d5c1652eed3848b2dd4131bb0eb7cfadfaf5", 0x9d}], 0x2, 0x0) (async) tee(r6, r7, 0x2, 0x100000000000003) (async) syz_genetlink_get_family_id$ipvs(&(0x7f0000000200), r0) (async) sendmsg$IPVS_CMD_SET_INFO(r6, &(0x7f0000000480)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f0000000300)={0x12c, r8, 0x200, 0x70bd2b, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_SERVICE={0x54, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x73}, @IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x87}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x8}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x5b}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@loopback}, @IPVS_SVC_ATTR_PE_NAME={0x8}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0xd, 0xe}}]}, @IPVS_CMD_ATTR_DAEMON={0x30, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'wlan0\x00'}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @initdev={0xac, 0x1e, 0x0, 0x0}}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e24}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x3cfd}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x2}, @IPVS_CMD_ATTR_DAEMON={0x2c, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @private0}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'veth1_to_team\x00'}]}, @IPVS_CMD_ATTR_SERVICE={0x44, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_AF={0x6, 0x1, 0x2}, @IPVS_SVC_ATTR_PE_NAME={0x8}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0xc, 0x13}}, @IPVS_SVC_ATTR_SCHED_NAME={0xa, 0x6, 'lblcr\x00'}, @IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x73}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x1}, @IPVS_SVC_ATTR_AF={0x6, 0x1, 0x2}]}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PE_NAME={0x8}]}]}, 0x12c}, 0x1, 0x0, 0x0, 0x40}, 0x40000) (async) ioctl$sock_ifreq(r5, 0x8922, &(0x7f0000000080)={'dummy0\x00', @ifru_ivalue=0xfffffffd}) (async) 756.699762ms ago: executing program 0 (id=1319): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x8000000008010004, 0x2) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000480)=@ipv4_newrule={0x28, 0x20, 0x301, 0x0, 0x0, {0x2, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1f}, [@FRA_TUN_ID={0xc, 0xc, 0x1, 0x0, 0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x4001}, 0x4c084) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0xa0d, 0xffffffff, 0x0, {0x0, 0x0, 0x0, 0x0, 0x9801, 0x1313}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipip={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_REMOTE={0x8, 0x3, @multicast1}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x1}, 0x40008c0) sendmsg$nl_route(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000009c0)=ANY=[@ANYBLOB="540000001000ffff2cbd7010ffdbde2500000000", @ANYRES32=0x0, @ANYBLOB="096d050025100000340012800b0001006772657461700000240002800800140004000000080005000300000005001300000000000800040002000000"], 0x54}, 0x1, 0x0, 0x0, 0x10000000}, 0x40040) 603.923381ms ago: executing program 3 (id=1320): r0 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'veth1_macvtap\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newtfilter={0x34, 0x2c, 0xf3f, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r1, {0xb, 0x9}, {0xf, 0xfff3}, {0xe, 0xb}}, [@filter_kind_options=@f_flower={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x8010}, 0x0) (fail_nth: 4) 601.434472ms ago: executing program 4 (id=1321): r0 = socket$kcm(0x10, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x0, 0x3, &(0x7f0000000a40)=ANY=[@ANYBLOB="850000002a00000025000000000000009500000000000000afcd48d6494d614dcc6fab5335ec470db2c6161dba392176dd2963038e1d69ba7ea94c500dc4ef2fad96ed406f21caf5adcf920569c00cc1199684fa7c93836d9ea2cfb0e60436e05425cc4686b066707de94a4f4d5fc79c987d669f381faca0f9d9924be41a9169bdfaf16da915b2e249ee1c6eee84309e7a23c19a39484809539fcb4e0b6eab1aa7d55545a34effa077faa55c59e88254f54077f799bf168301000000bf2255d6a0244d35b213bda84cc172afcc2e47a7d8b85a5e3d77ac463920e231b7ae0da8616d2b7958f9b080476ee7b8004469564262d81f5da6c025d060ab186d94af98af1da2b5952eb15855933a212304e035f7a35dfc72c81256a55a25f8fe3b28d7e53c78fbfe5ab0255f347160ec83070000000000004015cf10453f6c0b973b81a484ebad04859d928365a7ea3fab2e4b380a00d72bc0480f949c479757306720399379d9271cf555c14d56b51c2298237bebfc08e0d5976a942b846970cf8b9d4139f1111f2dc5e46ac1c60a9b030074bfbcd4b09012175484135f0e519f0b1e4aaa026d570ecb5e8cddbed65ff702000000a3ff4f8a4cf796b07a6ff61c5552417fd703f7f14d8b78a602ca3cdf6a662d8bc9c89c9120072a5d00dcdd8595356c9b2492aaf1264d4ef4a410c882834867bcd2b6e558d17879570c8ad943e392955f4f979ea13201bafe4f0f6ea508000000a0c548552b571bed5647323c78a996810000000571cbb17d9f37282462f0e9c147c0d497c61433"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000d00)={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc, '\x00', 0x0, @fallback=0x31, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x3, 0x0, &(0x7f0000000c40)=[{0x0, 0x1}, {0x0, 0x5, 0x0, 0x3}, {}]}, 0x94) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000d40)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000a40)=ANY=[@ANYBLOB="7c00000000000000000000000700000044140001ac1414aa00000000ac1414000000000000441c0003e0000001000000007f000001000000000000000000000000442c00000000000000000f883816814100000000000000000000000000000000000000000000000000000000000000000000440c0001000000000000000000000000000000a400000000000000000000000700000044280000000000000000000000000000000000000000000000000000000000000000000000000000071700e0000002ac1414bb00000000e0000002ac1414bb018616000000000010c986d78e6c4b9394b247217b87cb00830b00000000007f000001861f0000000000020010421487f84baabcbcfb42a4d90bab000748c68c4c31001089ca45d9612e5b5c11f12bc78a41000000000000006c000000000000000000000007000000441c0003ffffffff000000000000000000000000e00000010000000044340001ac1414bb0000000000000000000000000000000000000000ac1414aa00000000ac1414aa00000000ac1e000100000000830b0000000000e000000200000000001c000000000000000000", @ANYRES32=0x0, @ANYBLOB="ac1414aa00000000000000001400000000000018000000000200000000000000000000001c000000000000000000000008000000", @ANYRES32=0x0, @ANYBLOB="7f0000017f00000a0000000800"/28, @ANYRES32=0x0, @ANYBLOB="7f000001ac141400000000011c0e0000000000000000000007006fc946f1f569c01801"], 0x230}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030033000b35d25a806c8c6f94f90224fc60100005000a000200053582c137153e37000c06", 0xfffffffffffffea7}], 0x1}, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, &(0x7f0000000040), 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x2, 0x13, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000720000001801"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x33, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) write$cgroup_subtree(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="33fe0000190091c8b14a0778a8123d181d"], 0xfe33) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) r2 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000100)={&(0x7f0000000640)=ANY=[@ANYBLOB="9feb010018000000000000003400000034000000060000000400000000000012020000000000000000000001050000018000000000000000010000850200000000000000010000000000000400000000da"], 0x0, 0x52}, 0x20) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000140)={r2, 0x20, &(0x7f00000001c0)={&(0x7f0000002700)=""/4116, 0x1014, 0x0, &(0x7f0000000000)=""/89, 0x59}}, 0x10) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000003c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x73440d8a, '\x00', 0x0, r2, 0x1, 0x2, 0x4}, 0x50) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000300)="c99b573818", 0x5) r3 = accept4(r1, 0x0, 0x0, 0x0) ioctl$int_in(r3, 0x5452, &(0x7f00000013c0)=0xc7f) recvmsg$can_bcm(r3, &(0x7f0000000ac0)={0x0, 0x0, &(0x7f00000009c0)=[{&(0x7f0000000540)=""/78, 0x4e}], 0x1}, 0x2001) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000d80)={0x18, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="1801000021"], 0x0, 0x40, 0x0, 0x0, 0x0, 0xb4a02fe0ce239f93, '\x00', 0x0, 0x2}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xe, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r4], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x59, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, r5, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x18480, 0x0) ioctl$TUNSETLINK(r6, 0x400454cd, 0x307) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r7, 0x2000000, 0xe, 0x0, &(0x7f0000000040)="630b008646dc3f0adf33c9f7b986", 0x0, 0xcf25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x80}, 0x50) 562.339062ms ago: executing program 0 (id=1322): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="1400000010000100176c296f0f606f3ae0f499db3300000000000000001c6a000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030100e6ff00000000020000000900010073797a3000000000090003007379"], 0x7c}}, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a00)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x801, 0x0, 0x0, {0x2}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x64, 0x9, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x1}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x8}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x84}, @NFTA_SET_DESC={0x20, 0x9, 0x0, 0x1, [@NFTA_SET_DESC_CONCAT={0x1c, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x2}]}, {0xc, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x4}]}]}]}]}, @NFT_MSG_NEWSETELEM={0x44, 0xc, 0xa, 0x101, 0x0, 0x60, {0x2}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x18, 0x3, 0x0, 0x1, [{0x14, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0x10, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0xc, 0x1, '\x00\x00\x00\x00\x00\x00\x00\x00'}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0xf0}}, 0x0) sendmsg$NFNL_MSG_ACCT_NEW(r0, 0x0, 0x4) ioctl$FS_IOC_SETFSLABEL(r1, 0x8930, &(0x7f0000000cc0)="37c4a5e33a6081f2a3fcc30a2ea92ef80f6427c344d1178a1c43ca4f0000ec67b9f27cd83b08959c0e471c4ae78b9cc4c7603c7a040782f3c379a03019e3bfd92533743c915077dd984784f531853d184c539dcac54ff2e955ba3fd1c00b016be57263b9695d15c56bbfcc195f2becfab2fc273ea8aee645f9062c6ac6c6c02f59935620d42a59a7e285c4e602b45acbf3e1bfd871e98e4f37b281b5e13b55a48e24a9981b78fe161a9de127f5b2c8ae0a12cbc189b6a1f44e298ff0acca36aac1967ea538fb4d8ca3ff03884b543d868eac5217ad9b6e5c0f7bba6311f4b36020ec81e814f17062e2d5766abba3d757582a9b922b726173db7a852dc7983fdc") sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r3 = socket(0x2b, 0x1, 0x1) r4 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r4, 0x29, 0x20, &(0x7f0000000180)={@private2={0xfc, 0x2, '\x00', 0x1}, 0x8000000, 0x0, 0xff, 0x1}, 0x20) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r3, 0x29, 0x20, &(0x7f00000000c0)={@mcast1, 0x8000000, 0x2, 0x0, 0x18, 0x4, 0x96}, 0x20) 464.977802ms ago: executing program 3 (id=1323): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000700)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x7}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x301, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}]}, @NFT_MSG_NEWCHAIN={0x30, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}, @NFTA_CHAIN_HOOK={0x4}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}]}, @NFT_MSG_DELCHAIN={0x44, 0x5, 0xa, 0x220, 0x0, 0x0, {0x1, 0x0, 0x2000}, [@NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x1}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_HOOK={0x18, 0x4, 0x0, 0x1, [@NFTA_HOOK_DEV={0x14, 0x3, 'veth1_macvtap\x00'}]}]}], {0x14}}, 0xbc}}, 0x0) 356.732908ms ago: executing program 3 (id=1324): r0 = socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000100)=[{0x80000006}]}, 0x10) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) r2 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="5500000018007fd500fe01b2a4a280930a06000000a843089100fe800c00090008001100080000002d000f009b2c136ef75afb83de448daa72540d8102d2c55327c43ab82286ef1fdd20652383656d4d2449155037", 0x55}], 0x1}, 0x4040044) getsockopt$inet_sctp_SCTP_CONTEXT(0xffffffffffffffff, 0x84, 0x11, &(0x7f0000000140)={0x0, 0x8}, &(0x7f0000000180)=0x8) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r2, 0x84, 0x7c, &(0x7f00000001c0)={r3, 0x6, 0x3ff8}, &(0x7f0000000240)=0x8) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000080)={'syzkaller0\x00', 0x0}) r6 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r6, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', 0x1}) sendmsg$nl_route_sched(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@newqdisc={0x30, 0x24, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {0x0, 0xffff}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000001940)=@newtfilter={0x116c, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {0x1}, {0x0, 0xffff}, {0x300, 0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0x113c, 0x2, [@TCA_BASIC_EMATCHES={0x1138, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_LIST={0x88, 0x2, 0x0, 0x1, [@TCF_EM_NBYTE={0x14, 0x1, 0x0, 0x0, {{0x4, 0x2, 0x7ff}, {0x8000, 0x4, 0x2, "2ee62e9d"}}}, @TCF_EM_U32={0x1c, 0x1, 0x0, 0x0, {{0x3, 0x3, 0x29}, {0x2, 0x41, 0x3, 0x101}}}, @TCF_EM_CONTAINER={0x54, 0x1, 0x0, 0x0, {{0x1, 0x0, 0x7}, "1a174781810d4d0be6ba145f22b53aa99028da194595abc3acfc516a6c51c5451660891be2482b260beb88ad2df4832906ed5d0df9c34f8f7eb54fc97370d78a5838b874eb"}}]}, @TCA_EMATCH_TREE_HDR={0x8, 0x1, {0xf0}}, @TCA_EMATCH_TREE_LIST={0x4}, @TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x2}}, @TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x4}}, @TCA_EMATCH_TREE_LIST={0x1010, 0x2, 0x0, 0x1, [@TCF_EM_CONTAINER={0x100c, 0x2, 0x0, 0x0, {{0xfff, 0x0, 0x2}, "b31f8aa3cb4315c535229ced9f869b53f21594544c19c53a8613ba25354ac2d1227a5b1514fb3094357f78bac22ea84fe115f7ddc9607cf0d6914f447723b09d27c4d25b8aead1bbe947adce53622e1957a910af958ac74444e282e4ae748e344dd9dbbc29dc2dd2bca4078f62e51453425accafd071bc02c62d4868d9eac3be3f90a4587cbb12f5007a251ece9a178382dd40dd83fe5fb541f50e59cf01566a8260c532c6e10d7014f6cc8e63c12e711832ac6b9ca1c947017106625f86bf2d76e98fd378e8c4c0d5fd2d3c795ff3e27615be30460917aa6053b6a3dde4c39d75feeb1471803ff751b061d39596fdddbdcf3adb36c0bfa6bd94d29b768c86c680a5fd062bcf9eb57d1f617b4ee17efd10a983fd7a02caa1d9786c9c21ea1d9f22fb2a2033961201abdd0c661a6ab344fbbaa612c7a5c96c124d92903c425cadc0422f32225b6d6739d016f32027c8a95dc1c7d5f15aed8ccb50d9cb5f62fcacf41018a0ca1834dac0c3d9149a4158cd757eee3d65f247aa11b2ab28103d2b8bfdccb014d2052c3586babf7f8c9a4380388106e0d311476e7235e50078733bd593e6fdde8b4687058be75b52a87bfa73add42e19e14af77c59ef265ac00a6641b09b2de6162663a35fa019daaae79a7366ca35681fc0d2cee2a6b7a36d7f8084ff9c52403117bf9c6bc602ea785a454088cf4d16edc2f10768e474644bb37c8a98b4ac9b3b1f7c17e50c9ad0aad4e090c3788fa2b8c656dd41e32f285a8cb1461a9a2b2b0ad45c7f72568bac1e185aa025f2a20514aa0671aca1616875c708c1635114a90b17a2fb262292130109b8d3942ec8464efd8c683c8b306c50ec967cc8e7649218061f22ae673d7951fab5eec2896565b99052baed7ae80f5e5d127a47d193023995867d2a8a6d6e56b98d0ca1f5a97a744ef503c7d6ff37a23d376a440add90cba5cd30b61f033862a78d927fa3969368538acce80dcb0ac637af484d899158f60f1db421607e8840d45da89b7d4bfd58d32929d1a808f3c56ea5d9030b22b22431b5d24807c4863d840203614079d63e90cc0192791fd1ebcfc4c7a14e0213f8fa3305fd3573d7257a2595bc4520483c05677e88ec6efa566a01567a534c078b7c872cda6e1fa9884d6e275bd8ca7135227fbcd328fa6891e2b6cf9e1007148654a258210d74f7fe73a4c5919d2c4b69cbbe5f8ff9bd099f87d039799234f316edb209889d067f4dcee9a6254be5de95e3a8f89b1a035e636e99d8e9eca998fccb91fe98fae1037912a10e34ede35ba8020299cabc1aa9b0b3664d4fd127cbd6e2b62fd3ddc9205e6be6952c0bdfceebb832988190ea629b5e5482a3974461ab9d2d4a90c121664b1f0425c63cc7f74a3dba2f67cc888fc56b5f5b744c911d028408afe49028958e08eedd5b0aecf6c36ba028072e083df9795a96ea5f1e051dc69557e9eecbc84de643729ccf67e45eef778cf5238f33e28cbbd631ea2c366f9fa9c71ea2c619e1f0dd6821b0bb6bc85d4b69d292128c2808d26dc3ae19fb89f5beea82d51273c3d7223e9eeb27f4d6775c0b3c9671c0ab7bfd3c7a3d39676be6e2a46b2aca67dd7f1894b10834edb96dcaf3edb8c6610bfe1504405177f0b3f1621a4f26c72277bd0ebfca8cf2be43023c3d9ffa6257ca81d3045f4996ee724afe29bb5cd01bb36987fb7c171776c9624af2ba03491a0cf5e7af7d909df8d50adbe100bf093c5d514d160b09fcfef1fe571bc579d07fc35e994cf65a3e018dd1bae4b9d43adf49537801501ec6056bf887cf86e4c8cbd2c67332e8389ab79c909c57470b666ae4870cd93a81f28758a7927d64b4f892fffc2e90fc2e275df37ca498ed73accf073f3457537ce8840998c97a6f27958c8787cae1734462e09d7e309471961850112b0c34ad3d84588c55f65163a2a7fe42889fc38ca1ff20ef0a7d5a40af6e973bd010ba829b86756cd2646b90da2420d1dfd692e7fe10bf6a4099a5620c614eaf792570dd0ac2ad1232ad35434a8f59052d8dadd0d1a07812e55a5e4b14f161cb6f4765a28b9400b931aa8e2379656fa384a2008db00a2e637b6bd390c18296e9f69b0dfb626f32db7d0377fb031e6daaf7293603b4a1f8ca83fdf015a77d4a92656cce39dab5e7048f6a84a1d47eeb92afa0c7d278ea9ce822275bad50042736b95b9f3dc706866fcf291de7326e02c93909b0717ee29e2486f2233f851b44b10322f5ccc325729aaeab0b657503723b679ba9a3e499ea081247ae0a97bc2494756525eb5f3b254c3ea638c279d412c96cc1f693cc42a21e22addf3f2f6af4e485fa3b93f3855d106696727dd0e35024f7a641a5aed1f5141599830d56f40610ae47f742a369d81db5aa6b3874998a5781e7e81ef7064ba3d11d300a56bd5230276c2b99f8c677f06ff097f5bdd59cdcc8acc2a2dbf300e69cd516b8ede043efbb185408c19ec49b2e6f588b56238d95fefbdb5e735323243e98539ec326952bb9b6f3c3f572e5fb07c19cea78fe48cc656acc17d0c8283202b826e171f0315419ab1ddee9eeb3ff3214e25ef76a111c1e68d830dbc0dc904bb029dcf16ecb53174f14b96d7dd49d7ca1b89c1005dfa24b4f194f0bc5b343559265dfa0554cc5b368ecc86aea05e390e2ce92d2628fea08a84d5d8617d8b6e895ee4329e4b899d645fb7786549b49b1a0129437c26af11316f76abb5179d9b4ff83e62aa0eb90594ef9be8d33db8dde8f09aaa3e37c8eda8fba3ba58407574e491b0250c4abb563b59526a34f92a19a2380d3b255ffdacfebf8cc9818b5816ec931476355106ded832e5d29515fd24a0765f1dd0db222c64e00521881080435d4d165eca5d207bb6ed8e621216655d173dc9d2d1c2bc2b86687c5636e85ca56660cb1dcd9c9b714ca0c57acd08259dc90db9f47e193b5f71a38cde917522f6b05a4a4e18e5407b72c643ba00e9c5a94c3ac2dfb5f19c37c4d53c95b6648579a6cb75f195a97450f1989f305f2c942aeda34395e8be7fc667b3a64b206d2270aeb901e96f9994846a8e615640c87a7df067d21b22baef2a387b67a5a2478213cd4df98b07c746e1308e3bb902dec2785bf64f9ea9cdb522b03f1de58783beed58c9aa066c877f2f3ff7a1a76cbd046fe860c95d6628e17765a496269456eb54f7963b03ea63a84d50b7fec52f6281b18e047012ab47907132f28dd2f1f66756cce15bce5e41e6069bd91a4bcf19fbeaea00c46fe76fc54eea48dcfed6dc43773027e325a804d532fe4ff808bda5ff4bbed5bca8679b69263d66de84aacb71e2ff249c9808ad04fce4c22f96badb3809ec391fbc76f235202938ad78ec332daf2e7616f53908ad27a7010493c40624f1937572f5e6127fdafdb315abc2e24cbfbd4bba5298fe001a7835a24536606043ced4a8789a715b8b11ed8c1d5409cd25709e36e8f7e7fc542b74024f82ec1f5c3f471f09d901ebfbe2c58ee80437041baea9f044e36618fbb17cb5cc85e5bccd0a41e6d03f6b2809a405d01314e81b9dbedca35798ffc645c72d2cfb6048f1f55610e9b72a8974d9bcd763a3ecbd0dd1b9cc771a11545d2560deeb5100aac44057578b99f6272f8f024f93628c449ed08caa35c0aa92c600a84ca311f800f5e5bf3d630875a5b1d3f27b19899405ccdbdec35bf1f97e6a4159233973aaa7f022594e427d632ac979ece9e3b7b74b1e8546f297da09976dec1db7aabf8f519044dce848f8c7f534339013574b8c20bb8b525e9330828193bc8bc32dd2b3e88015cd7740386bd45d81bdf50433ca595710ae1912b15ddafcde4155a78cf719b31950436decda941fb1395819c8a40865c617a548a4b35d52dd9471f5ee149861f1cee24fd903633c70af67c7d639a8666b760c2b4679c3ef8288056c10db8f661c0590e7c6128819fec13ec2cf32e26cbf334f9bf17e716aa567e8806682af2559c7f95b10d7d6871d548eb462d4cf882d0a016de81175465f86b3e7002f80a4774145f79bf99c1a2ba53e633778d355ed8bea414d6c1df3129be14038ec25c74ae04ee5f73999efad33d7062b6a020ebd03b51c90bf49216542f725b2c1a32608960b528f49cee65824fab6719bd2d8c06cc01df10dad282273882c04f17b7c7a611ef6fadbeba7d1136a57d8ae25cb7f4a5a0f48d570d13243dd9bcf0ef2633359bdc599b3930b1606eede93b024c8e18f774896f587bbb6c24debdddec909f94b9a9b2ec723384090aa2db8c061581f3d8934e8d7138da4b651ad0e4699fc25301e84c5b7d55f01700422b02aa8b4e6aa3c89efae0edc3572c37e45ab523eabf6424974f35a7d4d7ae6c084ad96cac403b84e4e86f0c2389a1a4b3a48918c926ee0d1ad43397eea6556c70bf83b2e6343e4ad908bcfe1d158c229c3806ac8abfe75917bd6e0e7afe9ff852ce5f9f771075769075b96bf407c2f3816d63e4266148f4f02b7eed833a4e669b2075073a2b2cbdc0d221fdf8e94d80cae8281b8880dcfc88396bf711aad8d11b01abe574b4dbd00f069463d00f45cedf2809e4824cd8cc76263aeeabe2c3795531a2d87aa35e197cf21118f28ddb1ae6de5406995d9d860109c29bb4bda1989680e9a545c57decb2db06adfb413be8cd1a1507715868db1a0cd24a53ba9ca9567579daa9a4e52dfe290a4a39067179129d9ddb2052a08295473bdc0159d8c9c225e112856413ef6fcc2563801cf70d4e52d0f8889a6539151b1b371719051f074d2aefd02ae9a375b7132cbf6ffc177929b5e5723f42bbab018a5cea3101b916cb5ed1a0bfb9a670fed31864f887a6607cc1b53cf7a627840ddd2a413cf20820cd65e6b4c67727750880e4e5ee79be68932abd7c4f8aa57d5a93c3b84bd080f7571d86f44624f1d34a189d20cfbedb60dd5e1f9379a23b44a8a58e370e7fa7847f48f5b5bd9da1d86bb95043da551fa56f630361db59860e19e1779a41384233a30be00d665e7c96dbdb45c2ed3f62e7ae37b04c57b5ec9a719683bf32e6b973b077ccfb16f85c697119e66e9194599a469cad0f45803ec8375abcaba8f45bb514e92cf317c62af2eec2f748253796a7afb581a63e0ec6dce2ffa96c8bbed299546751eb612eb4c68653f6827c34d60370eced43d21235fff20c0344c0b1281a24b4044f1607e1b58cef4eb31768e614ccef489105e450f6a6a5a8f0136590f039e96df5777b8b0ff31a01b3e3e1a5ada9e62f0da3d492fba99f6e8a3b5be97eec4611f2ba9964ae3958b1d8456e6cb8fe03a846dba03bae4159929bc0c811aabf7cd52f09f033b0fd149a95f9010014e7636e56fdb28ecd57583c8a9140f03f1b779e2f8e991a592f17d961e8c2022b5cbf9361e963e7b602d3edef9bbf5a649293ac642827c4f32ed466920400c5e17c95fa19d3e36f83a360c4c9320ae98a3d1e17516d5ffd31da4f4c4a86c3da39091a8389919ec734b48977b4eabece179055fb46232bc0a1e290fbeaa8748cedaf5bd9aa533c48c098d0a7b11f268a4c7c4a969128ff105f0a3c450ab639c3c6b8ffd557f0999d28f169f1a78ce12a0cf5de74ada5f5541d1b0a26c5e720b3e2c13271085bb191a62b2b321ab902e8f2d899b759f64649490fd65fdd8753d41234d1b85135754566399542e2dafe853817d0a467ff81113a825abe8b2366298d6b74b8ccd63074418e2856d7870222ce7ace1835ce2427964d3b3d2b0350a9846ad8f3edba341774ecf3cf253168b95948e2b3da85db3631cf9ff4bdae761f37c2b2262607646c6d99bc0b7412ac85"}}]}, @TCA_EMATCH_TREE_LIST={0x70, 0x2, 0x0, 0x1, [@TCF_EM_NBYTE={0x14, 0x2, 0x0, 0x0, {{0x40, 0x2, 0xf648}, {0x5a, 0x2, 0x1, "65f3"}}}, @TCF_EM_IPSET={0x10, 0x3, 0x0, 0x0, {{0x3, 0x8, 0x8}, {0x0, 0x6, 0x3}}}, @TCF_EM_U32={0x1c, 0x2, 0x0, 0x0, {{0xfff, 0x3, 0x81}, {0xbb9, 0x0, 0xc, 0x4005}}}, @TCF_EM_U32={0x1c, 0x3, 0x0, 0x0, {{0x9, 0x3, 0x2}, {0xd2, 0xff, 0x2, 0x4d6c}}}, @TCF_EM_META={0x10, 0x1, 0x0, 0x0, {{0x4, 0x4, 0x1}, [@TCA_EM_META_LVALUE={0x4}]}}]}, @TCA_EMATCH_TREE_HDR={0x8}, @TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x7}}]}]}}]}, 0x116c}}, 0x48800) write$tun(r1, &(0x7f0000000140)=ANY=[], 0x20) 216.453725ms ago: executing program 0 (id=1325): r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000c00)=ANY=[@ANYBLOB="140000001000010000000000000000000300000a3c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc380000000e0a0102001b3d000000000000000a0000020900010073797a31000000000900020073797a31000000000c0003800800008004000180140000001100010000000000000000000100"], 0x9c}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmmsg$inet6(r0, &(0x7f0000005fc0)=[{{&(0x7f0000000400)={0xa, 0x4e23, 0x7ff, @mcast1, 0xfff}, 0x1c, 0x0, 0x0, &(0x7f0000001600)=[@rthdr_2292={{0x28, 0x29, 0x39, {0x32, 0x2, 0x2, 0x1, 0x0, [@private0]}}}], 0x28}}], 0x1, 0x91) r2 = socket(0x400000000010, 0x3, 0x0) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, &(0x7f0000000000)={0x0, 0x6}, &(0x7f0000000040)=0x8) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r2, 0x6, 0x23, &(0x7f0000000440)={&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0, &(0x7f0000000140)=""/134, 0x86, 0x0, &(0x7f0000000380)=""/104, 0x68}, &(0x7f0000000480)=0x40) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'veth1_macvtap\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newtfilter={0x34, 0x2c, 0xf3f, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0xb, 0x9}, {0xf, 0xfff3}, {0xe, 0xb}}, [@filter_kind_options=@f_flower={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x8010}, 0x0) 195.742511ms ago: executing program 3 (id=1326): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x7) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)=ANY=[@ANYBLOB="50000000100039042abd70000000000000000000", @ANYRES32=0x0, @ANYRESOCT=r0], 0x50}, 0x1, 0x0, 0x0, 0x410c0}, 0x0) r2 = socket$inet_smc(0x2b, 0x1, 0x0) ioctl$XFS_IOC_GETVERSION(r1, 0x80087601, &(0x7f00000000c0)) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000040)=[@sack_perm, @timestamp, @window={0x3, 0x5, 0x3}, @timestamp], 0x4) socket$inet6(0xa, 0x80000, 0xfffffffd) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000000)={0x0, 0x8847, &(0x7f0000000140)=[{&(0x7f0000000180)="d8000000180081064e81f782db4cb904021d0800fd007c05e8fe55a10a0007000140020203600e4109000800ac00060311000000040012000a00f6000000035c3b61c1d67f6f94007134cf6efb8000a007a290457f01a7cee4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5ae24e25ccca9e00360db79826835d3a71d95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703920723f9000000008af26c8b7b55f4d2a6823a45f28fcb1d", 0xd8}], 0x1}, 0x0) 1.147901ms ago: executing program 0 (id=1327): r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r0, 0x11b, 0x2, &(0x7f0000000140)=0x400, 0x4) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4) mmap(&(0x7f0000196000/0x1000)=nil, 0x1000, 0x0, 0x840000000000a132, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='freezer.parent_freezing\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetlb.2MB.rsvd.usage_in_bytes\x00', 0x275a, 0x0) mmap(&(0x7f0000215000/0x1000)=nil, 0x1000, 0x0, 0x6011, r2, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000540)=ANY=[@ANYBLOB="f4000000290001000000000000000000fc020000000000000000000000000001fe8000000000000000000000000000200000000000020000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="be6b6e000000000050001100ac1414aa000000000000000000000000ffffffff0000000000000000fc020000000000000000000000000001ff0200000000000000000000000000013c040000080000000a000a0028001e"], 0xf4}, 0x1, 0x0, 0x0, 0x24000000}, 0x0) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000c, 0x11, r2, 0xaa0f4000) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000691000/0x4000)=nil, 0x4000, 0x1000002, 0x12, r4, 0x0) getsockname$packet(r4, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000100)=0x14) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) mmap(&(0x7f0000ff4000/0x3000)=nil, 0x3000, 0x2000004, 0x12, r5, 0xe6905000) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)) mmap(&(0x7f0000867000/0x2000)=nil, 0x2000, 0x0, 0x11, r4, 0x1000) mmap(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x0, 0x10012, r1, 0x0) 0s ago: executing program 3 (id=1328): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWSETELEM={0x90, 0xc, 0xa, 0x101, 0x0, 0x0, {0x2}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x64, 0x3, 0x0, 0x1, [{0x60, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0x10, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0xc, 0x1, '\x00\x00\x00\x00\x00\x00\x00\x00'}]}, @NFTA_SET_ELEM_KEY_END={0x4c, 0xa, 0x0, 0x1, [@NFTA_DATA_VALUE={0x45, 0x1, "48b67517eb1ddd691a230da6de5729935aa906cb60be0bb8142a6b2c5eabeab481bbf6be0edc3f47dcf53055754bcf3027c7fd246afc1725a14d72bdf4a2af7b44"}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0xb8}}, 0x0) (fail_nth: 9) kernel console output (not intermixed with test programs): 07][ T6796] net_ratelimit: 8 callbacks suppressed [ 107.622825][ T6796] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 108.162587][ T6814] netlink: 'syz.0.291': attribute type 1 has an invalid length. [ 108.292973][ T6814] bond5: entered promiscuous mode [ 108.304700][ T6814] 8021q: adding VLAN 0 to HW filter on device bond5 [ 108.417912][ T6818] openvswitch: netlink: IPv4 tunnel dst address is zero [ 108.588557][ T6831] FAULT_INJECTION: forcing a failure. [ 108.588557][ T6831] name failslab, interval 1, probability 0, space 0, times 0 [ 108.629854][ T6831] CPU: 1 UID: 0 PID: 6831 Comm: syz.4.294 Not tainted syzkaller #0 PREEMPT(full) [ 108.629878][ T6831] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 108.629888][ T6831] Call Trace: [ 108.629895][ T6831] [ 108.629902][ T6831] dump_stack_lvl+0xe8/0x150 [ 108.629928][ T6831] should_fail_ex+0x40c/0x560 [ 108.629959][ T6831] should_failslab+0xa8/0x100 [ 108.629981][ T6831] kmem_cache_alloc_noprof+0xa6/0x5f0 [ 108.629999][ T6831] ? skb_clone+0x212/0x3a0 [ 108.630015][ T6831] ? skb_clone+0x212/0x3a0 [ 108.630036][ T6831] skb_clone+0x212/0x3a0 [ 108.630052][ T6831] ? nfnetlink_rcv+0x4b0/0x28c0 [ 108.630072][ T6831] nfnetlink_rcv+0x4de/0x28c0 [ 108.630092][ T6831] ? __dev_queue_xmit+0x29b/0x3820 [ 108.630112][ T6831] ? __local_bh_enable_ip+0xd0/0x130 [ 108.630129][ T6831] ? lockdep_hardirqs_on+0x7a/0x110 [ 108.630150][ T6831] ? __dev_queue_xmit+0x29b/0x3820 [ 108.630166][ T6831] ? __local_bh_enable_ip+0xd0/0x130 [ 108.630179][ T6831] ? __dev_queue_xmit+0x29b/0x3820 [ 108.630194][ T6831] ? __dev_queue_xmit+0x1edc/0x3820 [ 108.630210][ T6831] ? do_syscall_64+0x174/0x580 [ 108.630229][ T6831] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 108.630256][ T6831] ? __dev_queue_xmit+0x29b/0x3820 [ 108.630273][ T6831] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 108.630299][ T6831] ? ref_tracker_free+0x689/0x830 [ 108.630319][ T6831] ? __pfx_ref_tracker_free+0x10/0x10 [ 108.630343][ T6831] ? __skb_clone+0x449/0x6c0 [ 108.630366][ T6831] ? skb_clone+0x246/0x3a0 [ 108.630387][ T6831] ? __netlink_deliver_tap+0x811/0x860 [ 108.630406][ T6831] ? netlink_deliver_tap+0x2e/0x1b0 [ 108.630430][ T6831] ? netlink_deliver_tap+0x2e/0x1b0 [ 108.630444][ T6831] ? netlink_deliver_tap+0x2e/0x1b0 [ 108.630463][ T6831] netlink_unicast+0x7bb/0x940 [ 108.630491][ T6831] netlink_sendmsg+0x813/0xb40 [ 108.630519][ T6831] ? __pfx_netlink_sendmsg+0x10/0x10 [ 108.630542][ T6831] ? aa_sock_msg_perm+0xf1/0x1b0 [ 108.630570][ T6831] ? __pfx_netlink_sendmsg+0x10/0x10 [ 108.630588][ T6831] sock_sendmsg_nosec+0x13a/0x180 [ 108.630613][ T6831] ____sys_sendmsg+0x54e/0x850 [ 108.630636][ T6831] ? __pfx_____sys_sendmsg+0x10/0x10 [ 108.630662][ T6831] ? import_iovec+0x73/0xa0 [ 108.630687][ T6831] ___sys_sendmsg+0x2a5/0x360 [ 108.630704][ T6831] ? __lock_acquire+0x683/0x2cf0 [ 108.630729][ T6831] ? __pfx____sys_sendmsg+0x10/0x10 [ 108.630780][ T6831] ? __fget_files+0x2a/0x420 [ 108.630799][ T6831] ? __fget_files+0x3a2/0x420 [ 108.630829][ T6831] __x64_sys_sendmsg+0x1b1/0x290 [ 108.630850][ T6831] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 108.630884][ T6831] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 108.630901][ T6831] do_syscall_64+0x174/0x580 [ 108.630919][ T6831] ? trace_irq_disable+0x3b/0x140 [ 108.630945][ T6831] ? clear_bhb_loop+0x70/0xc0 [ 108.630965][ T6831] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 108.630981][ T6831] RIP: 0033:0x7fe2e319e0d9 [ 108.630997][ T6831] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 108.631010][ T6831] RSP: 002b:00007fe2e3fd5028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 108.631028][ T6831] RAX: ffffffffffffffda RBX: 00007fe2e3425fa0 RCX: 00007fe2e319e0d9 [ 108.631040][ T6831] RDX: 0000000000000000 RSI: 0000200000000400 RDI: 0000000000000003 [ 108.631051][ T6831] RBP: 00007fe2e3fd5090 R08: 0000000000000000 R09: 0000000000000000 [ 108.631061][ T6831] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 108.631071][ T6831] R13: 00007fe2e3426038 R14: 00007fe2e3425fa0 R15: 00007fff2e55a758 [ 108.631099][ T6831] [ 108.995942][ T6833] netlink: 'syz.2.295': attribute type 21 has an invalid length. [ 109.004975][ T6833] netlink: 'syz.2.295': attribute type 1 has an invalid length. [ 109.615051][ T6871] __nla_validate_parse: 20 callbacks suppressed [ 109.615094][ T6871] netlink: 12 bytes leftover after parsing attributes in process `syz.1.303'. [ 109.759388][ T6861] virt_wifi0: default qdisc (pfifo_fast) fail, fallback to noqueue [ 109.908683][ T6899] netlink: 4 bytes leftover after parsing attributes in process `syz.0.305'. [ 109.985045][ T6897] netlink: 8 bytes leftover after parsing attributes in process `syz.4.308'. [ 110.104021][ T6909] netlink: 8 bytes leftover after parsing attributes in process `syz.1.310'. [ 110.156531][ T6913] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 110.213353][ T6913] netlink: 44 bytes leftover after parsing attributes in process `syz.4.312'. [ 110.400666][ T6925] netlink: 24 bytes leftover after parsing attributes in process `syz.0.316'. [ 110.498988][ T6935] ip6gre0: Caught tx_queue_len zero misconfig [ 110.608692][ T6938] netlink: 'syz.4.318': attribute type 1 has an invalid length. [ 110.777112][ T6947] netlink: 12 bytes leftover after parsing attributes in process `syz.4.321'. [ 110.831300][ T6947] 8021q: adding VLAN 0 to HW filter on device bond1 [ 111.111186][ T6970] netlink: 9 bytes leftover after parsing attributes in process `syz.4.325'. [ 111.132969][ T6968] netlink: 12 bytes leftover after parsing attributes in process `syz.3.326'. [ 111.146225][ T6970] 0·: renamed from hsr0 (while UP) [ 111.362372][ T6963] Cannot find set identified by id 0 to match [ 111.388143][ T6970] 0·: entered allmulticast mode [ 111.397104][ T6970] hsr_slave_0: entered allmulticast mode [ 111.403405][ T6970] hsr_slave_1: entered allmulticast mode [ 111.407432][ T6975] netlink: 8 bytes leftover after parsing attributes in process `syz.0.327'. [ 111.410208][ T6970] A link change request failed with some changes committed already. Interface c0· may have been left with an inconsistent configuration, please check. [ 111.943859][ T7009] 8021q: adding VLAN 0 to HW filter on device bond3 [ 111.987784][ T7009] bridge0: port 2(bridge_slave_1) entered disabled state [ 111.995590][ T7009] bridge0: port 1(bridge_slave_0) entered disabled state [ 112.013149][ T7009] bridge0: left promiscuous mode [ 112.022767][ T7009] bridge0: port 2(bridge_slave_1) entered blocking state [ 112.030013][ T7009] bridge0: port 2(bridge_slave_1) entered forwarding state [ 112.037605][ T7009] bridge0: port 1(bridge_slave_0) entered blocking state [ 112.044840][ T7009] bridge0: port 1(bridge_slave_0) entered forwarding state [ 112.072829][ T7009] bond3: (slave bridge0): Enslaving as an active interface with an up link [ 112.339399][ T7022] syzkaller0: entered promiscuous mode [ 112.357973][ T7022] syzkaller0: entered allmulticast mode [ 112.505575][ T7038] netlink: 'syz.4.343': attribute type 24 has an invalid length. [ 113.907806][ T7038] bond0: option ad_actor_sys_prio: mode dependency failed, not supported in mode balance-rr(0) [ 114.397088][ T7077] netlink: 'syz.0.349': attribute type 4 has an invalid length. [ 114.516567][ T7084] netlink: 'syz.4.357': attribute type 24 has an invalid length. [ 114.538639][ T7085] ªªªªªª: renamed from vlan0 (while UP) [ 114.545094][ T7088] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth0_macvtap, syncid = 4, id = 0 [ 114.563127][ T7084] bond0: option ad_actor_sys_prio: mode dependency failed, not supported in mode balance-rr(0) [ 115.115677][ T7109] __nla_validate_parse: 7 callbacks suppressed [ 115.115699][ T7109] netlink: 20 bytes leftover after parsing attributes in process `syz.1.365'. [ 115.148871][ T7111] netlink: 12 bytes leftover after parsing attributes in process `syz.4.364'. [ 115.695645][ T7134] netlink: 'syz.0.370': attribute type 24 has an invalid length. [ 115.704122][ T7134] netlink: 8 bytes leftover after parsing attributes in process `syz.0.370'. [ 115.716455][ T7134] bond0: option ad_actor_sys_prio: mode dependency failed, not supported in mode balance-rr(0) [ 116.065713][ T7151] netlink: 8 bytes leftover after parsing attributes in process `syz.0.372'. [ 116.113460][ T7151] netlink: 20 bytes leftover after parsing attributes in process `syz.0.372'. [ 116.241783][ T7156] netlink: 'syz.3.376': attribute type 5 has an invalid length. [ 116.662792][ T7180] netlink: 'syz.1.383': attribute type 24 has an invalid length. [ 116.671419][ T7180] netlink: 8 bytes leftover after parsing attributes in process `syz.1.383'. [ 116.683119][ T7180] bond0: option ad_actor_sys_prio: mode dependency failed, not supported in mode balance-rr(0) [ 116.773717][ T7181] syzkaller0: entered promiscuous mode [ 116.781017][ T7181] syzkaller0: entered allmulticast mode [ 119.327839][ T7158] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 119.352007][ T7187] netlink: 'syz.2.384': attribute type 1 has an invalid length. [ 119.359946][ T7187] netlink: 248 bytes leftover after parsing attributes in process `syz.2.384'. [ 119.680856][ T7237] netlink: 16 bytes leftover after parsing attributes in process `syz.1.402'. [ 119.727167][ T7237] netlink: 84 bytes leftover after parsing attributes in process `syz.1.402'. [ 119.774667][ T7237] netlink: 16 bytes leftover after parsing attributes in process `syz.1.402'. [ 120.607202][ T7295] netlink: 'syz.0.420': attribute type 12 has an invalid length. [ 120.767264][ T7297] netlink: 'syz.3.422': attribute type 4 has an invalid length. [ 120.962817][ T7315] __nla_validate_parse: 4 callbacks suppressed [ 120.962833][ T7315] netlink: 24 bytes leftover after parsing attributes in process `syz.4.427'. [ 121.013147][ T7312] netlink: 12 bytes leftover after parsing attributes in process `syz.0.426'. [ 121.046045][ T7317] x_tables: duplicate underflow at hook 1 [ 121.278005][ T7332] netlink: 'syz.4.432': attribute type 49 has an invalid length. [ 121.732083][ T7361] netlink: 'syz.4.441': attribute type 3 has an invalid length. [ 121.956598][ T7372] netlink: 16 bytes leftover after parsing attributes in process `syz.3.447'. [ 122.241346][ T7387] netlink: 12 bytes leftover after parsing attributes in process `syz.4.453'. [ 122.279738][ T7387] 8021q: adding VLAN 0 to HW filter on device bond2 [ 122.401584][ T7395] FAULT_INJECTION: forcing a failure. [ 122.401584][ T7395] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 122.429354][ T7395] CPU: 0 UID: 0 PID: 7395 Comm: syz.3.454 Not tainted syzkaller #0 PREEMPT(full) [ 122.429376][ T7395] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 122.429385][ T7395] Call Trace: [ 122.429392][ T7395] [ 122.429398][ T7395] dump_stack_lvl+0xe8/0x150 [ 122.429437][ T7395] should_fail_ex+0x40c/0x560 [ 122.429458][ T7395] _copy_to_user+0x31/0xb0 [ 122.429481][ T7395] simple_read_from_buffer+0xe1/0x170 [ 122.429507][ T7395] proc_fail_nth_read+0x1bb/0x230 [ 122.429533][ T7395] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 122.429557][ T7395] ? rw_verify_area+0x24a/0x4c0 [ 122.429581][ T7395] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 122.429602][ T7395] vfs_read+0x213/0xa80 [ 122.429629][ T7395] ? __pfx___mutex_lock+0x10/0x10 [ 122.429660][ T7395] ? __pfx_vfs_read+0x10/0x10 [ 122.429685][ T7395] ? __fget_files+0x2a/0x420 [ 122.429709][ T7395] ? __fget_files+0x3a2/0x420 [ 122.429726][ T7395] ? __fget_files+0x2a/0x420 [ 122.429751][ T7395] ksys_read+0x150/0x270 [ 122.429777][ T7395] ? __pfx_ksys_read+0x10/0x10 [ 122.429809][ T7395] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 122.429827][ T7395] do_syscall_64+0x174/0x580 [ 122.429849][ T7395] ? trace_irq_disable+0x3b/0x140 [ 122.429869][ T7395] ? clear_bhb_loop+0x70/0xc0 [ 122.429891][ T7395] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 122.429908][ T7395] RIP: 0033:0x7f305ad5e90e [ 122.429930][ T7395] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 122.429944][ T7395] RSP: 002b:00007f305bb8cfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 122.429962][ T7395] RAX: ffffffffffffffda RBX: 00007f305bb8d6c0 RCX: 00007f305ad5e90e [ 122.429975][ T7395] RDX: 000000000000000f RSI: 00007f305bb8d0a0 RDI: 0000000000000005 [ 122.429985][ T7395] RBP: 00007f305bb8d090 R08: 0000000000000000 R09: 0000000000000000 [ 122.429996][ T7395] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 122.430006][ T7395] R13: 00007f305b026038 R14: 00007f305b025fa0 R15: 00007ffe63b43618 [ 122.430036][ T7395] [ 123.031571][ T7404] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 123.131406][ T7420] tunl0: Caught tx_queue_len zero misconfig [ 123.209152][ T7423] sctp: [Deprecated]: syz.1.462 (pid 7423) Use of int in max_burst socket option. [ 123.209152][ T7423] Use struct sctp_assoc_value instead [ 123.324402][ T7423] netlink: 20 bytes leftover after parsing attributes in process `syz.1.462'. [ 123.334757][ T7425] syzkaller0: entered promiscuous mode [ 123.362357][ T7425] syzkaller0: entered allmulticast mode [ 123.524108][ T7439] vlan2: entered promiscuous mode [ 123.543293][ T7439] bridge0: entered promiscuous mode [ 123.925937][ T7457] FAULT_INJECTION: forcing a failure. [ 123.925937][ T7457] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 123.949347][ T7457] CPU: 0 UID: 0 PID: 7457 Comm: syz.3.474 Not tainted syzkaller #0 PREEMPT(full) [ 123.949370][ T7457] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 123.949378][ T7457] Call Trace: [ 123.949384][ T7457] [ 123.949390][ T7457] dump_stack_lvl+0xe8/0x150 [ 123.949415][ T7457] should_fail_ex+0x40c/0x560 [ 123.949434][ T7457] _copy_from_user+0x2d/0xb0 [ 123.949454][ T7457] sk_setsockopt+0x2b5/0x2f10 [ 123.949481][ T7457] ? __pfx_sk_setsockopt+0x10/0x10 [ 123.949504][ T7457] ? aa_sk_perm+0x6d5/0x900 [ 123.949524][ T7457] ? __fget_files+0x2a/0x420 [ 123.949546][ T7457] ? __pfx_aa_sk_perm+0x10/0x10 [ 123.949567][ T7457] ? __fget_files+0x2a/0x420 [ 123.949581][ T7457] ? aa_sock_opt_perm+0xff/0x1a0 [ 123.949604][ T7457] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 123.949622][ T7457] do_sock_setsockopt+0x11b/0x1b0 [ 123.949640][ T7457] __x64_sys_setsockopt+0x13d/0x1b0 [ 123.949657][ T7457] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 123.949673][ T7457] do_syscall_64+0x174/0x580 [ 123.949694][ T7457] ? trace_irq_disable+0x3b/0x140 [ 123.949711][ T7457] ? clear_bhb_loop+0x70/0xc0 [ 123.949729][ T7457] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 123.949743][ T7457] RIP: 0033:0x7f305ad9e0d9 [ 123.949757][ T7457] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 123.949768][ T7457] RSP: 002b:00007f3058ff6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 123.949784][ T7457] RAX: ffffffffffffffda RBX: 00007f305b026090 RCX: 00007f305ad9e0d9 [ 123.949794][ T7457] RDX: 0000000000000009 RSI: 0000000000000001 RDI: 0000000000000003 [ 123.949802][ T7457] RBP: 00007f3058ff6090 R08: 0000000000000004 R09: 0000000000000000 [ 123.949811][ T7457] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000001 [ 123.949820][ T7457] R13: 00007f305b026128 R14: 00007f305b026090 R15: 00007ffe63b43618 [ 123.949844][ T7457] [ 124.249441][ T7462] netlink: 40 bytes leftover after parsing attributes in process `syz.1.476'. [ 124.320667][ T7465] netlink: 12 bytes leftover after parsing attributes in process `syz.2.477'. [ 124.562564][ T7480] openvswitch: netlink: IP tunnel dst address not specified [ 124.741727][ T7480] netlink: 48 bytes leftover after parsing attributes in process `syz.1.481'. [ 125.176973][ T7504] team_slave_1: Caught tx_queue_len zero misconfig [ 125.332477][ T7516] FAULT_INJECTION: forcing a failure. [ 125.332477][ T7516] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 125.353431][ T7516] CPU: 0 UID: 0 PID: 7516 Comm: syz.2.493 Not tainted syzkaller #0 PREEMPT(full) [ 125.353452][ T7516] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 125.353459][ T7516] Call Trace: [ 125.353465][ T7516] [ 125.353471][ T7516] dump_stack_lvl+0xe8/0x150 [ 125.353495][ T7516] should_fail_ex+0x40c/0x560 [ 125.353512][ T7516] _copy_to_user+0x31/0xb0 [ 125.353532][ T7516] simple_read_from_buffer+0xe1/0x170 [ 125.353555][ T7516] proc_fail_nth_read+0x1bb/0x230 [ 125.353575][ T7516] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 125.353595][ T7516] ? rw_verify_area+0x24a/0x4c0 [ 125.353613][ T7516] ? __local_bh_enable_ip+0xd0/0x130 [ 125.353630][ T7516] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 125.353647][ T7516] vfs_read+0x213/0xa80 [ 125.353668][ T7516] ? __pfx___mutex_lock+0x10/0x10 [ 125.353685][ T7516] ? __pfx_vfs_read+0x10/0x10 [ 125.353703][ T7516] ? __fget_files+0x2a/0x420 [ 125.353723][ T7516] ? __fget_files+0x3a2/0x420 [ 125.353738][ T7516] ? __fget_files+0x2a/0x420 [ 125.353761][ T7516] ksys_read+0x150/0x270 [ 125.353788][ T7516] ? __pfx_ksys_read+0x10/0x10 [ 125.353811][ T7516] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 125.353827][ T7516] do_syscall_64+0x174/0x580 [ 125.353844][ T7516] ? trace_irq_disable+0x3b/0x140 [ 125.353860][ T7516] ? clear_bhb_loop+0x70/0xc0 [ 125.353877][ T7516] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 125.353899][ T7516] RIP: 0033:0x7f04cab5e90e [ 125.353913][ T7516] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 125.353924][ T7516] RSP: 002b:00007f04c8df5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 125.353941][ T7516] RAX: ffffffffffffffda RBX: 00007f04c8df66c0 RCX: 00007f04cab5e90e [ 125.353951][ T7516] RDX: 000000000000000f RSI: 00007f04c8df60a0 RDI: 0000000000000004 [ 125.353960][ T7516] RBP: 00007f04c8df6090 R08: 0000000000000000 R09: 0000000000000000 [ 125.353968][ T7516] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 125.353976][ T7516] R13: 00007f04cae26038 R14: 00007f04cae25fa0 R15: 00007ffe3e36e778 [ 125.354001][ T7516] [ 125.701933][ T7522] syzkaller0: entered promiscuous mode [ 125.707453][ T7522] syzkaller0: entered allmulticast mode [ 125.720276][ T7522] netlink: 16 bytes leftover after parsing attributes in process `syz.0.495'. [ 125.981593][ T7537] netlink: 40 bytes leftover after parsing attributes in process `syz.2.499'. [ 126.084796][ T7537] netlink: 'syz.2.499': attribute type 4 has an invalid length. [ 126.121227][ T7537] netlink: 152 bytes leftover after parsing attributes in process `syz.2.499'. [ 126.795230][ T7571] tipc: Started in network mode [ 126.820126][ T7571] tipc: Node identity f6c5e1071a2e, cluster identity 4711 [ 126.846820][ T7571] tipc: Enabled bearer , priority 0 [ 126.866790][ T7573] syzkaller0: entered promiscuous mode [ 126.881335][ T7573] syzkaller0: entered allmulticast mode [ 126.895947][ T7571] netlink: 48 bytes leftover after parsing attributes in process `syz.4.510'. [ 126.943749][ T7570] tipc: Resetting bearer [ 127.020668][ T7570] tipc: Disabling bearer [ 127.481942][ T7589] netlink: 4 bytes leftover after parsing attributes in process `syz.2.516'. [ 127.861012][ T7609] bridge0: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 127.895668][ T7609] bridge0: port 2(bridge_slave_1) entered disabled state [ 127.904879][ T7609] bridge0: port 1(bridge_slave_0) entered disabled state [ 128.135206][ T7626] netlink: 'syz.1.522': attribute type 2 has an invalid length. [ 128.176039][ T7627] netlink: 4 bytes leftover after parsing attributes in process `syz.0.520'. [ 128.406236][ T7638] netlink: 52 bytes leftover after parsing attributes in process `syz.3.524'. [ 128.426100][ T7638] netlink: 'syz.3.524': attribute type 1 has an invalid length. [ 128.605111][ T7641] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 128.674420][ T7641] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 128.795440][ T7642] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 131.019180][ T7626] : entered promiscuous mode [ 131.389348][ T7657] macsec1: entered allmulticast mode [ 131.407838][ T7657] dummy0: entered allmulticast mode [ 131.458628][ T7657] dummy0: entered promiscuous mode [ 131.484958][ T7657] dummy0: left allmulticast mode [ 131.506369][ T987] dummy0: left promiscuous mode [ 131.533402][ T7666] netlink: 8 bytes leftover after parsing attributes in process `syz.4.535'. [ 131.565604][ T7666] netlink: 'syz.4.535': attribute type 1 has an invalid length. [ 131.588970][ T7664] netlink: 4 bytes leftover after parsing attributes in process `syz.3.534'. [ 131.601767][ T7666] netlink: 8 bytes leftover after parsing attributes in process `syz.4.535'. [ 132.104455][ T7660] netlink: 56 bytes leftover after parsing attributes in process `syz.1.532'. [ 132.172335][ T7692] netlink: 8 bytes leftover after parsing attributes in process `syz.3.543'. [ 132.380439][ T7699] netlink: 12 bytes leftover after parsing attributes in process `syz.2.546'. [ 132.427105][ T7699] 8021q: adding VLAN 0 to HW filter on device bond4 [ 132.472431][ T7703] bond3: (slave bridge0): Releasing backup interface [ 132.502272][ T7703] bridge0: port 2(bridge_slave_1) entered blocking state [ 132.509546][ T7703] bridge0: port 2(bridge_slave_1) entered forwarding state [ 132.517218][ T7703] bridge0: port 1(bridge_slave_0) entered blocking state [ 132.524578][ T7703] bridge0: port 1(bridge_slave_0) entered forwarding state [ 132.578570][ T7703] bond4: (slave bridge0): Enslaving as an active interface with an up link [ 132.815330][ T7711] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 132.845783][ T1307] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.852774][ T1307] ieee802154 phy1 wpan1: encryption failed: -22 [ 135.623363][ T7719] v: renamed from dummy0 (while UP) [ 135.888145][ T7726] netdevsim netdevsim0: Direct firmware load for ./file0 failed with error -2 [ 135.902501][ T7731] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 135.911082][ T7726] netdevsim netdevsim0: Falling back to sysfs fallback for: ./file0 [ 136.138007][ T7745] syz_tun: left promiscuous mode [ 136.160734][ T7745] syz_tun: entered promiscuous mode [ 136.172629][ T7745] team0: Port device syz_tun added [ 136.372142][ T7753] FAULT_INJECTION: forcing a failure. [ 136.372142][ T7753] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 136.389657][ T7753] CPU: 1 UID: 0 PID: 7753 Comm: syz.2.562 Not tainted syzkaller #0 PREEMPT(full) [ 136.389679][ T7753] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 136.389692][ T7753] Call Trace: [ 136.389698][ T7753] [ 136.389704][ T7753] dump_stack_lvl+0xe8/0x150 [ 136.389732][ T7753] should_fail_ex+0x40c/0x560 [ 136.389753][ T7753] _copy_from_user+0x2d/0xb0 [ 136.389775][ T7753] __sys_bpf+0x2e7/0xd90 [ 136.389804][ T7753] ? __pfx___sys_bpf+0x10/0x10 [ 136.389843][ T7753] ? __fget_files+0x2a/0x420 [ 136.389879][ T7753] ? ksys_write+0x242/0x270 [ 136.389904][ T7753] ? __pfx_ksys_write+0x10/0x10 [ 136.389932][ T7753] __x64_sys_bpf+0xba/0xd0 [ 136.389950][ T7753] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 136.389968][ T7753] do_syscall_64+0x174/0x580 [ 136.389989][ T7753] ? trace_irq_disable+0x3b/0x140 [ 136.390008][ T7753] ? clear_bhb_loop+0x70/0xc0 [ 136.390037][ T7753] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 136.390053][ T7753] RIP: 0033:0x7f04cab9e0d9 [ 136.390069][ T7753] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 136.390082][ T7753] RSP: 002b:00007f04c8df6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 136.390100][ T7753] RAX: ffffffffffffffda RBX: 00007f04cae25fa0 RCX: 00007f04cab9e0d9 [ 136.390111][ T7753] RDX: 000000000000000c RSI: 00002000000003c0 RDI: 000000000000000a [ 136.390121][ T7753] RBP: 00007f04c8df6090 R08: 0000000000000000 R09: 0000000000000000 [ 136.390132][ T7753] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 136.390142][ T7753] R13: 00007f04cae26038 R14: 00007f04cae25fa0 R15: 00007ffe3e36e778 [ 136.390166][ T7753] [ 137.049953][ T7782] netlink: 'syz.0.567': attribute type 3 has an invalid length. [ 137.501924][ T7804] netlink: 'syz.4.577': attribute type 11 has an invalid length. [ 137.576238][ T7776] netlink: 28 bytes leftover after parsing attributes in process `syz.1.569'. [ 137.611119][ T7809] netlink: 28 bytes leftover after parsing attributes in process `syz.3.578'. [ 137.956901][ T7827] netlink: 8 bytes leftover after parsing attributes in process `syz.2.582'. [ 137.992089][ T7827] netlink: 12 bytes leftover after parsing attributes in process `syz.2.582'. [ 138.011915][ T7827] netlink: 'syz.2.582': attribute type 12 has an invalid length. [ 138.143296][ T7837] netlink: 'syz.0.586': attribute type 153 has an invalid length. [ 138.565495][ T7863] netlink: 8 bytes leftover after parsing attributes in process `syz.3.590'. [ 138.906474][ T7833] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 139.623925][ T7827] netlink: 8 bytes leftover after parsing attributes in process `syz.2.582'. [ 139.658444][ T7827] netlink: 12 bytes leftover after parsing attributes in process `syz.2.582'. [ 139.680647][ T7827] netlink: 'syz.2.582': attribute type 12 has an invalid length. [ 139.755423][ T38] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 139.776469][ T38] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 139.791895][ T7866] netlink: 20 bytes leftover after parsing attributes in process `syz.4.591'. [ 139.820354][ T38] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 139.844505][ T38] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 140.065036][ T7882] syzkaller1: entered promiscuous mode [ 140.083950][ T7882] syzkaller1: entered allmulticast mode [ 140.143031][ T7880] netlink: 12 bytes leftover after parsing attributes in process `syz.2.595'. [ 140.291310][ T7897] netlink: 40 bytes leftover after parsing attributes in process `syz.1.596'. [ 140.471317][ T7873] batadv0: Caught tx_queue_len zero misconfig [ 140.721790][ T7903] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 140.782810][ T7903] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 140.827356][ T7903] bond0 (unregistering): Released all slaves [ 140.874852][ T7909] x_tables: duplicate underflow at hook 2 [ 143.135312][ T7922] netlink: 8 bytes leftover after parsing attributes in process `syz.4.608'. [ 143.274757][ T7933] netlink: 8 bytes leftover after parsing attributes in process `syz.1.611'. [ 143.374312][ T7935] netlink: 12 bytes leftover after parsing attributes in process `syz.3.612'. [ 143.557493][ T7949] netlink: 12 bytes leftover after parsing attributes in process `syz.2.616'. [ 143.742849][ T7955] netlink: 4 bytes leftover after parsing attributes in process `syz.4.619'. [ 143.769409][ T7955] netlink: 4 bytes leftover after parsing attributes in process `syz.4.619'. [ 143.780394][ T6892] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 143.818580][ T6892] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 143.849850][ T6892] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 143.864300][ T6887] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 144.043884][ T7976] netlink: 8 bytes leftover after parsing attributes in process `syz.2.625'. [ 144.407410][ T7991] bond5: option downdelay: invalid value (18446744073709551487) [ 144.426758][ T7991] bond5: option downdelay: allowed values 0 - 2147483647 [ 144.453192][ T7991] bond5 (unregistering): Released all slaves [ 144.571836][ T8000] FAULT_INJECTION: forcing a failure. [ 144.571836][ T8000] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 144.605219][ T8000] CPU: 0 UID: 0 PID: 8000 Comm: syz.4.633 Not tainted syzkaller #0 PREEMPT(full) [ 144.605244][ T8000] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 144.605253][ T8000] Call Trace: [ 144.605260][ T8000] [ 144.605267][ T8000] dump_stack_lvl+0xe8/0x150 [ 144.605295][ T8000] should_fail_ex+0x40c/0x560 [ 144.605317][ T8000] _copy_from_iter+0x1d3/0x1660 [ 144.605336][ T8000] ? kmem_cache_alloc_node_noprof+0x1c1/0x610 [ 144.605358][ T8000] ? rcu_is_watching+0x15/0xb0 [ 144.605382][ T8000] ? trace_kmem_cache_alloc+0x29/0xe0 [ 144.605402][ T8000] ? kmem_cache_alloc_node_noprof+0x3b8/0x610 [ 144.605421][ T8000] ? __pfx__copy_from_iter+0x10/0x10 [ 144.605439][ T8000] ? __alloc_skb+0x276/0x7a0 [ 144.605462][ T8000] ? __alloc_skb+0x276/0x7a0 [ 144.605496][ T8000] ? netlink_sendmsg+0x650/0xb40 [ 144.605515][ T8000] ? skb_put+0x112/0x210 [ 144.605534][ T8000] netlink_sendmsg+0x6c0/0xb40 [ 144.605562][ T8000] ? __pfx_netlink_sendmsg+0x10/0x10 [ 144.605584][ T8000] ? aa_sock_msg_perm+0xf1/0x1b0 [ 144.605613][ T8000] ? __pfx_netlink_sendmsg+0x10/0x10 [ 144.605630][ T8000] sock_sendmsg_nosec+0x13a/0x180 [ 144.605655][ T8000] ____sys_sendmsg+0x54e/0x850 [ 144.605679][ T8000] ? __pfx_____sys_sendmsg+0x10/0x10 [ 144.605705][ T8000] ? import_iovec+0x73/0xa0 [ 144.605726][ T8000] ___sys_sendmsg+0x2a5/0x360 [ 144.605743][ T8000] ? __lock_acquire+0x683/0x2cf0 [ 144.605763][ T8000] ? __pfx____sys_sendmsg+0x10/0x10 [ 144.605806][ T8000] ? __fget_files+0x2a/0x420 [ 144.605824][ T8000] ? __fget_files+0x3a2/0x420 [ 144.605848][ T8000] __x64_sys_sendmsg+0x1b1/0x290 [ 144.605866][ T8000] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 144.605898][ T8000] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 144.605915][ T8000] do_syscall_64+0x174/0x580 [ 144.605933][ T8000] ? trace_irq_disable+0x3b/0x140 [ 144.605955][ T8000] ? clear_bhb_loop+0x70/0xc0 [ 144.605975][ T8000] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 144.605991][ T8000] RIP: 0033:0x7fe2e319e0d9 [ 144.606006][ T8000] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 144.606018][ T8000] RSP: 002b:00007fe2e3fd5028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 144.606035][ T8000] RAX: ffffffffffffffda RBX: 00007fe2e3425fa0 RCX: 00007fe2e319e0d9 [ 144.606046][ T8000] RDX: 0000000020008000 RSI: 00002000000002c0 RDI: 0000000000000009 [ 144.606055][ T8000] RBP: 00007fe2e3fd5090 R08: 0000000000000000 R09: 0000000000000000 [ 144.606063][ T8000] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 144.606072][ T8000] R13: 00007fe2e3426038 R14: 00007fe2e3425fa0 R15: 00007fff2e55a758 [ 144.606105][ T8000] [ 145.144233][ T8009] trusted_key: syz.2.637 sent an empty control message without MSG_MORE. [ 145.144689][ T8011] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 145.264409][ T8016] netlink: 8 bytes leftover after parsing attributes in process `syz.1.640'. [ 145.313347][ T8019] FAULT_INJECTION: forcing a failure. [ 145.313347][ T8019] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 145.324877][ T8020] IPVS: sync thread started: state = BACKUP, mcast_ifn = vcan0, syncid = 0, id = 0 [ 145.354719][ T8019] CPU: 0 UID: 0 PID: 8019 Comm: syz.3.641 Not tainted syzkaller #0 PREEMPT(full) [ 145.354745][ T8019] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 145.354754][ T8019] Call Trace: [ 145.354761][ T8019] [ 145.354769][ T8019] dump_stack_lvl+0xe8/0x150 [ 145.354799][ T8019] should_fail_ex+0x40c/0x560 [ 145.354823][ T8019] _copy_from_iter+0x1d3/0x1660 [ 145.354841][ T8019] ? kmem_cache_alloc_node_noprof+0x1c1/0x610 [ 145.354863][ T8019] ? rcu_is_watching+0x15/0xb0 [ 145.354887][ T8019] ? trace_kmem_cache_alloc+0x29/0xe0 [ 145.354908][ T8019] ? kmem_cache_alloc_node_noprof+0x3b8/0x610 [ 145.354934][ T8019] ? __pfx__copy_from_iter+0x10/0x10 [ 145.354953][ T8019] ? __alloc_skb+0x276/0x7a0 [ 145.354976][ T8019] ? __alloc_skb+0x276/0x7a0 [ 145.355004][ T8019] ? netlink_sendmsg+0x650/0xb40 [ 145.355023][ T8019] ? skb_put+0x112/0x210 [ 145.355042][ T8019] netlink_sendmsg+0x6c0/0xb40 [ 145.355071][ T8019] ? __pfx_netlink_sendmsg+0x10/0x10 [ 145.355094][ T8019] ? aa_sock_msg_perm+0xf1/0x1b0 [ 145.355122][ T8019] ? __pfx_netlink_sendmsg+0x10/0x10 [ 145.355140][ T8019] sock_sendmsg_nosec+0x13a/0x180 [ 145.355165][ T8019] ____sys_sendmsg+0x54e/0x850 [ 145.355189][ T8019] ? __pfx_____sys_sendmsg+0x10/0x10 [ 145.355215][ T8019] ? import_iovec+0x73/0xa0 [ 145.355239][ T8019] ___sys_sendmsg+0x2a5/0x360 [ 145.355255][ T8019] ? __lock_acquire+0x683/0x2cf0 [ 145.355280][ T8019] ? __pfx____sys_sendmsg+0x10/0x10 [ 145.355332][ T8019] ? __fget_files+0x2a/0x420 [ 145.355352][ T8019] ? __fget_files+0x3a2/0x420 [ 145.355382][ T8019] __x64_sys_sendmsg+0x1b1/0x290 [ 145.355403][ T8019] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 145.355437][ T8019] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 145.355455][ T8019] do_syscall_64+0x174/0x580 [ 145.355481][ T8019] ? trace_irq_disable+0x3b/0x140 [ 145.355500][ T8019] ? clear_bhb_loop+0x70/0xc0 [ 145.355521][ T8019] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 145.355538][ T8019] RIP: 0033:0x7f305ad9e0d9 [ 145.355554][ T8019] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 145.355567][ T8019] RSP: 002b:00007f305bb8d028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 145.355585][ T8019] RAX: ffffffffffffffda RBX: 00007f305b025fa0 RCX: 00007f305ad9e0d9 [ 145.355595][ T8019] RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000000000000003 [ 145.355604][ T8019] RBP: 00007f305bb8d090 R08: 0000000000000000 R09: 0000000000000000 [ 145.355614][ T8019] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 145.355624][ T8019] R13: 00007f305b026038 R14: 00007f305b025fa0 R15: 00007ffe63b43618 [ 145.355656][ T8019] [ 145.778658][ T8028] xt_hashlimit: size too large, truncated to 1048576 [ 145.897592][ T8035] bridge0: port 1(bridge_slave_0) entered disabled state [ 145.926729][ T8035] bridge_slave_0 (unregistering): left allmulticast mode [ 145.934665][ T8035] bridge_slave_0 (unregistering): left promiscuous mode [ 145.942403][ T8035] bridge0: port 1(bridge_slave_0) entered disabled state [ 145.972080][ T8040] FAULT_INJECTION: forcing a failure. [ 145.972080][ T8040] name failslab, interval 1, probability 0, space 0, times 0 [ 146.000718][ T8040] CPU: 0 UID: 0 PID: 8040 Comm: syz.2.647 Not tainted syzkaller #0 PREEMPT(full) [ 146.000743][ T8040] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 146.000753][ T8040] Call Trace: [ 146.000760][ T8040] [ 146.000767][ T8040] dump_stack_lvl+0xe8/0x150 [ 146.000794][ T8040] should_fail_ex+0x40c/0x560 [ 146.000817][ T8040] should_failslab+0xa8/0x100 [ 146.000842][ T8040] kmem_cache_alloc_noprof+0xa6/0x5f0 [ 146.000863][ T8040] ? skb_clone+0x212/0x3a0 [ 146.000881][ T8040] ? skb_clone+0x212/0x3a0 [ 146.000906][ T8040] skb_clone+0x212/0x3a0 [ 146.000927][ T8040] __netlink_deliver_tap+0x413/0x860 [ 146.000957][ T8040] ? netlink_deliver_tap+0x2e/0x1b0 [ 146.000977][ T8040] netlink_deliver_tap+0x19c/0x1b0 [ 146.000997][ T8040] netlink_unicast+0x77f/0x940 [ 146.001023][ T8040] netlink_sendmsg+0x813/0xb40 [ 146.001051][ T8040] ? __pfx_netlink_sendmsg+0x10/0x10 [ 146.001072][ T8040] ? aa_sock_msg_perm+0xf1/0x1b0 [ 146.001101][ T8040] ? __pfx_netlink_sendmsg+0x10/0x10 [ 146.001118][ T8040] sock_sendmsg_nosec+0x13a/0x180 [ 146.001143][ T8040] ____sys_sendmsg+0x54e/0x850 [ 146.001166][ T8040] ? __pfx_____sys_sendmsg+0x10/0x10 [ 146.001194][ T8040] ? import_iovec+0x73/0xa0 [ 146.001218][ T8040] ___sys_sendmsg+0x2a5/0x360 [ 146.001235][ T8040] ? __lock_acquire+0x683/0x2cf0 [ 146.001260][ T8040] ? __pfx____sys_sendmsg+0x10/0x10 [ 146.001322][ T8040] ? __fget_files+0x2a/0x420 [ 146.001342][ T8040] ? __fget_files+0x3a2/0x420 [ 146.001372][ T8040] __x64_sys_sendmsg+0x1b1/0x290 [ 146.001391][ T8040] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 146.001427][ T8040] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 146.001445][ T8040] do_syscall_64+0x174/0x580 [ 146.001464][ T8040] ? trace_irq_disable+0x3b/0x140 [ 146.001483][ T8040] ? clear_bhb_loop+0x70/0xc0 [ 146.001503][ T8040] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 146.001516][ T8040] RIP: 0033:0x7f04cab9e0d9 [ 146.001533][ T8040] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 146.001546][ T8040] RSP: 002b:00007f04c8dd5028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 146.001563][ T8040] RAX: ffffffffffffffda RBX: 00007f04cae26090 RCX: 00007f04cab9e0d9 [ 146.001575][ T8040] RDX: 0000000020008000 RSI: 00002000000002c0 RDI: 000000000000000a [ 146.001585][ T8040] RBP: 00007f04c8dd5090 R08: 0000000000000000 R09: 0000000000000000 [ 146.001595][ T8040] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 146.001603][ T8040] R13: 00007f04cae26128 R14: 00007f04cae26090 R15: 00007ffe3e36e778 [ 146.001632][ T8040] [ 146.925802][ T8062] netlink: 'syz.2.651': attribute type 7 has an invalid length. [ 146.958848][ T8062] netlink: 148 bytes leftover after parsing attributes in process `syz.2.651'. [ 147.092477][ T8075] Cannot find set identified by id 0 to match [ 147.092477][ T8073] Cannot find set identified by id 0 to match [ 147.318621][ T8081] FAULT_INJECTION: forcing a failure. [ 147.318621][ T8081] name failslab, interval 1, probability 0, space 0, times 0 [ 147.365086][ T8081] CPU: 0 UID: 0 PID: 8081 Comm: syz.4.656 Not tainted syzkaller #0 PREEMPT(full) [ 147.365108][ T8081] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 147.365116][ T8081] Call Trace: [ 147.365122][ T8081] [ 147.365127][ T8081] dump_stack_lvl+0xe8/0x150 [ 147.365150][ T8081] should_fail_ex+0x40c/0x560 [ 147.365168][ T8081] should_failslab+0xa8/0x100 [ 147.365188][ T8081] kmem_cache_alloc_noprof+0xa6/0x5f0 [ 147.365204][ T8081] ? skb_clone+0x212/0x3a0 [ 147.365220][ T8081] ? skb_clone+0x212/0x3a0 [ 147.365238][ T8081] skb_clone+0x212/0x3a0 [ 147.365255][ T8081] __netlink_deliver_tap+0x413/0x860 [ 147.365278][ T8081] ? netlink_deliver_tap+0x2e/0x1b0 [ 147.365294][ T8081] netlink_deliver_tap+0x19c/0x1b0 [ 147.365309][ T8081] netlink_unicast+0x77f/0x940 [ 147.365330][ T8081] netlink_sendmsg+0x813/0xb40 [ 147.365351][ T8081] ? __pfx_netlink_sendmsg+0x10/0x10 [ 147.365377][ T8081] ? aa_sock_msg_perm+0xf1/0x1b0 [ 147.365400][ T8081] ? __pfx_netlink_sendmsg+0x10/0x10 [ 147.365417][ T8081] sock_sendmsg_nosec+0x13a/0x180 [ 147.365437][ T8081] ____sys_sendmsg+0x54e/0x850 [ 147.365455][ T8081] ? __pfx_____sys_sendmsg+0x10/0x10 [ 147.365476][ T8081] ? import_iovec+0x73/0xa0 [ 147.365495][ T8081] ___sys_sendmsg+0x2a5/0x360 [ 147.365508][ T8081] ? __lock_acquire+0x683/0x2cf0 [ 147.365527][ T8081] ? __pfx____sys_sendmsg+0x10/0x10 [ 147.365567][ T8081] ? __fget_files+0x2a/0x420 [ 147.365582][ T8081] ? __fget_files+0x3a2/0x420 [ 147.365604][ T8081] __x64_sys_sendmsg+0x1b1/0x290 [ 147.365620][ T8081] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 147.365647][ T8081] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 147.365661][ T8081] do_syscall_64+0x174/0x580 [ 147.365678][ T8081] ? trace_irq_disable+0x3b/0x140 [ 147.365694][ T8081] ? clear_bhb_loop+0x70/0xc0 [ 147.365710][ T8081] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 147.365722][ T8081] RIP: 0033:0x7fe2e319e0d9 [ 147.365735][ T8081] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 147.365745][ T8081] RSP: 002b:00007fe2e3fd5028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 147.365759][ T8081] RAX: ffffffffffffffda RBX: 00007fe2e3425fa0 RCX: 00007fe2e319e0d9 [ 147.365769][ T8081] RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000000000000003 [ 147.365776][ T8081] RBP: 00007fe2e3fd5090 R08: 0000000000000000 R09: 0000000000000000 [ 147.365784][ T8081] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 147.365792][ T8081] R13: 00007fe2e3426038 R14: 00007fe2e3425fa0 R15: 00007fff2e55a758 [ 147.365813][ T8081] [ 147.643672][ T8090] netlink: 12 bytes leftover after parsing attributes in process `syz.0.659'. [ 147.667673][ T8085] FAULT_INJECTION: forcing a failure. [ 147.667673][ T8085] name failslab, interval 1, probability 0, space 0, times 0 [ 147.701849][ T8085] CPU: 0 UID: 0 PID: 8085 Comm: syz.2.658 Not tainted syzkaller #0 PREEMPT(full) [ 147.701872][ T8085] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 147.701882][ T8085] Call Trace: [ 147.701888][ T8085] [ 147.701895][ T8085] dump_stack_lvl+0xe8/0x150 [ 147.701921][ T8085] should_fail_ex+0x40c/0x560 [ 147.701945][ T8085] should_failslab+0xa8/0x100 [ 147.701969][ T8085] __kmalloc_noprof+0xfe/0x720 [ 147.701990][ T8085] ? genl_family_rcv_msg_attrs_parse+0xd0/0x2f0 [ 147.702014][ T8085] ? genl_family_rcv_msg_attrs_parse+0xd0/0x2f0 [ 147.702042][ T8085] genl_family_rcv_msg_attrs_parse+0xd0/0x2f0 [ 147.702072][ T8085] genl_family_rcv_msg_doit+0xda/0x340 [ 147.702101][ T8085] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 147.702131][ T8085] ? apparmor_capable+0x126/0x170 [ 147.702152][ T8085] ? bpf_lsm_capable+0x9/0x20 [ 147.702171][ T8085] ? security_capable+0x7e/0x2c0 [ 147.702207][ T8085] genl_rcv_msg+0x614/0x7a0 [ 147.702235][ T8085] ? __pfx_genl_rcv_msg+0x10/0x10 [ 147.702256][ T8085] ? __pfx_ip_vs_genl_set_daemon+0x10/0x10 [ 147.702279][ T8085] ? __pfx_ref_tracker_free+0x10/0x10 [ 147.702307][ T8085] netlink_rcv_skb+0x226/0x4a0 [ 147.702327][ T8085] ? __pfx_genl_rcv_msg+0x10/0x10 [ 147.702350][ T8085] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 147.702383][ T8085] ? down_read+0x2be/0x330 [ 147.702410][ T8085] genl_rcv+0x28/0x40 [ 147.702430][ T8085] netlink_unicast+0x7bb/0x940 [ 147.702458][ T8085] netlink_sendmsg+0x813/0xb40 [ 147.702485][ T8085] ? __pfx_netlink_sendmsg+0x10/0x10 [ 147.702506][ T8085] ? aa_sock_msg_perm+0xf1/0x1b0 [ 147.702532][ T8085] ? __pfx_netlink_sendmsg+0x10/0x10 [ 147.702547][ T8085] sock_sendmsg_nosec+0x13a/0x180 [ 147.702571][ T8085] ____sys_sendmsg+0x54e/0x850 [ 147.702594][ T8085] ? __pfx_____sys_sendmsg+0x10/0x10 [ 147.702622][ T8085] ? import_iovec+0x73/0xa0 [ 147.702647][ T8085] ___sys_sendmsg+0x2a5/0x360 [ 147.702664][ T8085] ? __lock_acquire+0x683/0x2cf0 [ 147.702689][ T8085] ? __pfx____sys_sendmsg+0x10/0x10 [ 147.702742][ T8085] ? __fget_files+0x2a/0x420 [ 147.702761][ T8085] ? __fget_files+0x3a2/0x420 [ 147.702791][ T8085] __x64_sys_sendmsg+0x1b1/0x290 [ 147.702813][ T8085] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 147.702848][ T8085] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 147.702866][ T8085] do_syscall_64+0x174/0x580 [ 147.702887][ T8085] ? trace_irq_disable+0x3b/0x140 [ 147.702908][ T8085] ? clear_bhb_loop+0x70/0xc0 [ 147.702928][ T8085] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 147.702944][ T8085] RIP: 0033:0x7f04cab9e0d9 [ 147.702960][ T8085] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 147.702974][ T8085] RSP: 002b:00007f04c8df6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 147.702992][ T8085] RAX: ffffffffffffffda RBX: 00007f04cae25fa0 RCX: 00007f04cab9e0d9 [ 147.703004][ T8085] RDX: 0000000020008000 RSI: 00002000000002c0 RDI: 0000000000000009 [ 147.703015][ T8085] RBP: 00007f04c8df6090 R08: 0000000000000000 R09: 0000000000000000 [ 147.703025][ T8085] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 147.703034][ T8085] R13: 00007f04cae26038 R14: 00007f04cae25fa0 R15: 00007ffe3e36e778 [ 147.703063][ T8085] [ 148.483208][ T8112] netlink: 'syz.4.666': attribute type 1 has an invalid length. [ 148.543375][ T8112] 8021q: adding VLAN 0 to HW filter on device bond0 [ 148.741444][ T8134] geneve3: entered promiscuous mode [ 148.862368][ T8145] __nla_validate_parse: 2 callbacks suppressed [ 148.869640][ T8145] netlink: 8 bytes leftover after parsing attributes in process `syz.1.674'. [ 148.912241][ T8145] FAULT_INJECTION: forcing a failure. [ 148.912241][ T8145] name failslab, interval 1, probability 0, space 0, times 0 [ 148.980981][ T8150] netlink: 56 bytes leftover after parsing attributes in process `syz.2.676'. [ 148.987794][ T8145] CPU: 0 UID: 0 PID: 8145 Comm: syz.1.674 Not tainted syzkaller #0 PREEMPT(full) [ 148.987817][ T8145] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 148.987827][ T8145] Call Trace: [ 148.987833][ T8145] [ 148.987840][ T8145] dump_stack_lvl+0xe8/0x150 [ 148.987869][ T8145] should_fail_ex+0x40c/0x560 [ 148.987891][ T8145] should_failslab+0xa8/0x100 [ 148.987914][ T8145] kmem_cache_alloc_node_noprof+0xb3/0x610 [ 148.987932][ T8145] ? local_lock_release+0x9c/0x160 [ 148.987957][ T8145] ? __alloc_skb+0x1d7/0x7a0 [ 148.987978][ T8145] ? __alloc_skb+0x1d7/0x7a0 [ 148.988006][ T8145] __alloc_skb+0x1d7/0x7a0 [ 148.988031][ T8145] netlink_ack+0x136/0xb30 [ 148.988048][ T8145] ? __pfx_genl_rcv_msg+0x10/0x10 [ 148.988073][ T8145] ? __pfx_ref_tracker_free+0x10/0x10 [ 148.988101][ T8145] netlink_rcv_skb+0x2a4/0x4a0 [ 148.988119][ T8145] ? __pfx_genl_rcv_msg+0x10/0x10 [ 148.988143][ T8145] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 148.988174][ T8145] ? down_read+0x2be/0x330 [ 148.988208][ T8145] genl_rcv+0x28/0x40 [ 148.988227][ T8145] netlink_unicast+0x7bb/0x940 [ 148.988254][ T8145] netlink_sendmsg+0x813/0xb40 [ 148.988281][ T8145] ? __pfx_netlink_sendmsg+0x10/0x10 [ 148.988302][ T8145] ? aa_sock_msg_perm+0xf1/0x1b0 [ 148.988329][ T8145] ? __pfx_netlink_sendmsg+0x10/0x10 [ 148.988347][ T8145] sock_sendmsg_nosec+0x13a/0x180 [ 148.988371][ T8145] ____sys_sendmsg+0x54e/0x850 [ 148.988394][ T8145] ? __pfx_____sys_sendmsg+0x10/0x10 [ 148.988419][ T8145] ? import_iovec+0x73/0xa0 [ 148.988443][ T8145] ___sys_sendmsg+0x2a5/0x360 [ 148.988460][ T8145] ? __lock_acquire+0x683/0x2cf0 [ 148.988485][ T8145] ? __pfx____sys_sendmsg+0x10/0x10 [ 148.988534][ T8145] ? __fget_files+0x2a/0x420 [ 148.988553][ T8145] ? __fget_files+0x3a2/0x420 [ 148.988581][ T8145] __x64_sys_sendmsg+0x1b1/0x290 [ 148.988601][ T8145] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 148.988635][ T8145] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 148.988653][ T8145] do_syscall_64+0x174/0x580 [ 148.988673][ T8145] ? trace_irq_disable+0x3b/0x140 [ 148.988692][ T8145] ? clear_bhb_loop+0x70/0xc0 [ 148.988711][ T8145] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 148.988727][ T8145] RIP: 0033:0x7f98a6f9e0d9 [ 148.988742][ T8145] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 148.988755][ T8145] RSP: 002b:00007f98a7e0b028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 148.988773][ T8145] RAX: ffffffffffffffda RBX: 00007f98a7225fa0 RCX: 00007f98a6f9e0d9 [ 148.988784][ T8145] RDX: 0000000020008000 RSI: 00002000000002c0 RDI: 0000000000000009 [ 148.988795][ T8145] RBP: 00007f98a7e0b090 R08: 0000000000000000 R09: 0000000000000000 [ 148.988805][ T8145] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 148.988817][ T8145] R13: 00007f98a7226038 R14: 00007f98a7225fa0 R15: 00007fff2532e218 [ 148.988844][ T8145] [ 149.015474][ T8152] netlink: 12 bytes leftover after parsing attributes in process `syz.4.678'. [ 149.190737][ T8161] netlink: 16 bytes leftover after parsing attributes in process `syz.3.677'. [ 149.686344][ T8184] netlink: 12 bytes leftover after parsing attributes in process `syz.1.685'. [ 149.707290][ T8183] netlink: 'syz.2.686': attribute type 1 has an invalid length. [ 149.752881][ T8183] netlink: 'syz.2.686': attribute type 1 has an invalid length. [ 149.967671][ T8184] netlink: 8 bytes leftover after parsing attributes in process `syz.1.685'. [ 150.046544][ T8190] bond1: (slave macvlan1): Enslaving as an active interface with an up link [ 150.066773][ T8193] bond1 (unregistering): (slave macvlan1): Releasing backup interface [ 150.078134][ T8193] bond1 (unregistering): Released all slaves [ 150.170225][ T8184] bond1: option lacp_active: invalid value (5) [ 150.179391][ T8184] bond1 (unregistering): Released all slaves [ 150.188600][ T8178] syz.4.681 (8178) used greatest stack depth: 18280 bytes left [ 150.514703][ T8214] netlink: 8 bytes leftover after parsing attributes in process `syz.4.690'. [ 150.560731][ T8213] netlink: 40 bytes leftover after parsing attributes in process `syz.0.692'. [ 150.580969][ T8213] netlink: 40 bytes leftover after parsing attributes in process `syz.0.692'. [ 150.612931][ T8211] can: request_module (can-proto-5) failed. [ 150.639067][ T8220] netlink: 28 bytes leftover after parsing attributes in process `syz.2.695'. [ 150.821951][ T8230] netlink: 'syz.3.697': attribute type 1 has an invalid length. [ 151.282467][ T8264] dummy0: Caught tx_queue_len zero misconfig [ 151.310011][ T8264] netlink: 'syz.1.707': attribute type 1 has an invalid length. [ 151.469287][ T8276] gre0: Caught tx_queue_len zero misconfig [ 151.526561][ T8276] netlink: 'syz.1.712': attribute type 1 has an invalid length. [ 151.535971][ T8276] : renamed from dummy0 (while UP) [ 151.820995][ T8293] netdevsim netdevsim4: Direct firmware load for .® failed with error -2 [ 151.831829][ T8293] netdevsim netdevsim4: Falling back to sysfs fallback for: .® [ 152.136086][ T8311] FAULT_INJECTION: forcing a failure. [ 152.136086][ T8311] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 152.151094][ T8311] CPU: 1 UID: 0 PID: 8311 Comm: syz.3.720 Not tainted syzkaller #0 PREEMPT(full) [ 152.151118][ T8311] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 152.151128][ T8311] Call Trace: [ 152.151135][ T8311] [ 152.151142][ T8311] dump_stack_lvl+0xe8/0x150 [ 152.151168][ T8311] should_fail_ex+0x40c/0x560 [ 152.151187][ T8311] _copy_to_user+0x31/0xb0 [ 152.151211][ T8311] simple_read_from_buffer+0xe1/0x170 [ 152.151237][ T8311] proc_fail_nth_read+0x1bb/0x230 [ 152.151261][ T8311] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 152.151282][ T8311] ? rw_verify_area+0x24a/0x4c0 [ 152.151306][ T8311] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 152.151327][ T8311] vfs_read+0x213/0xa80 [ 152.151355][ T8311] ? __pfx___mutex_lock+0x10/0x10 [ 152.151377][ T8311] ? __pfx_vfs_read+0x10/0x10 [ 152.151400][ T8311] ? __fget_files+0x2a/0x420 [ 152.151432][ T8311] ? __fget_files+0x3a2/0x420 [ 152.151452][ T8311] ? __fget_files+0x2a/0x420 [ 152.151479][ T8311] ksys_read+0x150/0x270 [ 152.151503][ T8311] ? __pfx_ksys_read+0x10/0x10 [ 152.151533][ T8311] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 152.151552][ T8311] do_syscall_64+0x174/0x580 [ 152.151572][ T8311] ? trace_irq_disable+0x3b/0x140 [ 152.151591][ T8311] ? clear_bhb_loop+0x70/0xc0 [ 152.151610][ T8311] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 152.151626][ T8311] RIP: 0033:0x7f305ad5e90e [ 152.151641][ T8311] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 152.151651][ T8311] RSP: 002b:00007f305bb8cfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 152.151673][ T8311] RAX: ffffffffffffffda RBX: 00007f305bb8d6c0 RCX: 00007f305ad5e90e [ 152.151682][ T8311] RDX: 000000000000000f RSI: 00007f305bb8d0a0 RDI: 0000000000000004 [ 152.151689][ T8311] RBP: 00007f305bb8d090 R08: 0000000000000000 R09: 0000000000000000 [ 152.151696][ T8311] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 152.151703][ T8311] R13: 00007f305b026038 R14: 00007f305b025fa0 R15: 00007ffe63b43618 [ 152.151724][ T8311] [ 153.110523][ T8336] IPv6: addrconf: prefix option has invalid lifetime [ 154.446337][ T8288] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 154.815636][ T8374] __nla_validate_parse: 72 callbacks suppressed [ 154.815658][ T8374] netlink: 12 bytes leftover after parsing attributes in process `syz.1.735'. [ 154.924312][ T8379] netlink: 36 bytes leftover after parsing attributes in process `syz.3.737'. [ 154.982498][ T8381] netlink: 8 bytes leftover after parsing attributes in process `syz.3.737'. [ 155.017750][ T8383] vlan0: entered promiscuous mode [ 155.025540][ T8381] netlink: 12 bytes leftover after parsing attributes in process `syz.3.737'. [ 155.066447][ T8383] team0: Port device vlan0 added [ 155.072861][ T8381] netlink: 16 bytes leftover after parsing attributes in process `syz.3.737'. [ 155.199525][ T8391] netlink: 68 bytes leftover after parsing attributes in process `syz.2.742'. [ 155.522636][ T8404] netlink: 4 bytes leftover after parsing attributes in process `syz.3.746'. [ 155.550674][ T8404] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 155.656181][ T8404] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 155.869639][ T8415] netlink: 40 bytes leftover after parsing attributes in process `syz.0.750'. [ 155.948818][ T8415] netlink: 'syz.0.750': attribute type 4 has an invalid length. [ 155.982773][ T8415] netlink: 152 bytes leftover after parsing attributes in process `syz.0.750'. [ 156.165921][ T8427] gre0: left promiscuous mode [ 156.225582][ T8427] netlink: 136 bytes leftover after parsing attributes in process `syz.2.753'. [ 156.265273][ T8427] A link change request failed with some changes committed already. Interface gre0 may have been left with an inconsistent configuration, please check. [ 156.492247][ T8436] netlink: 'syz.4.757': attribute type 1 has an invalid length. [ 156.515620][ T8436] netlink: 'syz.4.757': attribute type 2 has an invalid length. [ 156.759034][ T8447] tipc: Failed to obtain node identity [ 156.787721][ T8447] tipc: Enabling of bearer rejected, failed to enable media [ 156.883462][ T8449] netlink: 'syz.4.759': attribute type 6 has an invalid length. [ 156.964042][ T8458] FAULT_INJECTION: forcing a failure. [ 156.964042][ T8458] name failslab, interval 1, probability 0, space 0, times 0 [ 156.990737][ T8458] CPU: 1 UID: 0 PID: 8458 Comm: syz.1.761 Not tainted syzkaller #0 PREEMPT(full) [ 156.990759][ T8458] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 156.990766][ T8458] Call Trace: [ 156.990772][ T8458] [ 156.990779][ T8458] dump_stack_lvl+0xe8/0x150 [ 156.990805][ T8458] should_fail_ex+0x40c/0x560 [ 156.990826][ T8458] should_failslab+0xa8/0x100 [ 156.990847][ T8458] kmem_cache_alloc_noprof+0xa6/0x5f0 [ 156.990875][ T8458] ? skb_clone+0x212/0x3a0 [ 156.990890][ T8458] ? skb_clone+0x212/0x3a0 [ 156.990911][ T8458] skb_clone+0x212/0x3a0 [ 156.990931][ T8458] __netlink_deliver_tap+0x413/0x860 [ 156.990955][ T8458] ? netlink_deliver_tap+0x2e/0x1b0 [ 156.990972][ T8458] netlink_deliver_tap+0x19c/0x1b0 [ 156.990989][ T8458] netlink_sendskb+0x68/0x140 [ 156.991006][ T8458] nfnetlink_rcv+0x260c/0x28c0 [ 156.991046][ T8458] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 156.991070][ T8458] ? ref_tracker_free+0x689/0x830 [ 156.991108][ T8458] ? skb_clone+0x246/0x3a0 [ 156.991126][ T8458] ? __netlink_deliver_tap+0x811/0x860 [ 156.991147][ T8458] ? netlink_deliver_tap+0x2e/0x1b0 [ 156.991163][ T8458] ? netlink_deliver_tap+0x2e/0x1b0 [ 156.991184][ T8458] netlink_unicast+0x7bb/0x940 [ 156.991207][ T8458] netlink_sendmsg+0x813/0xb40 [ 156.991232][ T8458] ? __pfx_netlink_sendmsg+0x10/0x10 [ 156.991253][ T8458] ? aa_sock_msg_perm+0xf1/0x1b0 [ 156.991277][ T8458] ? __pfx_netlink_sendmsg+0x10/0x10 [ 156.991291][ T8458] sock_sendmsg_nosec+0x13a/0x180 [ 156.991315][ T8458] ____sys_sendmsg+0x54e/0x850 [ 156.991335][ T8458] ? __pfx_____sys_sendmsg+0x10/0x10 [ 156.991360][ T8458] ? import_iovec+0x73/0xa0 [ 156.991384][ T8458] ___sys_sendmsg+0x2a5/0x360 [ 156.991400][ T8458] ? __lock_acquire+0x683/0x2cf0 [ 156.991419][ T8458] ? __pfx____sys_sendmsg+0x10/0x10 [ 156.991459][ T8458] ? __fget_files+0x2a/0x420 [ 156.991475][ T8458] ? __fget_files+0x3a2/0x420 [ 156.991499][ T8458] __x64_sys_sendmsg+0x1b1/0x290 [ 156.991516][ T8458] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 156.991546][ T8458] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 156.991562][ T8458] do_syscall_64+0x174/0x580 [ 156.991581][ T8458] ? trace_irq_disable+0x3b/0x140 [ 156.991599][ T8458] ? clear_bhb_loop+0x70/0xc0 [ 156.991617][ T8458] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 156.991632][ T8458] RIP: 0033:0x7f98a6f9e0d9 [ 156.991649][ T8458] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 156.991660][ T8458] RSP: 002b:00007f98a7e0b028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 156.991674][ T8458] RAX: ffffffffffffffda RBX: 00007f98a7225fa0 RCX: 00007f98a6f9e0d9 [ 156.991684][ T8458] RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000000000000003 [ 156.991693][ T8458] RBP: 00007f98a7e0b090 R08: 0000000000000000 R09: 0000000000000000 [ 156.991702][ T8458] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 156.991711][ T8458] R13: 00007f98a7226038 R14: 00007f98a7225fa0 R15: 00007fff2532e218 [ 156.991735][ T8458] [ 157.312001][ T8457] xt_hashlimit: size too large, truncated to 1048576 [ 157.553956][ T8468] A link change request failed with some changes committed already. Interface gre0 may have been left with an inconsistent configuration, please check. [ 157.908453][ T8489] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 158.131559][ T8499] FAULT_INJECTION: forcing a failure. [ 158.131559][ T8499] name failslab, interval 1, probability 0, space 0, times 0 [ 158.162538][ T8499] CPU: 0 UID: 0 PID: 8499 Comm: syz.1.776 Not tainted syzkaller #0 PREEMPT(full) [ 158.162564][ T8499] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 158.162574][ T8499] Call Trace: [ 158.162581][ T8499] [ 158.162588][ T8499] dump_stack_lvl+0xe8/0x150 [ 158.162617][ T8499] should_fail_ex+0x40c/0x560 [ 158.162640][ T8499] should_failslab+0xa8/0x100 [ 158.162665][ T8499] kmem_cache_alloc_noprof+0xa6/0x5f0 [ 158.162692][ T8499] ? skb_clone+0x212/0x3a0 [ 158.162709][ T8499] ? skb_clone+0x212/0x3a0 [ 158.162731][ T8499] skb_clone+0x212/0x3a0 [ 158.162753][ T8499] __netlink_deliver_tap+0x413/0x860 [ 158.162783][ T8499] ? netlink_deliver_tap+0x2e/0x1b0 [ 158.162802][ T8499] netlink_deliver_tap+0x19c/0x1b0 [ 158.162821][ T8499] netlink_sendskb+0x68/0x140 [ 158.162840][ T8499] nfnetlink_rcv+0x260c/0x28c0 [ 158.162889][ T8499] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 158.162922][ T8499] ? ref_tracker_free+0x689/0x830 [ 158.162964][ T8499] ? skb_clone+0x246/0x3a0 [ 158.162986][ T8499] ? __netlink_deliver_tap+0x811/0x860 [ 158.163012][ T8499] ? netlink_deliver_tap+0x2e/0x1b0 [ 158.163030][ T8499] ? netlink_deliver_tap+0x2e/0x1b0 [ 158.163053][ T8499] netlink_unicast+0x7bb/0x940 [ 158.163081][ T8499] netlink_sendmsg+0x813/0xb40 [ 158.163115][ T8499] ? __pfx_netlink_sendmsg+0x10/0x10 [ 158.163137][ T8499] ? aa_sock_msg_perm+0xf1/0x1b0 [ 158.163165][ T8499] ? __pfx_netlink_sendmsg+0x10/0x10 [ 158.163191][ T8499] sock_sendmsg_nosec+0x13a/0x180 [ 158.163217][ T8499] ____sys_sendmsg+0x54e/0x850 [ 158.163239][ T8499] ? __pfx_____sys_sendmsg+0x10/0x10 [ 158.163265][ T8499] ? import_iovec+0x73/0xa0 [ 158.163289][ T8499] ___sys_sendmsg+0x2a5/0x360 [ 158.163305][ T8499] ? __lock_acquire+0x683/0x2cf0 [ 158.163329][ T8499] ? __pfx____sys_sendmsg+0x10/0x10 [ 158.163380][ T8499] ? __fget_files+0x2a/0x420 [ 158.163399][ T8499] ? __fget_files+0x3a2/0x420 [ 158.163431][ T8499] __x64_sys_sendmsg+0x1b1/0x290 [ 158.163451][ T8499] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 158.163486][ T8499] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 158.163504][ T8499] do_syscall_64+0x174/0x580 [ 158.163524][ T8499] ? trace_irq_disable+0x3b/0x140 [ 158.163544][ T8499] ? clear_bhb_loop+0x70/0xc0 [ 158.163564][ T8499] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 158.163581][ T8499] RIP: 0033:0x7f98a6f9e0d9 [ 158.163598][ T8499] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 158.163610][ T8499] RSP: 002b:00007f98a7e0b028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 158.163629][ T8499] RAX: ffffffffffffffda RBX: 00007f98a7225fa0 RCX: 00007f98a6f9e0d9 [ 158.163641][ T8499] RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000000000000003 [ 158.163651][ T8499] RBP: 00007f98a7e0b090 R08: 0000000000000000 R09: 0000000000000000 [ 158.163661][ T8499] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 158.163670][ T8499] R13: 00007f98a7226038 R14: 00007f98a7225fa0 R15: 00007fff2532e218 [ 158.163699][ T8499] [ 158.809943][ T8504] netlink: 'syz.0.778': attribute type 4 has an invalid length. [ 158.821824][ T8506] A link change request failed with some changes committed already. Interface gre0 may have been left with an inconsistent configuration, please check. [ 158.892421][ T8509] netlink: 'syz.4.781': attribute type 22 has an invalid length. [ 159.430206][ T8517] bridge0: port 2(bridge_slave_1) entered disabled state [ 159.932010][ T8517] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 160.285697][ T8517] geneve2: left promiscuous mode [ 160.339400][ T8517] geneve3: left promiscuous mode [ 160.459060][ T8547] kthread_run failed with err -4 [ 160.532315][ T6886] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 160.565623][ T6886] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 160.592368][ T6886] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 160.669788][ T36] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 160.682457][ T8561] __nla_validate_parse: 8 callbacks suppressed [ 160.682474][ T8561] netlink: 156 bytes leftover after parsing attributes in process `syz.2.794'. [ 160.737522][ T8561] netlink: 8 bytes leftover after parsing attributes in process `syz.2.794'. [ 160.773281][ T8577] IPVS: sync thread started: state = BACKUP, mcast_ifn = vcan0, syncid = 0, id = 0 [ 160.834259][ T8571] netlink: 20 bytes leftover after parsing attributes in process `syz.3.797'. [ 161.092878][ T8593] netlink: 40 bytes leftover after parsing attributes in process `syz.3.801'. [ 161.124874][ T8596] netlink: 12 bytes leftover after parsing attributes in process `syz.0.802'. [ 161.157738][ T8593] netlink: 'syz.3.801': attribute type 4 has an invalid length. [ 161.176333][ T8593] netlink: 152 bytes leftover after parsing attributes in process `syz.3.801'. [ 161.248284][ T8593] 8021q: adding VLAN 0 to HW filter on device bond0 [ 161.325244][ T8605] netlink: 'syz.4.807': attribute type 2 has an invalid length. [ 161.345612][ T8605] netlink: 12 bytes leftover after parsing attributes in process `syz.4.807'. [ 161.386874][ T8605] netlink: 12 bytes leftover after parsing attributes in process `syz.4.807'. [ 161.389647][ T8608] netlink: 12 bytes leftover after parsing attributes in process `syz.0.808'. [ 161.421224][ T8610] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable [ 161.762458][ T8623] netlink: 8 bytes leftover after parsing attributes in process `syz.2.813'. [ 162.000929][ T8627] syzkaller0: entered promiscuous mode [ 162.018742][ T8627] syzkaller0: entered allmulticast mode [ 162.514211][ T8657] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 162.593352][ T8642] netlink: 'syz.1.820': attribute type 1 has an invalid length. [ 162.672554][ T8642] 8021q: adding VLAN 0 to HW filter on device bond1 [ 162.788587][ T8650] bond1: (slave gretap1): Enslaving as a backup interface with an up link [ 162.801024][ T6886] bond1: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 162.981698][ T6886] bond1: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 163.029511][ T8678] ip6gretap0: entered promiscuous mode [ 163.269990][ T8690] netlink: 'syz.0.833': attribute type 4 has an invalid length. [ 163.739105][ T8706] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 164.513627][ T8727] openvswitch: netlink: ufid size 41726 bytes exceeds the range (1, 16) [ 164.523180][ T8727] openvswitch: netlink: Message has 512 unknown bytes. [ 164.572644][ T8731] netlink: 'syz.2.848': attribute type 8 has an invalid length. [ 165.689085][ T8757] A link change request failed with some changes committed already. Interface gre1 may have been left with an inconsistent configuration, please check. [ 165.706548][ T8763] __nla_validate_parse: 6 callbacks suppressed [ 165.706568][ T8763] netlink: 40 bytes leftover after parsing attributes in process `syz.3.857'. [ 165.752818][ T8764] netlink: 12 bytes leftover after parsing attributes in process `syz.2.858'. [ 165.782158][ T8768] netlink: 'syz.3.857': attribute type 4 has an invalid length. [ 165.792498][ T8771] netlink: 20 bytes leftover after parsing attributes in process `syz.0.855'. [ 165.824779][ T8768] netlink: 152 bytes leftover after parsing attributes in process `syz.3.857'. [ 165.835583][ T8771] ksmbd: Unknown IPC event: 1, ignore. [ 165.870004][ T8764] 8021q: adding VLAN 0 to HW filter on device bond5 [ 165.885309][ T8774] bridge0: port 2(bridge_slave_1) entered disabled state [ 165.892832][ T8774] bridge0: port 1(bridge_slave_0) entered disabled state [ 165.938905][ T8774] bond4: (slave bridge0): Releasing backup interface [ 165.959266][ T8774] bridge0: port 2(bridge_slave_1) entered blocking state [ 165.966634][ T8774] bridge0: port 2(bridge_slave_1) entered forwarding state [ 165.974226][ T8774] bridge0: port 1(bridge_slave_0) entered blocking state [ 165.981441][ T8774] bridge0: port 1(bridge_slave_0) entered forwarding state [ 166.018343][ T8774] bond5: (slave bridge0): Enslaving as an active interface with an up link [ 166.137900][ T8784] netlink: 16 bytes leftover after parsing attributes in process `syz.4.865'. [ 166.796234][ T8806] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 166.809739][ T8804] netlink: 8 bytes leftover after parsing attributes in process `syz.0.868'. [ 166.836923][ T8806] netlink: 12 bytes leftover after parsing attributes in process `syz.4.869'. [ 166.895874][ T8810] netlink: 8 bytes leftover after parsing attributes in process `syz.1.870'. [ 167.148833][ T8817] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 167.274254][ T8824] netlink: 36 bytes leftover after parsing attributes in process `syz.3.874'. [ 167.339611][ T8822] netlink: 16 bytes leftover after parsing attributes in process `syz.3.874'. [ 168.134021][ T8865] bond2: option lp_interval: invalid value (0) [ 168.143250][ T8865] bond2: option lp_interval: allowed values 1 - 2147483647 [ 168.154456][ T8865] bond2 (unregistering): Released all slaves [ 168.438698][ T6888] IPVS: starting estimator thread 0... [ 168.570661][ T8884] IPVS: using max 28 ests per chain, 67200 per kthread [ 168.820726][ T8889] syzkaller1: entered promiscuous mode [ 168.829524][ T8889] syzkaller1: entered allmulticast mode [ 168.941940][ T8899] syzkaller0: entered promiscuous mode [ 168.952269][ T8899] syzkaller0: entered allmulticast mode [ 168.974203][ T8899] 0: reclassify loop, rule prio 0, protocol 700 [ 169.141511][ T8918] lo: Caught tx_queue_len zero misconfig [ 169.270488][ T8930] mac80211_hwsim hwsim3 syzkaller0: entered promiscuous mode [ 169.316289][ T8930] mac80211_hwsim hwsim3 syzkaller0: entered allmulticast mode [ 169.414774][ T8936] openvswitch: netlink: IP tunnel attribute has 8 unknown bytes. [ 169.442647][ T8936] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 169.617801][ T8936] tipc: Enabling of bearer rejected, failed to enable media [ 169.893533][ T8956] bridge0: port 1(vlan3) entered blocking state [ 169.927663][ T8956] bridge0: port 1(vlan3) entered disabled state [ 169.975255][ T8956] vlan3: entered allmulticast mode [ 169.995957][ T8956] geneve0: entered allmulticast mode [ 170.018496][ T8956] vlan3: entered promiscuous mode [ 170.033690][ T8956] geneve0: entered promiscuous mode [ 170.056481][ T8974] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 170.550461][ T8994] netlink: 'syz.3.907': attribute type 1 has an invalid length. [ 170.776140][ T9005] __nla_validate_parse: 6 callbacks suppressed [ 170.776159][ T9005] netlink: 8 bytes leftover after parsing attributes in process `syz.0.909'. [ 170.796550][ T9004] netlink: 8 bytes leftover after parsing attributes in process `syz.2.910'. [ 171.044990][ T8998] veth3: entered allmulticast mode [ 171.063991][ T8998] bond1: (slave veth3): Enslaving as an active interface with a down link [ 171.079077][ T8999] bond1: (slave veth0_to_bond): Enslaving as an active interface with a down link [ 171.115145][ T9007] macvlan2: entered promiscuous mode [ 171.121359][ T9007] macvlan2: entered allmulticast mode [ 171.127884][ T9022] netlink: 12 bytes leftover after parsing attributes in process `syz.1.914'. [ 171.128479][ T9007] bond1: entered promiscuous mode [ 171.146013][ T9007] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 171.155469][ T9007] bond1: left promiscuous mode [ 171.192201][ T9027] IPVS: sync thread started: state = BACKUP, mcast_ifn = vcan0, syncid = 0, id = 0 [ 171.373430][ T9032] netlink: 'syz.0.915': attribute type 3 has an invalid length. [ 171.383165][ T9032] netlink: 8 bytes leftover after parsing attributes in process `syz.0.915'. [ 171.481541][ T9022] 8021q: adding VLAN 0 to HW filter on device bond2 [ 171.522305][ T9039] syz_tun: left promiscuous mode [ 171.595930][ T9050] netlink: get zone limit has 4 unknown bytes [ 171.612253][ T9039] team0: Port device syz_tun removed [ 171.647227][ T9039] bond5: (slave bridge0): Releasing backup interface [ 171.666217][ T9039] bridge0: port 2(bridge_slave_1) entered disabled state [ 171.673647][ T9039] bridge0: port 1(bridge_slave_0) entered disabled state [ 171.704443][ T9039] bridge_slave_0: left allmulticast mode [ 171.716193][ T9039] bridge0: port 1(bridge_slave_0) entered disabled state [ 171.738660][ T9039] bridge_slave_1: left allmulticast mode [ 171.746587][ T9039] bridge0: port 2(bridge_slave_1) entered disabled state [ 171.763033][ T9039] bond0: (slave bond_slave_0): Releasing backup interface [ 171.783314][ T9039] bond0: (slave bond_slave_1): Releasing backup interface [ 171.818084][ T9039] team0: Port device team_slave_0 removed [ 171.841276][ T9039] team0: Port device team_slave_1 removed [ 171.860524][ T9039] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 171.877225][ T9026] bridge0: port 2(bridge_slave_1) entered disabled state [ 171.886122][ T9026] bridge0: port 1(bridge_slave_0) entered disabled state [ 171.921217][ T9026] bridge0: port 2(bridge_slave_1) entered blocking state [ 171.928442][ T9026] bridge0: port 2(bridge_slave_1) entered forwarding state [ 171.935999][ T9026] bridge0: port 1(bridge_slave_0) entered blocking state [ 171.943202][ T9026] bridge0: port 1(bridge_slave_0) entered forwarding state [ 171.970574][ T9026] bond2: (slave bridge0): Enslaving as an active interface with an up link [ 172.136514][ T9064] netlink: 8 bytes leftover after parsing attributes in process `syz.1.920'. [ 172.440877][ T76] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 172.476712][ T76] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 172.485005][ T9073] netlink: 8 bytes leftover after parsing attributes in process `syz.2.925'. [ 172.518054][ T76] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 172.556781][ T76] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 172.571870][ T9077] netlink: 64 bytes leftover after parsing attributes in process `syz.4.926'. [ 172.794438][ T9092] netlink: 'syz.4.926': attribute type 3 has an invalid length. [ 172.832336][ T9092] netlink: 3 bytes leftover after parsing attributes in process `syz.4.926'. [ 173.170808][ T9113] ip6tnl0: Caught tx_queue_len zero misconfig [ 173.181458][ T9113] sch_tbf: burst 3 is lower than device ip6tnl0 mtu (1452) ! [ 173.434497][ T9120] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 173.530524][ T9128] FAULT_INJECTION: forcing a failure. [ 173.530524][ T9128] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 173.563862][ T9128] CPU: 0 UID: 0 PID: 9128 Comm: syz.4.942 Not tainted syzkaller #0 PREEMPT(full) [ 173.563886][ T9128] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 173.563896][ T9128] Call Trace: [ 173.563902][ T9128] [ 173.563909][ T9128] dump_stack_lvl+0xe8/0x150 [ 173.563937][ T9128] should_fail_ex+0x40c/0x560 [ 173.563961][ T9128] _copy_from_iter+0x1d3/0x1660 [ 173.563979][ T9128] ? kmem_cache_alloc_node_noprof+0x1c1/0x610 [ 173.564001][ T9128] ? rcu_is_watching+0x15/0xb0 [ 173.564025][ T9128] ? trace_kmem_cache_alloc+0x29/0xe0 [ 173.564045][ T9128] ? kmem_cache_alloc_node_noprof+0x3b8/0x610 [ 173.564065][ T9128] ? __pfx__copy_from_iter+0x10/0x10 [ 173.564083][ T9128] ? __alloc_skb+0x276/0x7a0 [ 173.564105][ T9128] ? __alloc_skb+0x276/0x7a0 [ 173.564133][ T9128] ? netlink_sendmsg+0x650/0xb40 [ 173.564152][ T9128] ? skb_put+0x112/0x210 [ 173.564171][ T9128] netlink_sendmsg+0x6c0/0xb40 [ 173.564209][ T9128] ? __pfx_netlink_sendmsg+0x10/0x10 [ 173.564232][ T9128] ? aa_sock_msg_perm+0xf1/0x1b0 [ 173.564260][ T9128] ? __pfx_netlink_sendmsg+0x10/0x10 [ 173.564279][ T9128] sock_sendmsg_nosec+0x13a/0x180 [ 173.564304][ T9128] ____sys_sendmsg+0x54e/0x850 [ 173.564326][ T9128] ? __pfx_____sys_sendmsg+0x10/0x10 [ 173.564351][ T9128] ? import_iovec+0x73/0xa0 [ 173.564373][ T9128] ___sys_sendmsg+0x2a5/0x360 [ 173.564389][ T9128] ? __lock_acquire+0x683/0x2cf0 [ 173.564413][ T9128] ? __pfx____sys_sendmsg+0x10/0x10 [ 173.564460][ T9128] ? __fget_files+0x2a/0x420 [ 173.564479][ T9128] ? __fget_files+0x3a2/0x420 [ 173.564507][ T9128] __x64_sys_sendmsg+0x1b1/0x290 [ 173.564526][ T9128] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 173.564560][ T9128] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 173.564578][ T9128] do_syscall_64+0x174/0x580 [ 173.564599][ T9128] ? trace_irq_disable+0x3b/0x140 [ 173.564618][ T9128] ? clear_bhb_loop+0x70/0xc0 [ 173.564640][ T9128] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 173.564656][ T9128] RIP: 0033:0x7fe2e319e0d9 [ 173.564672][ T9128] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 173.564686][ T9128] RSP: 002b:00007fe2e3fd5028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 173.564703][ T9128] RAX: ffffffffffffffda RBX: 00007fe2e3425fa0 RCX: 00007fe2e319e0d9 [ 173.564714][ T9128] RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000000000000003 [ 173.564723][ T9128] RBP: 00007fe2e3fd5090 R08: 0000000000000000 R09: 0000000000000000 [ 173.564732][ T9128] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 173.564742][ T9128] R13: 00007fe2e3426038 R14: 00007fe2e3425fa0 R15: 00007fff2e55a758 [ 173.564770][ T9128] [ 174.427149][ T9144] netlink: 8 bytes leftover after parsing attributes in process `syz.2.949'. [ 174.457160][ T9144] netlink: 4 bytes leftover after parsing attributes in process `syz.2.949'. [ 174.550020][ T76] netdevsim netdevsim2 netdevsim3: set [0, 1] type 1 family 0 port 4352 - 0 [ 174.589013][ T76] netdevsim netdevsim2 netdevsim2: set [0, 1] type 1 family 0 port 4352 - 0 [ 174.615940][ T76] netdevsim netdevsim2 netdevsim1: set [0, 1] type 1 family 0 port 4352 - 0 [ 174.660930][ T76] netdevsim netdevsim2 netdevsim0: set [0, 1] type 1 family 0 port 4352 - 0 [ 175.002962][ T9169] netlink: 'syz.2.955': attribute type 1 has an invalid length. [ 175.027393][ T9169] netlink: del zone limit has 8 unknown bytes [ 175.095413][ T9172] 8021q: adding VLAN 0 to HW filter on device bond3 [ 175.137201][ T9181] bridge0: port 2(bridge_slave_1) entered disabled state [ 175.144503][ T9181] bridge0: port 1(bridge_slave_0) entered disabled state [ 175.153251][ T9185] x_tables: duplicate underflow at hook 3 [ 175.167877][ T9181] bond2: (slave bridge0): Releasing backup interface [ 175.206517][ T9181] bridge0: port 2(bridge_slave_1) entered blocking state [ 175.213812][ T9181] bridge0: port 2(bridge_slave_1) entered forwarding state [ 175.221355][ T9181] bridge0: port 1(bridge_slave_0) entered blocking state [ 175.228529][ T9181] bridge0: port 1(bridge_slave_0) entered forwarding state [ 175.255612][ T9181] bond3: (slave bridge0): Enslaving as an active interface with an up link [ 175.359558][ T9193] netlink: 'syz.4.963': attribute type 1 has an invalid length. [ 175.391774][ T9193] workqueue: Failed to create a rescuer kthread for wq "bond3": -EINTR [ 175.509033][ T9205] netlink: 'syz.0.967': attribute type 32 has an invalid length. [ 175.926448][ T9230] __nla_validate_parse: 9 callbacks suppressed [ 175.926466][ T9230] netlink: 36 bytes leftover after parsing attributes in process `syz.1.975'. [ 176.012637][ T9233] netlink: 12 bytes leftover after parsing attributes in process `syz.2.976'. [ 176.084772][ T9233] 8021q: adding VLAN 0 to HW filter on device bond6 [ 176.106592][ T9233] bond6: (slave bridge0): Enslaving as an active interface with an up link [ 176.287224][ T9250] netlink: 212 bytes leftover after parsing attributes in process `syz.2.981'. [ 176.298072][ T9250] netlink: 12 bytes leftover after parsing attributes in process `syz.2.981'. [ 176.308122][ T9250] netlink: 16 bytes leftover after parsing attributes in process `syz.2.981'. [ 176.703212][ T9270] FAULT_INJECTION: forcing a failure. [ 176.703212][ T9270] name failslab, interval 1, probability 0, space 0, times 0 [ 176.730607][ T9270] CPU: 0 UID: 0 PID: 9270 Comm: syz.4.987 Not tainted syzkaller #0 PREEMPT(full) [ 176.730633][ T9270] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 176.730643][ T9270] Call Trace: [ 176.730650][ T9270] [ 176.730657][ T9270] dump_stack_lvl+0xe8/0x150 [ 176.730684][ T9270] should_fail_ex+0x40c/0x560 [ 176.730706][ T9270] should_failslab+0xa8/0x100 [ 176.730731][ T9270] kmem_cache_alloc_noprof+0xa6/0x5f0 [ 176.730751][ T9270] ? skb_clone+0x212/0x3a0 [ 176.730769][ T9270] ? skb_clone+0x212/0x3a0 [ 176.730792][ T9270] skb_clone+0x212/0x3a0 [ 176.730809][ T9270] ? nfnetlink_rcv+0x4b0/0x28c0 [ 176.730829][ T9270] nfnetlink_rcv+0x4de/0x28c0 [ 176.730856][ T9270] ? __dev_queue_xmit+0x29b/0x3820 [ 176.730880][ T9270] ? __local_bh_enable_ip+0xd0/0x130 [ 176.730899][ T9270] ? lockdep_hardirqs_on+0x7a/0x110 [ 176.730920][ T9270] ? __dev_queue_xmit+0x29b/0x3820 [ 176.730938][ T9270] ? __local_bh_enable_ip+0xd0/0x130 [ 176.730954][ T9270] ? __dev_queue_xmit+0x29b/0x3820 [ 176.730972][ T9270] ? __dev_queue_xmit+0x1edc/0x3820 [ 176.730988][ T9270] ? do_syscall_64+0x174/0x580 [ 176.731008][ T9270] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 176.731036][ T9270] ? __dev_queue_xmit+0x29b/0x3820 [ 176.731056][ T9270] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 176.731087][ T9270] ? ref_tracker_free+0x689/0x830 [ 176.731109][ T9270] ? __pfx_ref_tracker_free+0x10/0x10 [ 176.731136][ T9270] ? __skb_clone+0x449/0x6c0 [ 176.731158][ T9270] ? skb_clone+0x246/0x3a0 [ 176.731179][ T9270] ? __netlink_deliver_tap+0x811/0x860 [ 176.731198][ T9270] ? netlink_deliver_tap+0x2e/0x1b0 [ 176.731224][ T9270] ? netlink_deliver_tap+0x2e/0x1b0 [ 176.731241][ T9270] ? netlink_deliver_tap+0x2e/0x1b0 [ 176.731264][ T9270] netlink_unicast+0x7bb/0x940 [ 176.731291][ T9270] netlink_sendmsg+0x813/0xb40 [ 176.731318][ T9270] ? __pfx_netlink_sendmsg+0x10/0x10 [ 176.731340][ T9270] ? aa_sock_msg_perm+0xf1/0x1b0 [ 176.731367][ T9270] ? __pfx_netlink_sendmsg+0x10/0x10 [ 176.731382][ T9270] sock_sendmsg_nosec+0x13a/0x180 [ 176.731406][ T9270] ____sys_sendmsg+0x54e/0x850 [ 176.731427][ T9270] ? __pfx_____sys_sendmsg+0x10/0x10 [ 176.731452][ T9270] ? import_iovec+0x73/0xa0 [ 176.731475][ T9270] ___sys_sendmsg+0x2a5/0x360 [ 176.731495][ T9270] ? __lock_acquire+0x683/0x2cf0 [ 176.731518][ T9270] ? __pfx____sys_sendmsg+0x10/0x10 [ 176.731565][ T9270] ? __fget_files+0x2a/0x420 [ 176.731584][ T9270] ? __fget_files+0x3a2/0x420 [ 176.731612][ T9270] __x64_sys_sendmsg+0x1b1/0x290 [ 176.731629][ T9270] ? lockdep_hardirqs_on+0x7a/0x110 [ 176.731652][ T9270] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 176.731689][ T9270] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 176.731706][ T9270] do_syscall_64+0x174/0x580 [ 176.731727][ T9270] ? trace_irq_disable+0x3b/0x140 [ 176.731745][ T9270] ? clear_bhb_loop+0x70/0xc0 [ 176.731764][ T9270] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 176.731779][ T9270] RIP: 0033:0x7fe2e319e0d9 [ 176.731798][ T9270] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 176.731812][ T9270] RSP: 002b:00007fe2e3fd5028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 176.731829][ T9270] RAX: ffffffffffffffda RBX: 00007fe2e3425fa0 RCX: 00007fe2e319e0d9 [ 176.731841][ T9270] RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000000000000003 [ 176.731859][ T9270] RBP: 00007fe2e3fd5090 R08: 0000000000000000 R09: 0000000000000000 [ 176.731870][ T9270] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 176.731880][ T9270] R13: 00007fe2e3426038 R14: 00007fe2e3425fa0 R15: 00007fff2e55a758 [ 176.731909][ T9270] [ 176.794741][ T9273] macvlan1: entered allmulticast mode [ 177.116809][ T9273] veth1_vlan: entered allmulticast mode [ 177.237841][ T9282] netlink: 20 bytes leftover after parsing attributes in process `syz.0.990'. [ 177.388159][ T9284] netlink: 12 bytes leftover after parsing attributes in process `syz.2.991'. [ 177.413724][ T9288] netlink: 8 bytes leftover after parsing attributes in process `syz.3.993'. [ 177.467206][ T9284] 8021q: adding VLAN 0 to HW filter on device bond7 [ 177.554673][ T9294] bond6: (slave bridge0): Releasing backup interface [ 177.659466][ T9294] bond7: (slave bridge0): Enslaving as an active interface with an up link [ 177.957023][ T9319] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1000'. [ 177.974658][ T9319] netlink: 'syz.3.1000': attribute type 22 has an invalid length. [ 177.982998][ T9319] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1000'. [ 177.995786][ T9319] tunl0: Caught tx_queue_len zero misconfig [ 178.787021][ T9364] syzkaller0: entered promiscuous mode [ 178.793611][ T9364] syzkaller0: entered allmulticast mode [ 178.803686][ T9363] mac80211_hwsim hwsim3 syzkaller0: left promiscuous mode [ 178.817711][ T9363] mac80211_hwsim hwsim3 syzkaller0: left allmulticast mode [ 179.020028][ T9378] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 180.334154][ T9444] 8021q: adding VLAN 0 to HW filter on device bond6 [ 180.396131][ T9449] bond4: (slave bridge0): Releasing backup interface [ 180.472155][ T9449] bond6: (slave bridge0): Enslaving as an active interface with an up link [ 181.096134][ T9486] __nla_validate_parse: 11 callbacks suppressed [ 181.096153][ T9486] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1046'. [ 181.437129][ T9508] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1054'. [ 181.444016][ T9507] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1051'. [ 181.525058][ T9509] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1054'. [ 181.640514][ T9505] block nbd1: server does not support multiple connections per device. [ 181.645208][ T9522] netlink: 48 bytes leftover after parsing attributes in process `syz.0.1055'. [ 181.728540][ T9507] 8021q: adding VLAN 0 to HW filter on device bond4 [ 181.739797][ T9505] block nbd1: shutting down sockets [ 181.832087][ T9518] bridge0: port 2(bridge_slave_1) entered disabled state [ 181.839433][ T9518] bridge0: port 1(bridge_slave_0) entered disabled state [ 181.917473][ T9518] bond3: (slave bridge0): Releasing backup interface [ 181.964321][ T9518] bridge0: port 2(bridge_slave_1) entered blocking state [ 181.971629][ T9518] bridge0: port 2(bridge_slave_1) entered forwarding state [ 181.979159][ T9518] bridge0: port 1(bridge_slave_0) entered blocking state [ 181.986506][ T9518] bridge0: port 1(bridge_slave_0) entered forwarding state [ 182.012604][ T9518] bond4: (slave bridge0): Enslaving as an active interface with an up link [ 182.256430][ T9547] netlink: 140 bytes leftover after parsing attributes in process `syz.1.1059'. [ 182.285369][ T9549] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1060'. [ 182.428254][ T9553] netlink: 5 bytes leftover after parsing attributes in process `syz.2.1062'. [ 182.751079][ T9569] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1069'. [ 182.817810][ T9569] 8021q: adding VLAN 0 to HW filter on device bond3 [ 183.237594][ T9604] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1074'. [ 184.142862][ T9645] sch_tbf: peakrate 7 is lower than or equals to rate 6829859379779001161 ! [ 184.208448][ T9647] netlink: 'syz.4.1089': attribute type 16 has an invalid length. [ 184.240140][ T9647] netlink: 'syz.4.1089': attribute type 3 has an invalid length. [ 184.243504][ T9649] openvswitch: netlink: Flow actions attr not present in new flow. [ 184.695842][ T9682] netlink: 'syz.0.1101': attribute type 2 has an invalid length. [ 184.789942][ T9684] netlink: 'syz.4.1102': attribute type 2 has an invalid length. [ 184.805366][ T9687] 8021q: VLANs not supported on ip6_vti0 [ 184.909005][ T9684] : entered promiscuous mode [ 185.091769][ T9703] veth0: left promiscuous mode [ 185.097396][ T9703] veth0: left allmulticast mode [ 185.112473][ T9703] bond5: left promiscuous mode [ 185.124007][ T9703] vlan2: left promiscuous mode [ 185.169471][ T9708] 8021q: adding VLAN 0 to HW filter on device bond4 [ 185.303341][ T9713] bridge0: left promiscuous mode [ 185.328199][ T9713] vlan3: left promiscuous mode [ 185.365743][ T9713] geneve0: left promiscuous mode [ 185.403588][ T9713] 8021q: adding VLAN 0 to HW filter on device bond0 [ 185.442595][ T9713] 8021q: adding VLAN 0 to HW filter on device team0 [ 185.471593][ T9713] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 185.578384][ T9713] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 185.590435][ T9713] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 185.608599][ T9713] veth1_vlan: left promiscuous mode [ 185.615974][ T9713] veth0_vlan: left promiscuous mode [ 185.625339][ T9713] veth0_vlan: entered promiscuous mode [ 185.636663][ T9713] veth1_vlan: entered promiscuous mode [ 185.653374][ T9713] veth1_macvtap: left promiscuous mode [ 185.661465][ T9713] veth0_macvtap: left promiscuous mode [ 185.668487][ T9713] veth0_macvtap: entered promiscuous mode [ 185.677276][ T9713] veth1_macvtap: entered promiscuous mode [ 185.693217][ T9713] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 185.702264][ T9713] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 185.732805][ T9713] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 185.752508][ T9713] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 185.771998][ T9713] 8021q: adding VLAN 0 to HW filter on device bond1 [ 185.779437][ T9713] 8021q: adding VLAN 0 to HW filter on device bond2 [ 185.804389][ T9713] 8021q: adding VLAN 0 to HW filter on device bond3 [ 185.814604][ T9713] 8021q: adding VLAN 0 to HW filter on device bond4 [ 185.823171][ T9713] 8021q: adding VLAN 0 to HW filter on device bond5 [ 185.868439][ T9713] bridge0: port 1(vlan3) entered blocking state [ 185.874896][ T9713] bridge0: port 1(vlan3) entered forwarding state [ 185.883443][ T9713] geneve0: entered promiscuous mode [ 185.892124][ T9713] 8021q: adding VLAN 0 to HW filter on device bond6 [ 185.904412][ T9] bridge0: entered promiscuous mode [ 185.911090][ T9] vlan3: entered promiscuous mode [ 186.165272][ C1] bridge0: received packet on vlan3 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:1) [ 186.200531][ T80] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 186.244335][ T80] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 186.310858][ T36] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 186.330392][ T36] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 186.369303][ T9743] netlink: 'syz.0.1121': attribute type 39 has an invalid length. [ 186.382418][ C0] bridge0: received packet on vlan3 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:1) [ 186.469624][ T9747] ipvlan2: entered promiscuous mode [ 186.504057][ T9749] geneve0: Caught tx_queue_len zero misconfig [ 186.543649][ T9752] __nla_validate_parse: 17 callbacks suppressed [ 186.543671][ T9752] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1120'. [ 186.573971][ T9755] bridge_slave_1: left allmulticast mode [ 186.590515][ T9755] bridge_slave_1: left promiscuous mode [ 186.604674][ T9755] bridge0: port 2(bridge_slave_1) entered disabled state [ 186.742111][ C0] bridge0: received packet on vlan3 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:1) [ 187.006152][ C1] bridge0: received packet on vlan3 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:1) [ 187.321641][ C0] bridge0: received packet on vlan3 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:1) [ 187.822949][ C0] bridge0: received packet on vlan3 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:1) [ 187.838550][ C0] bridge0: received packet on vlan3 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:1) [ 187.937508][ T9799] syzkaller0: entered promiscuous mode [ 187.945033][ T9799] syzkaller0: entered allmulticast mode [ 188.163204][ C0] bridge0: received packet on vlan3 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:1) [ 188.238042][ T9818] netlink: 48 bytes leftover after parsing attributes in process `syz.4.1140'. [ 188.426763][ T9835] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 188.551227][ T9842] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1147'. [ 188.749571][ T9850] geneve0: Caught tx_queue_len zero misconfig [ 188.824256][ T9855] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1151'. [ 188.844444][ T9855] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1151'. [ 188.920065][ T9850] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1151'. [ 189.440106][ C0] net_ratelimit: 2 callbacks suppressed [ 189.440124][ C0] bridge0: received packet on vlan3 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:1) [ 189.709259][ T9909] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1166'. [ 189.985051][ T5610] Bluetooth: hci4: link tx timeout [ 189.994390][ T5610] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 190.012124][ T5610] Bluetooth: hci4: link tx timeout [ 190.020552][ T5610] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 190.078821][ T9923] netlink: 60795 bytes leftover after parsing attributes in process `syz.3.1170'. [ 190.108192][ T9927] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 190.147001][ T5610] Bluetooth: hci4: link tx timeout [ 190.153083][ T5610] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 190.172774][ T5610] Bluetooth: hci4: link tx timeout [ 190.177996][ T5610] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 190.262590][ T9930] tap0: tun_chr_ioctl cmd 1074025677 [ 190.292429][ T9930] tap0: linktype set to 805 [ 190.445679][ T9940] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1176'. [ 190.451980][ T9943] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1175'. [ 190.503963][ T9940] netlink: 'syz.2.1176': attribute type 1 has an invalid length. [ 190.530654][ C0] bridge0: received packet on vlan3 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:1) [ 191.006144][ T5610] Bluetooth: hci4: link tx timeout [ 191.011897][ T5610] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 191.157516][ T9961] syzkaller0: entered promiscuous mode [ 191.175965][ T9961] syzkaller0: entered allmulticast mode [ 191.206083][ T5610] Bluetooth: hci4: link tx timeout [ 191.219745][ T5610] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 191.273708][ T9992] raw_sendmsg: syz.2.1185 forgot to set AF_INET. Fix it! [ 191.485339][ C0] bridge0: received packet on vlan3 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:1) [ 191.497019][ C0] bridge0: received packet on vlan3 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:1) [ 192.048255][ T5610] Bluetooth: hci4: command 0x0406 tx timeout [ 192.520032][ C0] bridge0: received packet on vlan3 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:1) [ 193.272489][T10009] __nla_validate_parse: 1 callbacks suppressed [ 193.272510][T10009] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1191'. [ 193.315239][T10010] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1190'. [ 193.324818][T10014] FAULT_INJECTION: forcing a failure. [ 193.324818][T10014] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 193.324850][T10014] CPU: 0 UID: 0 PID: 10014 Comm: syz.4.1192 Not tainted syzkaller #0 PREEMPT(full) [ 193.324869][T10014] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 193.324879][T10014] Call Trace: [ 193.324885][T10014] [ 193.324892][T10014] dump_stack_lvl+0xe8/0x150 [ 193.324921][T10014] should_fail_ex+0x40c/0x560 [ 193.324944][T10014] _copy_from_iter+0x1d3/0x1660 [ 193.324962][T10014] ? kmem_cache_alloc_node_noprof+0x1c1/0x610 [ 193.324983][T10014] ? rcu_is_watching+0x15/0xb0 [ 193.325006][T10014] ? trace_kmem_cache_alloc+0x29/0xe0 [ 193.325024][T10014] ? kmem_cache_alloc_node_noprof+0x3b8/0x610 [ 193.325042][T10014] ? __pfx__copy_from_iter+0x10/0x10 [ 193.325061][T10014] ? __alloc_skb+0x276/0x7a0 [ 193.325082][T10014] ? __alloc_skb+0x276/0x7a0 [ 193.325110][T10014] ? netlink_sendmsg+0x650/0xb40 [ 193.325129][T10014] ? skb_put+0x112/0x210 [ 193.325148][T10014] netlink_sendmsg+0x6c0/0xb40 [ 193.325176][T10014] ? __pfx_netlink_sendmsg+0x10/0x10 [ 193.325206][T10014] ? aa_sock_msg_perm+0xf1/0x1b0 [ 193.325236][T10014] ? __pfx_netlink_sendmsg+0x10/0x10 [ 193.325254][T10014] sock_sendmsg_nosec+0x13a/0x180 [ 193.325279][T10014] ____sys_sendmsg+0x54e/0x850 [ 193.325302][T10014] ? __pfx_____sys_sendmsg+0x10/0x10 [ 193.325328][T10014] ? import_iovec+0x73/0xa0 [ 193.325350][T10014] ___sys_sendmsg+0x2a5/0x360 [ 193.325365][T10014] ? __lock_acquire+0x683/0x2cf0 [ 193.325387][T10014] ? __pfx____sys_sendmsg+0x10/0x10 [ 193.325454][T10014] ? __fget_files+0x2a/0x420 [ 193.325478][T10014] ? __fget_files+0x3a2/0x420 [ 193.325506][T10014] __x64_sys_sendmsg+0x1b1/0x290 [ 193.325526][T10014] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 193.325560][T10014] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 193.325578][T10014] do_syscall_64+0x174/0x580 [ 193.325599][T10014] ? trace_irq_disable+0x3b/0x140 [ 193.325619][T10014] ? clear_bhb_loop+0x70/0xc0 [ 193.325639][T10014] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 193.325655][T10014] RIP: 0033:0x7fe2e319e0d9 [ 193.325671][T10014] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 193.325685][T10014] RSP: 002b:00007fe2e3fd5028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 193.325703][T10014] RAX: ffffffffffffffda RBX: 00007fe2e3425fa0 RCX: 00007fe2e319e0d9 [ 193.325716][T10014] RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000000000000003 [ 193.325726][T10014] RBP: 00007fe2e3fd5090 R08: 0000000000000000 R09: 0000000000000000 [ 193.325737][T10014] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 193.325746][T10014] R13: 00007fe2e3426038 R14: 00007fe2e3425fa0 R15: 00007fff2e55a758 [ 193.325773][T10014] [ 193.363827][T10013] netlink: 'syz.3.1193': attribute type 1 has an invalid length. [ 193.496325][T10021] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1195'. [ 193.580566][T10017] netlink: 'syz.3.1193': attribute type 1 has an invalid length. [ 193.700326][ C0] bridge0: received packet on vlan3 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:1) [ 193.896201][T10032] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1198'. [ 193.907372][T10032] openvswitch: netlink: Tunnel attr 68 out of range max 16 [ 194.114315][T10040] nbd: socks must be embedded in a SOCK_ITEM attr [ 194.130756][T10043] mac80211_hwsim hwsim3 syzkaller0: entered promiscuous mode [ 194.142781][T10043] mac80211_hwsim hwsim3 syzkaller0: entered allmulticast mode [ 194.151685][T10040] netlink: 'syz.2.1201': attribute type 1 has an invalid length. [ 194.283434][ T1307] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.418422][T10050] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 194.450809][T10054] FAULT_INJECTION: forcing a failure. [ 194.450809][T10054] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 194.481343][T10054] CPU: 1 UID: 0 PID: 10054 Comm: syz.3.1205 Not tainted syzkaller #0 PREEMPT(full) [ 194.481371][T10054] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 194.481381][T10054] Call Trace: [ 194.481388][T10054] [ 194.481396][T10054] dump_stack_lvl+0xe8/0x150 [ 194.481425][T10054] should_fail_ex+0x40c/0x560 [ 194.481451][T10054] _copy_from_iter+0x1d3/0x1660 [ 194.481475][T10054] ? kmem_cache_alloc_node_noprof+0x1c1/0x610 [ 194.481497][T10054] ? rcu_is_watching+0x15/0xb0 [ 194.481520][T10054] ? trace_kmem_cache_alloc+0x29/0xe0 [ 194.481537][T10054] ? kmem_cache_alloc_node_noprof+0x3b8/0x610 [ 194.481551][T10054] ? __pfx__copy_from_iter+0x10/0x10 [ 194.481566][T10054] ? __alloc_skb+0x276/0x7a0 [ 194.481584][T10054] ? __alloc_skb+0x276/0x7a0 [ 194.481607][T10054] ? netlink_sendmsg+0x650/0xb40 [ 194.481622][T10054] ? skb_put+0x112/0x210 [ 194.481637][T10054] netlink_sendmsg+0x6c0/0xb40 [ 194.481660][T10054] ? __pfx_netlink_sendmsg+0x10/0x10 [ 194.481682][T10054] ? aa_sock_msg_perm+0xf1/0x1b0 [ 194.481710][T10054] ? __pfx_netlink_sendmsg+0x10/0x10 [ 194.481724][T10054] sock_sendmsg_nosec+0x13a/0x180 [ 194.481758][T10054] ____sys_sendmsg+0x54e/0x850 [ 194.481777][T10054] ? __pfx_____sys_sendmsg+0x10/0x10 [ 194.481803][T10054] ? import_iovec+0x73/0xa0 [ 194.481823][T10054] ___sys_sendmsg+0x2a5/0x360 [ 194.481836][T10054] ? __lock_acquire+0x683/0x2cf0 [ 194.481857][T10054] ? __pfx____sys_sendmsg+0x10/0x10 [ 194.481899][T10054] ? __fget_files+0x2a/0x420 [ 194.481915][T10054] ? __fget_files+0x3a2/0x420 [ 194.481940][T10054] __x64_sys_sendmsg+0x1b1/0x290 [ 194.481957][T10054] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 194.481986][T10054] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 194.482002][T10054] do_syscall_64+0x174/0x580 [ 194.482019][T10054] ? trace_irq_disable+0x3b/0x140 [ 194.482039][T10054] ? clear_bhb_loop+0x70/0xc0 [ 194.482060][T10054] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 194.482074][T10054] RIP: 0033:0x7f305ad9e0d9 [ 194.482088][T10054] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 194.482099][T10054] RSP: 002b:00007f305bb8d028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 194.482115][T10054] RAX: ffffffffffffffda RBX: 00007f305b025fa0 RCX: 00007f305ad9e0d9 [ 194.482125][T10054] RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000000000000003 [ 194.482134][T10054] RBP: 00007f305bb8d090 R08: 0000000000000000 R09: 0000000000000000 [ 194.482142][T10054] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 194.482150][T10054] R13: 00007f305b026038 R14: 00007f305b025fa0 R15: 00007ffe63b43618 [ 194.482174][T10054] [ 194.749779][ C0] bridge0: received packet on vlan3 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:1) [ 195.131877][T10078] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1213'. [ 195.202496][T10078] veth1: entered promiscuous mode [ 195.209339][T10078] vlan4: entered promiscuous mode [ 195.533633][T10103] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 195.534941][T10105] FAULT_INJECTION: forcing a failure. [ 195.534941][T10105] name failslab, interval 1, probability 0, space 0, times 0 [ 195.597947][T10105] CPU: 1 UID: 0 PID: 10105 Comm: syz.3.1220 Not tainted syzkaller #0 PREEMPT(full) [ 195.597973][T10105] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 195.597983][T10105] Call Trace: [ 195.597990][T10105] [ 195.597998][T10105] dump_stack_lvl+0xe8/0x150 [ 195.598033][T10105] should_fail_ex+0x40c/0x560 [ 195.598057][T10105] should_failslab+0xa8/0x100 [ 195.598082][T10105] __kmalloc_cache_noprof+0xa8/0x660 [ 195.598106][T10105] ? nfnetlink_rcv+0x1021/0x28c0 [ 195.598123][T10105] ? nfnetlink_rcv+0x1021/0x28c0 [ 195.598146][T10105] nfnetlink_rcv+0x1021/0x28c0 [ 195.598195][T10105] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 195.598259][T10105] ? netlink_deliver_tap+0x2e/0x1b0 [ 195.598289][T10105] ? netlink_deliver_tap+0x2e/0x1b0 [ 195.598308][T10105] ? netlink_deliver_tap+0x2e/0x1b0 [ 195.598332][T10105] netlink_unicast+0x7bb/0x940 [ 195.598361][T10105] netlink_sendmsg+0x813/0xb40 [ 195.598389][T10105] ? __pfx_netlink_sendmsg+0x10/0x10 [ 195.598414][T10105] ? aa_sock_msg_perm+0xf1/0x1b0 [ 195.598443][T10105] ? __pfx_netlink_sendmsg+0x10/0x10 [ 195.598461][T10105] sock_sendmsg_nosec+0x13a/0x180 [ 195.598487][T10105] ____sys_sendmsg+0x54e/0x850 [ 195.598512][T10105] ? __pfx_____sys_sendmsg+0x10/0x10 [ 195.598538][T10105] ? import_iovec+0x73/0xa0 [ 195.598562][T10105] ___sys_sendmsg+0x2a5/0x360 [ 195.598580][T10105] ? __lock_acquire+0x683/0x2cf0 [ 195.598606][T10105] ? __pfx____sys_sendmsg+0x10/0x10 [ 195.598660][T10105] ? __fget_files+0x2a/0x420 [ 195.598680][T10105] ? __fget_files+0x3a2/0x420 [ 195.598711][T10105] __x64_sys_sendmsg+0x1b1/0x290 [ 195.598733][T10105] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 195.598770][T10105] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 195.598790][T10105] do_syscall_64+0x174/0x580 [ 195.598811][T10105] ? trace_irq_disable+0x3b/0x140 [ 195.598832][T10105] ? clear_bhb_loop+0x70/0xc0 [ 195.598853][T10105] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 195.598870][T10105] RIP: 0033:0x7f305ad9e0d9 [ 195.598887][T10105] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 195.598901][T10105] RSP: 002b:00007f305bb8d028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 195.598920][T10105] RAX: ffffffffffffffda RBX: 00007f305b025fa0 RCX: 00007f305ad9e0d9 [ 195.598932][T10105] RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000000000000003 [ 195.598946][T10105] RBP: 00007f305bb8d090 R08: 0000000000000000 R09: 0000000000000000 [ 195.598957][T10105] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 195.598968][T10105] R13: 00007f305b026038 R14: 00007f305b025fa0 R15: 00007ffe63b43618 [ 195.598998][T10105] [ 195.767108][ C0] bridge0: received packet on vlan3 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:1) [ 195.993130][T10121] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1224'. [ 196.002573][T10121] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1224'. [ 196.058335][T10121] gretap0: entered promiscuous mode [ 196.070215][T10121] gretap0: left promiscuous mode [ 196.072639][T10126] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1224'. [ 196.089208][T10126] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1224'. [ 196.105068][T10125] netlink: 48 bytes leftover after parsing attributes in process `syz.1.1225'. [ 196.145728][T10126] gretap0: entered promiscuous mode [ 196.166389][T10126] gretap0: left promiscuous mode [ 196.197660][T10127] syzkaller0: entered promiscuous mode [ 196.210876][T10127] syzkaller0: entered allmulticast mode [ 196.404287][T10139] netlink: 'syz.4.1228': attribute type 4 has an invalid length. [ 196.440488][T10139] netlink: 'syz.4.1228': attribute type 4 has an invalid length. [ 196.512941][T10150] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 196.647435][T10154] x_tables: ip_tables: ah match: only valid for protocol 51 [ 196.667420][T10159] A link change request failed with some changes committed already. Interface gre0 may have been left with an inconsistent configuration, please check. [ 196.839640][T10166] 8021q: adding VLAN 0 to HW filter on device bond5 [ 196.906121][T10173] netlink: 'syz.0.1239': attribute type 1 has an invalid length. [ 196.940136][ C0] bridge0: received packet on vlan3 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:1) [ 196.973420][T10173] 8021q: adding VLAN 0 to HW filter on device bond7 [ 196.981183][T10180] bond7: option tlb_dynamic_lb: unable to set because the bond device is up [ 197.047287][ T38] IPVS: starting estimator thread 0... [ 197.089652][T10186] netlink: 'syz.4.1240': attribute type 15 has an invalid length. [ 197.135417][T10186] netlink: 'syz.4.1240': attribute type 15 has an invalid length. [ 197.150422][ T36] netdevsim netdevsim4 netdevsim3: set [0, 1] type 1 family 0 port 256 - 0 [ 197.181828][T10184] IPVS: using max 33 ests per chain, 79200 per kthread [ 197.189056][ T36] netdevsim netdevsim4 netdevsim2: set [0, 1] type 1 family 0 port 256 - 0 [ 197.311239][ T80] netdevsim netdevsim4 netdevsim0: set [0, 1] type 1 family 0 port 256 - 0 [ 197.323131][ T80] netdevsim netdevsim4 netdevsim1: set [0, 1] type 1 family 0 port 256 - 0 [ 197.497154][T10213] FAULT_INJECTION: forcing a failure. [ 197.497154][T10213] name failslab, interval 1, probability 0, space 0, times 0 [ 197.515989][T10213] CPU: 1 UID: 0 PID: 10213 Comm: syz.1.1245 Not tainted syzkaller #0 PREEMPT(full) [ 197.516012][T10213] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 197.516021][T10213] Call Trace: [ 197.516027][T10213] [ 197.516034][T10213] dump_stack_lvl+0xe8/0x150 [ 197.516063][T10213] should_fail_ex+0x40c/0x560 [ 197.516084][T10213] should_failslab+0xa8/0x100 [ 197.516108][T10213] kmem_cache_alloc_noprof+0xa6/0x5f0 [ 197.516126][T10213] ? skb_clone+0x212/0x3a0 [ 197.516143][T10213] ? skb_clone+0x212/0x3a0 [ 197.516165][T10213] skb_clone+0x212/0x3a0 [ 197.516187][T10213] __netlink_deliver_tap+0x413/0x860 [ 197.516217][T10213] ? netlink_deliver_tap+0x2e/0x1b0 [ 197.516235][T10213] netlink_deliver_tap+0x19c/0x1b0 [ 197.516254][T10213] netlink_unicast+0x77f/0x940 [ 197.516281][T10213] netlink_sendmsg+0x813/0xb40 [ 197.516308][T10213] ? __pfx_netlink_sendmsg+0x10/0x10 [ 197.516403][T10213] ? aa_sock_msg_perm+0xf1/0x1b0 [ 197.516431][T10213] ? __pfx_netlink_sendmsg+0x10/0x10 [ 197.516447][T10213] sock_sendmsg_nosec+0x13a/0x180 [ 197.516469][T10213] ____sys_sendmsg+0x54e/0x850 [ 197.516492][T10213] ? __pfx_____sys_sendmsg+0x10/0x10 [ 197.516519][T10213] ? import_iovec+0x73/0xa0 [ 197.516545][T10213] ___sys_sendmsg+0x2a5/0x360 [ 197.516560][T10213] ? __lock_acquire+0x683/0x2cf0 [ 197.516584][T10213] ? __pfx____sys_sendmsg+0x10/0x10 [ 197.516639][T10213] ? __fget_files+0x2a/0x420 [ 197.516657][T10213] ? __fget_files+0x3a2/0x420 [ 197.516686][T10213] __x64_sys_sendmsg+0x1b1/0x290 [ 197.516706][T10213] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 197.516741][T10213] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 197.516759][T10213] do_syscall_64+0x174/0x580 [ 197.516782][T10213] ? clear_bhb_loop+0x70/0xc0 [ 197.516802][T10213] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 197.516819][T10213] RIP: 0033:0x7f98a6f9e0d9 [ 197.516833][T10213] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 197.516846][T10213] RSP: 002b:00007f98a7e0b028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 197.516864][T10213] RAX: ffffffffffffffda RBX: 00007f98a7225fa0 RCX: 00007f98a6f9e0d9 [ 197.516877][T10213] RDX: 0000000000000000 RSI: 0000200000000400 RDI: 0000000000000003 [ 197.516887][T10213] RBP: 00007f98a7e0b090 R08: 0000000000000000 R09: 0000000000000000 [ 197.516898][T10213] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 197.516907][T10213] R13: 00007f98a7226038 R14: 00007f98a7225fa0 R15: 00007fff2532e218 [ 197.516935][T10213] [ 197.974184][ C0] bridge0: received packet on vlan3 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:1) [ 197.996769][T10228] 8021q: adding VLAN 0 to HW filter on device bond6 [ 198.005389][T10235] FAULT_INJECTION: forcing a failure. [ 198.005389][T10235] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 198.018620][T10236] bond6: (slave ip6gretap0): Enslaving as an active interface with an up link [ 198.054427][T10235] CPU: 1 UID: 0 PID: 10235 Comm: syz.2.1250 Not tainted syzkaller #0 PREEMPT(full) [ 198.054453][T10235] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 198.054463][T10235] Call Trace: [ 198.054470][T10235] [ 198.054477][T10235] dump_stack_lvl+0xe8/0x150 [ 198.054507][T10235] should_fail_ex+0x40c/0x560 [ 198.054529][T10235] _copy_from_user+0x2d/0xb0 [ 198.054552][T10235] ___sys_sendmsg+0x1c6/0x360 [ 198.054571][T10235] ? __lock_acquire+0x683/0x2cf0 [ 198.054595][T10235] ? __pfx____sys_sendmsg+0x10/0x10 [ 198.054645][T10235] ? __fget_files+0x2a/0x420 [ 198.054665][T10235] ? __fget_files+0x3a2/0x420 [ 198.054692][T10235] __x64_sys_sendmsg+0x1b1/0x290 [ 198.054713][T10235] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 198.054757][T10235] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 198.054776][T10235] do_syscall_64+0x174/0x580 [ 198.054797][T10235] ? trace_irq_disable+0x3b/0x140 [ 198.054817][T10235] ? clear_bhb_loop+0x70/0xc0 [ 198.054838][T10235] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 198.054854][T10235] RIP: 0033:0x7f04cab9e0d9 [ 198.054870][T10235] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 198.054883][T10235] RSP: 002b:00007f04c8df6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 198.054900][T10235] RAX: ffffffffffffffda RBX: 00007f04cae25fa0 RCX: 00007f04cab9e0d9 [ 198.054910][T10235] RDX: 0000000000000000 RSI: 0000200000000280 RDI: 0000000000000003 [ 198.054920][T10235] RBP: 00007f04c8df6090 R08: 0000000000000000 R09: 0000000000000000 [ 198.054929][T10235] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 198.054939][T10235] R13: 00007f04cae26038 R14: 00007f04cae25fa0 R15: 00007ffe3e36e778 [ 198.054961][T10235] [ 198.555369][T10255] openvswitch: netlink: nsh attribute has 1 unknown bytes. [ 198.609483][T10257] __nla_validate_parse: 9 callbacks suppressed [ 198.609502][T10257] netlink: 1004 bytes leftover after parsing attributes in process `syz.3.1259'. [ 198.686667][T10259] openvswitch: netlink: IPv4 tun info is not correct [ 198.761570][ C0] bridge0: received packet on vlan3 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:1) [ 198.808559][T10266] tipc: Started in network mode [ 198.839413][T10266] tipc: Node identity 222fe7748729, cluster identity 4711 [ 198.880764][T10266] tipc: Enabled bearer , priority 0 [ 198.926029][T10280] syzkaller0: entered promiscuous mode [ 198.951047][T10280] syzkaller0: entered allmulticast mode [ 199.004583][T10266] tipc: Resetting bearer [ 199.115670][T10260] tipc: Resetting bearer [ 199.148091][T10260] tipc: Disabling bearer [ 199.201761][T10294] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1270'. [ 199.357447][T10304] netlink: 1004 bytes leftover after parsing attributes in process `syz.1.1274'. [ 199.534834][T10308] netlink: 52 bytes leftover after parsing attributes in process `syz.2.1276'. [ 199.622340][T10310] netlink: 'syz.1.1277': attribute type 39 has an invalid length. [ 199.719048][T10314] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1280'. [ 199.967871][T10328] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1285'. [ 200.007839][T10328] 8021q: adding VLAN 0 to HW filter on device bond3 [ 200.021015][T10331] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1286'. [ 200.103653][T10337] FAULT_INJECTION: forcing a failure. [ 200.103653][T10337] name failslab, interval 1, probability 0, space 0, times 0 [ 200.123802][T10337] CPU: 1 UID: 0 PID: 10337 Comm: syz.3.1289 Not tainted syzkaller #0 PREEMPT(full) [ 200.123827][T10337] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 200.123836][T10337] Call Trace: [ 200.123843][T10337] [ 200.123850][T10337] dump_stack_lvl+0xe8/0x150 [ 200.123879][T10337] should_fail_ex+0x40c/0x560 [ 200.123901][T10337] should_failslab+0xa8/0x100 [ 200.123925][T10337] kmem_cache_alloc_node_noprof+0xb3/0x610 [ 200.123942][T10337] ? local_lock_release+0x9c/0x160 [ 200.123965][T10337] ? __alloc_skb+0x1d7/0x7a0 [ 200.123985][T10337] ? __alloc_skb+0x1d7/0x7a0 [ 200.124010][T10337] __alloc_skb+0x1d7/0x7a0 [ 200.124037][T10337] netlink_ack+0x136/0xb30 [ 200.124060][T10337] ? __kmalloc_cache_noprof+0x150/0x660 [ 200.124078][T10337] ? nfnetlink_rcv+0x1021/0x28c0 [ 200.124099][T10337] nfnetlink_rcv+0x260c/0x28c0 [ 200.124141][T10337] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 200.124189][T10337] ? netlink_deliver_tap+0x2e/0x1b0 [ 200.124211][T10337] ? netlink_deliver_tap+0x2e/0x1b0 [ 200.124225][T10337] ? netlink_deliver_tap+0x2e/0x1b0 [ 200.124243][T10337] netlink_unicast+0x7bb/0x940 [ 200.124264][T10337] netlink_sendmsg+0x813/0xb40 [ 200.124285][T10337] ? __pfx_netlink_sendmsg+0x10/0x10 [ 200.124303][T10337] ? aa_sock_msg_perm+0xf1/0x1b0 [ 200.124325][T10337] ? __pfx_netlink_sendmsg+0x10/0x10 [ 200.124339][T10337] sock_sendmsg_nosec+0x13a/0x180 [ 200.124358][T10337] ____sys_sendmsg+0x54e/0x850 [ 200.124377][T10337] ? __pfx_____sys_sendmsg+0x10/0x10 [ 200.124397][T10337] ? import_iovec+0x73/0xa0 [ 200.124417][T10337] ___sys_sendmsg+0x2a5/0x360 [ 200.124430][T10337] ? __lock_acquire+0x683/0x2cf0 [ 200.124449][T10337] ? __pfx____sys_sendmsg+0x10/0x10 [ 200.124488][T10337] ? __fget_files+0x2a/0x420 [ 200.124503][T10337] ? __fget_files+0x3a2/0x420 [ 200.124525][T10337] __x64_sys_sendmsg+0x1b1/0x290 [ 200.124542][T10337] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 200.124577][T10337] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 200.124592][T10337] do_syscall_64+0x174/0x580 [ 200.124609][T10337] ? trace_irq_disable+0x3b/0x140 [ 200.124624][T10337] ? clear_bhb_loop+0x70/0xc0 [ 200.124640][T10337] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 200.124654][T10337] RIP: 0033:0x7f305ad9e0d9 [ 200.124668][T10337] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 200.124679][T10337] RSP: 002b:00007f305bb8d028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 200.124694][T10337] RAX: ffffffffffffffda RBX: 00007f305b025fa0 RCX: 00007f305ad9e0d9 [ 200.124704][T10337] RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000000000000003 [ 200.124712][T10337] RBP: 00007f305bb8d090 R08: 0000000000000000 R09: 0000000000000000 [ 200.124721][T10337] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 200.124728][T10337] R13: 00007f305b026038 R14: 00007f305b025fa0 R15: 00007ffe63b43618 [ 200.124750][T10337] [ 200.191777][ C0] net_ratelimit: 2 callbacks suppressed [ 200.191795][ C0] bridge0: received packet on vlan3 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:1) [ 200.213168][T10331] 8021q: adding VLAN 0 to HW filter on device bond5 [ 200.457241][T10340] bridge0: port 2(bridge_slave_1) entered disabled state [ 200.464681][T10340] bridge0: port 1(bridge_slave_0) entered disabled state [ 200.512898][T10340] bond4: (slave bridge0): Releasing backup interface [ 200.535898][T10340] bridge0: port 2(bridge_slave_1) entered blocking state [ 200.543182][T10340] bridge0: port 2(bridge_slave_1) entered forwarding state [ 200.550824][T10340] bridge0: port 1(bridge_slave_0) entered blocking state [ 200.557995][T10340] bridge0: port 1(bridge_slave_0) entered forwarding state [ 200.599426][T10340] bond5: (slave bridge0): Enslaving as an active interface with an up link [ 200.664556][T10345] tc_dump_action: action bad kind [ 200.954595][T10367] bond6 (unregistering): Released all slaves [ 200.976875][T10371] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1296'. [ 201.009011][T10371] netlink: 356 bytes leftover after parsing attributes in process `syz.2.1296'. [ 201.020600][ C0] bridge0: received packet on vlan3 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:1) [ 201.051836][T10373] syz.1.1295 (10373) used obsolete PPPIOCDETACH ioctl [ 201.061302][T10371] netlink: 68 bytes leftover after parsing attributes in process `syz.2.1296'. [ 201.456045][T10385] syz_tun: entered allmulticast mode [ 201.480404][ T5619] Bluetooth: hci2: command 0x0406 tx timeout [ 201.486863][ T5619] Bluetooth: hci3: command 0x0406 tx timeout [ 201.493083][ T5619] Bluetooth: hci1: command 0x0406 tx timeout [ 201.586567][T10385] dvmrp8: entered allmulticast mode [ 201.658325][T10399] FAULT_INJECTION: forcing a failure. [ 201.658325][T10399] name failslab, interval 1, probability 0, space 0, times 0 [ 201.708489][T10399] CPU: 1 UID: 0 PID: 10399 Comm: syz.0.1302 Not tainted syzkaller #0 PREEMPT(full) [ 201.708512][T10399] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 201.708522][T10399] Call Trace: [ 201.708529][T10399] [ 201.708536][T10399] dump_stack_lvl+0xe8/0x150 [ 201.708564][T10399] should_fail_ex+0x40c/0x560 [ 201.708585][T10399] should_failslab+0xa8/0x100 [ 201.708607][T10399] kmem_cache_alloc_node_noprof+0xb3/0x610 [ 201.708624][T10399] ? local_lock_release+0x9c/0x160 [ 201.708647][T10399] ? __alloc_skb+0x1d7/0x7a0 [ 201.708667][T10399] ? __alloc_skb+0x1d7/0x7a0 [ 201.708693][T10399] __alloc_skb+0x1d7/0x7a0 [ 201.708717][T10399] netlink_ack+0x136/0xb30 [ 201.708736][T10399] ? __kmalloc_cache_noprof+0x150/0x660 [ 201.708753][T10399] ? nfnetlink_rcv+0x1021/0x28c0 [ 201.708776][T10399] nfnetlink_rcv+0x260c/0x28c0 [ 201.708824][T10399] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 201.708855][T10399] ? ref_tracker_free+0x689/0x830 [ 201.708897][T10399] ? lockdep_hardirqs_on+0x7a/0x110 [ 201.708918][T10399] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 201.708937][T10399] ? rcu_preempt_deferred_qs_irqrestore+0x7b7/0xb90 [ 201.708974][T10399] netlink_unicast+0x7bb/0x940 [ 201.708996][T10399] netlink_sendmsg+0x813/0xb40 [ 201.709023][T10399] ? __pfx_netlink_sendmsg+0x10/0x10 [ 201.709044][T10399] ? aa_sock_msg_perm+0xf1/0x1b0 [ 201.709071][T10399] ? __pfx_netlink_sendmsg+0x10/0x10 [ 201.709087][T10399] sock_sendmsg_nosec+0x13a/0x180 [ 201.709107][T10399] ____sys_sendmsg+0x54e/0x850 [ 201.709126][T10399] ? __pfx_____sys_sendmsg+0x10/0x10 [ 201.709147][T10399] ? import_iovec+0x73/0xa0 [ 201.709168][T10399] ___sys_sendmsg+0x2a5/0x360 [ 201.709184][T10399] ? __lock_acquire+0x683/0x2cf0 [ 201.709209][T10399] ? __pfx____sys_sendmsg+0x10/0x10 [ 201.709259][T10399] ? __fget_files+0x2a/0x420 [ 201.709278][T10399] ? __fget_files+0x3a2/0x420 [ 201.709307][T10399] __x64_sys_sendmsg+0x1b1/0x290 [ 201.709328][T10399] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 201.709361][T10399] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 201.709386][T10399] do_syscall_64+0x174/0x580 [ 201.709408][T10399] ? trace_irq_disable+0x3b/0x140 [ 201.709427][T10399] ? clear_bhb_loop+0x70/0xc0 [ 201.709448][T10399] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 201.709465][T10399] RIP: 0033:0x7f69d4f9e0d9 [ 201.709481][T10399] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 201.709495][T10399] RSP: 002b:00007f69d5e4f028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 201.709513][T10399] RAX: ffffffffffffffda RBX: 00007f69d5225fa0 RCX: 00007f69d4f9e0d9 [ 201.709525][T10399] RDX: 0000000000000000 RSI: 0000200000000400 RDI: 0000000000000003 [ 201.709536][T10399] RBP: 00007f69d5e4f090 R08: 0000000000000000 R09: 0000000000000000 [ 201.709546][T10399] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 201.709555][T10399] R13: 00007f69d5226038 R14: 00007f69d5225fa0 R15: 00007fff038c05c8 [ 201.709582][T10399] [ 202.110384][ C0] bridge0: received packet on vlan3 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:1) [ 202.164233][T10411] netlink: 'syz.4.1308': attribute type 21 has an invalid length. [ 202.178929][T10411] IPv6: NLM_F_CREATE should be specified when creating new route [ 202.188794][T10411] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 202.196131][T10411] IPv6: NLM_F_CREATE should be set when creating new route [ 202.196486][T10384] syz_tun: left allmulticast mode [ 202.645227][T10444] netlink: 'syz.2.1315': attribute type 4 has an invalid length. [ 202.739458][T10446] dummy0: mtu less than device minimum [ 203.100151][ C0] bridge0: received packet on vlan3 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:1) [ 203.141507][T10418] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 203.166895][T10467] netlink: 'syz.3.1324': attribute type 15 has an invalid length. [ 203.176637][T10418] Bluetooth: hci1: Error when powering off device on rfkill (-4) [ 203.193774][T10467] mac80211_hwsim hwsim3 syzkaller0: left promiscuous mode [ 203.215586][T10467] mac80211_hwsim hwsim3 syzkaller0: left allmulticast mode [ 203.218043][T10418] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 203.270939][T10418] Bluetooth: hci2: Error when powering off device on rfkill (-4) [ 203.356732][T10418] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 203.367483][T10471] netlink: 'syz.3.1326': attribute type 7 has an invalid length. [ 203.379857][T10418] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 203.427116][T10418] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 203.444688][T10418] Bluetooth: hci4: Error when powering off device on rfkill (-4) [ 203.526779][T10474] netlink: 'syz.0.1327': attribute type 30 has an invalid length. [ 203.539021][T10477] FAULT_INJECTION: forcing a failure. [ 203.539021][T10477] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 203.592843][ T30] audit: type=1804 audit(1786115098.177:4): pid=10474 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.0.1327" name="/newroot/270/cgroup.controllers" dev="tmpfs" ino=1393 res=1 errno=0 [ 203.623523][T10477] CPU: 0 UID: 0 PID: 10477 Comm: syz.3.1328 Not tainted syzkaller #0 PREEMPT(full) [ 203.623555][T10477] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 203.623564][T10477] Call Trace: [ 203.623571][T10477] [ 203.623579][T10477] dump_stack_lvl+0xe8/0x150 [ 203.623607][T10477] should_fail_ex+0x40c/0x560 [ 203.623629][T10477] _copy_to_user+0x31/0xb0 [ 203.623670][T10477] simple_read_from_buffer+0xe1/0x170 [ 203.623697][T10477] proc_fail_nth_read+0x1bb/0x230 [ 203.623723][T10477] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 203.623749][T10477] ? rw_verify_area+0x24a/0x4c0 [ 203.623774][T10477] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 203.623796][T10477] vfs_read+0x213/0xa80 [ 203.623824][T10477] ? __pfx___mutex_lock+0x10/0x10 [ 203.623848][T10477] ? __pfx_vfs_read+0x10/0x10 [ 203.623872][T10477] ? __fget_files+0x2a/0x420 [ 203.623897][T10477] ? __fget_files+0x3a2/0x420 [ 203.623915][T10477] ? __fget_files+0x2a/0x420 [ 203.623944][T10477] ksys_read+0x150/0x270 [ 203.623969][T10477] ? __pfx_ksys_read+0x10/0x10 [ 203.624001][T10477] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 203.624019][T10477] do_syscall_64+0x174/0x580 [ 203.624040][T10477] ? trace_irq_disable+0x3b/0x140 [ 203.624061][T10477] ? clear_bhb_loop+0x70/0xc0 [ 203.624082][T10477] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 203.624099][T10477] RIP: 0033:0x7f305ad5e90e [ 203.624115][T10477] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 203.624129][T10477] RSP: 002b:00007f305bb8cfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 203.624147][T10477] RAX: ffffffffffffffda RBX: 00007f305bb8d6c0 RCX: 00007f305ad5e90e [ 203.624159][T10477] RDX: 000000000000000f RSI: 00007f305bb8d0a0 RDI: 0000000000000004 [ 203.624170][T10477] RBP: 00007f305bb8d090 R08: 0000000000000000 R09: 0000000000000000 [ 203.624180][T10477] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 203.624190][T10477] R13: 00007f305b026038 R14: 00007f305b025fa0 R15: 00007ffe63b43618 [ 203.624220][T10477] [ 203.626651][T10418] Oops: general protection fault, probably for non-canonical address 0xdffffc000000000b: 0000 [#1] SMP KASAN PTI [ 203.640468][ T30] audit: type=1800 audit(1786115098.177:5): pid=10474 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.1327" name="cgroup.controllers" dev="tmpfs" ino=1393 res=0 errno=0 [ 203.646131][T10418] KASAN: null-ptr-deref in range [0x0000000000000058-0x000000000000005f] [ 203.872091][T10418] CPU: 1 UID: 0 PID: 10418 Comm: syz.1.1310 Not tainted syzkaller #0 PREEMPT(full) [ 203.881570][T10418] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 203.891637][T10418] RIP: 0010:klist_remove+0x156/0x340 [ 203.896954][T10418] Code: 4d 89 f5 49 c1 ed 03 43 80 7c 3d 00 00 74 08 4c 89 f7 e8 0d 83 6d f6 4d 8b 26 49 83 e4 fe 49 8d 7c 24 58 48 89 f8 48 c1 e8 03 <42> 80 3c 38 00 74 05 e8 ee 82 6d f6 49 8b 44 24 58 48 89 44 24 08 [ 203.916662][T10418] RSP: 0018:ffffc90006a07820 EFLAGS: 00010202 [ 203.922769][T10418] RAX: 000000000000000b RBX: ffff888027ff9f00 RCX: 0000000000000000 [ 203.930755][T10418] RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000058 [ 203.938742][T10418] RBP: ffffc90006a07920 R08: ffffffff903d14a3 R09: 1ffffffff207a294 [ 203.946713][T10418] R10: dffffc0000000000 R11: fffffbfff207a295 R12: 0000000000000000 [ 203.954677][T10418] R13: 1ffff1100aeb628c R14: ffff8880575b1460 R15: dffffc0000000000 [ 203.962643][T10418] FS: 00007f98a7e0b6c0(0000) GS:ffff88812505b000(0000) knlGS:0000000000000000 [ 203.971562][T10418] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 203.978138][T10418] CR2: 000000110c3604b6 CR3: 0000000051416000 CR4: 00000000003526f0 [ 203.986105][T10418] Call Trace: [ 203.989380][T10418] [ 203.992306][T10418] ? __pfx_klist_remove+0x10/0x10 [ 203.997329][T10418] ? kobject_move+0x5e2/0x720 [ 204.001993][T10418] ? __pfx_kobject_move+0x10/0x10 [ 204.007000][T10418] ? do_raw_spin_unlock+0xf5/0x210 [ 204.012100][T10418] ? get_device_parent+0x366/0x3a0 [ 204.017210][T10418] device_move+0x18e/0x720 [ 204.021619][T10418] hci_conn_del_sysfs+0xb8/0x1a0 [ 204.026550][T10418] hci_conn_del+0xc3d/0x1200 [ 204.031137][T10418] hci_conn_hash_flush+0x189/0x260 [ 204.036246][T10418] hci_dev_close_sync+0x7fc/0x10a0 [ 204.041349][T10418] ? __pfx___mutex_lock+0x10/0x10 [ 204.046367][T10418] ? __pfx_hci_dev_close_sync+0x10/0x10 [ 204.051904][T10418] ? do_raw_spin_lock+0x12b/0x2f0 [ 204.056919][T10418] hci_dev_do_close+0x30/0xc0 [ 204.061585][T10418] hci_rfkill_set_block+0x1f4/0x290 [ 204.066781][T10418] ? __pfx_hci_rfkill_set_block+0x10/0x10 [ 204.072502][T10418] rfkill_set_block+0x19f/0x4d0 [ 204.077349][T10418] rfkill_fop_write+0x43b/0x560 [ 204.082195][T10418] ? apparmor_file_permission+0x1f4/0x300 [ 204.087999][T10418] ? __pfx_rfkill_fop_write+0x10/0x10 [ 204.093367][T10418] ? security_kernfs_init_security+0x210/0x270 [ 204.099509][T10418] ? rw_verify_area+0x203/0x4c0 [ 204.104354][T10418] ? __pfx_rfkill_fop_write+0x10/0x10 [ 204.109723][T10418] vfs_write+0x296/0xba0 [ 204.114002][T10418] ? __pfx_vfs_write+0x10/0x10 [ 204.118762][T10418] ? __fget_files+0x2a/0x420 [ 204.123353][T10418] ? __fget_files+0x2a/0x420 [ 204.127933][T10418] ? __fget_files+0x3a2/0x420 [ 204.131380][ C0] bridge0: received packet on vlan3 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:1) [ 204.132605][T10418] ? __fget_files+0x2a/0x420 [ 204.148288][T10418] ksys_write+0x150/0x270 [ 204.152623][T10418] ? __pfx_ksys_write+0x10/0x10 [ 204.157474][T10418] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 204.163532][T10418] do_syscall_64+0x174/0x580 [ 204.168205][T10418] ? trace_irq_disable+0x3b/0x140 [ 204.173220][T10418] ? clear_bhb_loop+0x70/0xc0 [ 204.177887][T10418] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 204.183767][T10418] RIP: 0033:0x7f98a6f9e0d9 [ 204.188177][T10418] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 204.207867][T10418] RSP: 002b:00007f98a7e0b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 204.216291][T10418] RAX: ffffffffffffffda RBX: 00007f98a7225fa0 RCX: 00007f98a6f9e0d9 [ 204.224257][T10418] RDX: 0000000000000008 RSI: 0000200000000080 RDI: 0000000000000008 [ 204.232225][T10418] RBP: 00007f98a7035024 R08: 0000000000000000 R09: 0000000000000000 [ 204.240303][T10418] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 204.248263][T10418] R13: 00007f98a7226038 R14: 00007f98a7225fa0 R15: 00007fff2532e218 [ 204.256228][T10418] [ 204.259233][T10418] Modules linked in: [ 204.264992][T10418] ---[ end trace 0000000000000000 ]--- [ 204.321354][T10491] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 204.341891][T10418] RIP: 0010:klist_remove+0x156/0x340 [ 204.376938][T10418] Code: 4d 89 f5 49 c1 ed 03 43 80 7c 3d 00 00 74 08 4c 89 f7 e8 0d 83 6d f6 4d 8b 26 49 83 e4 fe 49 8d 7c 24 58 48 89 f8 48 c1 e8 03 <42> 80 3c 38 00 74 05 e8 ee 82 6d f6 49 8b 44 24 58 48 89 44 24 08 [ 204.401624][T10418] RSP: 0018:ffffc90006a07820 EFLAGS: 00010202 [ 204.407821][T10418] RAX: 000000000000000b RBX: ffff888027ff9f00 RCX: 0000000000000000 [ 204.435190][T10418] RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000058 [ 204.455918][T10418] RBP: ffffc90006a07920 R08: ffffffff903d14a3 R09: 1ffffffff207a294 [ 204.464681][T10418] R10: dffffc0000000000 R11: fffffbfff207a295 R12: 0000000000000000 [ 204.473074][T10418] R13: 1ffff1100aeb628c R14: ffff8880575b1460 R15: dffffc0000000000 [ 204.481167][T10418] FS: 00007f98a7e0b6c0(0000) GS:ffff88812505b000(0000) knlGS:0000000000000000 [ 204.490244][T10418] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 204.496899][T10418] CR2: 00007f305afef2f8 CR3: 0000000051416000 CR4: 00000000003526f0 [ 204.505592][T10418] Kernel panic - not syncing: Fatal exception [ 204.511944][T10418] Kernel Offset: disabled [ 204.516263][T10418] Rebooting in 86400 seconds..