last executing test programs: 36.46486452s ago: executing program 4 (id=14473): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r0, 0x0, 0x0) 36.410991819s ago: executing program 4 (id=14474): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB], &(0x7f0000000040)='GPL\x00', 0x5, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x32, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r1}, 0x18) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)={0x38, 0x1403, 0x1, 0x70bd29, 0x25dfdbff, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth0_to_bridge\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x8081}, 0x20000010) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'batadv_slave_1\x00', 0x0}) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0b00000007000000010001000900000001"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000000)={{r3, 0xffffffffffffffff}, &(0x7f0000000580), &(0x7f00000005c0)}, 0x20) r5 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340), 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000000c0)={r5, 0xffffffffffffffff}, 0x4) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x18, 0x19, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000003000000b7080000000000007b8af8ff00000000b7080000010000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r6, @ANYBLOB="0000000000000000b70500000800000085000000a500000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r7}, 0x10) sendmsg$nl_route_sched(r0, &(0x7f0000000480)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)=@gettfilter={0x3c, 0x2e, 0x10, 0x70bd2a, 0x25dfdbff, {0x0, 0x0, 0x0, r2, {0x8, 0x5}, {0x4, 0x7}, {0x1, 0x10}}, [{0x8, 0xb, 0x9}, {0x8, 0xb, 0xfb}, {0x8, 0xb, 0x6}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4040801}, 0x4010) sendmsg$nl_route(r0, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="540000001900030525bd7000ffdbdf2502201081fc02fd050000000008000500ac1e010108000700e000000108000300", @ANYRES32=0x0, @ANYBLOB="08000400", @ANYRES32=r2, @ANYBLOB="06001c004e220000090005000000000008000500ac1e0101"], 0x54}, 0x1, 0x0, 0x0, 0x40841}, 0x4008802) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)=[{0x0}, {&(0x7f0000000580)="d4fa0c51", 0x4}], 0x2}, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8b18, &(0x7f0000000000)={'wlan1\x00'}) ioctl$sock_ifreq(0xffffffffffffffff, 0x8910, &(0x7f0000000000)={'veth0_vlan\x00', @ifru_ivalue=0x7}) 36.410348652s ago: executing program 4 (id=14475): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000340)=ANY=[@ANYBLOB="1c0000002500012f8b74ae53050571ff050000000800030047"], 0x1c}, 0x1, 0x0, 0x0, 0x4048957}, 0x28040) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r2 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r2, &(0x7f0000000000), 0x10) sendmsg$can_bcm(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000000c0)={0x5, 0x0, 0x0, {}, {0x77359400}, {}, 0x2, @can={{}, 0x0, 0x0, 0x0, 0x0, "3fd31340e92c4bb8"}}, 0x48}, 0x300}, 0x0) sendmsg$can_bcm(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)={0x5, 0x4, 0xc0000000, {0x0, 0x2710}, {0x77359400}, {}, 0x2, @canfd={{0x1, 0x1, 0x1, 0x1}, 0x1d, 0x3, 0x0, 0x0, "750cb35a82f275078e2c086f5a4308684eef29381ae2fd2dce79f6a5346987625ae037455b5a8bb03f34c0b61ffa5b631792a23a4e42d821acb37de82ad3b52b"}}, 0x80}, 0x300}, 0x8040) accept4$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @private0}, &(0x7f0000000040)=0x1c, 0x0) recvmsg(r0, &(0x7f0000001980)={0x0, 0x0, 0x0}, 0x142) 36.343896618s ago: executing program 4 (id=14477): syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(r0, 0x0, 0x4000000) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r1, &(0x7f0000000140), 0x10) socket$nl_route(0x10, 0x3, 0x0) socket$packet(0x11, 0x2, 0x300) close(0x3) socket$can_raw(0x1d, 0x3, 0x1) r2 = socket$nl_route(0x10, 0x3, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) write$tun(r3, 0x0, 0xfc) ioctl$ifreq_SIOCGIFINDEX_wireguard(r4, 0x8933, &(0x7f0000000180)={'wg0\x00'}) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000580)=ANY=[@ANYBLOB="54003f001000010400000000000000ffff000000", @ANYRES32=0x0, @ANYBLOB="0380000000000000240012800c0001006d6163766c616e00140002800800010008000000062102000100000008000500", @ANYRES32=r4, @ANYBLOB='\b\x00\n\x00]'], 0x54}, 0x1, 0x0, 0x0, 0x8000}, 0x0) 36.271626999s ago: executing program 4 (id=14479): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0x1c1341, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r1, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_rx_ring(r1, 0x107, 0x5, &(0x7f0000000140)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x7ff, 0xf83, 0x6}, 0x1c) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r2) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) writev(r0, &(0x7f0000000040)=[{&(0x7f0000000000)="89e7ee2c7cdad9b4b47380c988ca", 0xe}, {&(0x7f0000000100)='9', 0x1}], 0x2) 36.148931772s ago: executing program 4 (id=14481): r0 = socket$inet6(0xa, 0x2, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$DEVLINK_CMD_SB_POOL_GET(r1, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000001c0)={&(0x7f0000000480)={0x14, 0x0, 0x1, 0x70bd26, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x40}, 0x20000040) getsockname$packet(r1, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) accept4$inet(r1, &(0x7f0000000240)={0x2, 0x0, @private}, &(0x7f0000000280)=0x10, 0x0) sendmsg$nl_route(r1, &(0x7f0000000440)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000500)=@newlink={0x88, 0x10, 0x437, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x5a413}, [@IFLA_LINKINFO={0x68, 0x12, 0x0, 0x1, @geneve={{0xb}, {0x58, 0x2, 0x0, 0x1, [@IFLA_GENEVE_DF={0x5, 0xd, 0x2}, @IFLA_GENEVE_DF={0x5, 0xd, 0xf}, @IFLA_GENEVE_REMOTE6={0x14, 0x7, @private0}, @IFLA_GENEVE_TTL={0x5, 0x3, 0x81}, @IFLA_GENEVE_TOS={0x5, 0x4, 0x3}, @IFLA_GENEVE_LABEL={0x8, 0xb, 0x1, 0x0, 0xd}, @IFLA_GENEVE_PORT={0x6, 0x5, 0x4e21}, @IFLA_GENEVE_LABEL={0x8, 0xb, 0x1, 0x0, 0x7}, @IFLA_GENEVE_ID={0x8, 0x1, 0x4}]}}}]}, 0x88}, 0x1, 0x0, 0x0, 0x40000}, 0x0) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r4 = accept4(r3, 0x0, 0x0, 0x80000) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000201000010000000000000000000000000a34000000060a0b04000000000000000002000000200004801c0001800900010068617368000000000c0002800f0001400000080a140000001100010000000000000000000000000a"], 0x5c}, 0x1, 0x0, 0x0, 0x24004094}, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x101400, 0x0) ioctl$SIOCSIFHWADDR(r5, 0x8924, &(0x7f0000000140)={'bond_slave_1\x00'}) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a010400000000000000000500fffe0900010073797a30000000002c000000030a01020000000000000000050000000900010073797a30000000000900030073797a3200000000e4040000060a010400000000000000000500000008000b40000000000900010073797a300000000008000940000000020c0005800800014000000000c4000740ab487b1b512f33a8dbd67a8b35f2405127f309901ea13e31d5810f85eae8f528c938c24abb1b1abbda2e7fa6e0758629bb09ed64a8ba5b2ef3c3591fd06d7e10d93c0857ecac854ac51ad69639d98adb2c1464e444cc1a6a2e7ee244622433b51f58606b063f4938101a7e764c957eba2e913b2ac10435471fa769740a1275cb467e5264b71bc8727fc12e9aba46e4a8abf3dda91e0da608d6a0a35573d5524fb25451cc23051887de4df85c8e771260c4943e78905aa1e7493027366ed1bea0d80304804800018008000100667764003c0002800800"], 0x558}}, 0x40) sendmmsg$alg(r4, &(0x7f0000000400)=[{0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000380)="7106c3604b3896c24ad23870642fef065d940ba1fdfc701cb204b4216b9ca5cca3de52ce0a86d7b02e4af368b98741b0", 0x30}], 0x1, &(0x7f0000000a40)=ANY=[@ANYBLOB="1800000000000000170100000300000001"], 0x18}], 0x1, 0x0) recvmmsg(r4, &(0x7f0000000780)=[{{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000005c0)=""/179, 0xb3}], 0x1}, 0xb}], 0x1, 0x10050, 0x0) socket$tipc(0x1e, 0x5, 0x0) sendmmsg$inet(r0, &(0x7f00000018c0)=[{{&(0x7f0000000040)={0x2, 0x4e1c, @loopback}, 0x10, 0x0, 0x0, &(0x7f0000000080)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r2, @empty, @multicast1}}}], 0x20}}], 0x1, 0x4880) 35.972511534s ago: executing program 32 (id=14481): r0 = socket$inet6(0xa, 0x2, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$DEVLINK_CMD_SB_POOL_GET(r1, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000001c0)={&(0x7f0000000480)={0x14, 0x0, 0x1, 0x70bd26, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x40}, 0x20000040) getsockname$packet(r1, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) accept4$inet(r1, &(0x7f0000000240)={0x2, 0x0, @private}, &(0x7f0000000280)=0x10, 0x0) sendmsg$nl_route(r1, &(0x7f0000000440)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000500)=@newlink={0x88, 0x10, 0x437, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x5a413}, [@IFLA_LINKINFO={0x68, 0x12, 0x0, 0x1, @geneve={{0xb}, {0x58, 0x2, 0x0, 0x1, [@IFLA_GENEVE_DF={0x5, 0xd, 0x2}, @IFLA_GENEVE_DF={0x5, 0xd, 0xf}, @IFLA_GENEVE_REMOTE6={0x14, 0x7, @private0}, @IFLA_GENEVE_TTL={0x5, 0x3, 0x81}, @IFLA_GENEVE_TOS={0x5, 0x4, 0x3}, @IFLA_GENEVE_LABEL={0x8, 0xb, 0x1, 0x0, 0xd}, @IFLA_GENEVE_PORT={0x6, 0x5, 0x4e21}, @IFLA_GENEVE_LABEL={0x8, 0xb, 0x1, 0x0, 0x7}, @IFLA_GENEVE_ID={0x8, 0x1, 0x4}]}}}]}, 0x88}, 0x1, 0x0, 0x0, 0x40000}, 0x0) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r4 = accept4(r3, 0x0, 0x0, 0x80000) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000201000010000000000000000000000000a34000000060a0b04000000000000000002000000200004801c0001800900010068617368000000000c0002800f0001400000080a140000001100010000000000000000000000000a"], 0x5c}, 0x1, 0x0, 0x0, 0x24004094}, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x101400, 0x0) ioctl$SIOCSIFHWADDR(r5, 0x8924, &(0x7f0000000140)={'bond_slave_1\x00'}) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a010400000000000000000500fffe0900010073797a30000000002c000000030a01020000000000000000050000000900010073797a30000000000900030073797a3200000000e4040000060a010400000000000000000500000008000b40000000000900010073797a300000000008000940000000020c0005800800014000000000c4000740ab487b1b512f33a8dbd67a8b35f2405127f309901ea13e31d5810f85eae8f528c938c24abb1b1abbda2e7fa6e0758629bb09ed64a8ba5b2ef3c3591fd06d7e10d93c0857ecac854ac51ad69639d98adb2c1464e444cc1a6a2e7ee244622433b51f58606b063f4938101a7e764c957eba2e913b2ac10435471fa769740a1275cb467e5264b71bc8727fc12e9aba46e4a8abf3dda91e0da608d6a0a35573d5524fb25451cc23051887de4df85c8e771260c4943e78905aa1e7493027366ed1bea0d80304804800018008000100667764003c0002800800"], 0x558}}, 0x40) sendmmsg$alg(r4, &(0x7f0000000400)=[{0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000380)="7106c3604b3896c24ad23870642fef065d940ba1fdfc701cb204b4216b9ca5cca3de52ce0a86d7b02e4af368b98741b0", 0x30}], 0x1, &(0x7f0000000a40)=ANY=[@ANYBLOB="1800000000000000170100000300000001"], 0x18}], 0x1, 0x0) recvmmsg(r4, &(0x7f0000000780)=[{{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000005c0)=""/179, 0xb3}], 0x1}, 0xb}], 0x1, 0x10050, 0x0) socket$tipc(0x1e, 0x5, 0x0) sendmmsg$inet(r0, &(0x7f00000018c0)=[{{&(0x7f0000000040)={0x2, 0x4e1c, @loopback}, 0x10, 0x0, 0x0, &(0x7f0000000080)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r2, @empty, @multicast1}}}], 0x20}}], 0x1, 0x4880) 5.036207073s ago: executing program 3 (id=14674): r0 = socket$inet(0x2, 0x2, 0x1) sendmsg$inet(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000400)='\b\x00', 0x2}], 0x1, 0x0, 0x40}, 0x20000000) r1 = epoll_create1(0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000200)="ad00"/16, 0x10) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, 0x0, 0x0) r3 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000800000000bf91000000000000b702000043e7b5538500000085000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r5 = socket(0x2, 0x80805, 0x0) r6 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r6, &(0x7f0000000140)=[{&(0x7f0000000080)="580000001400192340834b80040d8c560a067f0200ff000000000000000058000b4824ca945f64009400ff0325010ebc000000000000008000f0fffeffe809005300fff5dd000000100001000a0c100000000000000fff00", 0x58}], 0x1) setsockopt$IP_VS_SO_SET_ADD(0xffffffffffffffff, 0x0, 0x482, &(0x7f0000000040)={0x84, @dev={0xac, 0x14, 0x14, 0x2d}, 0x4e20, 0x3, 'wrr\x00', 0x1, 0x2, 0x6a}, 0x2c) setsockopt$IP_VS_SO_SET_ADDDEST(r5, 0x0, 0x487, &(0x7f0000000000)={{0x84, @private=0xa010101, 0x4e21, 0x3, 'lc\x00', 0x4, 0x8, 0x77}, {@rand_addr=0x64010102, 0x4e24, 0x2, 0xcd, 0x12d5e, 0x3}}, 0x44) socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$IP_VS_SO_SET_FLUSH(0xffffffffffffffff, 0x0, 0x485, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r4}, 0x10) ppoll(&(0x7f0000000500)=[{r3}], 0x1, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0xfffffffffffff5fd, 0x0, 0x4000003}, 0x0, &(0x7f00000002c0)={0x3ff, 0x9, 0x0, 0xc, 0x0, 0x0, 0x4, 0x1}, 0x0, 0x0) r7 = socket$unix(0x1, 0x5, 0x0) unshare(0x2c060000) unshare(0x24020400) r8 = socket$unix(0x1, 0x1, 0x0) bind$unix(r8, &(0x7f00000000c0)=@abs={0x1, 0x0, 0x4e22}, 0x6e) bind$unix(r8, &(0x7f0000000000)=@file={0x1, './file0\x00'}, 0x6e) syz_emit_ethernet(0x4e, &(0x7f00000001c0)={@random="5b37182347bc", @broadcast, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "9d0080", 0x18, 0x3a, 0xff, @empty, @mcast2, {[], @ndisc_ns={0x87, 0x0, 0x0, @local, [{0x0, 0x0, "ff9b"}]}}}}}}, 0x0) setsockopt$sock_int(r7, 0x1, 0x2e, &(0x7f0000000040)=0x80, 0x4) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r7, &(0x7f0000000080)={0xa002a008}) 4.088782755s ago: executing program 3 (id=14684): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000b40)) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000340), r0) sendmsg$TIPC_CMD_GET_NETID(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000380)={0x1c, r1, 0x4, 0x70bd27, 0x25df9bfd}, 0xffc4}, 0x1, 0x0, 0x0, 0x20040000}, 0x80) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000340)={0x26, 'skcipher\x00', 0x0, 0x0, 'chacha20-generic\x00'}, 0x58) unshare(0x62040200) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="1c0000006800e97800000000000000000a0000000000000004000400f6a3455c054099bc27f26cdca43e1562d7a1607b68160c7d3121cce626695321baa8b1539367aa47da5552c0b0e840ef2c3682ab59b45c5775b904000000000000006519377ca0b294038898843980f5965afe201324b1be11e965daae29b8d51467d4c95790eca3a69f2d46046650ea5f34840e826a32337181761e3e095ed416fed1fc391dd74d3570dfa9e6781da62f083c161d96581af54081b27dce9ad503eb761b8022232666bb302d9bd5bffc2dfde48c6de70eb320d5e46d65287da98a8d8dd29ae76ec157d1faeff0afb9f4c3f436b7d994cba170f3884254d8fbd78793e4865b6c41bbf9a5e365cba0ba94717844fa6939136edc7ddf5b41ddbd0a1808bb8f8694"], 0x1c}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=@newnexthop={0x24, 0x68, 0x1, 0x2, 0x7ffffffc, {}, [@NHA_GROUP={0xc, 0x2, [{0x1, 0x4}]}]}, 0x24}, 0x1, 0x0, 0x0, 0x24008000}, 0x4000) socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=ANY=[@ANYBLOB="24000000478c808c000004000000000002001000fe04000100000020084d7e3612021e14"], 0x24}, 0x1, 0x0, 0x0, 0x4a044}, 0x4010) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000300)="c99b57381801238c09d04a0f1d0d47b2", 0x10) r5 = accept4(r2, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$fou(0x0, r5) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0x4401}) writev(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f0000000080)="0bc3ff", 0x3}, {&(0x7f0000000000)='G', 0x1}, {&(0x7f0000000240)='\x00'/10, 0xa}], 0x3) sendmmsg$inet6(r5, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000480)="dacd51deb3f4c5aad709a3adffd82be4a4080d81eec8532a5c78916a94945addab2bb680d45927b0ed8f9b9c9addff71fbc1052f219d7d3000"/69, 0x45}], 0x1}}], 0x1, 0x4000040) r6 = socket$netlink(0x10, 0x3, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) sendmmsg(r7, &(0x7f0000001c00), 0x400000000000159, 0x40840) sendmsg(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x6, @local, 0xe}, 0x80, &(0x7f0000000200)=[{&(0x7f0000000100)}, {&(0x7f0000000140)="9b87a7e080d34ad499b9b36f4e70aee186d5d1e5772aa3f0467475f8094db20c5e5127a95234343b77c67c308ea9c06415fc620429d23dbfc0ef1a0e7dda683e", 0x40}, {&(0x7f0000000700)="75b9d2605b5c55d110450f05b6c40dd49285e80041e8f30b01ba94fa0bf194de217c42e1e9b27c3eccc64aec3deaf054faa2288a248e8c6042bcf362edceaf80b63a86dde285b9aa83bcaa57b41e5fc50abdf43327e6f26f3cb02d457305e133ab94b65474ed3073294736761da4dbd8249631cd1fa6f3d66cdd4f5ad58d9b70107bb1b282ea4aa15aeac716931af5539bbeb3e34ef63d04b94d646cf8ee1821e11e3c022bfff4a2ebf1ea3056cb99da9e2794f236539c94b73e24829caaecbc56bdbd9f70a1db659461e35d85bcd2f63f8e6ee23457b3b5bdaa24aed6293b4da54225dbc3bc94909793fec82c8e16603c06b30c92b4cdcadd55ea70066faf2ada83cfe515fd931304bc2aa3f8354feb80a31ba966e333a98b02a3a664b8752f8ca2968ffcdef6cee13e798b9e71ee5c93e02e3118068aa3ddd67ee1f281517778e769118b63109b33a2ac5f5b53b48ac1497a11038e9063c6a6d7642b81710de07fcb7e999aa6e63f361b576f02d14d7deb3130347cff575bdbcb0c276a719c4ff68a041352292be461098a00e676a666da6eeede87f490c7bae567d2d05b77aa94b409297343203f6f5d34d2077f75843272f0e6df84c3475bd5d5c158226ff39d8b5a5946eca37b056ce5ff60641f03d377b065eeb04eb21d445aac91643cf348afe8e8ef4dee08fae3889f437d89c82952ea778f98b9dde4ac76187a1fa819c5514f95bc16e89a866745ec79db691c4fcea5394e5c5b1331346b3f7fdd306b53edf0421f96a2f7fbb0852c398a5aa7b64587d57054efd72ff186e9f09998aec7156aa8df82bb328797e3f7efe356a14a2428d27a7d1e190e0beb609652294493aad66e5860a1a9d5ab8d2839550493c97f0d668da6a7a0d431264804e0f3c9bfcd1ae3b0bacc1da6c809f617bf6c3f7780ae929fb26be8d7c3f659af672ce1ecb750749731784c72129985329565359ec8dbef1ce27fd06cb4d039b43a2b0a3b87e7dd1752ae0b7ed1f27a9c304706256aaa004c1d5880cb5f42729ad1759bb485fa9aaf8f0b397a34d774a1e5fffba62cfddf25f3063c6c67dc76b7645ea8042b7eea6c3184abc7140241b155becfaeb788a23251cd27bf0803f0d8353227daef3f4614b3f1bdf78fb92712761cbeda352147f5d4534d1ca987ae68872f9dcc9209436a01ec82d6f71d150050d69e61d3a71e75a95f101cf79d52a61abeda702f3a26668d82db43b20321af82d2cd603c10b9a201eba34c7b10459d68e1a729597ceb5d5b88e61a60cf98366074d3f7f0e5216e5498a39c88bb8a488f3754a9890c12a33be60e94371f490d3a28755cfebadf05fbf81e24d63d1af73f76e5001c6276950222b6ecc324d30b02b8163b6cbb63dd6eae8ad78af85deb397f3d90297efc297801b98a566028e841385009a364818f4057c51ee107a8d0198f94afb05571224632759aa03ae3f52de9901bf4125d6e2f78df809dd65a6321485b5a0811ce8ed5ccd393a5086455f738059f8a542ef662660e01513c4b8b4e69656ec31d1094e4dd4e30a448cb2bf24f58f0b70998db23dfd02f4c109734a86a9befb06964345e44e67861e4172d10360ea815698883c2a1b30faff182fee0ee26ba507f2f5044f9e654d1a849cff80f98ecb02eed404c33b7d7a049bf32ce0e3ce86299c5a32a861f3b7f7fab6d9e308278d15c8690c254f41a8098b69c377ebc20326d133fa6a4cecab1ff7770fbd23f650d83ef1c3da2f7e7130c28b4fecb78e456506c1daa8c5552e081101c5879f7be3fbc1daf9560d97d80af0f90152225075918fbb3078dcad7b766393e364e2e5d8b9f7254a2169f2a6bdaee1e2038251802d229b01c3af7b07317738aab276ec604095eebe6569832d617a236cb93ed8b992504be019ce043d9c6dd308b4910916ca343039b2149b60d1b002f8a9a54846ea175c960cea6e5318ec2ecf277185377539bb5028503ee7c52bc4d5f3710fde85c7d3c747f9942c9d603f81b9ec95cdc977504a4911590dc8011d1ff96dc2af6f399ee2ccf09aef4b54910086d6f0f90800f6e033aa217d8d126c52c78a1b2b3f8c214129d98a71da147386f05def930ec0f142a4af04adaf79ce052a2fc98e2f9e14ba423bc58b7ac428828d2c369ca77bec0b64e28dd0e6ac99f53ac2281ca52605995a4f5119ccabd4ab98a7e23c2391df6ab26b1a115d25e79b41b4f4bc0013574775903624e3ee5f0d7377492d365b0985ea61282a8d002ac0ae8b897440133d7eda0e0ee93fe00e46e1b9c90f01bb54415c7bac14a8196f7c020f9c0e7ddc6893611bbeaf1f1102e191bb54997cc10a5423f4f44bb8bf2e3354ed1216446e27182d519a8f6e0a7b48565d79b511652e0a28381ea7e14625262800c8c7aed2c5ae1f2c2bad9a7ac0320578693338fcfbccdfdff56be8ce9f17aa35c2079f4b56db2e9b304fbefff36fb3a21b71b3b7b84b5c6ad4798a0a0282696bf2e785f3c540e119fc2f224c695efea8fadc7cf3a2e7f5cfa5da177de119764bb25028f1be946d689a85db9d868d0d625f4dd51e222ad8abe76a95266f5c875aab191d578c49b79f163a08d435a4cf4815ccfb01e72176f41176f77f2e4bc4f1bcae240835b24b3f9f203b9ec5b2602a7f85462b0c938c61d609da28f15079322f6a9ebcebdd1e09e722883bfcc45ef7e84605a3168a0d53b27c5df0f31663f33b81bc07c2de03aefc25b2e169d0ba315d62ac332c9c71a08efc09917724773f171c056d5547c83c65ab15c45ee9c7212782fbdf1c77b2ba9cfd5d9d7369e75dcf535a9592f8b74e230e48079dc6992f6d47415a9b7f2b6d82f56b83d5f6e0b3709139977f0044e09761d9c99bbc6eff29cc6ee64e0e624a17b4204f5c62ccb1586a060be66fe890aef12eb87e77e07744ba611fd1e24e8ed627a847e04e07288d8eca065f5c04631dc17f18ad6faa76fdb9da0eaa30e8bc3cc5a3d6d96fc488d6356b0fcc396d4c7f8c3b2ff1bb680b8e542a10039a94d91075ccd5840074884714ab4bc456d2dd8ba2a5aec48a086b7e52fc6e279e48381b44586fc74e8943a3f8696cea9c2a4388a66abd0e669dad1071dcc58dbd4f2bc98925ddb2185c43b5ad75d9a1f69a7089beec17e858de304e28c759aeb1b374511dc4854050e9532fa56f64727d837169ac0e608f15154be73c1464e9c6fdab89ebcd764ae2b3ab45b1a56862b8d0c5fcf10fe6cc2c546a68920667a1a738639888a80effb3cd37c6c89f34846d3a8de7b23ef08161db25f4915701d8b64fddfc97bfcdd028adb28ed3f5b7eb007d7ede9527abb793e0229a41468251bbb6d8dca7db719b06cb9d6e83bdaf4f8b4ae4eb6f120d35c808cf5553290df7b1f90316970a2c4977f71a6ba755d8a471033f5efc0343629162d3c61c32cd66ad02ca4810c914fb5be4b3749baa88a7ef3d5e6214189e0486869f109efa508e51803bba701588f8d3685a5b347a1277d8fcde4c0517fb901242dbc8fbc8726d2e68707a63e7dd78519b0daadce5a336ccbb9aa6d959c1599f48d199354875ee8fd145edb7ad0186e30840cda343e732ed65f9d13ccd37470524011de1e4d1f4d4695fc20682771b436b7b767dff6baf79d3ae0ebe5cf6e8b6d4f4bac2a7abac3717c78b354fa25a78bfaa795f26ea0a800472dc44af4d8469581af9c03e9137167e00643a28fd92a85760c3d3d8c58296ac5e4ab671673dfa05e569cd69fbbda1c562991bae6e6ff28961396b6f0f7dd042a804354f789429ef4bc4dcc737bae30fd9570733f38179b9e062902282297b00209bb739767495c2e26d4e9a44b990ab6a2405fae1fdd91f6cc48baeb689fb9dffb7e5a0174450eee6be75547dad1ca21d5418eaabfc14aa89f064379cd9400be4132012bc6780bd1950a73b0d417ef4d6ef0f49110fd2d2fcca0292330218c359ec4864bb78149018b2aa68d19472192f72f71a8f4fa348d9ae83cb96c88f44e31eae1e7adfe983a9943dd7ae1d52ee34bbd3339d57d21a049a1a272a293fb8817399a5cec77fb4a6e69db410b0f83b9e5ea9baea3048149ddcaf28914a07ec7af16420f529f702cff2da3b7a7ccafa44d6f2b5612b0b31ccbdf8f1ee58e83fbd14d80c3fd04b188df2807d37c5cdae4f3fb3f32fa141ec6e1fca94a2383861de7e8ea2eb97719c5421a912744dd043ecc86738c48d303321662aede9d0047586d9361320ba06a864bffd899678830ea486b201e98f3b7b5a9e044df8fea04c0109575c4d4d5ee870a62331ae39ec1a4404ec351e084c4421a50b2fe2ec8ecd56eaf79d5da79671f38bb453109482447dd9f1d16d9ed07eeb4d3cbce0aa915055349ae2aaa1927f11d5770638b5310fcf56f68b96cc6af72e7679e10e6ac8fd950e05a49d2ca0a3b339e29015a9fa759639109b2cb1cfc0824a3a74e70e16f20cdb2bd101ef5449228fb1711d65b367ae7173eb3c388562794df235dae4406908f323e9ae280fffec8f65a4ae2570bfbae2648a56a89ff591dd297a87c7da308a93ef018798f96ce63e4e5bcbc8b638c618977c3583eed250280a7ea51aea3e9e9349de76ce83259cfed016ab8ba5771e9287a483134367d1d01efd0766cb3b02e9d63a96037e774037553c08ebfe89a3084d5aedb6f73f4b10c8b55b194a1ca60b3e62b9b3db2eb1704f4fe98397f8f15ce5e98b36c703467f3a7add1c3281fc537a0915be7dc72d50a1ba69fd5caea46e1f46eebf4c1c6f761d03ef78c11512ff69a2f317898457d5b187327d6f9fdc945726a4700f9d6db5cc15a22e6d5461eeadcc133141d8833cb30c096917466503e5ab20a5383de7b64b5849acbaa6765c9feebb25bc2f06b72590432dd28524ec36b1417032149a06a69fcdedddf22344983341d66d36dc2f813a2b8ff3688f245ec931cfad87398556efa5d3a5212a3a399c962c96bed52a6384eb60052f058158ab0981f05fe395f0ce7f83cb529bf69eb784de3bc15a624d56c2c5151a7ab6ecf5dbe7ffec970acc0774414dcd0821ab38e25f435b60f4233cf33b6d26d51d3402fff9e6fc94dc6e292fee091ec23770069381ef3bb33408c0f3601ae708be6553985139d85531ae9aa91a495da80bca5c943da7ccb282b7bb3ddb83051a0f3477bb4f5bbb3952f59473b14ab68ac421b4de4ae1f3292208ecaa3462db2e53b00b6af3b03d25bff9a3b69ab97c7b0ff6904cb3144a035ecc841d7abc89fd7ce826bb261ceaa57098240b0c1b77833a80c3ede213e54e8ca6bc39c863743b43efb4f50196ef8106a4784842720043aaf550b89618d006fb067455593b5392ae1565c52b9f000cc7503e793bd91e22397af6d30971ecdf593aaee3e0437644f070f55014c3cdae83ecc52e9d059fae59c8648ec544d61ae56687c02a8a13d5af9dd0bcd131a3837b72d847dd6a0bba2eebbac1832f83fb64e309b4c56527a149dbf319d6e9c10bd2311037be9b1dc0eef90b6706d87a0faa6db78697a3fc55e556b8139b7cf2dd8b4802d487e839105871ee2b867e1d2b78a2ef280baa4c1360adaceb954e287253ace5f8dcb66f3e986cd5c9e8badd9dc76a63a103495dea9a56d55f98cf73c01062bc0cde8fdf79672fdb4e34aa74b056f7daa16aabe80bea613533fd8f819b1a9248daa71cc552e91002f646ea1a2c4412bdd16f88e704395615f5e0c3f096524340210fffb1a0329cd08b715a95b72267a36c4bb10e0a58fabc67051e1bf385e9088cc1e276cadd33c2cbbd5baffd3fbe1845220584c40d22fa343c5c7e5", 0x1000}, {&(0x7f0000000180)="c5b755bb45e1f3c340d438006dde6f05e385d0c7f8d02d9e53cc1d31329ec33529d7017f11e4ff150c155a844235938f3e54cc915d4add4d4e356f37f84cba1e208d464bc1df12e391766e6edf700b83b4", 0x51}], 0x4, &(0x7f0000000240)=[{0x60, 0x84, 0xfffffff7, "1c2cd211a6c738377413ecad1015c7b24a04613b3cf2d93fbf53703b1000f4c62137dfa60e159a4e6eb030755820677db90979fe3a9deaddeeb1aa9efe3c7b5fb7b8bfc2136bc2d9f3f801"}, {0x10, 0x113, 0xffffb0fe}, {0x70, 0x10f, 0x9, "6d8ee527374f15fac538cde3e25698a117b2ea8f7f9acfebebeb26c648b1742d0f66ce18f455175851346c8102e5790eaec776f9d12639a282d1e64fb53721c82f84a5bbbd1db0a490a6a5969d90018b84d58ec320f2ce507a"}, {0xd0, 0x10f, 0x0, "65f869128288bdcd38d8b5c5ee12184be16af530c0f7dc0aa7d03e8ab21e6b6d6b05d0a767ffa230d5e8ab0287fc8f402409c0a6188b71b6c7a951377364844a769da7ad4ce4e62fc6079f01943acc0d375f8ce53a17411d7347988dc91e8c69e4dc0293b989dfaf7b21ed33f5aad03545e63b78ca11d1c471e2a07ed5b7fcf2e99b040c62e1c95773ae31cd9edb59906dabd786fbe7cc920c95f8975e3ae268295ef53cc544d92c5acb2173a75487920ff440072aa321abf35d18"}], 0x1b0}, 0x8004) r8 = socket$inet6(0xa, 0x2, 0x3a) sendto$inet6(r8, 0x0, 0x0, 0x0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @private}}, 0x1c) write(r6, &(0x7f00000000c0)="29000000140005b7ff000051915f95eb01010003a606a40e07fff024bb000000000000000040000000", 0x29) 3.679893946s ago: executing program 0 (id=14689): mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmmsg$inet6(r0, &(0x7f00000009c0)=[{{&(0x7f0000000240)={0xa, 0x4f21, 0x400, @private0, 0x3}, 0x1c, &(0x7f0000000180)=[{&(0x7f0000000440)="14", 0x1}], 0x1}}, {{&(0x7f0000000300)={0xa, 0x4e21, 0xa6, @private0={0xfc, 0x0, '\x00', 0x1}, 0x20000009}, 0x1c, &(0x7f0000000940)=[{&(0x7f00000006c0)="8e4151a067", 0x5}], 0x1, &(0x7f0000001a80)=ANY=[@ANYBLOB="180000000000000029000000360000002f000000000000004000000000000000290000003700000002040000000000000001000401ff0502000204010405026c0dc910fc0100000000000000000000000000000000000000d80000000000000029000000360000000c1800000000000004bbeb353498e7e22319fdfe60398e84453cf1d32de1ce9ef3e1a1202416f47960883771e1dc8e38e17928465d73ea3efbb8b54b4b0793a7e81b6ab0a65b757d25e5152e2fdfdea944df669c99dd6fb0ee47b469d9f4ed57ba69b4ccd58ecf420fe3b4c02739836cdf33ea8f61f74796118beb7d891276e8583057872cab7a6b3a0862b5e0be10d4c3624ba39b3ba2ca972c614af71302eaeb1c203da1db569347e65c488c2b8fe2b73a2627602dea6d9e567698019aab06c9ff57008401010038000000000000002900000037000000740400000000000007180000000004810010040000000000000040000000000000000104000000001400000000000000290000000b0000000000000400000000580000000000000029000000360000008207000000000000040104c910ff020000000000000000000000000001c910fe8000000000000000000000000000bb05020000c20400000f2a000100000100c20402b9519300000028000000000000002900000039000000330200e600000000fe800000000000000000000000000021180000000000000029000000360000005c0000000000000018010000000000002900000036000000881f000000000000000100050200000718000000020407acac66650000000000000000e00000000000c910fe8000000000000000000000000000aa072000000003060900000100008000000000a703000000000000050000000000000000010001050000000000109c7971cdaf83af16ca6acd35962eced527d9a7ca08a576662c7a9fcaca4866dcce92b2ec4346b2f5f535b5f26ea7411ed2101b82a6d8ce5e3085e7aa8efcc2e926bd6d9ae80e518e404d44abc88ec9cc67821887f2d463831e9701ea66ed882bebf1d65b8822c6fc65658bbb769a8c576916fcf9daabfca49b1167763281dedde93bba6815ac383bd49d613ba2ee90eafb72781f1058c3dacf68cd398c00000048"], 0x378}}], 0x2, 0x931766f6319eed44) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x2000009, 0x32, 0xffffffffffffffff, 0x0) ioctl$F2FS_IOC_GET_PIN_FILE(0xffffffffffffffff, 0x8004f50e, 0x0) socket$kcm(0xa, 0x2, 0x88) socket$tipc(0x1e, 0x5, 0x0) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) r2 = socket(0x10, 0x80003, 0x0) r3 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_prio={{0x9}, {0x18, 0x2, {0xf, "0000000000000000000f00000e000081"}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x2000000}, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x9, 0x3, 0x10004, 0x5}, 0x50) close(r5) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0x5, 0x10001, 0x9, 0x1}, 0x48) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x14, &(0x7f0000000580)=ANY=[@ANYBLOB="1802000000000000000000000000000018010000786c6c2500000000070000007b1af8ff00000000bfa100000000000007010000f8ffffffb700000000000000b7030000000000fd850000002d00000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000480)={&(0x7f0000000680)='sys_exit\x00', r6}, 0x10) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x6, &(0x7f0000000cc0)=ANY=[@ANYBLOB="050000000000000061110c00000000008510000002000000850000000500000095000000000000009500a5050000000077d8f3b423cdac8d80000000000000002be16ad10a48b243ccc42606d25dfd73a015e0ca7fc2506a0f7535f7866907dc0200000000000000ae669e17fd6587d452d6453559c3421eed73d56615fe6c54c3b3ffe1b4ce25d7c983c044c03bf3a48dfe47ec9dd6c091c30b93bfae76d9ebacd3ed3e26e7a23129d6606fd28a69989d552af6bda9df2c3af36effff9af2551ce896165127cb3f011a7d06602e2fc40848228567ffb400000000003ed38ae89d24e1cebfba2f87925bfacba83109751fe6c05405d027edd68149ee99eef6a6992308a4fc0b7c70bc677d6dd4aed4af7500d7900a820b6347184e9a217b5614cd50cbe43a1ed2526814bc0000e9e086ce48e90defb6670c3df2624f56da648d28ad0a97aec7291c25447c106a99893e10db21901eb397b2f5fd71400fa7a050fbbef9e326ea27e513e96068fd1e8a43e89f9c85c822a961546ed5363c17ff1432d08806bc376e3e49ee52b59d13182e1f24ed200ada10eb1affb87ba55b2d72078e9f40b4ae7d01000000d11cd22c35d32940000088dde499000000fdffffff00000000000f000000ef0000000000000000000000000c52f4ebd2c893bb97a068bd10734a83584898eccb26f7b789cfc4cd995fa3e11a5c74c85404e2df3ad37b729ac83b0dcb4f48f3c3356b9997fc455a17690b6f7f9ccbe4b1701941b18aba6b16455a66c3b84b138efc20a546d3d5227e23b03f2a834391ade2ff3e93ee296c4082ee73e7c353312c9d75711ce1623e9c54bdff59d2a69dcb7d84c235b23a4480c2461b405cfd1a38992f295ad3adc94cd07c850d1ce6d0b2fea02c24e9280333152fb794e4ddea02017a6c139b50101caecaf2abc0847a1ff2f7fc3c2b99a96fc4275ad107274e2934a87a4ddcdb112754ca5bdec0ead14b6c0f19a43a2f05c7f0be31491eb8c9ff68236c8600040000000000000000000066e034c81c3cab64e4fc8dc55ce0ada18dcbf31c6e82893add3bee3e10fc873d1d922b0877cbcd95b839d3059d5140a1f742f6e75741e39e5cb6a193e06a1043375b0f61b5d4e17c81baa31b924d84f224baf1221c15fa12313ffbfa7c2730309f66705b71e6205e7cbf3643561eabb9a63fcd604d5cc27e1317ad94cf438d71873e540be16b6ca205081173bd03c4754fc4674812daab482fd390a1c903b5d28a1eb247b5837d7603b92495d5c569f6433c3fca5206cb0000003fdbbd3892c52c2e7612e05de32322e980a3d69931e2c9312dd517c96f2ee90362476ed853c4c9b7d4ebf13cbaa795860e92a3d7d004f2c491db38eb769f094d5d48b262cc35c40682138cf13a49aa9f27abec00002f01ba1251aaf2385416ca719300"], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6}, 0x70) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000001c0)='sched_switch\x00', r7}, 0x18) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000800000000bf91000000000000b702000043e7b5538500000085000000b70000000000000095"], &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x43, '\x00', 0x0, @fallback=0xa, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r8, 0x0, 0x8}, 0x18) ppoll(&(0x7f0000000500)=[{r1}], 0x1, 0x0, 0x0, 0x0) shutdown(r0, 0x1) 3.493796309s ago: executing program 1 (id=14692): bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x4, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="180000000800000000000000080000006b1149000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x1, 0x0, 0x0, 0x41100, 0x20, '\x00', 0x0, @fallback=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000b40)={0xffffffffffffffff, 0xffffffffffffffff}) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x11, 0x0, 0x0, &(0x7f00000003c0)='GPL\x00'}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000140)='contention_end\x00', r1}, 0x10) socket(0x2, 0x80805, 0x0) ioctl$SIOCSIFHWADDR(r0, 0x8b04, &(0x7f0000000000)={'wlan1\x00', @random="0200ff8d00"}) r2 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCETHTOOL(r2, 0x89f0, &(0x7f0000000080)={'bridge0\x00', &(0x7f0000000a80)=@ethtool_regs={0x12, 0x0, 0xa, "dfbfd1f7328096f1dbd7"}}) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000036c0)={0x18, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB="180100002100000000000000000000008500000075000000a50000002300000095"], &(0x7f0000003640)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1000}, 0x94) r4 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f00000001c0)='mmap_lock_acquire_returned\x00', r3}, 0x10) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000100)=ANY=[], 0x32600) ioctl$BTRFS_IOC_SUBVOL_GETFLAGS(r4, 0x80089419, &(0x7f0000000200)) epoll_pwait(0xffffffffffffffff, 0x0, 0x0, 0x10001, &(0x7f0000000180)={[0xffffffffe277652b]}, 0x8) 3.353255815s ago: executing program 1 (id=14694): r0 = socket$inet(0x2, 0x2, 0x1) sendmsg$inet(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000400)='\b\x00', 0x2}], 0x1, 0x0, 0x40}, 0x20000000) r1 = epoll_create1(0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000200)="ad00"/16, 0x10) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, 0x0, 0x0) r3 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000800000000bf91000000000000b702000043e7b5538500000085000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r5 = socket(0x2, 0x80805, 0x0) r6 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r6, &(0x7f0000000140)=[{&(0x7f0000000080)="580000001400192340834b80040d8c560a067f0200ff000000000000000058000b4824ca945f64009400ff0325010ebc000000000000008000f0fffeffe809005300fff5dd000000100001000a0c100000000000000fff00", 0x58}], 0x1) setsockopt$IP_VS_SO_SET_ADD(0xffffffffffffffff, 0x0, 0x482, &(0x7f0000000040)={0x84, @dev={0xac, 0x14, 0x14, 0x2d}, 0x4e20, 0x3, 'wrr\x00', 0x1, 0x2, 0x6a}, 0x2c) setsockopt$IP_VS_SO_SET_ADDDEST(r5, 0x0, 0x487, &(0x7f0000000000)={{0x84, @private=0xa010101, 0x4e21, 0x3, 'lc\x00', 0x4, 0x8, 0x77}, {@rand_addr=0x64010102, 0x4e24, 0x2, 0xcd, 0x12d5e, 0x3}}, 0x44) socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$IP_VS_SO_SET_FLUSH(0xffffffffffffffff, 0x0, 0x485, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r4}, 0x10) ppoll(&(0x7f0000000500)=[{r3}], 0x1, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0xfffffffffffff5fd, 0x0, 0x4000003}, 0x0, &(0x7f00000002c0)={0x3ff, 0x9, 0x0, 0xc, 0x0, 0x0, 0x4, 0x1}, 0x0, 0x0) r7 = socket$unix(0x1, 0x5, 0x0) unshare(0x2c060000) unshare(0x24020400) r8 = socket$unix(0x1, 0x1, 0x0) bind$unix(r8, &(0x7f00000000c0)=@abs={0x1, 0x0, 0x4e22}, 0x6e) bind$unix(r8, &(0x7f0000000000)=@file={0x1, './file0\x00'}, 0x6e) syz_emit_ethernet(0x4e, &(0x7f00000001c0)={@random="5b37182347bc", @broadcast, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "9d0080", 0x18, 0x3a, 0xff, @empty, @mcast2, {[], @ndisc_ns={0x87, 0x0, 0x0, @local, [{0x0, 0x0, "ff9b"}]}}}}}}, 0x0) setsockopt$sock_int(r7, 0x1, 0x2e, &(0x7f0000000040)=0x80, 0x4) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r7, &(0x7f0000000080)={0xa002a008}) 3.296481511s ago: executing program 5 (id=14695): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x18, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={0x0, r0, 0x0, 0x9}, 0x18) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="280011bdd64ecea4517d7000fcdb9979874986a88da39ea1a47adf2500000004", @ANYRES32=0x0, @ANYBLOB="800a0000000000000800290000010000"], 0x28}}, 0x0) sendmsg$TIPC_CMD_SET_NODE_ADDR(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)={0x24, r2, 0x201, 0x400000, 0x0, {{}, {}, {0x8, 0x11, 0x4}}}, 0x24}, 0x1, 0x0, 0x0, 0x80}, 0x8000) 3.018308968s ago: executing program 5 (id=14697): mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmmsg$inet6(r0, &(0x7f00000009c0)=[{{&(0x7f0000000240)={0xa, 0x4f21, 0x400, @private0, 0x3}, 0x1c, &(0x7f0000000180)=[{&(0x7f0000000440)="14", 0x1}], 0x1}}, {{&(0x7f0000000300)={0xa, 0x4e21, 0xa6, @private0={0xfc, 0x0, '\x00', 0x1}, 0x20000009}, 0x1c, &(0x7f0000000940)=[{&(0x7f00000006c0)="8e4151a067", 0x5}], 0x1, &(0x7f0000001a80)=ANY=[@ANYBLOB="180000000000000029000000360000002f000000000000004000000000000000290000003700000002040000000000000001000401ff0502000204010405026c0dc910fc0100000000000000000000000000000000000000d80000000000000029000000360000000c1800000000000004bbeb353498e7e22319fdfe60398e84453cf1d32de1ce9ef3e1a1202416f47960883771e1dc8e38e17928465d73ea3efbb8b54b4b0793a7e81b6ab0a65b757d25e5152e2fdfdea944df669c99dd6fb0ee47b469d9f4ed57ba69b4ccd58ecf420fe3b4c02739836cdf33ea8f61f74796118beb7d891276e8583057872cab7a6b3a0862b5e0be10d4c3624ba39b3ba2ca972c614af71302eaeb1c203da1db569347e65c488c2b8fe2b73a2627602dea6d9e567698019aab06c9ff57008401010038000000000000002900000037000000740400000000000007180000000004810010040000000000000040000000000000000104000000001400000000000000290000000b0000000000000400000000580000000000000029000000360000008207000000000000040104c910ff020000000000000000000000000001c910fe8000000000000000000000000000bb05020000c20400000f2a000100000100c20402b9519300000028000000000000002900000039000000330200e600000000fe800000000000000000000000000021180000000000000029000000360000005c0000000000000018010000000000002900000036000000881f000000000000000100050200000718000000020407acac66650000000000000000e00000000000c910fe8000000000000000000000000000aa072000000003060900000100008000000000a703000000000000050000000000000000010001050000000000109c7971cdaf83af16ca6acd35962eced527d9a7ca08a576662c7a9fcaca4866dcce92b2ec4346b2f5f535b5f26ea7411ed2101b82a6d8ce5e3085e7aa8efcc2e926bd6d9ae80e518e404d44abc88ec9cc67821887f2d463831e9701ea66ed882bebf1d65b8822c6fc65658bbb769a8c576916fcf9daabfca49b1167763281dedde93bba6815ac383bd49d613ba2ee90eafb72781f1058c3dacf68cd398c00000048"], 0x378}}], 0x2, 0x931766f6319eed44) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x2000009, 0x32, 0xffffffffffffffff, 0x0) ioctl$F2FS_IOC_GET_PIN_FILE(0xffffffffffffffff, 0x8004f50e, 0x0) socket$kcm(0xa, 0x2, 0x88) socket$tipc(0x1e, 0x5, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) r1 = socket(0x10, 0x80003, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_prio={{0x9}, {0x18, 0x2, {0xf, "0000000000000000000f00000e000081"}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x2000000}, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x9, 0x3, 0x10004, 0x5}, 0x50) close(r4) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0x5, 0x10001, 0x9, 0x1}, 0x48) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x14, &(0x7f0000000580)=ANY=[@ANYBLOB="1802000000000000000000000000000018010000786c6c2500000000070000007b1af8ff00000000bfa100000000000007010000f8ffffffb700000000000000b7030000000000fd850000002d00000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000480)={&(0x7f0000000680)='sys_exit\x00', r5}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x6, &(0x7f0000000cc0)=ANY=[@ANYBLOB="050000000000000061110c00000000008510000002000000850000000500000095000000000000009500a5050000000077d8f3b423cdac8d80000000000000002be16ad10a48b243ccc42606d25dfd73a015e0ca7fc2506a0f7535f7866907dc0200000000000000ae669e17fd6587d452d6453559c3421eed73d56615fe6c54c3b3ffe1b4ce25d7c983c044c03bf3a48dfe47ec9dd6c091c30b93bfae76d9ebacd3ed3e26e7a23129d6606fd28a69989d552af6bda9df2c3af36effff9af2551ce896165127cb3f011a7d06602e2fc40848228567ffb400000000003ed38ae89d24e1cebfba2f87925bfacba83109751fe6c05405d027edd68149ee99eef6a6992308a4fc0b7c70bc677d6dd4aed4af7500d7900a820b6347184e9a217b5614cd50cbe43a1ed2526814bc0000e9e086ce48e90defb6670c3df2624f56da648d28ad0a97aec7291c25447c106a99893e10db21901eb397b2f5fd71400fa7a050fbbef9e326ea27e513e96068fd1e8a43e89f9c85c822a961546ed5363c17ff1432d08806bc376e3e49ee52b59d13182e1f24ed200ada10eb1affb87ba55b2d72078e9f40b4ae7d01000000d11cd22c35d32940000088dde499000000fdffffff00000000000f000000ef0000000000000000000000000c52f4ebd2c893bb97a068bd10734a83584898eccb26f7b789cfc4cd995fa3e11a5c74c85404e2df3ad37b729ac83b0dcb4f48f3c3356b9997fc455a17690b6f7f9ccbe4b1701941b18aba6b16455a66c3b84b138efc20a546d3d5227e23b03f2a834391ade2ff3e93ee296c4082ee73e7c353312c9d75711ce1623e9c54bdff59d2a69dcb7d84c235b23a4480c2461b405cfd1a38992f295ad3adc94cd07c850d1ce6d0b2fea02c24e9280333152fb794e4ddea02017a6c139b50101caecaf2abc0847a1ff2f7fc3c2b99a96fc4275ad107274e2934a87a4ddcdb112754ca5bdec0ead14b6c0f19a43a2f05c7f0be31491eb8c9ff68236c8600040000000000000000000066e034c81c3cab64e4fc8dc55ce0ada18dcbf31c6e82893add3bee3e10fc873d1d922b0877cbcd95b839d3059d5140a1f742f6e75741e39e5cb6a193e06a1043375b0f61b5d4e17c81baa31b924d84f224baf1221c15fa12313ffbfa7c2730309f66705b71e6205e7cbf3643561eabb9a63fcd604d5cc27e1317ad94cf438d71873e540be16b6ca205081173bd03c4754fc4674812daab482fd390a1c903b5d28a1eb247b5837d7603b92495d5c569f6433c3fca5206cb0000003fdbbd3892c52c2e7612e05de32322e980a3d69931e2c9312dd517c96f2ee90362476ed853c4c9b7d4ebf13cbaa795860e92a3d7d004f2c491db38eb769f094d5d48b262cc35c40682138cf13a49aa9f27abec00002f01ba1251aaf2385416ca719300"], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6}, 0x70) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x32, 0xffffffffffffffff, 0x0) getsockopt$bt_hci(r0, 0x84, 0x80, &(0x7f0000002100)=""/4127, &(0x7f0000000000)=0x101f) 2.916341041s ago: executing program 5 (id=14698): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xf, &(0x7f0000000000)=0x3da, 0x4) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000100)=@bpf_ext={0x1c, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x41100, 0x60, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x1313f, 0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000000), 0x10, 0x749}, 0x94) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r2) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETOFFLOAD(r3, 0xc004743e, 0x110e22fff6) ioctl$TUNGETVNETLE(r2, 0x4010744d, &(0x7f0000000180)) sendmsg$NL80211_CMD_GET_COALESCE(r1, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000400)={0x0, 0x14}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r4, 0x10e, 0xc, &(0x7f0000000040)={0x80}, 0x10) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000200)=ANY=[@ANYBLOB="240000004a00010000000000000000000a000000", @ANYRES32=0x0, @ANYBLOB="00000000f3ff090000fff200"], 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)=ANY=[@ANYBLOB="3c0000001000030400000006000000005dcc0300", @ANYRES32=r5, @ANYBLOB="71e79fd800000000140012800c0001006d616376746170001400028008000500", @ANYRES32=r6], 0x3c}}, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000040)={'batadv0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000001240)=@newtfilter={0x34, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x74, r7, {}, {0x7, 0x1}, {0xa, 0x7}}, [@filter_kind_options=@f_cgroup={{0xb}, {0x4}}]}, 0x34}, 0x1, 0xf0ffffffffffff, 0x0, 0x60001d0}, 0xc084) 2.607999684s ago: executing program 2 (id=14700): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0x7101}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x8, 0x4}}]}}]}, 0x48}}, 0x20040084) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000440)=@newqdisc={0x8c, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r6, {0x4}, {0xffff}, {0x2, 0xfff3}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x5c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x4, [0x2, 0x3, 0x3, 0x4, 0xd, 0x5, 0xb, 0x8, 0x7, 0x5, 0x6, 0x3, 0x5, 0x8, 0xf, 0x3], 0x1, [0x1, 0x10, 0x3, 0x9, 0x31d4, 0x6, 0x6, 0xadf, 0x7fff, 0x7, 0xff, 0x800, 0xcbe6, 0xd80, 0xf638, 0x1], [0x3, 0x9, 0x8, 0x4, 0x0, 0x3, 0xc, 0x6, 0x5, 0x0, 0xe, 0x8001, 0x8a67, 0x4, 0x7fff, 0xfffe]}}]}}]}, 0x8c}}, 0x0) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r7) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r7, 0x8914, 0x0) r8 = socket$inet6(0xa, 0x2, 0x0) close(0xffffffffffffffff) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, 0x0) r9 = socket$unix(0x1, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmmsg$inet(r8, &(0x7f00000017c0)=[{{&(0x7f0000000040)={0x2, 0x4e1c, @local}, 0x10, 0x0, 0x0, &(0x7f00000006c0)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r10, @dev={0xac, 0x14, 0x14, 0x41}, @empty}}}], 0x20}}], 0x1, 0x8000004) 2.567788388s ago: executing program 5 (id=14701): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWFLOWTABLE={0x58, 0x16, 0xa, 0x1, 0x0, 0x0, {0x1}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_FLOWTABLE_HOOK={0x2c, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_NUM={0x8}, @NFTA_FLOWTABLE_HOOK_DEVS={0x18, 0x3, 0x0, 0x1, [{0x14, 0x1, 'veth1_to_bond\x00'}]}, @NFTA_FLOWTABLE_HOOK_PRIORITY={0x8}]}]}, @NFT_MSG_DELFLOWTABLE={0x70, 0x16, 0xa, 0x101, 0xb00, 0x0, {0x1}, [@NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_HOOK={0x44, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_DEVS={0xffffffffffffffc7, 0x3, 0x0, 0x1, [{0x14, 0x1, 'vcan0\x00'}, {0x14, 0x1, 'pim6reg1\x00'}, {0x14, 0x1, 'veth1_to_bond\x00'}]}]}]}], {0x14, 0x10}}, 0x110}, 0x1, 0x0, 0x0, 0x40000}, 0x0) socket$kcm(0x2, 0xa, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x15, 0x6, &(0x7f0000000000)=@framed={{0x5, 0x0, 0x0, 0x0, 0x0, 0x69, 0x11, 0x12}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @call={0x85, 0x0, 0x0, 0x1a}, @exit], {0x95, 0x0, 0x5a5}}, &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_reuseport, 0xffffffffffffffff, 0x6}, 0x70) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x5, &(0x7f00000001c0)=ANY=[@ANYBLOB="18020000020000000000000003000000180000000300000000000000040000009500000000000000"], &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) r1 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) socket$inet(0x2b, 0x801, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) sendmsg$inet(r2, &(0x7f0000000980)={0x0, 0x6000, &(0x7f0000000900)=[{&(0x7f0000000640)='U', 0xa00120}], 0x1}, 0x3) r3 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r4, 0x8933, &(0x7f0000000580)={'wpan0\x00'}) bpf$MAP_CREATE(0x0, 0x0, 0x48) setsockopt$inet_sctp6_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, &(0x7f0000000080), 0x8) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x40, &(0x7f0000000140)={0xa, 0x4e23, 0x800, @loopback, 0xffffffff}, 0x1c) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000700)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf09000000000000550901"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r5}, 0x10) ppoll(&(0x7f0000000500)=[{r3}], 0x1, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x40000000000, 0x3, 0x4, 0x0, 0x0, 0x3}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x9, 0x0, 0x0, 0x7fffffff}, 0x0, 0x0) sendmsg$IEEE802154_LLSEC_ADD_DEVKEY(r4, 0x0, 0x40) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) close(0x4) bpf$ITER_CREATE(0x21, 0x0, 0x0) bind$802154_dgram(r1, &(0x7f0000000000)={0x24, @long={0x3, 0x0, {0xaaaaaaaaaaaa0102}}}, 0x14) sendmsg$802154_dgram(r1, &(0x7f00000004c0)={&(0x7f0000000400)={0x24, @long={0x3, 0x1, {0xaaaaaaaaaaaa0302}}}, 0x14, &(0x7f0000000480)={0x0}, 0x1, 0x0, 0x0, 0x20000080}, 0x0) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0900000006000000080000000800000000000000", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00 \x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000010c0)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x19, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000180)={0x0, 0x0, 0x0, &(0x7f0000000080), 0x8000, r6}, 0x38) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000300)={r7, 0x2000000, 0xe, 0x0, &(0x7f0000000600)="c9f7b98600"/14, 0x0, 0x7ffd, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 2.477370464s ago: executing program 0 (id=14702): r0 = socket(0x10, 0x803, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f0000000000)=0x228018, 0x4) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0x439, 0x70bd2c, 0xffffffea, {0x0, 0x0, 0xe403, 0x0, 0x40083}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @sit={{0x8}, {0x14, 0x2, 0x0, 0x1, [@IFLA_IPTUN_6RD_PREFIXLEN={0x6, 0xd, 0x9}, @IFLA_IPTUN_REMOTE={0x8, 0x3, @multicast1}]}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x8000}, 0x4040) 2.447271435s ago: executing program 2 (id=14703): socket$kcm(0x2, 0x922000000001, 0x106) pipe(&(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) socketpair$unix(0x1, 0x3, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000002c0)={'bridge_slave_0\x00', 0x0}) openat$tun(0xffffffffffffff9c, &(0x7f0000000b40), 0x40, 0x0) r2 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="440000001100a7cc4a372eaf541d002007000000", @ANYRES32=r1, @ANYBLOB="00000000100000001c001a80080002802d00ff0008000200", @ANYRES16=r2, @ANYRES32=r2], 0x44}}, 0x2000800) 2.42067588s ago: executing program 3 (id=14704): bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x4, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="180000000800000000000000080000006b1149000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x1, 0x0, 0x0, 0x41100, 0x20, '\x00', 0x0, @fallback=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000b40)={0xffffffffffffffff, 0xffffffffffffffff}) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x11, 0x0, 0x0, &(0x7f00000003c0)='GPL\x00'}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000140)='contention_end\x00', r1}, 0x10) socket(0x2, 0x80805, 0x0) ioctl$SIOCSIFHWADDR(r0, 0x8b04, &(0x7f0000000000)={'wlan1\x00', @random="0200ff8d00"}) r2 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCETHTOOL(r2, 0x89f0, &(0x7f0000000080)={'bridge0\x00', &(0x7f0000000a80)=@ethtool_regs={0x12, 0x0, 0xa, "dfbfd1f7328096f1dbd7"}}) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000036c0)={0x18, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB="180100002100000000000000000000008500000075000000a50000002300000095"], &(0x7f0000003640)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1000}, 0x94) r4 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f00000001c0)='mmap_lock_acquire_returned\x00', r3}, 0x10) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000100)=ANY=[], 0x32600) ioctl$BTRFS_IOC_SUBVOL_GETFLAGS(r4, 0x80089419, &(0x7f0000000200)) epoll_pwait(0xffffffffffffffff, 0x0, 0x0, 0x10001, &(0x7f0000000180)={[0xffffffffe277652b]}, 0x8) 2.366338532s ago: executing program 1 (id=14705): r0 = socket$inet(0x2, 0x2, 0x1) r1 = bpf$ITER_CREATE(0x21, &(0x7f0000000000), 0x8) connect$vsock_stream(r1, &(0x7f0000000240)={0x28, 0x0, 0xffffffff, @hyper}, 0x10) accept4(r1, 0x0, &(0x7f0000000280), 0x0) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="0207e80702"], 0x10}}, 0x40044) r3 = socket$inet6(0xa, 0x3, 0x7b) setsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f0000000480)={{{@in=@multicast2, @in6=@remote, 0x0, 0x56, 0x2, 0x0, 0x2}, {0x0, 0x80, 0x0, 0x0, 0xdffffffffffffffb, 0xffffffffffffffff, 0x9, 0x3}, {0x6, 0x0, 0x4}, 0x1, 0x0, 0x1}, {{@in=@private=0xa010100, 0x0, 0x2b}, 0xa, @in=@rand_addr=0x64010100, 0x3507, 0x4, 0x0, 0x0, 0x3, 0x0, 0x4}}, 0xe8) connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0xff}}}, 0x1c) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x19, 0x4, 0x8, 0xb, 0x0, 0xffffffffffffffff, 0xfffffffe}, 0x50) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000780)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x50) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x10, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b702000003000000850000008600000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='sched_switch\x00', r6}, 0x10) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0x5, &(0x7f0000000040)=@framed={{0x18, 0x2, 0x0, 0x0, 0x80000000}, [@call={0x85, 0x0, 0x0, 0x27}, @call={0x85, 0x0, 0x0, 0x7}]}, &(0x7f0000000080)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x1}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r7, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) socketpair(0x18, 0x0, 0x2, &(0x7f0000000000)) setsockopt$inet6_int(r1, 0x29, 0xce, &(0x7f00000001c0)=0x4, 0x4) getsockopt$XDP_STATISTICS(r1, 0x11b, 0x7, &(0x7f0000000000), &(0x7f0000000080)=0x30) r8 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_RES_MR_GET(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="200000001a1401000000000000000000080003000000000008"], 0x20}, 0x1, 0x0, 0x0, 0x4000015}, 0x0) sendmsg$inet(r0, &(0x7f00000000c0)={&(0x7f0000000040)={0x2, 0x0, @local}, 0x10, &(0x7f0000000300)=[{&(0x7f0000000280)="08001efbb07d5a6e", 0x8}], 0x1}, 0x20000810) r9 = socket$inet_udplite(0x2, 0x2, 0x88) connect$inet(r9, &(0x7f0000000100)={0x2, 0x4e22, @private=0xa010100}, 0x10) 2.277179333s ago: executing program 0 (id=14706): bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000240)={0x6, 0x4, &(0x7f00000003c0)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x8, 0x9e, &(0x7f0000000180)=""/158, 0x40f00, 0x42, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xffffffff}, 0x94) sendmsg$NFT_MSG_GETOBJ(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0xc0, 0x13, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_OBJ_TYPE={0x8, 0x3, 0x1, 0x0, 0xa}, @NFTA_OBJ_USERDATA={0x7f, 0x8, "a4893660695177b89dfaefb4ae615f9a5be7120e9cc429f4781102b64885cf92bfa3c0c0c1e9ea966450c2a4a618548ad38c68e03acf838d9d8502c612d4c2af245f3c7a76d05ecdd93148f9d8557d61d222e32694c0ed53d3690dd9344e901c055c57508fa0636c0b2ad73585662d8f057ca6e8cf8a4266fc3bda"}, @NFTA_OBJ_TYPE={0x8, 0x3, 0x1, 0x0, 0x7}, @NFTA_OBJ_TYPE={0x8, 0x3, 0x1, 0x0, 0x8}, @NFTA_OBJ_TYPE={0x8, 0x3, 0x1, 0x0, 0x6}, @NFTA_OBJ_NAME={0x9, 0x2, 'syz1\x00'}]}, 0xc0}, 0x1, 0x0, 0x0, 0x4004000}, 0x20000895) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000", @ANYRES32, @ANYBLOB="0000000000000000b70800000000396f7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000002400000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = socket$unix(0x1, 0x5, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x2, 0x9, 0xfa, 0x0, 0x4, 0x0, 0x70bd25, 0x25dfdbfe, [@sadb_x_sec_ctx={0x1, 0x18, 0x7, 0xff}, @sadb_x_nat_t_type={0x1, 0x14, 0x57}]}, 0x20}}, 0x24000800) bind$unix(r1, &(0x7f0000003000)=@abs={0x1, 0x0, 0xffffffff}, 0x6e) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000040)={@private1, 0x6, 0x0, 0x1, 0x7}, 0x20) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl(r2, 0x8b32, &(0x7f0000000040)) r3 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r3, &(0x7f0000000340)=@nameseq={0x1e, 0x1, 0x3, {0x43, 0x0, 0xfffffffc}}, 0x2f) r4 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$TIPC_GROUP_JOIN(r3, 0x10f, 0x87, &(0x7f0000000000)={0x41, 0x2, 0x1}, 0x10) syz_genetlink_get_family_id$tipc(&(0x7f0000000080), r4) r5 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r5, 0x0, 0x0) sendmsg$TIPC_CMD_GET_NODES(r4, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000440)={0x0}, 0x1, 0x0, 0x0, 0x1}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000440)={&(0x7f0000000040)='block_bio_remap\x00', r0, 0x0, 0x3fffd}, 0x18) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r6, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)={0x14, r7, 0x9c3fa077fa966179, 0x0, 0x0, {{0x7e}, {@void, @void}}}, 0x14}}, 0x4000054) 2.245294311s ago: executing program 2 (id=14707): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000100000a70000000090401040000000000000000000000040900020073797a310000000008000a40fffffffc0900010073797a3100000000080005400000000b2c00128014000180090001006c6173740000000004000280140001800c000100636f756e7465b2e70cf19138b190034000000130140000001100010000000000000000000100000a"], 0x98}, 0x1, 0x0, 0x0, 0x4044050}, 0x40) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket(0x10, 0x803, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x2, 0x4, 0x8, 0xa}, 0x50) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000400)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, r3}, 0x38) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0e00000004000000080000000b"], 0x50) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000002300000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x34, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000000)='contention_end\x00', r5, 0xe4}, 0x18) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r6) r7 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETOFFLOAD(r7, 0xc004743e, 0x110e22fff6) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x14, &(0x7f0000000000)=ANY=[@ANYBLOB="1802"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$TUNGETVNETLE(r6, 0x4010744d, &(0x7f0000000180)) sendmsg$nl_route_sched(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)=@gettaction={0x24, 0x32, 0x201, 0x70bd28, 0x25dfdbfe, {}, [@action_gd=@TCA_ACT_TAB={0x10, 0x1, [{0xc, 0x1, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ipt\x00'}}]}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x50) pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) writev(r8, &(0x7f0000000400)=[{&(0x7f0000000640)="000393a08e01f1be5841e773da5303a4bf9fb901aad587309c3991ce4c03ea09508e41574161ebe2d3ac6c96e3ef3d9d8c2a89b8cc97a4c3921e4f475571127df89abde5c7b7fb78c06014ca3df5985edea50f3c53704b7120d2f9651ddcd1fc7dc8a2378114466a4647114e6101bf67212a28529e519cba4813a458d054cc9ab6", 0x81}], 0x1) bpf$MAP_DELETE_BATCH(0x1b, &(0x7f0000000100)={&(0x7f00000006c0)="d0fb0fe29762ee800e1e30c6c85ca94efccd50a0d5675c26e425a0465d0249c859e7ad208fb371f64ec0958c46c480bb52dafe8914bdf2d479918eb0b43392c376fa1e74da99dd6e0f14c26cf67bd37fb81a83cfed6b8c453942ea1264f1dd4f1dfb4f86cf878184d7f03df75f376152b96d926e5826c914e10fb1e785774f41687553b295259329019b546da1ae41957473afbf9152e4d4e3d39dc1765b74463e322a5793aa32974b3ec90431d729b4", &(0x7f0000000780)=""/163, &(0x7f00000011c0)="9459355ab832d274395c56e5e6db0a7c5c00d3004a8d1c692acd170bf4a786ea18e14980927c9dc7531f310e4161eb2259ce0b61344f31d4a5bfc914dd064a58f44155f5b02160f4fc66958151bd1ec0befc9e788cd91fe73c8f9abc504995d43ce8976a44b094250a70b03f66c9fb20b0789a93c4b4a01b02c3ef5b27be42d59b981b4487ca5c80e7f217201390c76cd856972c8f175efbeb1937b6b2aea98ffabcbb12b7ce1ddd453eb11be405fda7643116d50047b7b1102fc73ee7b3879ff7bbe996961dadd770940cc1c8f0a601370ee665a897586468d0890223b6c930eafaa968ee85c5e4a1689170bcf2a3ce4ac6df4ead5e29cc8cac5af380cf7bb817f9dabe326f6efcfa1912ee2697b93a758732a5341ff93fb4d0abdaa7bc4fa0f4f6950649ed1cdcc46baf7470be5e16ad5919f860dbbb47595d46f524fd4ebeda67ee5ad5577fece398bd537ff56af6c48412e4da20d80c729da11dd0c174da72f4540abe922c49196dcd4484383a5308eca5b95e96582ecdc95c1c923c9d7fa460196ca7d944f4e34e87396077a1f1671440cf451e2d9fb259acaa1ab35fc4563dcfd02262d01dabbc1546984a11970f08dbebd9802bc62b410b02bcba6d5ace4856b61b5e4a017a6916745f7666f895457c7e23dde22d92c26e0a4addae98d5b19f74165ccaea28dfcaa777fd4fa69ffa0e6cd5e40099645982143fa95d2f138308ca601150071caaa7a9794f57fc3defea17b592a7cf4fb386a45c7fbe824e5797e38cba9748811c45ff8c3de1e2caf591ea74eb9c5e7139df5f33021043eb912cb7bad636308e978f714db7a7815526a5b85f072ea9a17a1f613bf49bfe50fadeca16ad941268c98288f9da3dd0db46f49e97dbfb57173078c2eb0a235234526c3836fb5eac4effd89d7d7e5ff74eb0c24dbbd8aeeab4ad636540abcf9632bc0af0f1a513290648dafe6739731ec1f5b65caa414a0dad4578658f2e1e4d80a7721f9c6ea63637dc8172cbb8da1dd268db1a6bbb794dc569c53e33a14c0290b0890349805eca20a9e3819a124986ee6ddd2f8c7457b6045f957c55208d49635a0dc63bf3c246d81675671a3c51c1602959091218c36036e3e88f5d01ef4eb826868135636917645b744f950280f59134bc3f7be51e00180a1e69b5566dcbdd735e807039cf3dc603a99c51d7d05b09cae0d916e4a2c3dce88a0f41c86fbf7b30e5d828cd0428c2b36946f9f52e1086829f13ea0fec49e213a32a45497b31c7704d3e8bb4b7bfc3c6a5e9804a21d0ac4e4bcd14f243b70995f5fc9acc3c395e3c0a97a43bc591827101e35aaaa1931b44a1e411c9b285c6a866abbfdc14e61215ff74eed68b637a7a8afd9dca81263a2661d1b6f49c730093f814ae68377f7eecd483f3afb05d9c4da326b5d593b416d180cf22761f1123cd53fe35fad6a0c4be3dff915c92037219a52ec666b89c523e46e64666b9ed88e318322187971f0ab7df74675d1a3dca4d584706c3f9849334a5a95e1891fbdad366bf2d439b55a631a9d29c46cf46dfe2b2966704fc0cc6ecdf336570d333974918e846ae06e3de129440eb66ebbe6d8492045f98c5acae65489a6acf9d53dc4958c5c5b7787d671d662ccd81576d6528132f67262c4527595ac129271229f9a226d8ec918d0c62d80505a44a22d14f990742b4424e926004f46a9ed2e4670ca1d33dd8f5a8f18dfa0fb792a6db1a4f48306086fdadef2d07b39650e92da294f33c7607c11cb578a75f97cc15a0eb72d93176920d60852f4039905ba199640a00b2e3d1856bc57120c27175359f2559fecbbb37a91997957a1ae741db693f49eb7f355ce5b43944c55ee254ec9df0c90955e3eafca56a87e6d14b30e0aadfa78f8b8be953c58a351d38ee29bde3b2a5bd5501d176ca8ac283603547f4fcd4a6745f08b7f44e6067d3b21a2627b7ab490cb132259770670d381ba659afc721a25514ef054ee67dd334e77dfdd3e701af5099edc845ac09b2235de111ec8170788491c885d5f209b985d9cafbf965d92da23f77b0bcec97d642b21be9470effbadaa9480a2401c9c345dc1c37a2fba71b75e8cc3206062f732c0df9c77eefbe2ef27275a9022e745f7a453f4b08a9f06939ddbdc02892c904c374738a10cdaa8067d5cc43cf47bec23ad8ddcb21331bd60ce30d8d7218860a1205d33b27bb66cdbfa98b984b902cac94ee08becc3ee4b9d4e81d00de0cef60a59615d7f1609e84c21d044c227b23565b69c5fae13e472c4bb541607c07dc5bb6ec5a6449ce067ff9bc8afca7178e480082f192d9f76eee4ca3266f6f90a19fadbaf981e0153f8e613fd2babdb77a1eecad820373ec926efb9d1ab3fed37ab278de45968fcfc1d4160fc631649b523b5bf6f927e03360522b1bf8cc82e2b8f598b93e3bce2dfc22458a8626b7a0cba96b839e82d5057b844dde08e0cfd0af2f0be047ecd5f6d7f0733bad83ab836e4cd958db7b1fec55e64121da9cd54756ceba3b6f675d31a2938f12c94e4e35f4a109c919beade21c4387a98a0e9262a8c3b7a476b0b0883fbda949bb033663a68019ca977916420aaffe1f3088453bbd33602b3ef2eb6fd3d8f64af0de1c938496bf3d632a78dcd277b538b012aca7ab6490ecc56794464947df2e87c6cc4179fc1d276290046f27044bb5f334153fac0862e7c4cdfc1841596e81000b24a9d466fd8f0ee61ed1de48e44529cf5f273e60f037dd63ae529421fa87866e79890997ea6607037941747f2917e03dfbee5dd59b913ded23b5d9d5b233d2ed1be2498ca7b3e065f27a7709d378af1e961ead03c511dc4d49f6a8d1983de357c74da4e41788de1ad3d6a528896103f22fb53692aabb6ac8fd8f65da780aa7b08ede01dba7853668cc375f44d307c2863be50b365425b360ccac9df6edd0b4ae0f5c25eea0d4dc19ac57a4b4a5767cc20966d7d38e13921569d471fd2274c832b7b99b37799f76479bdcd90cb5b30b1970e598480b33c774f7225d3a4d817c80596b6ae63c6db8e79ab01c552becbcf9df534c8c01f163894c6a3de6aed74d3fc442eb41f76ba5900ce1d215428b81de1713097afd13670046bd56a165e8914b4b837e9acab632bfa2f67fdfd73be8027655e5bf8445ca51d180c06e3bb41488548a375e588d2316e592a32679d8a2417dbc81f746a034c17a3109d948a6326cd5113d9ab04815503adb65a36eb3f1e22a42ff1cc25d1f6dea94abbb384f92688e82f09188a3e34bfc5ee290f570d62a9247d39995e6c10595c85aa4cf592d7927078e77b9f3a788664831ead5f5b1847fbf8b30cee7c0b10f844817ef53f9274677b2b12c698eb102bfbbb31efc109d7a0d875573e807d4783e70681f7f02594e6587a11224f274561466e4e3d7900ee2022e218ab31e6870da6dc69ee6eff35d86d46556986b79cc57193c06de60927a81754c6c365d91ffdfb9c85f326a9e729caac9b7613ddfdc18340bd916fa3ef3f6e80e868f1ec605eb3d5e0e5e02b444ef5203e7e6d6cec0f8840c232fe829c700929a451c5a202e26ec12a779e3c7eb52237f8755875392597aed1e7175919414722ed28eabc4a2cffd5f2af5216a6c34daea83ca6098ae5f14d4d3188c8e56ec588c22c5910600d63494c3c75ef20cdcd37b4c764cb47f0dd12d1c7f78c498d50b53889641f17f0e19ca27b94d78d223a4a2b9ac029388b5acd179f34629dc7c095d6c96328c41679933bdc6ac9f7c7be92fdba950d30bd883446fe2063d3e5a9bdcc7c685bf21f30a53b49885a06a08f0cef567cccac0148e133c1aa9f959345a6279e9aed54e3d543bb0cf11174c15b9eeebe37df86ed8ec6f7b6a4bdb840ae5b6fc7ed635023952818d559654a95ddc247c3f76b9762240684aca58e107917b53f44a702239fddf33e3716fac6bb3418905ebad6701003b2e9d2957fbdaf4cc2092ee55cd10e9fbe0d6b0bdc11513af3ce4044e4dba22aed59b13f898c051f35f2f4e1b31186fcd5088e7a1e1188e4ab01946dc7699a4fcad6c6609dbae8ed31a1c8137c7e688e619d44fec4dd6d66fbc9b9ee67bcde5b2887d199c78bbd14066ffd81aec283370e4210c5bd4abcd0e92004fe12eea23f78ea494f03fe650147f159caee69c657d529d9d5c2d45ccd155d06f4feb0753dee049651c045ff539beb6b619db4e082b7d663642ef710ce586cc079ab1940af07338c16c8b25d46b2cd6f3b7f637df410cef7dc39a400cacf7dbeff32c49691e36591d647956d77f67d89ba7e693e4e9df4f3abeb568dbf6d2ec60c43c795239e5124303e92ee1ffaec0627dad46bbc99b6108c8ca9785be8482d0cd32e644f4d5f6d0eeb1b7fd2236cc02cb5438f780bc349dc73c871255da46051cdc299d7bf17f711168e1ab2890cd74670a9d86b6a327502df42ed10e5a6fa3d5ca216075058b4ae081624804424b4762894acb44dd7d9f8408ac95bcc3305f71c84c3d0844fdae9ab1c0035930579256e2041fb8bb560286fd1bbacb61f561502df36e9399d21561f40250205aeb1160cefa211d069997deee280498f36bb94aa191fbdaa571ac601f6c7b69521dfe94dc182d3dad39e460e9060f0346d627c6c3ceba23b1eef5bb01f4dbe973bd60ae152054bdd3cfdebdce8247a675cfa46667fa21f826faf93417e9c23e6fbb9a35137ace8eeab4235b4fffe7cfeb913d5bec86332b4406ade34cd47c3bbb035805d06c39c6822b8d25970f94219f7543bb42767960cb878d7fcfce03664924b62856d908d15e62ee1e7d1b23352d7b7bdb690bd8b454cd7f4b08e9fbf2a149c470e5b31c404bb5490bf5941185e94799951cabf9a0e0f07537445a9ff4ec114c918a37198d912b9e8fb3400ab473773308f08600cc252260de348ceed4e7e32c2937b6da8868e9be6337ca720cbcf8d18c2db3aca99b1f350f99c0686a98cc86a672d401e0fbb1cc810cec7a0d6aa2ff2d7f0010bce1412a2447391b8e19e3840d63294b0dc04e4a2300cec631b9e20d4bb669fe340639ece31dc4bb065d2be880b570269f5e5d3ce8a523cf490a77564cc91d6a41c6ac21ae81236b14a6de493392cbc83f1bc2ca472359807416aaf7854e398a701f9f8f077c6f8efcf93a1c294f265f59b0064542e8abc4d652a9e8f3a2a813eee3a165d84c5e1bd1f590f9282225d474165c9549e38ea780757116f6572aa8f1371ca3fbc3f2b74751ec12edce142cb5d57eb8b2bf57af7a3af12e28ba27b30b0d023d07715f689a82e7df3ea6763da4f47550540d069a49438bb8f74a972cdf14b2c93fc580cfb457035b5ad7f9f889263ba33ebb2f7d2c9bf83d4ef2b0dc46dda94c7e410f45ab65fcf8e1319eb8cc13e3c8273f02047d847b34b201d1bce5dfd6b03e2651ef201cca43db45d78605cd9e18db0c215cae7116758911b04acc100bbd5b54208d2166090b3265f75a187aab0d0bb59027b1eacda50c024cee792d107dcb3cff42f43276580da5a2f65e3ffe5d5d89c31603cb9ea08424701f8653a93a5d2caaea3491eddffb6d7037fea307fdb5d8342e066333ebe5af5650197ac440e21e5fc96283cd77e76290f02a1cc5423b0a571456bc94a755644775f83d62fe8780c3bdf99ef11a8402c3f8116dfb20ba2394949616fdc3484a7f2b917173c1593e08f93c9208fc9daa66d877955ebdbfd4d605b8fcf1987706d099d87a9c73e8985b23693de889c7860c3d6e727c3900be4cc4b8229905e867326addee73c2fcb42ed6ec60b1a46b68dc5925ce9d39e809995dab", &(0x7f0000000440)="718ff280212403adb19c748cf57bf7bce85e1390467edc8cc947ce2ef7c365368a3275b43c5aa5cf5444d01f40956fdb08364d59afc878347e9a0230fbd63fc20e76a4d7fd972be17a2145c9742fb31e56f54b107de390", 0x8000, r8, 0x4}, 0x38) sendmsg$NFT_MSG_GETSET(r1, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f00000005c0)={0x14, 0xa, 0xa, 0x101}, 0x14}}, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) r9 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r10 = openat$cgroup_int(r9, &(0x7f0000001180)='hugetlb.2MB.rsvd.limit_in_bytes\x00', 0x2, 0x0) write$cgroup_subtree(r10, &(0x7f0000000280)=ANY=[@ANYRESOCT=r9], 0x27) r11 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r11, 0x29, 0x40, &(0x7f00000008c0)=@mangle={'mangle\x00', 0x2, 0x6, 0x510, 0x370, 0x0, 0x280, 0xd0, 0xd0, 0x440, 0x440, 0x440, 0x440, 0x440, 0x6, 0x0, {[{{@uncond, 0x0, 0xa8, 0xd0, 0x0, {0x7a00000000000000}}, @HL={0x28}}, {{@ipv6={@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @mcast1, [0xff, 0xff000000], [0x0, 0xff000000], 'syzkaller0\x00', 'bridge0\x00', {0xff}, {}, 0x0, 0x2}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38, 'SET\x00', 0x3, {{0xffffffffffffffff}, {0xffffffffffffffff, 0x0, 0x7}, {}, 0x2}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@CLASSIFY={0x28, 'CLASSIFY\x00', 0x0, {0x3ff}}}, {{@ipv6={@remote, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', [0x0, 0xff], [], 'bond_slave_1\x00', 'pim6reg1\x00', {0xff}, {}, 0x0, 0x9}, 0x0, 0xa8, 0xf0}, @SNPT={0x48, 'SNPT\x00', 0x0, {@ipv6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @ipv4, 0x0, 0x2b}}}, {{@ipv6={@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @empty, [0xffffff00, 0xffffffff, 0xff000000], [0xffffffff, 0xffffffff, 0x0, 0xffffffff], 'xfrm0\x00', 'team_slave_1\x00', {0xff}, {}, 0x11, 0x9, 0x1, 0x40}, 0x0, 0xa8, 0xd0}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0xffffffffffffffff, 0x3, 0x4}, {0x2, 0x2}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x570) 2.23387697s ago: executing program 3 (id=14708): mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmmsg$inet6(r0, &(0x7f00000009c0)=[{{&(0x7f0000000240)={0xa, 0x4f21, 0x400, @private0, 0x3}, 0x1c, &(0x7f0000000180)=[{&(0x7f0000000440)="14", 0x1}], 0x1}}, {{&(0x7f0000000300)={0xa, 0x4e21, 0xa6, @private0={0xfc, 0x0, '\x00', 0x1}, 0x20000009}, 0x1c, &(0x7f0000000940)=[{&(0x7f00000006c0)="8e4151a067", 0x5}], 0x1, &(0x7f0000001a80)=ANY=[@ANYBLOB="180000000000000029000000360000002f000000000000004000000000000000290000003700000002040000000000000001000401ff0502000204010405026c0dc910fc0100000000000000000000000000000000000000d80000000000000029000000360000000c1800000000000004bbeb353498e7e22319fdfe60398e84453cf1d32de1ce9ef3e1a1202416f47960883771e1dc8e38e17928465d73ea3efbb8b54b4b0793a7e81b6ab0a65b757d25e5152e2fdfdea944df669c99dd6fb0ee47b469d9f4ed57ba69b4ccd58ecf420fe3b4c02739836cdf33ea8f61f74796118beb7d891276e8583057872cab7a6b3a0862b5e0be10d4c3624ba39b3ba2ca972c614af71302eaeb1c203da1db569347e65c488c2b8fe2b73a2627602dea6d9e567698019aab06c9ff57008401010038000000000000002900000037000000740400000000000007180000000004810010040000000000000040000000000000000104000000001400000000000000290000000b0000000000000400000000580000000000000029000000360000008207000000000000040104c910ff020000000000000000000000000001c910fe8000000000000000000000000000bb05020000c20400000f2a000100000100c20402b9519300000028000000000000002900000039000000330200e600000000fe800000000000000000000000000021180000000000000029000000360000005c0000000000000018010000000000002900000036000000881f000000000000000100050200000718000000020407acac66650000000000000000e00000000000c910fe8000000000000000000000000000aa072000000003060900000100008000000000a703000000000000050000000000000000010001050000000000109c7971cdaf83af16ca6acd35962eced527d9a7ca08a576662c7a9fcaca4866dcce92b2ec4346b2f5f535b5f26ea7411ed2101b82a6d8ce5e3085e7aa8efcc2e926bd6d9ae80e518e404d44abc88ec9cc67821887f2d463831e9701ea66ed882bebf1d65b8822c6fc65658bbb769a8c576916fcf9daabfca49b1167763281dedde93bba6815ac383bd49d613ba2ee90eafb72781f1058c3dacf68cd398c00000048"], 0x378}}], 0x2, 0x931766f6319eed44) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x2000009, 0x32, 0xffffffffffffffff, 0x0) ioctl$F2FS_IOC_GET_PIN_FILE(0xffffffffffffffff, 0x8004f50e, 0x0) socket$kcm(0xa, 0x2, 0x88) socket$tipc(0x1e, 0x5, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) r1 = socket(0x10, 0x80003, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_prio={{0x9}, {0x18, 0x2, {0xf, "0000000000000000000f00000e000081"}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x2000000}, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x9, 0x3, 0x10004, 0x5}, 0x50) close(r4) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0x5, 0x10001, 0x9, 0x1}, 0x48) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x14, &(0x7f0000000580)=ANY=[@ANYBLOB="1802000000000000000000000000000018010000786c6c2500000000070000007b1af8ff00000000bfa100000000000007010000f8ffffffb700000000000000b7030000000000fd850000002d00000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000480)={&(0x7f0000000680)='sys_exit\x00', r5}, 0x10) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x32, 0xffffffffffffffff, 0x0) getsockopt$bt_hci(r0, 0x84, 0x80, &(0x7f0000002100)=""/4127, &(0x7f0000000000)=0x101f) 2.052303164s ago: executing program 3 (id=14709): r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f0000000280)=0x4, 0x4) sendto$inet(r0, &(0x7f0000000040)="0400", 0xffec, 0x0, &(0x7f0000000340)={0x2, 0x0, @loopback}, 0x10) (fail_nth: 4) 1.572580504s ago: executing program 3 (id=14710): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0a00000007000000060000008c"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x20, 0xd, &(0x7f0000000280)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000500000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = socket$packet(0x11, 0x2, 0x300) recvmsg(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000140)=[{0x0}], 0x1}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="740000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="2b030040000000004c0012800b00010067656e65766500003c0002800800"], 0x74}}, 0x24005000) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000040)=@newqdisc={0x24, 0x24, 0x8, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x5}, {0xffff, 0xffff}, {0xfff3, 0x6}}}, 0x24}}, 0x8040) r2 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r2, &(0x7f00000002c0), 0x40000000000009f, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000000c0)={'netdevsim0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r6 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="3000000002060101000000000000000000f90003050005000a0000000900020073797a3000000000050001009f"], 0x30}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYRESHEX, @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000b70300000000000085000000330000"], 0x0, 0x800, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r7 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="300000001c0001000000000004086aa42d"], 0x30}}, 0x0) writev(r5, &(0x7f0000001640)=[{&(0x7f00000002c0)="429b5b0007f6b0885f57b0b77775963f88a8", 0x12}], 0x1) ioctl$FIBMAP(r4, 0x1, &(0x7f0000000040)=0xc97) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000240)={0x1b, 0x0, 0x0, 0x1000000, 0x0, 0xffffffffffffffff, 0x1c000, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x4}, 0x50) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000080)={0xffffffffffffffff, &(0x7f0000000300), 0x0}, 0x20) sendmsg$nl_route(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000005a40)=ANY=[@ANYBLOB="b400000010000904000000000000000000002200", @ANYRES32=0x0, @ANYBLOB="fffffffed9526cfd8400128009000100766c616e000000007400028006000100000600000c000200367da1650e000000280003800c00010001800000002000000c000100a1000000c84200000c0001000800000008000000340004800c00010006000000ff0300000c00010004000000080000000c00010004000000020000000c000100050000000300000008000500", @ANYRES32=r3, @ANYBLOB='\b\x00\n\x00', @ANYRESOCT], 0xb4}}, 0x0) 1.569082784s ago: executing program 0 (id=14711): r0 = socket(0x2b, 0x80801, 0x1) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = accept4$rose(r0, &(0x7f00000002c0)=@short={0xb, @remote, @bcast, 0x1, @default}, &(0x7f0000000300)=0x1c, 0x800) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000340)='cpuset.memory_pressure\x00', 0x0, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r0, 0x89e0, &(0x7f0000000380)={r2, r3}) syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000ac0), r1) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x18, 0x3, &(0x7f00000000c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000280)={&(0x7f0000000040)='contention_end\x00', r4}, 0x10) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='blkio.bfq.io_serviced\x00', 0x26e1, 0x0) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0xd, 0x12, r7, 0x1f4d2000) sendmsg$IPVS_CMD_ZERO(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)={0x14, r6, 0x1, 0x400, 0x4}, 0x14}}, 0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_UNCONFIRMED(r8, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000140)={0x14, 0x7, 0x1, 0x101, 0x0, 0x0, {0x2, 0x0, 0x6}}, 0x14}, 0x1, 0x0, 0x0, 0x24040004}, 0x9e802f8602b7f6b8) 1.453534876s ago: executing program 0 (id=14712): r0 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r0, &(0x7f0000000040), 0x10) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000780)=ANY=[@ANYRES32=r0, @ANYRESOCT=0x0, @ANYRES32=r0], 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYRESDEC=r0, @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000f6000000850000004300000095"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x1fffffffffffff9d, &(0x7f0000000440)=ANY=[], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x26, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r6}, 0xc) close(r0) r7 = socket$inet(0x2, 0x4000000000000001, 0x0) r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x3, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="1802000002000000000000000d00000085000000a0000000950000000000000057cee8d61a39059f4242e3f5b50c917c143919c1bddf02198540670bf71f9f8e9021628239025100e60136577de1d5e6b62fbcae98bfb301123a8b748442544869c729c6ef7cff890b7c88dfc43aae0e3c739431291edfa20b366bea0c68fb36b2fba27a25614e7490f30542c878d10229a5b667f7374967b6440f7d15677de4e62b17bc57b23918f51c661c0d01268ccafea1debced6e9d1329a722ec0eb5209c44d6f88990453c8000041caf5cf7001d743df98e0d507ad9172ba20d4d35dfd0f4d67e2ddcf6639d7e790a390c02358b2bcfb6e6ee33e1"], &(0x7f0000000740)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x40, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xffffffff}, 0x94) r9 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f0000000000)='udp_fail_queue_rcv_skb\x00', r8, 0x0, 0x1}, 0x18) r10 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r10, 0x11, 0x65, &(0x7f0000000080)=0x6991, 0x4) bind$inet(r7, &(0x7f0000000300)={0x2, 0x4e23, @multicast1}, 0x10) r11 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x2, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000611898000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x24, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r12 = socket$vsock_stream(0x28, 0x1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x1, 0x4, &(0x7f0000000180)=ANY=[@ANYRES16=r11, @ANYRESOCT=r12, @ANYBLOB="d744ddb2426ff2c4e9057c39b101cb5c5b7a51f841b2bcd9b2e54a84148f64bc74ebfea2b29f0631468651353969f6ebb270a48528eded4772e1240156269e5e", @ANYRES16=r5, @ANYRES64=r2, @ANYRES8=r3, @ANYRES64=r9, @ANYRESHEX=r12], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1007}, 0x94) r13 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r13, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="480000001000210400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000001c0012800b00010067726574617000800c00028008000001000014bb0a0001"], 0x48}}, 0x0) socket$inet(0x2, 0x801, 0x0) unshare(0x6a040000) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x48) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000340)={0x0, r4, 0x0, 0x8a2}, 0xffffffffffffff71) r14 = bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x1f, 0x6, &(0x7f0000000cc0)=ANY=[@ANYBLOB="050000000000000061110c00000000008510000002000000850000000500000095000000000000009500a5050000000077d8f3b423cdac8d80000000000000002be16ad10a48b243ccc42606d25dfd73a015e0ca7fc2506a0f7535f7866907dc0200000000000000ae669e17fd6587d452d6453559c3421eed73d56615fe6c54c3b3ffe1b4ce25d7c983c044c03bf3a48dfe47ec9dd6c091c30b93bfae76d9ebacd3ed3e26e7a23129d6606fd28a69989d552af6bda9df2c3af36effff9af2551ce896165127cb3f011a7d06602e2fc40848228567ffb400000000003ed38ae89d24e1cebfba2f87925bfacba83109751fe6c05405d027edd68149ee99eef6a6992308a4fc0b7c70bc677d6dd4aed4af7500d7900a820b6347184e9a217b5614cd50cbe43a1ed2526814bc0000e9e086ce48e90defb6670c3df2624f56da648d28ad0a97aec7291c25447c106a99893e10db21901eb397b2f5fd71400fa7a050fbbef9e326ea27e513e96068fd1e8a43e89f9c85c822a961546ed5363c17ff1432d08806bc376e3e49ee52b59d13182e1f24ed200ada10eb1affb87ba55b2d72078e9f40b4ae7d01000000d11cd22c35d32940000088dde499000000fdffffff00000000000f000000ef0000000000000000000000000c52f4ebd2c893bb97a068bd10734a83584898eccb26f7b789cfc4cd995fa3e11a5c74c85404e2df3ad37b729ac83b0dcb4f48f3c3356b9997fc455a17690b6f7f9ccbe4b1701941b18aba6b16455a66c3b84b138efc20a546d3d5227e23b03f2a834391ade2ff3e93ee296c4082ee73e7c353312c9d75711ce1623e9c54bdff59d2a69dcb7d84c235b23a4480c2461b405cfd1a38992f295ad3adc94cd07c850d1ce6d0b2fea02c24e9280333152fb794e4ddea02017a6c139b50101caecaf2abc0847a1ff2f7fc3c2b99a96fc4275ad107274e2934a87a4ddcdb112754ca5bdec0ead14b6c0f19a43a2f05c7f0be31491eb8c9ff68236c8600040000000000000000000066e034c81c3cab64e4fc8dc55ce0ada18dcbf31c6e82893add3bee3e10fc873d1d922b0877cbcd95b839d3059d5140a1f742f6e75741e39e5cb6a193e06a1043375b0f61b5d4e17c81baa31b924d84f224baf1221c15fa12313ffbfa7c2730309f66705b71e6205e7cbf3643561eabb9a63fcd604d5cc27e1317ad94cf438d71873e540be16b6ca205081173bd03c4754fc4674812daab482fd390a1c903b5d28a1eb247b5837d7603b92495d5c569f6433c3fca5206cb0000003fdbbd3892c52c2e7612e05de32322e980a3d69931e2c9312dd517c96f2ee90362476ed853c4c9b7d4ebf13cbaa795860e92a3d7d004f2c491db38eb769f094d5d48b262"], &(0x7f0000000080)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x41100, 0x15, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x6, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='cq_alloc\x00', r14, 0x0, 0x4000000000}, 0x18) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x16, 0x4, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x8}, [@generic={0x91, 0x1, 0x1, 0x4f}]}, &(0x7f0000000c40)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffff9}, 0x94) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r17 = socket$rxrpc(0x21, 0x2, 0xa) setsockopt$RXRPC_SECURITY_KEYRING(r17, 0x110, 0x2, &(0x7f00000000c0)='/dev/ppp\x00', 0x9) vmsplice(r16, &(0x7f0000000440)=[{&(0x7f00000000c0)='7', 0x1}], 0x1, 0x100000000000000) close(r15) 1.434050005s ago: executing program 2 (id=14713): r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg$unix(r1, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x2022) recvmsg$can_raw(r2, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r2, 0x0, 0x0, 0xd3, 0xfffffffffffffffc, &(0x7f0000000180)=""/211, 0x4, 0x0, 0xab, 0x2d, &(0x7f0000000280)="8d76a3cdeb7ca8123d4965e32bc597340e5a28099fed1de4a6985a5311ec298dc78e2444f757af732ba66f38814b9bd9a49a792575a38337d623147d9f172d57bc09d52b8da0d6ad90a33f3514e939aeb73dbebdfacf2dbc1bce89c6224af30c70cef5a939427c723c3fb86c4f444ed476a472118c23a16209c9f7d6e2235ddee955ab333c6f0eb545850244830b5e5c351973a531f5fddc523d92aa0e83b4fd7e8fc4b3d0ad30d3c7fb39", &(0x7f0000000040)="51a822e2db2facb13381d498d7a3fba8147ae70426a67539f1f7a69a4d3f04d78f046737d92d74f9140478ac4c", 0x0, 0x0, 0xd0c}, 0x50) connect$bt_sco(r0, 0x0, 0x0) r3 = socket$can_j1939(0x1d, 0x2, 0x7) r4 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$IP_VS_SO_SET_ADD(r4, 0x0, 0x482, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'dh\x00', 0x10, 0x5, 0x2d}, 0x2c) setsockopt$IP_VS_SO_SET_ADD(r4, 0x0, 0x483, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'none\x00', 0x3a, 0x5, 0x54}, 0x2c) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000000)={'vxcan1\x00', 0x0}) bind$can_j1939(r3, &(0x7f00000000c0)={0x1d, r5}, 0x18) connect$can_j1939(r3, &(0x7f0000000140)={0x1d, r5, 0x0, {0x1, 0xf1, 0xa8fe8ad4eea2351f}, 0x2}, 0x18) 1.277349507s ago: executing program 1 (id=14714): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000380)={0x0, 0x600, &(0x7f0000000000)={&(0x7f0000000240)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWFLOWTABLE={0x58, 0x16, 0xa, 0x1, 0x0, 0x0, {0x1}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_FLOWTABLE_HOOK={0x2c, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_NUM={0x8}, @NFTA_FLOWTABLE_HOOK_DEVS={0x18, 0x3, 0x0, 0x1, [{0x14, 0x1, 'veth1_to_bond\x00'}]}, @NFTA_FLOWTABLE_HOOK_PRIORITY={0x8}]}]}, @NFT_MSG_DELFLOWTABLE={0x5c, 0x16, 0xa, 0x101, 0xb00, 0x0, {0x1}, [@NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_HOOK={0x30, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_DEVS={0x2c, 0x3, 0x0, 0x1, [{0x14, 0x1, 'vcan0\x00'}, {0x14, 0x1, 'veth1_to_bond\x00'}]}]}]}], {0x14, 0x10}}, 0xfc}, 0x1, 0x0, 0x0, 0x40000}, 0x0) 1.080447563s ago: executing program 1 (id=14715): r0 = socket$inet(0x2, 0x2, 0x1) sendmsg$inet(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000400)='\b\x00', 0x2}], 0x1, 0x0, 0x40}, 0x20000000) r1 = epoll_create1(0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000200)="ad00"/16, 0x10) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, 0x0, 0x0) r3 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000800000000bf91000000000000b702000043e7b5538500000085000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r5 = socket(0x2, 0x80805, 0x0) r6 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r6, &(0x7f0000000140)=[{&(0x7f0000000080)="580000001400192340834b80040d8c560a067f0200ff000000000000000058000b4824ca945f64009400ff0325010ebc000000000000008000f0fffeffe809005300fff5dd000000100001000a0c100000000000000fff00", 0x58}], 0x1) setsockopt$IP_VS_SO_SET_ADD(0xffffffffffffffff, 0x0, 0x482, &(0x7f0000000040)={0x84, @dev={0xac, 0x14, 0x14, 0x2d}, 0x4e20, 0x3, 'wrr\x00', 0x1, 0x2, 0x6a}, 0x2c) setsockopt$IP_VS_SO_SET_ADDDEST(r5, 0x0, 0x487, &(0x7f0000000000)={{0x84, @private=0xa010101, 0x4e21, 0x3, 'lc\x00', 0x4, 0x8, 0x77}, {@rand_addr=0x64010102, 0x4e24, 0x2, 0xcd, 0x12d5e, 0x3}}, 0x44) socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$IP_VS_SO_SET_FLUSH(0xffffffffffffffff, 0x0, 0x485, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r4}, 0x10) ppoll(&(0x7f0000000500)=[{r3}], 0x1, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0xfffffffffffff5fd, 0x0, 0x4000003}, 0x0, &(0x7f00000002c0)={0x3ff, 0x9, 0x0, 0xc, 0x0, 0x0, 0x4, 0x1}, 0x0, 0x0) r7 = socket$unix(0x1, 0x5, 0x0) unshare(0x2c060000) unshare(0x24020400) r8 = socket$unix(0x1, 0x1, 0x0) bind$unix(r8, &(0x7f00000000c0)=@abs={0x1, 0x0, 0x4e22}, 0x6e) bind$unix(r8, &(0x7f0000000000)=@file={0x1, './file0\x00'}, 0x6e) syz_emit_ethernet(0x4e, &(0x7f00000001c0)={@random="5b37182347bc", @broadcast, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "9d0080", 0x18, 0x3a, 0xff, @empty, @mcast2, {[], @ndisc_ns={0x87, 0x0, 0x0, @local, [{0x0, 0x0, "ff9b"}]}}}}}}, 0x0) setsockopt$sock_int(r7, 0x1, 0x2e, &(0x7f0000000040)=0x80, 0x4) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r7, &(0x7f0000000080)={0xa002a008}) 1.055091462s ago: executing program 5 (id=14716): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket(0x10, 0x3, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x24, &(0x7f0000000280)=0x1, 0x4) shutdown(r2, 0x0) recvmmsg(r2, &(0x7f0000000f40)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000ec0)=""/65, 0x41}, 0x8}], 0x1, 0x0, 0x0) write$nbd(r1, &(0x7f0000000240)={0x67446698, 0x1, 0x0, 0x4, 0x2, "4d33655eab64be593b6aa4bd0226440f199345a5b6c7875e15156264e77245646b11d2fccc0acba7e1e40a6ac756bcdf8d4afa93d77c6a2cdf471d56cbe1d79a693b991d94d25572fea43c5647df35904808c7c196a525753f130a8fd9dd2d794e726e5ebe535e2acbd91fb4df6244bdd38ad8753170c0ba07f1a2086558c903f2acd2f61943c69a7b8f67ea0f8d69db1a04d1656f966bab646201749bd5c60355609c9ee2d8f6f4fc718950620716d58b8775da2692e20ca4f3965e8e866e66dbe7291a1a3f860295b23f"}, 0xdb) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="400000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000001800128008000100707070000c00028008000100", @ANYRES32=r3, @ANYBLOB='\b\x00\n\x00', @ANYRES64=r1], 0x40}}, 0x0) bind$alg(r1, &(0x7f0000000040)={0x26, 'rng\x00', 0x0, 0x0, 'stdrng\x00'}, 0x58) r4 = syz_init_net_socket$rose(0xb, 0x5, 0x0) connect$rose(r4, &(0x7f0000000100)=@full={0xb, @dev={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, 0x5, [@default, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @null]}, 0x40) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0xe, @empty, 0x204}, 0x1c) setsockopt(r0, 0x1, 0x9, &(0x7f0000000040), 0x29) 501.879433ms ago: executing program 0 (id=14718): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000340)={0x26, 'skcipher\x00', 0x0, 0x0, 'chacha20-generic\x00'}, 0x58) unshare(0x62040200) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="1c0000006800e97800000000f9ffffff0a0000000000000004"], 0x1c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=@newnexthop={0x24, 0x68, 0x1, 0x2, 0x7ffffffc, {}, [@NHA_GROUP={0xc, 0x2, [{0x1, 0x4}]}]}, 0x24}, 0x1, 0x0, 0x0, 0x24008000}, 0x4000) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=ANY=[@ANYBLOB="240000001800dd0400010000002008001e000200"], 0x24}, 0x1, 0x0, 0x0, 0x4a044}, 0x4010) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@ipv6_newnexthop={0x24, 0x68, 0x309, 0x0, 0x0, {}, [@NHA_BLACKHOLE={0x4}, @NHA_ID={0x8, 0x1, 0x1}]}, 0x24}}, 0x0) r4 = socket$inet_udplite(0x2, 0x2, 0x88) r5 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, 0x0) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00"/13], 0x48) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x6, 0x7, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x100}, [@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r6}}]}, &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={r7, 0x0, 0x25, 0x0, @void}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r4, 0x89f1, &(0x7f0000000040)={'syztnl0\x00', &(0x7f00000003c0)={'ip_vti0\x00', 0x0, 0x20, 0x40, 0x1, 0x7, {{0x22, 0x4, 0x0, 0x39, 0x88, 0x66, 0x0, 0x4, 0x29, 0x0, @rand_addr=0x64010101, @remote, {[@generic={0x88, 0x4, "9bc8"}, @cipso={0x86, 0x3b, 0x0, [{0x1, 0xe, "1e953597a5560df5289bd51d"}, {0x0, 0xa, "01e18c5bf4a625a3"}, {0x5, 0x8, "6d6e41963b84"}, {0x2, 0x4, "8984"}, {0x2, 0x4, "8259"}, {0x0, 0x2}, {0x2, 0x8, "de0739c3c730"}, {0x6, 0x3, "c9"}]}, @lsrr={0x83, 0x2b, 0x71, [@private=0xa010100, @broadcast, @private=0xa010102, @empty, @local, @remote, @remote, @multicast1, @multicast1, @initdev={0xac, 0x1e, 0x1, 0x0}]}, @lsrr={0x83, 0x7, 0xc0, [@initdev={0xac, 0x1e, 0x6, 0x0}]}]}}}}}) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="c99b57381801238c09d04a0f1d0d47b2", 0x10) r8 = bpf$MAP_CREATE(0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="0f000000040000000800000009"], 0x48) socket$xdp(0x2c, 0x3, 0x0) r9 = socket(0x1, 0x2, 0x0) setsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x8, &(0x7f0000000280)=0x3ff, 0x4) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000200)={r8, &(0x7f0000000100), &(0x7f00000001c0)=@tcp=r9, 0x2}, 0x20) syz_genetlink_get_family_id$fou(0x0, 0xffffffffffffffff) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0x4401}) writev(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f0000000080)="0bc3ff", 0x3}, {&(0x7f0000000000)='G', 0x1}, {&(0x7f0000000240)='\x00'/10, 0xa}], 0x3) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000480)="dacd5189a3831e198991e875a5b0e2a0631aadffd82be4a44a532a5c78916a94945addab2ba680d45927b0ed8f9b9c9addff71fbc1052f219d7d30a17c4ec05172dad2", 0x43}], 0x1}}], 0x1, 0x4000040) 427.041411ms ago: executing program 2 (id=14719): mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmmsg$inet6(r0, &(0x7f00000009c0)=[{{&(0x7f0000000240)={0xa, 0x4f21, 0x400, @private0, 0x3}, 0x1c, &(0x7f0000000180)=[{&(0x7f0000000440)="14", 0x1}], 0x1}}, {{&(0x7f0000000300)={0xa, 0x4e21, 0xa6, @private0={0xfc, 0x0, '\x00', 0x1}, 0x20000009}, 0x1c, &(0x7f0000000940)=[{&(0x7f00000006c0)="8e4151a067", 0x5}], 0x1, &(0x7f0000001a80)=ANY=[@ANYBLOB="180000000000000029000000360000002f000000000000004000000000000000290000003700000002040000000000000001000401ff0502000204010405026c0dc910fc0100000000000000000000000000000000000000d80000000000000029000000360000000c1800000000000004bbeb353498e7e22319fdfe60398e84453cf1d32de1ce9ef3e1a1202416f47960883771e1dc8e38e17928465d73ea3efbb8b54b4b0793a7e81b6ab0a65b757d25e5152e2fdfdea944df669c99dd6fb0ee47b469d9f4ed57ba69b4ccd58ecf420fe3b4c02739836cdf33ea8f61f74796118beb7d891276e8583057872cab7a6b3a0862b5e0be10d4c3624ba39b3ba2ca972c614af71302eaeb1c203da1db569347e65c488c2b8fe2b73a2627602dea6d9e567698019aab06c9ff57008401010038000000000000002900000037000000740400000000000007180000000004810010040000000000000040000000000000000104000000001400000000000000290000000b0000000000000400000000580000000000000029000000360000008207000000000000040104c910ff020000000000000000000000000001c910fe8000000000000000000000000000bb05020000c20400000f2a000100000100c20402b9519300000028000000000000002900000039000000330200e600000000fe800000000000000000000000000021180000000000000029000000360000005c0000000000000018010000000000002900000036000000881f000000000000000100050200000718000000020407acac66650000000000000000e00000000000c910fe8000000000000000000000000000aa072000000003060900000100008000000000a703000000000000050000000000000000010001050000000000109c7971cdaf83af16ca6acd35962eced527d9a7ca08a576662c7a9fcaca4866dcce92b2ec4346b2f5f535b5f26ea7411ed2101b82a6d8ce5e3085e7aa8efcc2e926bd6d9ae80e518e404d44abc88ec9cc67821887f2d463831e9701ea66ed882bebf1d65b8822c6fc65658bbb769a8c576916fcf9daabfca49b1167763281dedde93bba6815ac383bd49d613ba2ee90eafb72781f1058c3dacf68cd398c00000048"], 0x378}}], 0x2, 0x931766f6319eed44) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x2000009, 0x32, 0xffffffffffffffff, 0x0) ioctl$F2FS_IOC_GET_PIN_FILE(0xffffffffffffffff, 0x8004f50e, 0x0) socket$kcm(0xa, 0x2, 0x88) socket$tipc(0x1e, 0x5, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) r1 = socket(0x10, 0x80003, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_prio={{0x9}, {0x18, 0x2, {0xf, "0000000000000000000f00000e000081"}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x2000000}, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x9, 0x3, 0x10004, 0x5}, 0x50) close(r4) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0x5, 0x10001, 0x9, 0x1}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x14, &(0x7f0000000580)=ANY=[@ANYBLOB="1802000000000000000000000000000018010000786c6c2500000000070000007b1af8ff00000000bfa100000000000007010000f8ffffffb700000000000000b7030000000000fd850000002d00000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x32, 0xffffffffffffffff, 0x0) getsockopt$bt_hci(r0, 0x84, 0x80, &(0x7f0000002100)=""/4127, &(0x7f0000000000)=0x101f) 158.189128ms ago: executing program 2 (id=14720): r0 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000040)=0x1, 0x4) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000300)={{{@in=@multicast1, @in=@multicast2, 0x0, 0x0, 0x4e21, 0x0, 0xa, 0x0, 0x0, 0x3b}, {0x0, 0x0, 0xfffffffffffffffe, 0x1000000, 0x0, 0x0, 0x2e4e}, {0xffffffff, 0x80000001, 0x3}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0xa, @in=@empty, 0x0, 0x0, 0x1}}, 0xe8) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) r2 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000140)={0x0, @in6={{0xa, 0x4e22, 0x8, @rand_addr=' \x01\x00', 0x7fffffff}}, 0x7, 0xfe00, 0x2, 0x6, 0x54, 0x6, 0xf9}, &(0x7f0000000000)=0x9c) r3 = socket$rxrpc(0x21, 0x2, 0xa) bind$rxrpc(r3, &(0x7f0000000140)=@in6={0x21, 0x2, 0x2, 0x1c, {0xa, 0x4e24, 0x8, @ipv4={'\x00', '\xff\xff', @multicast1}, 0x38000000}}, 0x24) r4 = socket$packet(0x11, 0x2, 0x300) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000020000000900010073797a300000000048000000030a0101000000000000000002000000090001007379"], 0xa4}}, 0x0) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000180), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r6, 0x8933, &(0x7f00000001c0)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_KEY(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000640)=ANY=[@ANYRES64=r5, @ANYRES16=r7, @ANYBLOB="3f9d00000000000000001700000008000300", @ANYRES32=r8, @ANYBLOB="60003080050002000000000014000400403a050c5bae9c544ef2b6d713459a7a1c00018005", @ANYBLOB="f4600eeff321123e01b8db6efe3e26a0a3cee73b74a8efd24838294e50c956dcb7bfafbcc3ef82b77f2d008b570dbcc914c047bf77acee575aa82071f8bc60b6ffcbbc3fc7883efe438e983039ea9e04cb56e6b2afc31bca3b43b7b18eeba6f92955f9a4119186a2d3e82c6fd5591f5dfda593cb0e60e0a6c824319562950bd556966877a086dfe68f8c06df03ff23d88e7ff041e2d785880557882b16863ef3fd95c385663ae02895a7cce9c102ce3d39bfe5826ca9d48898f0a341a35bf87eae"], 0x7c}, 0x1, 0x0, 0x0, 0x4004}, 0x0) r9 = socket$packet(0x11, 0x2, 0x300) r10 = socket(0x400000000010, 0x3, 0x0) write(r10, &(0x7f0000000040)="3a03000018002551075c0165ff0ffc02802000030011000500e1000c0400070080000700", 0x33a) setsockopt$packet_int(r9, 0x107, 0xa, &(0x7f0000000080)=0x1, 0x4) setsockopt$packet_rx_ring(r9, 0x107, 0x5, &(0x7f0000000140)=@req={0x8, 0x81, 0x8000, 0x5}, 0x10) r11 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r11, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) getsockname$packet(r11, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendto$packet(r4, &(0x7f0000000280)="31bb6f71", 0x4, 0x6040004, &(0x7f0000000200)={0x11, 0x88a8, r12, 0x1, 0x4, 0x6, @local}, 0x14) listen(r3, 0x5076265b) getsockopt$inet_sctp_SCTP_MAX_BURST(r2, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000300)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x85, &(0x7f0000000000)={r13, @in={{0x2, 0x0, @empty}}, 0x27c0}, 0x90) socket$nl_netfilter(0x10, 0x3, 0xc) unshare(0x2c020400) 111.850284ms ago: executing program 5 (id=14721): r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x48800, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0b000000080000000c0000000300000001000000", @ANYRES32, @ANYBLOB="04000600d1000000000000000000c07b9142ec3c", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001a00)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a30000000006c000000160a05000000000000000000010000000900010073797a30000000000900020073797a300000000040000380080001400000000008000240fffffffd2c000380140001007665746830000000000000000000000014000100648a6d7270310000000000000000000048000000160a0101000b000000000000010000000900020073797a30000000000900010073797a30000000001c00038018000380140001"], 0xfc}, 0x1, 0x0, 0x0, 0x20040841}, 0x0) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000140), 0x5, r1}, 0x38) ioctl$FIOCLEX(r0, 0x5451) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000080)={r1, &(0x7f0000000000), &(0x7f0000000140)=""/75}, 0x40) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'tunl0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=@newtclass={0x24, 0x28, 0x300, 0x70bd28, 0x25dfdbfe, {0x0, 0x0, 0x0, r4, {0x8, 0xb}, {0x6, 0xfff1}, {0x6, 0x4}}}, 0x24}, 0x1, 0x0, 0x0, 0x40000}, 0x24000010) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl802154(&(0x7f00000003c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r5, 0x8933, &(0x7f0000000000)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_DEVKEY(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f00000000c0)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="0100fdffffff000000001d00000008000300", @ANYRES32=r7, @ANYBLOB='(\x00/'], 0x44}}, 0x0) close(r1) setsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f0000000280)=0x4, 0x4) r8 = socket(0x10, 0x3, 0x0) r9 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x5, &(0x7f00000002c0)=ANY=[@ANYRES8], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r4, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1ff}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='signal_deliver\x00', r9}, 0x10) syz_open_procfs$namespace(0x0, 0xfffffffffffffffe) r10 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x5, &(0x7f0000000280)=ANY=[], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1ff}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='signal_deliver\x00', r10}, 0x10) setsockopt$netlink_NETLINK_TX_RING(r8, 0x10e, 0xc, &(0x7f0000000980)={0x802}, 0x10) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r11, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="140000001000010007000000000000000000000a20000000000a03000000000000000000010000000900010073797a300000000048000000090a010400000000000000000100000008000a40000000000900020073797a32000000000900010073797a3000000000080005400000001f0c00098008000140000000075c0000000e0a01020000000000000000010000000900020073797a32000000000900010073797a3000000000300003"], 0xec}}, 0x0) sendmsg$nl_generic(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000500)={0x18, 0x52, 0x201, 0x2, 0x0, {0x2}, [@generic="de43"]}, 0x18}}, 0x40044c4) socket$nl_rdma(0x10, 0x3, 0x14) r12 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r12, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00'}) 0s ago: executing program 1 (id=14722): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000780)=ANY=[@ANYBLOB="74000000090601020000000000000000030000000900020073797a310000000005000100070000004c0007801800018014000240fe8000000000000000000000000000aa1800148014000240fc000000000000000000000000000000060004404e1f00000500070084"], 0x74}, 0x1, 0x0, 0x0, 0x10040003}, 0x0) kernel console output (not intermixed with test programs): 51] openvswitch: netlink: Flow key attr not present in new flow. [ 1663.266281][T20954] netlink: 6 bytes leftover after parsing attributes in process `syz.1.14053'. [ 1663.344927][T20954] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1663.613224][T20966] netlink: 'syz.4.14055': attribute type 12 has an invalid length. [ 1663.888212][T20973] netlink: 'syz.0.14059': attribute type 5 has an invalid length. [ 1663.896900][T20973] netlink: 28 bytes leftover after parsing attributes in process `syz.0.14059'. [ 1664.354762][T20996] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 1664.375358][T20994] netlink: 4 bytes leftover after parsing attributes in process `syz.4.14064'. [ 1665.114696][T21020] netlink: 'syz.3.14071': attribute type 5 has an invalid length. [ 1665.142580][T21020] netlink: 28 bytes leftover after parsing attributes in process `syz.3.14071'. [ 1665.223017][T21027] netlink: 148 bytes leftover after parsing attributes in process `syz.4.14070'. [ 1665.400704][T21029] netlink: 4 bytes leftover after parsing attributes in process `syz.2.14074'. [ 1665.502138][T21039] FAULT_INJECTION: forcing a failure. [ 1665.502138][T21039] name failslab, interval 1, probability 0, space 0, times 0 [ 1665.515754][T21039] CPU: 0 UID: 0 PID: 21039 Comm: syz.3.14076 Not tainted syzkaller #0 PREEMPT(full) [ 1665.515781][T21039] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1665.515793][T21039] Call Trace: [ 1665.515801][T21039] [ 1665.515810][T21039] dump_stack_lvl+0xe8/0x150 [ 1665.515838][T21039] should_fail_ex+0x414/0x560 [ 1665.515870][T21039] should_failslab+0xa8/0x100 [ 1665.515892][T21039] kmem_cache_alloc_noprof+0x88/0x710 [ 1665.515918][T21039] ? security_file_alloc+0x34/0x330 [ 1665.515940][T21039] security_file_alloc+0x34/0x330 [ 1665.515958][T21039] init_file+0x93/0x2f0 [ 1665.515983][T21039] alloc_empty_file+0x6e/0x1d0 [ 1665.516004][T21039] alloc_file_pseudo+0x13d/0x210 [ 1665.516028][T21039] ? __pfx_alloc_file_pseudo+0x10/0x10 [ 1665.516062][T21039] anon_inode_getfile+0xc5/0x1a0 [ 1665.516089][T21039] bpf_link_prime+0xfc/0x220 [ 1665.516110][T21039] bpf_raw_tp_link_attach+0x49a/0x6c0 [ 1665.516134][T21039] ? __pfx_bpf_raw_tp_link_attach+0x10/0x10 [ 1665.516162][T21039] ? __fget_files+0x2a/0x420 [ 1665.516192][T21039] bpf_raw_tracepoint_open+0x1b2/0x220 [ 1665.516218][T21039] __sys_bpf+0x73e/0x860 [ 1665.516240][T21039] ? __pfx___sys_bpf+0x10/0x10 [ 1665.516275][T21039] ? ksys_write+0x22a/0x250 [ 1665.516294][T21039] ? __pfx_ksys_write+0x10/0x10 [ 1665.516318][T21039] __x64_sys_bpf+0x7c/0x90 [ 1665.516339][T21039] do_syscall_64+0xec/0xf80 [ 1665.516358][T21039] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1665.516373][T21039] ? trace_irq_disable+0x37/0x100 [ 1665.516393][T21039] ? clear_bhb_loop+0x60/0xb0 [ 1665.516414][T21039] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1665.516430][T21039] RIP: 0033:0x7ff46618f749 [ 1665.516447][T21039] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1665.516461][T21039] RSP: 002b:00007ff466f8b038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1665.516480][T21039] RAX: ffffffffffffffda RBX: 00007ff4663e5fa0 RCX: 00007ff46618f749 [ 1665.516493][T21039] RDX: 0000000000000010 RSI: 0000200000000080 RDI: 0000000000000011 [ 1665.516505][T21039] RBP: 00007ff466f8b090 R08: 0000000000000000 R09: 0000000000000000 [ 1665.516516][T21039] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1665.516526][T21039] R13: 00007ff4663e6038 R14: 00007ff4663e5fa0 R15: 00007ffcc17b4028 [ 1665.516555][T21039] [ 1666.556423][T21066] netlink: 8 bytes leftover after parsing attributes in process `syz.3.14082'. [ 1666.602867][T21066] netlink: 4 bytes leftover after parsing attributes in process `syz.3.14082'. [ 1666.613707][T21066] netlink: 'syz.3.14082': attribute type 13 has an invalid length. [ 1666.629560][T21066] netlink: 'syz.3.14082': attribute type 11 has an invalid length. [ 1667.247905][T21064] netlink: 'syz.3.14082': attribute type 2 has an invalid length. [ 1667.282783][T21064] netlink: 4 bytes leftover after parsing attributes in process `syz.3.14082'. [ 1667.349292][T21072] netlink: 'syz.1.14084': attribute type 1 has an invalid length. [ 1667.367915][T21072] workqueue: Failed to create a rescuer kthread for wq "bond6": -EINTR [ 1667.423717][T21078] FAULT_INJECTION: forcing a failure. [ 1667.423717][T21078] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1667.486851][T21078] CPU: 1 UID: 0 PID: 21078 Comm: syz.2.14085 Not tainted syzkaller #0 PREEMPT(full) [ 1667.486878][T21078] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1667.486888][T21078] Call Trace: [ 1667.486895][T21078] [ 1667.486902][T21078] dump_stack_lvl+0xe8/0x150 [ 1667.486929][T21078] should_fail_ex+0x414/0x560 [ 1667.486960][T21078] _copy_to_user+0x31/0xb0 [ 1667.486983][T21078] simple_read_from_buffer+0xe1/0x170 [ 1667.487007][T21078] proc_fail_nth_read+0x1b3/0x220 [ 1667.487029][T21078] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1667.487048][T21078] ? rw_verify_area+0x2a6/0x4d0 [ 1667.487073][T21078] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1667.487092][T21078] vfs_read+0x200/0xa30 [ 1667.487107][T21078] ? fdget_pos+0x247/0x320 [ 1667.487132][T21078] ? __pfx___mutex_lock+0x10/0x10 [ 1667.487153][T21078] ? __pfx_vfs_read+0x10/0x10 [ 1667.487171][T21078] ? __fget_files+0x2a/0x420 [ 1667.487193][T21078] ? __fget_files+0x3a0/0x420 [ 1667.487212][T21078] ? __fget_files+0x2a/0x420 [ 1667.487250][T21078] ksys_read+0x145/0x250 [ 1667.487269][T21078] ? __pfx_ksys_read+0x10/0x10 [ 1667.487298][T21078] do_syscall_64+0xec/0xf80 [ 1667.487318][T21078] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1667.487333][T21078] ? trace_irq_disable+0x37/0x100 [ 1667.487354][T21078] ? clear_bhb_loop+0x60/0xb0 [ 1667.487374][T21078] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1667.487389][T21078] RIP: 0033:0x7f705f18e15c [ 1667.487406][T21078] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 1667.487419][T21078] RSP: 002b:00007f705ffce030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1667.487438][T21078] RAX: ffffffffffffffda RBX: 00007f705f3e5fa0 RCX: 00007f705f18e15c [ 1667.487450][T21078] RDX: 000000000000000f RSI: 00007f705ffce0a0 RDI: 0000000000000005 [ 1667.487461][T21078] RBP: 00007f705ffce090 R08: 0000000000000000 R09: 0000000000000000 [ 1667.487473][T21078] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1667.487484][T21078] R13: 00007f705f3e6038 R14: 00007f705f3e5fa0 R15: 00007ffea6e68d58 [ 1667.487514][T21078] [ 1667.790016][T21090] FAULT_INJECTION: forcing a failure. [ 1667.790016][T21090] name failslab, interval 1, probability 0, space 0, times 0 [ 1667.804022][T21090] CPU: 1 UID: 0 PID: 21090 Comm: syz.2.14090 Not tainted syzkaller #0 PREEMPT(full) [ 1667.804048][T21090] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1667.804059][T21090] Call Trace: [ 1667.804068][T21090] [ 1667.804076][T21090] dump_stack_lvl+0xe8/0x150 [ 1667.804104][T21090] should_fail_ex+0x414/0x560 [ 1667.804133][T21090] should_failslab+0xa8/0x100 [ 1667.804157][T21090] kmem_cache_alloc_noprof+0x88/0x710 [ 1667.804181][T21090] ? apparmor_capable+0x137/0x1a0 [ 1667.804198][T21090] ? skb_clone+0x212/0x3a0 [ 1667.804225][T21090] skb_clone+0x212/0x3a0 [ 1667.804245][T21090] ? nfnetlink_rcv+0x4ba/0x2590 [ 1667.804269][T21090] nfnetlink_rcv+0x4ec/0x2590 [ 1667.804291][T21090] ? is_bpf_text_address+0x26/0x2b0 [ 1667.804319][T21090] ? kernel_text_address+0xa5/0xe0 [ 1667.804345][T21090] ? unwind_get_return_address+0x4d/0x90 [ 1667.804366][T21090] ? arch_stack_walk+0xfc/0x150 [ 1667.804403][T21090] ? __lock_acquire+0x6b6/0x2cf0 [ 1667.804431][T21090] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 1667.804470][T21090] ? __lock_acquire+0x6b6/0x2cf0 [ 1667.804498][T21090] ? __netlink_lookup+0xbd/0x8a0 [ 1667.804533][T21090] ? netlink_deliver_tap+0x2e/0x1b0 [ 1667.804557][T21090] ? netlink_deliver_tap+0x2e/0x1b0 [ 1667.804597][T21090] netlink_unicast+0x82f/0x9e0 [ 1667.804627][T21090] ? __pfx_netlink_unicast+0x10/0x10 [ 1667.804650][T21090] ? netlink_sendmsg+0x642/0xb30 [ 1667.804672][T21090] ? skb_put+0x11b/0x210 [ 1667.804695][T21090] netlink_sendmsg+0x805/0xb30 [ 1667.804728][T21090] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1667.804755][T21090] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1667.804777][T21090] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1667.804794][T21090] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1667.804817][T21090] __sock_sendmsg+0x21c/0x270 [ 1667.804843][T21090] ____sys_sendmsg+0x505/0x820 [ 1667.804869][T21090] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1667.804897][T21090] ? import_iovec+0x74/0xa0 [ 1667.804921][T21090] ___sys_sendmsg+0x21f/0x2a0 [ 1667.804945][T21090] ? __pfx____sys_sendmsg+0x10/0x10 [ 1667.804997][T21090] ? __fget_files+0x2a/0x420 [ 1667.805018][T21090] ? __fget_files+0x3a0/0x420 [ 1667.805046][T21090] __x64_sys_sendmsg+0x19b/0x260 [ 1667.805071][T21090] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1667.805101][T21090] ? __pfx_ksys_write+0x10/0x10 [ 1667.805130][T21090] do_syscall_64+0xec/0xf80 [ 1667.805151][T21090] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1667.805168][T21090] ? trace_irq_disable+0x37/0x100 [ 1667.805189][T21090] ? clear_bhb_loop+0x60/0xb0 [ 1667.805210][T21090] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1667.805227][T21090] RIP: 0033:0x7f705f18f749 [ 1667.805245][T21090] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1667.805260][T21090] RSP: 002b:00007f705ffce038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1667.805280][T21090] RAX: ffffffffffffffda RBX: 00007f705f3e5fa0 RCX: 00007f705f18f749 [ 1667.805293][T21090] RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000000000000003 [ 1667.805305][T21090] RBP: 00007f705ffce090 R08: 0000000000000000 R09: 0000000000000000 [ 1667.805316][T21090] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1667.805328][T21090] R13: 00007f705f3e6038 R14: 00007f705f3e5fa0 R15: 00007ffea6e68d58 [ 1667.805357][T21090] [ 1668.194140][T21095] tipc: Enabled bearer , priority 10 [ 1668.334161][T21101] lo speed is unknown, defaulting to 1000 [ 1668.334590][T21096] netlink: 20 bytes leftover after parsing attributes in process `syz.4.14091'. [ 1668.341459][T21101] lo speed is unknown, defaulting to 1000 [ 1668.437868][T21106] lo speed is unknown, defaulting to 1000 [ 1668.532595][T18122] Bluetooth: hci3: command 0x0405 tx timeout [ 1668.533134][T21111] netlink: 'syz.3.14092': attribute type 12 has an invalid length. [ 1668.676963][T21106] lo speed is unknown, defaulting to 1000 [ 1668.849619][T21116] FAULT_INJECTION: forcing a failure. [ 1668.849619][T21116] name failslab, interval 1, probability 0, space 0, times 0 [ 1668.866170][T21116] CPU: 0 UID: 0 PID: 21116 Comm: syz.4.14096 Not tainted syzkaller #0 PREEMPT(full) [ 1668.866196][T21116] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1668.866207][T21116] Call Trace: [ 1668.866215][T21116] [ 1668.866223][T21116] dump_stack_lvl+0xe8/0x150 [ 1668.866251][T21116] should_fail_ex+0x414/0x560 [ 1668.866282][T21116] should_failslab+0xa8/0x100 [ 1668.866305][T21116] __kvmalloc_node_noprof+0x175/0x920 [ 1668.866325][T21116] ? kthread_queue_work+0x111/0x180 [ 1668.866345][T21116] ? bpf_test_run_xdp_live+0x18e/0x1b20 [ 1668.866375][T21116] bpf_test_run_xdp_live+0x18e/0x1b20 [ 1668.866397][T21116] ? bpf_dispatcher_change_prog+0xb35/0xc90 [ 1668.866425][T21116] ? __mutex_unlock_slowpath+0x1a1/0x730 [ 1668.866459][T21116] ? 0xffffffffa02057c0 [ 1668.866477][T21116] ? __pfx_bpf_test_run_xdp_live+0x10/0x10 [ 1668.866502][T21116] ? 0xffffffffa02057c0 [ 1668.866534][T21116] ? 0xffffffffa02016d4 [ 1668.866575][T21116] ? __pfx_xdp_test_run_init_page+0x10/0x10 [ 1668.866608][T21116] ? _copy_from_user+0x94/0xb0 [ 1668.866629][T21116] ? bpf_test_init+0x113/0x150 [ 1668.866649][T21116] ? xdp_convert_md_to_buff+0x5b/0x330 [ 1668.866674][T21116] bpf_prog_test_run_xdp+0x7c4/0x1110 [ 1668.866712][T21116] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 1668.866739][T21116] ? __fget_files+0x2a/0x420 [ 1668.866763][T21116] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 1668.866784][T21116] bpf_prog_test_run+0x2c7/0x340 [ 1668.866809][T21116] __sys_bpf+0x562/0x860 [ 1668.866832][T21116] ? __pfx___sys_bpf+0x10/0x10 [ 1668.866867][T21116] ? ksys_write+0x22a/0x250 [ 1668.866884][T21116] ? __pfx_ksys_write+0x10/0x10 [ 1668.866907][T21116] __x64_sys_bpf+0x7c/0x90 [ 1668.866927][T21116] do_syscall_64+0xec/0xf80 [ 1668.866952][T21116] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1668.866969][T21116] ? trace_irq_disable+0x37/0x100 [ 1668.866990][T21116] ? clear_bhb_loop+0x60/0xb0 [ 1668.867012][T21116] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1668.867028][T21116] RIP: 0033:0x7f5a6438f749 [ 1668.867050][T21116] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1668.867065][T21116] RSP: 002b:00007f5a652f5038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1668.867083][T21116] RAX: ffffffffffffffda RBX: 00007f5a645e5fa0 RCX: 00007f5a6438f749 [ 1668.867095][T21116] RDX: 0000000000000050 RSI: 0000200000000280 RDI: 000000000000000a [ 1668.867107][T21116] RBP: 00007f5a652f5090 R08: 0000000000000000 R09: 0000000000000000 [ 1668.867118][T21116] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1668.867129][T21116] R13: 00007f5a645e6038 R14: 00007f5a645e5fa0 R15: 00007ffe29489ec8 [ 1668.867158][T21116] [ 1669.182650][ T1297] aoe: packet could not be sent on bond0. consider increasing tx_queue_len [ 1669.341968][T21119] netlink: 4 bytes leftover after parsing attributes in process `syz.3.14097'. [ 1669.351083][T21119] netlink: 336 bytes leftover after parsing attributes in process `syz.3.14097'. [ 1669.363383][T21119] netlink: 4 bytes leftover after parsing attributes in process `syz.3.14097'. [ 1669.414034][T21119] netlink: 336 bytes leftover after parsing attributes in process `syz.3.14097'. [ 1669.442133][T21119] netlink: 4 bytes leftover after parsing attributes in process `syz.3.14097'. [ 1669.628170][T21130] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 1669.869969][T21142] openvswitch: netlink: Message has 572 unknown bytes. [ 1669.881852][T21142] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1670.006458][T21136] lo: Caught tx_queue_len zero misconfig [ 1670.382405][T21154] netlink: 'syz.2.14108': attribute type 3 has an invalid length. [ 1670.410941][T21154] netlink: 'syz.2.14108': attribute type 1 has an invalid length. [ 1670.423347][T21152] __nla_validate_parse: 2 callbacks suppressed [ 1670.423368][T21152] netlink: 6 bytes leftover after parsing attributes in process `syz.3.14106'. [ 1670.439560][T21152] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1670.455227][T21154] netlink: 60387 bytes leftover after parsing attributes in process `syz.2.14108'. [ 1670.663860][T21169] netlink: 8 bytes leftover after parsing attributes in process `syz.2.14108'. [ 1670.682477][T21169] netlink: 8 bytes leftover after parsing attributes in process `syz.2.14108'. [ 1671.448326][T21175] netlink: 20 bytes leftover after parsing attributes in process `syz.3.14113'. [ 1671.458931][T21175] netlink: 12 bytes leftover after parsing attributes in process `syz.3.14113'. [ 1671.470726][T21175] netlink: 48 bytes leftover after parsing attributes in process `syz.3.14113'. [ 1671.480087][T21175] netlink: 'syz.3.14113': attribute type 1 has an invalid length. [ 1671.488181][T21175] netlink: 20 bytes leftover after parsing attributes in process `syz.3.14113'. [ 1671.511226][T21179] lo speed is unknown, defaulting to 1000 [ 1671.521935][T21179] lo speed is unknown, defaulting to 1000 [ 1671.821962][T21193] FAULT_INJECTION: forcing a failure. [ 1671.821962][T21193] name failslab, interval 1, probability 0, space 0, times 0 [ 1671.858146][T21193] CPU: 1 UID: 0 PID: 21193 Comm: syz.3.14119 Not tainted syzkaller #0 PREEMPT(full) [ 1671.858197][T21193] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1671.858221][T21193] Call Trace: [ 1671.858230][T21193] [ 1671.858239][T21193] dump_stack_lvl+0xe8/0x150 [ 1671.858268][T21193] should_fail_ex+0x414/0x560 [ 1671.858301][T21193] should_failslab+0xa8/0x100 [ 1671.858326][T21193] kmem_cache_alloc_noprof+0x88/0x710 [ 1671.858353][T21193] ? security_file_alloc+0x34/0x330 [ 1671.858378][T21193] security_file_alloc+0x34/0x330 [ 1671.858399][T21193] init_file+0x93/0x2f0 [ 1671.858425][T21193] alloc_empty_file+0x6e/0x1d0 [ 1671.858449][T21193] alloc_file_pseudo+0x13d/0x210 [ 1671.858475][T21193] ? __pfx_alloc_file_pseudo+0x10/0x10 [ 1671.858512][T21193] anon_inode_getfile+0xc5/0x1a0 [ 1671.858542][T21193] bpf_link_prime+0xfc/0x220 [ 1671.858567][T21193] bpf_raw_tp_link_attach+0x49a/0x6c0 [ 1671.858593][T21193] ? __pfx_bpf_raw_tp_link_attach+0x10/0x10 [ 1671.858624][T21193] ? __fget_files+0x2a/0x420 [ 1671.858655][T21193] bpf_raw_tracepoint_open+0x1b2/0x220 [ 1671.858683][T21193] __sys_bpf+0x73e/0x860 [ 1671.858710][T21193] ? __pfx___sys_bpf+0x10/0x10 [ 1671.858749][T21193] ? ksys_write+0x22a/0x250 [ 1671.858770][T21193] ? __pfx_ksys_write+0x10/0x10 [ 1671.858794][T21193] __x64_sys_bpf+0x7c/0x90 [ 1671.858816][T21193] do_syscall_64+0xec/0xf80 [ 1671.858837][T21193] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1671.858853][T21193] ? trace_irq_disable+0x37/0x100 [ 1671.858874][T21193] ? clear_bhb_loop+0x60/0xb0 [ 1671.858896][T21193] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1671.858922][T21193] RIP: 0033:0x7ff46618f749 [ 1671.858939][T21193] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1671.858955][T21193] RSP: 002b:00007ff466f8b038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1671.858975][T21193] RAX: ffffffffffffffda RBX: 00007ff4663e5fa0 RCX: 00007ff46618f749 [ 1671.858989][T21193] RDX: 0000000000000010 RSI: 0000200000000480 RDI: 0000000000000011 [ 1671.859001][T21193] RBP: 00007ff466f8b090 R08: 0000000000000000 R09: 0000000000000000 [ 1671.859013][T21193] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1671.859024][T21193] R13: 00007ff4663e6038 R14: 00007ff4663e5fa0 R15: 00007ffcc17b4028 [ 1671.859063][T21193] [ 1671.905440][T21197] netlink: 8 bytes leftover after parsing attributes in process `syz.2.14121'. [ 1672.227052][T21205] netlink: 16 bytes leftover after parsing attributes in process `syz.3.14124'. [ 1672.625120][T21218] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1672.658471][T21220] FAULT_INJECTION: forcing a failure. [ 1672.658471][T21220] name failslab, interval 1, probability 0, space 0, times 0 [ 1672.758291][T21220] CPU: 1 UID: 0 PID: 21220 Comm: syz.2.14128 Not tainted syzkaller #0 PREEMPT(full) [ 1672.758318][T21220] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1672.758329][T21220] Call Trace: [ 1672.758338][T21220] [ 1672.758347][T21220] dump_stack_lvl+0xe8/0x150 [ 1672.758375][T21220] should_fail_ex+0x414/0x560 [ 1672.758407][T21220] should_failslab+0xa8/0x100 [ 1672.758430][T21220] kmem_cache_alloc_node_noprof+0x8c/0x720 [ 1672.758455][T21220] ? __alloc_skb+0x190/0x720 [ 1672.758474][T21220] ? __alloc_skb+0x1d5/0x720 [ 1672.758491][T21220] ? __local_bh_enable_ip+0xd0/0x130 [ 1672.758513][T21220] ? __alloc_skb+0x190/0x720 [ 1672.758533][T21220] __alloc_skb+0x1d5/0x720 [ 1672.758557][T21220] netlink_ack+0x146/0xa50 [ 1672.758578][T21220] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1672.758609][T21220] netlink_rcv_skb+0x28c/0x470 [ 1672.758631][T21220] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1672.758652][T21220] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1672.758694][T21220] ? netlink_deliver_tap+0x2e/0x1b0 [ 1672.758726][T21220] netlink_unicast+0x82f/0x9e0 [ 1672.758756][T21220] ? __pfx_netlink_unicast+0x10/0x10 [ 1672.758779][T21220] ? netlink_sendmsg+0x642/0xb30 [ 1672.758800][T21220] ? skb_put+0x11b/0x210 [ 1672.758823][T21220] netlink_sendmsg+0x805/0xb30 [ 1672.758856][T21220] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1672.758883][T21220] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1672.758907][T21220] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1672.758924][T21220] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1672.758947][T21220] __sock_sendmsg+0x21c/0x270 [ 1672.758985][T21220] ____sys_sendmsg+0x52d/0x820 [ 1672.759012][T21220] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1672.759043][T21220] ? import_iovec+0x74/0xa0 [ 1672.759068][T21220] ___sys_sendmsg+0x21f/0x2a0 [ 1672.759092][T21220] ? __pfx____sys_sendmsg+0x10/0x10 [ 1672.759111][T21220] ? __lock_acquire+0x6b6/0x2cf0 [ 1672.759134][T21220] ? kstrtouint+0x6e/0xe0 [ 1672.759200][T21220] __sys_sendmmsg+0x227/0x430 [ 1672.759227][T21220] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1672.759246][T21220] ? __mutex_unlock_slowpath+0x1a1/0x730 [ 1672.759294][T21220] ? ksys_write+0x22a/0x250 [ 1672.759314][T21220] ? __pfx_ksys_write+0x10/0x10 [ 1672.759338][T21220] __x64_sys_sendmmsg+0xa0/0xc0 [ 1672.759362][T21220] do_syscall_64+0xec/0xf80 [ 1672.759382][T21220] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1672.759398][T21220] ? trace_irq_disable+0x37/0x100 [ 1672.759419][T21220] ? clear_bhb_loop+0x60/0xb0 [ 1672.759441][T21220] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1672.759458][T21220] RIP: 0033:0x7f705f18f749 [ 1672.759475][T21220] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1672.759490][T21220] RSP: 002b:00007f705ffce038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1672.759510][T21220] RAX: ffffffffffffffda RBX: 00007f705f3e5fa0 RCX: 00007f705f18f749 [ 1672.759524][T21220] RDX: 04000000000001f2 RSI: 0000200000000000 RDI: 0000000000000005 [ 1672.759537][T21220] RBP: 00007f705ffce090 R08: 0000000000000000 R09: 0000000000000000 [ 1672.759549][T21220] R10: 000000000000fff0 R11: 0000000000000246 R12: 0000000000000001 [ 1672.759560][T21220] R13: 00007f705f3e6038 R14: 00007f705f3e5fa0 R15: 00007ffea6e68d58 [ 1672.759592][T21220] [ 1673.508508][T21226] lo speed is unknown, defaulting to 1000 [ 1673.587001][T21226] lo speed is unknown, defaulting to 1000 [ 1673.645474][T21231] FAULT_INJECTION: forcing a failure. [ 1673.645474][T21231] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1673.742657][T21231] CPU: 1 UID: 0 PID: 21231 Comm: syz.4.14133 Not tainted syzkaller #0 PREEMPT(full) [ 1673.742684][T21231] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1673.742695][T21231] Call Trace: [ 1673.742703][T21231] [ 1673.742711][T21231] dump_stack_lvl+0xe8/0x150 [ 1673.742739][T21231] should_fail_ex+0x414/0x560 [ 1673.742770][T21231] _copy_from_user+0x2d/0xb0 [ 1673.742793][T21231] ___sys_sendmsg+0x158/0x2a0 [ 1673.742818][T21231] ? __pfx____sys_sendmsg+0x10/0x10 [ 1673.742874][T21231] ? __fget_files+0x2a/0x420 [ 1673.742894][T21231] ? __fget_files+0x3a0/0x420 [ 1673.742929][T21231] __x64_sys_sendmsg+0x19b/0x260 [ 1673.742962][T21231] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1673.742992][T21231] ? __pfx_ksys_write+0x10/0x10 [ 1673.743022][T21231] do_syscall_64+0xec/0xf80 [ 1673.743043][T21231] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1673.743060][T21231] ? trace_irq_disable+0x37/0x100 [ 1673.743081][T21231] ? clear_bhb_loop+0x60/0xb0 [ 1673.743103][T21231] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1673.743121][T21231] RIP: 0033:0x7f5a6438f749 [ 1673.743137][T21231] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1673.743153][T21231] RSP: 002b:00007f5a652f5038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1673.743173][T21231] RAX: ffffffffffffffda RBX: 00007f5a645e5fa0 RCX: 00007f5a6438f749 [ 1673.743187][T21231] RDX: 0000000000000080 RSI: 00002000000002c0 RDI: 0000000000000003 [ 1673.743199][T21231] RBP: 00007f5a652f5090 R08: 0000000000000000 R09: 0000000000000000 [ 1673.743211][T21231] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1673.743222][T21231] R13: 00007f5a645e6038 R14: 00007f5a645e5fa0 R15: 00007ffe29489ec8 [ 1673.743253][T21231] [ 1674.668740][T21251] FAULT_INJECTION: forcing a failure. [ 1674.668740][T21251] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1674.727995][T21251] CPU: 0 UID: 0 PID: 21251 Comm: syz.4.14136 Not tainted syzkaller #0 PREEMPT(full) [ 1674.728022][T21251] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1674.728034][T21251] Call Trace: [ 1674.728042][T21251] [ 1674.728051][T21251] dump_stack_lvl+0xe8/0x150 [ 1674.728082][T21251] should_fail_ex+0x414/0x560 [ 1674.728114][T21251] _copy_from_iter+0x1cd/0x1630 [ 1674.728136][T21251] ? rcu_is_watching+0x15/0xb0 [ 1674.728158][T21251] ? trace_kmem_cache_alloc+0x1f/0xb0 [ 1674.728181][T21251] ? kmem_cache_alloc_node_noprof+0x48c/0x720 [ 1674.728207][T21251] ? kmalloc_reserve+0xbd/0x290 [ 1674.728230][T21251] ? __pfx__copy_from_iter+0x10/0x10 [ 1674.728257][T21251] ? netlink_sendmsg+0x642/0xb30 [ 1674.728279][T21251] ? skb_put+0x11b/0x210 [ 1674.728302][T21251] netlink_sendmsg+0x6b2/0xb30 [ 1674.728334][T21251] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1674.728361][T21251] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1674.728384][T21251] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1674.728402][T21251] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1674.728426][T21251] __sock_sendmsg+0x21c/0x270 [ 1674.728454][T21251] ____sys_sendmsg+0x52d/0x820 [ 1674.728481][T21251] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1674.728511][T21251] ? import_iovec+0x74/0xa0 [ 1674.728541][T21251] ___sys_sendmsg+0x21f/0x2a0 [ 1674.728566][T21251] ? __pfx____sys_sendmsg+0x10/0x10 [ 1674.728585][T21251] ? __lock_acquire+0x6b6/0x2cf0 [ 1674.728609][T21251] ? kstrtouint+0x6e/0xe0 [ 1674.728671][T21251] __sys_sendmmsg+0x227/0x430 [ 1674.728699][T21251] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1674.728718][T21251] ? __mutex_unlock_slowpath+0x1a1/0x730 [ 1674.728764][T21251] ? ksys_write+0x22a/0x250 [ 1674.728784][T21251] ? __pfx_ksys_write+0x10/0x10 [ 1674.728808][T21251] __x64_sys_sendmmsg+0xa0/0xc0 [ 1674.728832][T21251] do_syscall_64+0xec/0xf80 [ 1674.728853][T21251] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1674.728870][T21251] ? trace_irq_disable+0x37/0x100 [ 1674.728891][T21251] ? clear_bhb_loop+0x60/0xb0 [ 1674.728912][T21251] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1674.728930][T21251] RIP: 0033:0x7f5a6438f749 [ 1674.728947][T21251] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1674.728964][T21251] RSP: 002b:00007f5a652f5038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1674.728984][T21251] RAX: ffffffffffffffda RBX: 00007f5a645e5fa0 RCX: 00007f5a6438f749 [ 1674.728998][T21251] RDX: 04000000000001f2 RSI: 0000200000000000 RDI: 0000000000000003 [ 1674.729012][T21251] RBP: 00007f5a652f5090 R08: 0000000000000000 R09: 0000000000000000 [ 1674.729024][T21251] R10: 000000000000fff0 R11: 0000000000000246 R12: 0000000000000001 [ 1674.729036][T21251] R13: 00007f5a645e6038 R14: 00007f5a645e5fa0 R15: 00007ffe29489ec8 [ 1674.729065][T21251] [ 1675.448201][T21257] lo speed is unknown, defaulting to 1000 [ 1675.478985][T21257] lo speed is unknown, defaulting to 1000 [ 1675.500352][T21268] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 1675.895134][T21282] __nla_validate_parse: 4 callbacks suppressed [ 1675.895154][T21282] netlink: 16 bytes leftover after parsing attributes in process `syz.2.14146'. [ 1676.395710][T21303] netlink: 'syz.1.14150': attribute type 4 has an invalid length. [ 1676.425825][T21297] lo speed is unknown, defaulting to 1000 [ 1676.477085][T21297] lo speed is unknown, defaulting to 1000 [ 1676.517054][T21308] netlink: 4 bytes leftover after parsing attributes in process `syz.0.14152'. [ 1676.629110][T21311] netlink: 16 bytes leftover after parsing attributes in process `syz.2.14153'. [ 1677.286853][T21327] lo speed is unknown, defaulting to 1000 [ 1677.477689][T21339] bridge2: entered promiscuous mode [ 1677.547836][T21337] netlink: 6 bytes leftover after parsing attributes in process `syz.2.14161'. [ 1677.564475][T21336] netlink: 'syz.0.14162': attribute type 9 has an invalid length. [ 1677.585131][T21336] netlink: 'syz.0.14162': attribute type 11 has an invalid length. [ 1677.594714][T21337] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1677.610279][T21336] netlink: 'syz.0.14162': attribute type 12 has an invalid length. [ 1677.622237][T21336] netlink: 210020 bytes leftover after parsing attributes in process `syz.0.14162'. [ 1677.648662][T21327] lo speed is unknown, defaulting to 1000 [ 1677.663415][T21339] netlink: 64 bytes leftover after parsing attributes in process `syz.0.14162'. [ 1677.674760][T21336] netlink: 4 bytes leftover after parsing attributes in process `syz.0.14162'. [ 1677.919987][T21348] netlink: 8 bytes leftover after parsing attributes in process `syz.2.14164'. [ 1677.929333][T21348] netlink: 28 bytes leftover after parsing attributes in process `syz.2.14164'. [ 1677.962687][T21348] geneve3: entered promiscuous mode [ 1677.968309][T21348] geneve3: entered allmulticast mode [ 1678.014296][ T2970] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1678.057963][ T2970] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1678.123248][ T2970] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1678.132014][ T2970] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1678.475050][T21349] vlan2: entered allmulticast mode [ 1678.620882][T21361] netlink: 6 bytes leftover after parsing attributes in process `syz.1.14168'. [ 1678.643240][T21361] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1679.171098][T21381] xt_nfacct: accounting object `syz0' does not exist [ 1680.254669][T21440] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1680.611950][T21463] Bluetooth: MGMT ver 1.23 [ 1680.996491][T21483] __nla_validate_parse: 8 callbacks suppressed [ 1680.996510][T21483] netlink: 8 bytes leftover after parsing attributes in process `syz.2.14209'. [ 1681.032974][T21483] netlink: 28 bytes leftover after parsing attributes in process `syz.2.14209'. [ 1681.149675][T21487] vlan2: entered allmulticast mode [ 1681.394855][T21490] FAULT_INJECTION: forcing a failure. [ 1681.394855][T21490] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1681.462584][T21490] CPU: 0 UID: 0 PID: 21490 Comm: syz.0.14211 Not tainted syzkaller #0 PREEMPT(full) [ 1681.462607][T21490] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1681.462617][T21490] Call Trace: [ 1681.462624][T21490] [ 1681.462631][T21490] dump_stack_lvl+0xe8/0x150 [ 1681.462656][T21490] should_fail_ex+0x414/0x560 [ 1681.462684][T21490] _copy_from_user+0x2d/0xb0 [ 1681.462704][T21490] wext_handle_ioctl+0xba/0x1c0 [ 1681.462728][T21490] ? __pfx_wext_handle_ioctl+0x10/0x10 [ 1681.462743][T21490] ? __mutex_unlock_slowpath+0x1a1/0x730 [ 1681.462776][T21490] sock_ioctl+0x15f/0x790 [ 1681.462800][T21490] ? __pfx_sock_ioctl+0x10/0x10 [ 1681.462820][T21490] ? __fget_files+0x2a/0x420 [ 1681.462848][T21490] ? __fget_files+0x3a0/0x420 [ 1681.462864][T21490] ? __fget_files+0x2a/0x420 [ 1681.462885][T21490] ? bpf_lsm_file_ioctl+0x9/0x20 [ 1681.462902][T21490] ? __pfx_sock_ioctl+0x10/0x10 [ 1681.462921][T21490] __se_sys_ioctl+0xfc/0x170 [ 1681.462946][T21490] do_syscall_64+0xec/0xf80 [ 1681.462964][T21490] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1681.462978][T21490] ? trace_irq_disable+0x37/0x100 [ 1681.462996][T21490] ? clear_bhb_loop+0x60/0xb0 [ 1681.463014][T21490] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1681.463029][T21490] RIP: 0033:0x7fc40c18f749 [ 1681.463043][T21490] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1681.463056][T21490] RSP: 002b:00007fc40cfa1038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1681.463074][T21490] RAX: ffffffffffffffda RBX: 00007fc40c3e5fa0 RCX: 00007fc40c18f749 [ 1681.463085][T21490] RDX: 0000200000000080 RSI: 0000000000008b19 RDI: 0000000000000003 [ 1681.463096][T21490] RBP: 00007fc40cfa1090 R08: 0000000000000000 R09: 0000000000000000 [ 1681.463105][T21490] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1681.463115][T21490] R13: 00007fc40c3e6038 R14: 00007fc40c3e5fa0 R15: 00007fff8ebb6418 [ 1681.463142][T21490] [ 1682.052860][T21494] netlink: 'syz.3.14213': attribute type 33 has an invalid length. [ 1682.086506][T21494] netlink: 152 bytes leftover after parsing attributes in process `syz.3.14213'. [ 1682.097040][T21501] netlink: 20 bytes leftover after parsing attributes in process `syz.2.14215'. [ 1682.133571][T21494] `: renamed from team0 [ 1682.323851][T21502] lo speed is unknown, defaulting to 1000 [ 1682.331464][T21502] lo speed is unknown, defaulting to 1000 [ 1682.445675][T21512] lo speed is unknown, defaulting to 1000 [ 1682.709049][T21512] lo speed is unknown, defaulting to 1000 [ 1683.481135][T21526] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 1683.500065][T21527] netlink: 6 bytes leftover after parsing attributes in process `syz.3.14223'. [ 1683.510111][T21527] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1683.797210][T21550] netlink: 32 bytes leftover after parsing attributes in process `syz.1.14227'. [ 1683.862841][T21552] netlink: 64 bytes leftover after parsing attributes in process `syz.0.14229'. [ 1684.013723][T21560] netlink: 'syz.2.14231': attribute type 39 has an invalid length. [ 1684.056368][T21562] team_slave_0: entered promiscuous mode [ 1684.337020][T21581] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1684.595214][T21579] lo speed is unknown, defaulting to 1000 [ 1684.607971][T21579] lo speed is unknown, defaulting to 1000 [ 1684.610109][T21587] netlink: 12 bytes leftover after parsing attributes in process `syz.3.14236'. [ 1684.686619][T21584] lo speed is unknown, defaulting to 1000 [ 1684.746403][T21593] netlink: 6 bytes leftover after parsing attributes in process `syz.1.14237'. [ 1684.793691][T21593] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1685.026126][T21599] netlink: 68 bytes leftover after parsing attributes in process `syz.0.14241'. [ 1685.095018][T21584] lo speed is unknown, defaulting to 1000 [ 1685.329191][T21607] netlink: 'syz.0.14244': attribute type 39 has an invalid length. [ 1685.469177][T21613] FAULT_INJECTION: forcing a failure. [ 1685.469177][T21613] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1685.484057][T21613] CPU: 1 UID: 0 PID: 21613 Comm: syz.0.14246 Not tainted syzkaller #0 PREEMPT(full) [ 1685.484077][T21613] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1685.484086][T21613] Call Trace: [ 1685.484094][T21613] [ 1685.484102][T21613] dump_stack_lvl+0xe8/0x150 [ 1685.484129][T21613] should_fail_ex+0x414/0x560 [ 1685.484160][T21613] _copy_from_user+0x2d/0xb0 [ 1685.484182][T21613] kstrtouint_from_user+0xc4/0x170 [ 1685.484203][T21613] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 1685.484237][T21613] proc_fail_nth_write+0x88/0x200 [ 1685.484256][T21613] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 1685.484280][T21613] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 1685.484298][T21613] vfs_write+0x27e/0xb30 [ 1685.484324][T21613] ? __pfx_vfs_write+0x10/0x10 [ 1685.484344][T21613] ? __fget_files+0x2a/0x420 [ 1685.484367][T21613] ? __fget_files+0x3a0/0x420 [ 1685.484384][T21613] ? __fget_files+0x2a/0x420 [ 1685.484413][T21613] ksys_write+0x145/0x250 [ 1685.484434][T21613] ? __pfx_ksys_write+0x10/0x10 [ 1685.484462][T21613] do_syscall_64+0xec/0xf80 [ 1685.484481][T21613] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1685.484498][T21613] ? trace_irq_disable+0x37/0x100 [ 1685.484519][T21613] ? clear_bhb_loop+0x60/0xb0 [ 1685.484541][T21613] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1685.484556][T21613] RIP: 0033:0x7fc40c18e1ff [ 1685.484573][T21613] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48 [ 1685.484587][T21613] RSP: 002b:00007fc40cfa1030 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 1685.484605][T21613] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fc40c18e1ff [ 1685.484625][T21613] RDX: 0000000000000001 RSI: 00007fc40cfa10a0 RDI: 0000000000000004 [ 1685.484636][T21613] RBP: 00007fc40cfa1090 R08: 0000000000000000 R09: 0000000000000000 [ 1685.484647][T21613] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000001 [ 1685.484657][T21613] R13: 00007fc40c3e6038 R14: 00007fc40c3e5fa0 R15: 00007fff8ebb6418 [ 1685.484687][T21613] [ 1686.067951][T21622] lo speed is unknown, defaulting to 1000 [ 1686.079638][T21622] lo speed is unknown, defaulting to 1000 [ 1686.152793][T21632] tipc: Started in network mode [ 1686.157800][T21632] tipc: Node identity , cluster identity 4711 [ 1686.164556][T21632] tipc: Failed to obtain node identity [ 1686.170156][T21632] tipc: Enabling of bearer rejected, failed to enable media [ 1686.310991][T21636] netlink: 'syz.1.14253': attribute type 12 has an invalid length. [ 1686.962049][T21645] lo speed is unknown, defaulting to 1000 [ 1687.076407][T21645] lo speed is unknown, defaulting to 1000 [ 1687.154939][T21651] netlink: 'syz.2.14256': attribute type 39 has an invalid length. [ 1687.325813][T21663] netlink: 'syz.2.14261': attribute type 12 has an invalid length. [ 1687.716190][T21670] pim6reg: entered allmulticast mode [ 1687.735998][T21670] pim6reg: left allmulticast mode [ 1687.873640][T21679] __nla_validate_parse: 1 callbacks suppressed [ 1687.875908][T21679] netlink: 64 bytes leftover after parsing attributes in process `syz.3.14266'. [ 1687.915372][T32480] netdevsim netdevsim1 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1687.964359][T32480] netdevsim netdevsim1 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1687.975836][T21682] tipc: Started in network mode [ 1687.980927][T21682] tipc: Node identity , cluster identity 4711 [ 1687.992147][T21682] tipc: Failed to obtain node identity [ 1688.009235][T21682] tipc: Enabling of bearer rejected, failed to enable media [ 1688.017853][T32480] netdevsim netdevsim1 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1688.036907][T32480] netdevsim netdevsim1 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1688.196097][T21689] netlink: 'syz.0.14267': attribute type 12 has an invalid length. [ 1688.491966][T21685] lo speed is unknown, defaulting to 1000 [ 1688.499328][T21685] lo speed is unknown, defaulting to 1000 [ 1689.079531][T21719] lo speed is unknown, defaulting to 1000 [ 1689.137831][T21719] lo speed is unknown, defaulting to 1000 [ 1689.153745][T21721] netlink: 28 bytes leftover after parsing attributes in process `syz.2.14276'. [ 1689.237696][T21728] netlink: 16 bytes leftover after parsing attributes in process `syz.2.14276'. [ 1689.300253][T21732] netlink: 80 bytes leftover after parsing attributes in process `syz.2.14276'. [ 1689.350307][T21734] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci3/hci3:200/input14 [ 1689.359271][T21731] lo speed is unknown, defaulting to 1000 [ 1689.363966][T21735] netlink: 'syz.0.14279': attribute type 12 has an invalid length. [ 1689.390299][T21734] netlink: 8 bytes leftover after parsing attributes in process `syz.3.14280'. [ 1689.432131][T21731] lo speed is unknown, defaulting to 1000 [ 1689.862592][T21750] tipc: Enabling of bearer rejected, already enabled [ 1690.095276][T21761] netlink: 'syz.3.14283': attribute type 12 has an invalid length. [ 1690.477330][T21771] netlink: 'syz.1.14289': attribute type 5 has an invalid length. [ 1690.487175][T21771] netlink: 4 bytes leftover after parsing attributes in process `syz.1.14289'. [ 1690.496933][T21773] netlink: 64 bytes leftover after parsing attributes in process `syz.0.14288'. [ 1691.021889][T21790] netlink: 'syz.3.14296': attribute type 12 has an invalid length. [ 1691.056975][T32533] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 1691.067206][T32533] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 1691.076888][T32533] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 1691.085720][T32533] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 1691.094867][T32533] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 1691.339289][T21793] lo speed is unknown, defaulting to 1000 [ 1691.355158][T21793] lo speed is unknown, defaulting to 1000 [ 1691.401487][T21798] netlink: 'syz.4.14297': attribute type 5 has an invalid length. [ 1691.403867][T21800] FAULT_INJECTION: forcing a failure. [ 1691.403867][T21800] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1691.436501][T21798] netlink: 4 bytes leftover after parsing attributes in process `syz.4.14297'. [ 1691.475039][T21800] CPU: 1 UID: 0 PID: 21800 Comm: syz.2.14298 Not tainted syzkaller #0 PREEMPT(full) [ 1691.475066][T21800] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1691.475077][T21800] Call Trace: [ 1691.475086][T21800] [ 1691.475094][T21800] dump_stack_lvl+0xe8/0x150 [ 1691.475130][T21800] should_fail_ex+0x414/0x560 [ 1691.475160][T21800] _copy_to_user+0x31/0xb0 [ 1691.475182][T21800] simple_read_from_buffer+0xe1/0x170 [ 1691.475203][T21800] proc_fail_nth_read+0x1b3/0x220 [ 1691.475220][T21800] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1691.475237][T21800] ? rw_verify_area+0x2a6/0x4d0 [ 1691.475256][T21800] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1691.475271][T21800] vfs_read+0x200/0xa30 [ 1691.475283][T21800] ? fdget_pos+0x247/0x320 [ 1691.475303][T21800] ? __pfx___mutex_lock+0x10/0x10 [ 1691.475322][T21800] ? __pfx_vfs_read+0x10/0x10 [ 1691.475337][T21800] ? __fget_files+0x2a/0x420 [ 1691.475358][T21800] ? __fget_files+0x3a0/0x420 [ 1691.475373][T21800] ? __fget_files+0x2a/0x420 [ 1691.475398][T21800] ksys_read+0x145/0x250 [ 1691.475416][T21800] ? __pfx_ksys_read+0x10/0x10 [ 1691.475443][T21800] do_syscall_64+0xec/0xf80 [ 1691.475460][T21800] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1691.475475][T21800] ? trace_irq_disable+0x37/0x100 [ 1691.475495][T21800] ? clear_bhb_loop+0x60/0xb0 [ 1691.475516][T21800] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1691.475533][T21800] RIP: 0033:0x7f705f18e15c [ 1691.475550][T21800] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 1691.475565][T21800] RSP: 002b:00007f705ffce030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1691.475584][T21800] RAX: ffffffffffffffda RBX: 00007f705f3e5fa0 RCX: 00007f705f18e15c [ 1691.475597][T21800] RDX: 000000000000000f RSI: 00007f705ffce0a0 RDI: 0000000000000004 [ 1691.475607][T21800] RBP: 00007f705ffce090 R08: 0000000000000000 R09: 0000000000000000 [ 1691.475618][T21800] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1691.475628][T21800] R13: 00007f705f3e6038 R14: 00007f705f3e5fa0 R15: 00007ffea6e68d58 [ 1691.475653][T21800] [ 1691.839691][T21806] netlink: 'syz.2.14300': attribute type 5 has an invalid length. [ 1691.847820][T21806] netlink: 4 bytes leftover after parsing attributes in process `syz.2.14300'. [ 1692.085410][T21816] netlink: 4 bytes leftover after parsing attributes in process `syz.3.14304'. [ 1692.121428][T21815] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1692.191117][T21818] tipc: Started in network mode [ 1692.197298][T21818] tipc: Node identity , cluster identity 4711 [ 1692.205643][T21818] tipc: Failed to obtain node identity [ 1692.222585][T21818] tipc: Enabling of bearer rejected, failed to enable media [ 1692.275446][T21821] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 1692.320081][T21818] netlink: 'syz.0.14305': attribute type 12 has an invalid length. [ 1692.521660][T17066] netdevsim netdevsim1 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1692.628776][ T12] netdevsim netdevsim1 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1692.697518][ T12] netdevsim netdevsim1 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1692.720601][T21840] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 1692.837880][ T7422] netdevsim netdevsim1 eth4: set [0, 0] type 1 family 0 port 8472 - 0 [ 1692.849860][T32480] macsec0: left allmulticast mode [ 1692.856318][T32480] macsec0: left promiscuous mode [ 1692.863935][T32480] bridge0: port 3(macsec0) entered disabled state [ 1692.897345][T21850] netlink: 'syz.3.14312': attribute type 5 has an invalid length. [ 1692.925876][T21850] __nla_validate_parse: 1 callbacks suppressed [ 1692.925896][T21850] netlink: 4 bytes leftover after parsing attributes in process `syz.3.14312'. [ 1693.193014][T32533] Bluetooth: hci0: command tx timeout [ 1693.594378][T32480] bond0 (unregistering): Released all slaves [ 1693.646865][T21863] netlink: 64 bytes leftover after parsing attributes in process `syz.2.14314'. [ 1693.771232][T32480] bond1 (unregistering): Released all slaves [ 1693.953974][T32480] bond2 (unregistering): Released all slaves [ 1694.124635][T32480] bond3 (unregistering): Released all slaves [ 1694.289707][T32480] bond4 (unregistering): Released all slaves [ 1694.456393][T32480] bond5 (unregistering): Released all slaves [ 1694.662232][T21793] chnl_net:caif_netlink_parms(): no params data found [ 1694.960616][T21881] Bluetooth: MGMT ver 1.23 [ 1695.252861][T32533] Bluetooth: hci0: command tx timeout [ 1695.260918][T21892] netlink: 16 bytes leftover after parsing attributes in process `syz.4.14321'. [ 1695.350204][T21793] bridge0: port 1(bridge_slave_0) entered blocking state [ 1695.361520][T21793] bridge0: port 1(bridge_slave_0) entered disabled state [ 1695.403343][T21793] bridge_slave_0: entered allmulticast mode [ 1695.448615][T21793] bridge_slave_0: entered promiscuous mode [ 1695.494301][T21793] bridge0: port 2(bridge_slave_1) entered blocking state [ 1695.521331][T21793] bridge0: port 2(bridge_slave_1) entered disabled state [ 1695.546524][T21793] bridge_slave_1: entered allmulticast mode [ 1695.560166][T21910] netlink: 'syz.3.14324': attribute type 5 has an invalid length. [ 1695.574023][T21910] netlink: 4 bytes leftover after parsing attributes in process `syz.3.14324'. [ 1695.587617][T21793] bridge_slave_1: entered promiscuous mode [ 1695.637920][T32480] hsr_slave_0: left promiscuous mode [ 1695.646378][T32480] hsr_slave_1: left promiscuous mode [ 1695.768227][T21919] netlink: 64 bytes leftover after parsing attributes in process `syz.0.14327'. [ 1696.822066][T21793] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1696.878899][T21793] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1696.955616][T21932] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1697.000220][T21935] FAULT_INJECTION: forcing a failure. [ 1697.000220][T21935] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1697.013676][T21935] CPU: 1 UID: 0 PID: 21935 Comm: syz.4.14331 Not tainted syzkaller #0 PREEMPT(full) [ 1697.013701][T21935] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1697.013712][T21935] Call Trace: [ 1697.013720][T21935] [ 1697.013728][T21935] dump_stack_lvl+0xe8/0x150 [ 1697.013754][T21935] should_fail_ex+0x414/0x560 [ 1697.013784][T21935] _copy_to_user+0x31/0xb0 [ 1697.013807][T21935] generic_map_lookup_batch+0x8ee/0xce0 [ 1697.013842][T21935] ? __pfx_generic_map_lookup_batch+0x10/0x10 [ 1697.013868][T21935] ? __pfx_generic_map_lookup_batch+0x10/0x10 [ 1697.013888][T21935] bpf_map_do_batch+0x285/0x630 [ 1697.013911][T21935] ? security_bpf+0x7e/0x300 [ 1697.013930][T21935] __sys_bpf+0x537/0x860 [ 1697.013949][T21935] ? __pfx___sys_bpf+0x10/0x10 [ 1697.013967][T21935] ? kmem_cache_free+0x197/0x620 [ 1697.013998][T21935] ? ksys_write+0x1e1/0x250 [ 1697.014016][T21935] ? __pfx_ksys_write+0x10/0x10 [ 1697.014036][T21935] __x64_sys_bpf+0x7c/0x90 [ 1697.014054][T21935] do_syscall_64+0xec/0xf80 [ 1697.014071][T21935] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1697.014084][T21935] ? trace_irq_disable+0x37/0x100 [ 1697.014104][T21935] ? clear_bhb_loop+0x60/0xb0 [ 1697.014125][T21935] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1697.014142][T21935] RIP: 0033:0x7f5a6438f749 [ 1697.014159][T21935] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1697.014175][T21935] RSP: 002b:00007f5a652f5038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1697.014195][T21935] RAX: ffffffffffffffda RBX: 00007f5a645e5fa0 RCX: 00007f5a6438f749 [ 1697.014210][T21935] RDX: 0000000000000038 RSI: 00002000000001c0 RDI: 0000000000000018 [ 1697.014221][T21935] RBP: 00007f5a652f5090 R08: 0000000000000000 R09: 0000000000000000 [ 1697.014232][T21935] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1697.014243][T21935] R13: 00007f5a645e6038 R14: 00007f5a645e5fa0 R15: 00007ffe29489ec8 [ 1697.014273][T21935] [ 1697.015626][T21935] netlink: 28 bytes leftover after parsing attributes in process `syz.4.14331'. [ 1697.180927][T21941] netlink: 132 bytes leftover after parsing attributes in process `syz.0.14333'. [ 1697.312954][T21944] openvswitch: netlink: IP tunnel attribute has 4 unknown bytes. [ 1697.320751][T21944] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1697.337182][T32533] Bluetooth: hci0: command tx timeout [ 1697.470708][T21793] team0: Port device team_slave_0 added [ 1697.484027][T21955] netlink: 28 bytes leftover after parsing attributes in process `syz.4.14336'. [ 1697.496037][T21793] team0: Port device team_slave_1 added [ 1697.659270][T21961] netlink: 'syz.4.14338': attribute type 5 has an invalid length. [ 1697.668281][T21961] netlink: 4 bytes leftover after parsing attributes in process `syz.4.14338'. [ 1697.669927][T21793] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1697.687989][T21793] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1697.715472][T21793] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1697.727441][T21958] syzkaller0: entered promiscuous mode [ 1697.735833][T21958] syzkaller0: entered allmulticast mode [ 1697.747336][T21793] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1697.754946][T21793] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1697.795256][T21793] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1697.867877][T21958] netlink: 24 bytes leftover after parsing attributes in process `syz.0.14337'. [ 1697.886638][T21972] netlink: 'syz.4.14340': attribute type 39 has an invalid length. [ 1697.929029][T21971] netlink: 24 bytes leftover after parsing attributes in process `syz.0.14337'. [ 1698.098936][T32480] IPVS: stop unused estimator thread 0... [ 1698.100603][T21966] lo speed is unknown, defaulting to 1000 [ 1698.113127][T21966] lo speed is unknown, defaulting to 1000 [ 1698.224524][T21978] tipc: Enabling of bearer rejected, already enabled [ 1698.346544][T21793] hsr_slave_0: entered promiscuous mode [ 1698.374131][T21793] hsr_slave_1: entered promiscuous mode [ 1698.384826][T21985] netlink: 428 bytes leftover after parsing attributes in process `syz.2.14342'. [ 1698.400284][T21793] debugfs: 'hsr0' already exists in 'hsr' [ 1698.409820][T21793] Cannot create hsr debugfs directory [ 1698.437307][T21985] netlink: 32 bytes leftover after parsing attributes in process `syz.2.14342'. [ 1698.511233][T21987] netlink: 'syz.4.14341': attribute type 12 has an invalid length. [ 1699.039451][T21996] lo speed is unknown, defaulting to 1000 [ 1699.059587][T21996] lo speed is unknown, defaulting to 1000 [ 1699.079809][T21793] netdevsim netdevsim1 eth4 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1699.178234][T21793] netdevsim netdevsim1 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1699.266003][T22000] pim6reg1: entered promiscuous mode [ 1699.283441][T22000] pim6reg1: entered allmulticast mode [ 1699.354714][T21793] netdevsim netdevsim1 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1699.412925][T32533] Bluetooth: hci0: command tx timeout [ 1699.490936][T21793] netdevsim netdevsim1 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1699.796694][T21998] delete_channel: no stack [ 1699.938884][T22020] netlink: 132 bytes leftover after parsing attributes in process `syz.4.14353'. [ 1699.983548][T22022] netlink: 'syz.3.14354': attribute type 39 has an invalid length. [ 1700.044492][T22025] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1700.317579][T21793] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 1700.340160][T21793] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 1700.389887][T21793] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 1700.468176][T22036] openvswitch: netlink: IP tunnel dst address not specified [ 1700.480803][T21793] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 1700.776786][T21793] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1700.867238][T22058] tipc: Enabled bearer , priority 0 [ 1700.885152][T21793] 8021q: adding VLAN 0 to HW filter on device team0 [ 1700.898111][T22058] tipc: Resetting bearer [ 1700.910063][ T7422] bridge0: port 1(bridge_slave_0) entered blocking state [ 1700.917401][ T7422] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1700.960120][T22057] tipc: Disabling bearer [ 1700.995452][ T73] bridge0: port 2(bridge_slave_1) entered blocking state [ 1701.002809][ T73] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1701.366161][T22071] netlink: 'syz.2.14365': attribute type 39 has an invalid length. [ 1701.750364][T21793] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1701.964422][T21793] veth0_vlan: entered promiscuous mode [ 1701.994482][T21793] veth1_vlan: entered promiscuous mode [ 1702.055698][T21793] veth0_macvtap: entered promiscuous mode [ 1702.099775][T21793] veth1_macvtap: entered promiscuous mode [ 1702.166885][T22108] netlink: 'syz.0.14373': attribute type 5 has an invalid length. [ 1702.180908][T21793] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1702.189241][T22108] netlink: 4 bytes leftover after parsing attributes in process `syz.0.14373'. [ 1702.213283][T21793] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1702.246549][ T73] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1702.257776][ T73] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1702.286111][ T73] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1702.305267][ T73] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1702.624411][ T73] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1702.632683][ T73] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1702.764437][T22116] ip6t_REJECT: TCP_RESET illegal for non-tcp [ 1702.802764][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1702.810619][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1702.886806][T22124] netlink: 'syz.3.14379': attribute type 15 has an invalid length. [ 1702.899535][T22122] netlink: 'syz.4.14378': attribute type 39 has an invalid length. [ 1702.938999][T22124] netlink: 24 bytes leftover after parsing attributes in process `syz.3.14379'. [ 1703.111747][T22134] netlink: 6 bytes leftover after parsing attributes in process `syz.1.14292'. [ 1703.161649][T22134] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1703.288069][T22146] netlink: 'syz.3.14383': attribute type 5 has an invalid length. [ 1703.296261][T22146] netlink: 4 bytes leftover after parsing attributes in process `syz.3.14383'. [ 1703.346690][T22143] lo speed is unknown, defaulting to 1000 [ 1703.446875][T22145] netlink: 6 bytes leftover after parsing attributes in process `syz.4.14384'. [ 1703.464332][T22145] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1703.485075][T22143] lo speed is unknown, defaulting to 1000 [ 1703.604046][T22152] netlink: 4 bytes leftover after parsing attributes in process `syz.1.14386'. [ 1703.682109][T18122] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 1703.703817][T18122] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 1703.715301][T18122] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 1703.739385][T18122] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 1703.747948][T18122] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 1703.774487][T22155] tipc: Resetting bearer [ 1703.871889][T22155] lo speed is unknown, defaulting to 1000 [ 1703.950451][T22155] lo speed is unknown, defaulting to 1000 [ 1704.545346][T22172] netlink: 4 bytes leftover after parsing attributes in process `syz.3.14393'. [ 1704.619935][T22175] netlink: 'syz.4.14394': attribute type 5 has an invalid length. [ 1704.668202][T22175] netlink: 4 bytes leftover after parsing attributes in process `syz.4.14394'. [ 1704.896572][T22182] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 1705.004834][T22187] netlink: 64 bytes leftover after parsing attributes in process `syz.4.14398'. [ 1705.022029][T22155] chnl_net:caif_netlink_parms(): no params data found [ 1705.131245][T22189] netlink: 'syz.3.14399': attribute type 1 has an invalid length. [ 1705.141462][T22194] netlink: 'syz.1.14400': attribute type 1 has an invalid length. [ 1705.194182][T22189] 8021q: adding VLAN 0 to HW filter on device bond8 [ 1705.237114][T22201] 8021q: adding VLAN 0 to HW filter on device bond8 [ 1705.253551][T22201] bond8: (slave vxcan1): The slave device specified does not support setting the MAC address [ 1705.267679][T22201] bond8: (slave vxcan1): Error -95 calling set_mac_address [ 1705.304222][T22155] bridge0: port 1(bridge_slave_0) entered blocking state [ 1705.311603][T22155] bridge0: port 1(bridge_slave_0) entered disabled state [ 1705.319370][T22155] bridge_slave_0: entered allmulticast mode [ 1705.327388][T22155] bridge_slave_0: entered promiscuous mode [ 1705.338958][T22155] bridge0: port 2(bridge_slave_1) entered blocking state [ 1705.362751][T22155] bridge0: port 2(bridge_slave_1) entered disabled state [ 1705.370227][T22155] bridge_slave_1: entered allmulticast mode [ 1705.378186][T22155] bridge_slave_1: entered promiscuous mode [ 1705.476296][T22209] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 1705.498656][T22155] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1705.511397][T22211] netlink: 'syz.1.14405': attribute type 5 has an invalid length. [ 1705.514785][T22155] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1705.531475][T22211] netlink: 4 bytes leftover after parsing attributes in process `syz.1.14405'. [ 1705.631751][T22155] team0: Port device team_slave_0 added [ 1705.655201][T22155] team0: Port device team_slave_1 added [ 1705.736052][T22155] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1705.740990][T22223] FAULT_INJECTION: forcing a failure. [ 1705.740990][T22223] name failslab, interval 1, probability 0, space 0, times 0 [ 1705.759816][T22155] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1705.762657][T22223] CPU: 0 UID: 0 PID: 22223 Comm: syz.4.14411 Not tainted syzkaller #0 PREEMPT(full) [ 1705.762683][T22223] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1705.762694][T22223] Call Trace: [ 1705.762702][T22223] [ 1705.762710][T22223] dump_stack_lvl+0xe8/0x150 [ 1705.762737][T22223] should_fail_ex+0x414/0x560 [ 1705.762768][T22223] should_failslab+0xa8/0x100 [ 1705.762791][T22223] kmem_cache_alloc_node_noprof+0x8c/0x720 [ 1705.762816][T22223] ? __alloc_skb+0x190/0x720 [ 1705.762834][T22223] ? __alloc_skb+0x1d5/0x720 [ 1705.762850][T22223] ? __local_bh_enable_ip+0xd0/0x130 [ 1705.762868][T22223] ? __alloc_skb+0x190/0x720 [ 1705.762887][T22223] __alloc_skb+0x1d5/0x720 [ 1705.762904][T22223] ? netlink_autobind+0xdb/0x300 [ 1705.762926][T22223] ? netlink_autobind+0x2c2/0x300 [ 1705.762953][T22223] netlink_sendmsg+0x5c6/0xb30 [ 1705.762984][T22223] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1705.763010][T22223] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1705.763033][T22223] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1705.763050][T22223] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1705.763078][T22223] __sock_sendmsg+0x21c/0x270 [ 1705.763106][T22223] ____sys_sendmsg+0x505/0x820 [ 1705.763139][T22223] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1705.763168][T22223] ? import_iovec+0x74/0xa0 [ 1705.763192][T22223] ___sys_sendmsg+0x21f/0x2a0 [ 1705.763215][T22223] ? __pfx____sys_sendmsg+0x10/0x10 [ 1705.763267][T22223] ? __fget_files+0x2a/0x420 [ 1705.763287][T22223] ? __fget_files+0x3a0/0x420 [ 1705.763316][T22223] __x64_sys_sendmsg+0x19b/0x260 [ 1705.763339][T22223] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1705.763369][T22223] ? __pfx_ksys_write+0x10/0x10 [ 1705.763397][T22223] do_syscall_64+0xec/0xf80 [ 1705.763416][T22223] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1705.763433][T22223] ? trace_irq_disable+0x37/0x100 [ 1705.763453][T22223] ? clear_bhb_loop+0x60/0xb0 [ 1705.763474][T22223] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1705.763490][T22223] RIP: 0033:0x7f5a6438f749 [ 1705.763507][T22223] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1705.763522][T22223] RSP: 002b:00007f5a652f5038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1705.763542][T22223] RAX: ffffffffffffffda RBX: 00007f5a645e5fa0 RCX: 00007f5a6438f749 [ 1705.763556][T22223] RDX: 0000000000000800 RSI: 0000200000000200 RDI: 000000000000000a [ 1705.763567][T22223] RBP: 00007f5a652f5090 R08: 0000000000000000 R09: 0000000000000000 [ 1705.763579][T22223] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1705.763589][T22223] R13: 00007f5a645e6038 R14: 00007f5a645e5fa0 R15: 00007ffe29489ec8 [ 1705.763618][T22223] [ 1705.831325][T18122] Bluetooth: hci5: command tx timeout [ 1705.967708][T22155] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1706.147148][T22155] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1706.179034][T22238] netlink: 'syz.3.14415': attribute type 32 has an invalid length. [ 1706.181336][T22155] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1706.220474][T22155] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1706.232008][T22231] syzkaller0: entered promiscuous mode [ 1706.238327][T22231] syzkaller0: entered allmulticast mode [ 1706.266391][T22240] bridge_slave_0: left allmulticast mode [ 1706.272202][T22240] bridge_slave_0: left promiscuous mode [ 1706.279317][T22240] bridge0: port 1(bridge_slave_0) entered disabled state [ 1706.291676][T22240] bridge_slave_1: left allmulticast mode [ 1706.300937][T22240] bridge_slave_1: left promiscuous mode [ 1706.307142][T22240] bridge0: port 2(bridge_slave_1) entered disabled state [ 1706.326020][T22240] bond0: (slave bond_slave_0): Releasing backup interface [ 1706.340805][T22240] bond0: (slave bond_slave_1): Releasing backup interface [ 1706.362983][T22244] netlink: 'syz.3.14418': attribute type 5 has an invalid length. [ 1706.366061][T22240] team0: Port device team_slave_0 removed [ 1706.370956][T22244] netlink: 4 bytes leftover after parsing attributes in process `syz.3.14418'. [ 1706.390920][T22240] team0: Port device team_slave_1 removed [ 1706.397821][T22240] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1706.405735][T22240] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1706.414908][T22240] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1706.422332][T22240] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1706.432099][T22240] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 1706.545337][T22155] hsr_slave_0: entered promiscuous mode [ 1706.555644][T22155] hsr_slave_1: entered promiscuous mode [ 1706.568476][T22155] debugfs: 'hsr0' already exists in 'hsr' [ 1706.574327][T22155] Cannot create hsr debugfs directory [ 1706.645753][T22252] tipc: Started in network mode [ 1706.650857][T22252] tipc: Node identity , cluster identity 4711 [ 1706.657371][T22252] tipc: Failed to obtain node identity [ 1706.663247][T22252] tipc: Enabling of bearer rejected, failed to enable media [ 1706.754630][T22253] netlink: 'syz.1.14421': attribute type 12 has an invalid length. [ 1707.167641][T22155] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 1707.178818][T22155] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 1707.194882][T22155] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 1707.206252][T22155] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 1707.294643][T22155] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1707.317774][T22155] 8021q: adding VLAN 0 to HW filter on device team0 [ 1707.337782][ T7422] bridge0: port 1(bridge_slave_0) entered blocking state [ 1707.345033][ T7422] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1707.364081][T13013] bridge0: port 2(bridge_slave_1) entered blocking state [ 1707.371298][T13013] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1707.688847][T22279] syzkaller0: entered promiscuous mode [ 1707.705400][T22279] syzkaller0: entered allmulticast mode [ 1707.720456][T22277] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1707.813465][T22155] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1707.923089][T22155] veth0_vlan: entered promiscuous mode [ 1707.947132][T22283] netlink: 'syz.1.14428': attribute type 5 has an invalid length. [ 1707.949594][T22155] veth1_vlan: entered promiscuous mode [ 1707.955452][T22283] __nla_validate_parse: 6 callbacks suppressed [ 1707.955468][T22283] netlink: 4 bytes leftover after parsing attributes in process `syz.1.14428'. [ 1707.977799][T18122] Bluetooth: hci5: command tx timeout [ 1708.024402][T22285] netlink: 'syz.3.14429': attribute type 1 has an invalid length. [ 1708.069331][T22287] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 1708.140278][T22285] 8021q: adding VLAN 0 to HW filter on device bond9 [ 1708.212088][T22291] 8021q: adding VLAN 0 to HW filter on device bond9 [ 1708.231763][T22291] bond9: (slave vxcan1): The slave device specified does not support setting the MAC address [ 1708.244925][T22291] bond9: (slave vxcan1): Error -95 calling set_mac_address [ 1708.270302][T22285] gretap1: entered promiscuous mode [ 1708.286444][T22296] macvlan2: entered promiscuous mode [ 1708.291919][T22296] macvlan2: entered allmulticast mode [ 1708.304014][T22296] bond9: entered promiscuous mode [ 1708.311028][T22296] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 1708.334102][T22296] bond9: left promiscuous mode [ 1708.372272][T22155] veth0_macvtap: entered promiscuous mode [ 1708.400987][T22155] veth1_macvtap: entered promiscuous mode [ 1708.441769][T22301] netlink: 4 bytes leftover after parsing attributes in process `syz.4.14435'. [ 1708.661258][T22155] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1708.682791][T22155] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1708.707647][ T7553] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1708.724276][ T7553] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1708.745005][ T7553] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1708.776598][ T73] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1708.848152][T22309] netlink: 'syz.4.14438': attribute type 39 has an invalid length. [ 1708.970544][ T73] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1708.997568][ T73] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1709.073484][T22317] netlink: 'syz.4.14440': attribute type 5 has an invalid length. [ 1709.092710][T22317] netlink: 4 bytes leftover after parsing attributes in process `syz.4.14440'. [ 1709.116327][ T7553] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1709.128537][ T7553] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1709.229070][T22319] netlink: 4 bytes leftover after parsing attributes in process `syz.3.14441'. [ 1709.261037][T22322] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 1709.576028][T22326] netlink: 6 bytes leftover after parsing attributes in process `syz.0.14381'. [ 1709.588047][T22326] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1709.609186][T22332] dummy0: left promiscuous mode [ 1709.621337][T22332] geneve2: left promiscuous mode [ 1709.631403][T22332] geneve3: left promiscuous mode [ 1709.636823][T22332] geneve3: left allmulticast mode [ 1709.768720][T22343] netlink: 16 bytes leftover after parsing attributes in process `syz.1.14450'. [ 1709.792213][T22343] bridge1: entered promiscuous mode [ 1709.805892][T22345] netlink: 'syz.3.14451': attribute type 5 has an invalid length. [ 1709.819046][T22345] netlink: 4 bytes leftover after parsing attributes in process `syz.3.14451'. [ 1709.933992][T22350] netlink: 'syz.3.14452': attribute type 4 has an invalid length. [ 1709.934204][T22354] netlink: 'syz.3.14452': attribute type 4 has an invalid length. [ 1709.943722][T22350] netlink: 'syz.3.14452': attribute type 4 has an invalid length. [ 1709.957030][T22354] netlink: 'syz.3.14452': attribute type 4 has an invalid length. [ 1709.966907][T22354] netlink: 'syz.3.14452': attribute type 4 has an invalid length. [ 1710.062487][T18122] Bluetooth: hci5: command tx timeout [ 1710.166775][ T6028] netdevsim netdevsim3 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1710.181715][ T6028] netdevsim netdevsim3 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1710.191251][ T6028] netdevsim netdevsim3 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1710.241797][ T6028] netdevsim netdevsim3 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1710.376454][T22361] netlink: 152 bytes leftover after parsing attributes in process `syz.3.14455'. [ 1710.386632][T22359] syzkaller0: entered promiscuous mode [ 1710.392146][T22359] syzkaller0: entered allmulticast mode [ 1710.404450][T22359] FAULT_INJECTION: forcing a failure. [ 1710.404450][T22359] name failslab, interval 1, probability 0, space 0, times 0 [ 1710.428496][T22361] netlink: 20 bytes leftover after parsing attributes in process `syz.3.14455'. [ 1710.432731][T22359] CPU: 1 UID: 0 PID: 22359 Comm: syz.4.14454 Not tainted syzkaller #0 PREEMPT(full) [ 1710.432757][T22359] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1710.432768][T22359] Call Trace: [ 1710.432776][T22359] [ 1710.432785][T22359] dump_stack_lvl+0xe8/0x150 [ 1710.432813][T22359] should_fail_ex+0x414/0x560 [ 1710.432847][T22359] should_failslab+0xa8/0x100 [ 1710.432870][T22359] kmem_cache_alloc_node_noprof+0x8c/0x720 [ 1710.432895][T22359] ? __alloc_skb+0x190/0x720 [ 1710.432914][T22359] ? __alloc_skb+0x1d5/0x720 [ 1710.432931][T22359] ? __local_bh_enable_ip+0xd0/0x130 [ 1710.432949][T22359] ? __alloc_skb+0x190/0x720 [ 1710.432968][T22359] __alloc_skb+0x1d5/0x720 [ 1710.432992][T22359] alloc_skb_with_frags+0xca/0x890 [ 1710.433015][T22359] ? __lock_acquire+0x6b6/0x2cf0 [ 1710.433042][T22359] sock_alloc_send_pskb+0x84d/0x980 [ 1710.433081][T22359] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 1710.433108][T22359] ? dev_get_by_index+0x22/0x2e0 [ 1710.433132][T22359] ? dev_get_by_index+0x22/0x2e0 [ 1710.433160][T22359] packet_sendmsg+0x33a0/0x5080 [ 1710.433194][T22359] ? aa_label_match+0x1b11/0x1be0 [ 1710.433216][T22359] ? __lock_acquire+0x6b6/0x2cf0 [ 1710.433258][T22359] ? aa_sk_perm+0x15f/0x920 [ 1710.433346][T22359] ? __pfx_packet_sendmsg+0x10/0x10 [ 1710.433378][T22359] ? aa_sk_perm+0x7ee/0x920 [ 1710.433406][T22359] ? tomoyo_socket_sendmsg_permission+0x1e1/0x300 [ 1710.433440][T22359] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1710.433471][T22359] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1710.433488][T22359] ? __pfx_packet_sendmsg+0x10/0x10 [ 1710.433513][T22359] __sock_sendmsg+0x21c/0x270 [ 1710.433542][T22359] __sys_sendto+0x3bd/0x520 [ 1710.433564][T22359] ? __pfx___sys_sendto+0x10/0x10 [ 1710.433597][T22359] ? __mutex_unlock_slowpath+0x1a1/0x730 [ 1710.433631][T22359] ? __fget_files+0x3a0/0x420 [ 1710.433663][T22359] ? ksys_write+0x22a/0x250 [ 1710.433682][T22359] ? __pfx_ksys_write+0x10/0x10 [ 1710.433704][T22359] __x64_sys_sendto+0xde/0x100 [ 1710.433727][T22359] do_syscall_64+0xec/0xf80 [ 1710.433747][T22359] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1710.433764][T22359] ? trace_irq_disable+0x37/0x100 [ 1710.433784][T22359] ? clear_bhb_loop+0x60/0xb0 [ 1710.433806][T22359] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1710.433824][T22359] RIP: 0033:0x7f5a6438f749 [ 1710.433843][T22359] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1710.433858][T22359] RSP: 002b:00007f5a652f5038 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 1710.433880][T22359] RAX: ffffffffffffffda RBX: 00007f5a645e5fa0 RCX: 00007f5a6438f749 [ 1710.433894][T22359] RDX: 0000000000000001 RSI: 00002000000005c0 RDI: 000000000000000a [ 1710.433905][T22359] RBP: 00007f5a652f5090 R08: 00002000000001c0 R09: 0000000000000014 [ 1710.433917][T22359] R10: 0000000000000040 R11: 0000000000000246 R12: 0000000000000001 [ 1710.433928][T22359] R13: 00007f5a645e6038 R14: 00007f5a645e5fa0 R15: 00007ffe29489ec8 [ 1710.433960][T22359] [ 1710.905976][T22366] FAULT_INJECTION: forcing a failure. [ 1710.905976][T22366] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1710.927443][T22366] CPU: 0 UID: 0 PID: 22366 Comm: syz.4.14457 Not tainted syzkaller #0 PREEMPT(full) [ 1710.927471][T22366] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1710.927483][T22366] Call Trace: [ 1710.927492][T22366] [ 1710.927500][T22366] dump_stack_lvl+0xe8/0x150 [ 1710.927528][T22366] should_fail_ex+0x414/0x560 [ 1710.927558][T22366] _copy_from_iter+0x1cd/0x1630 [ 1710.927591][T22366] ? __pfx__copy_from_iter+0x10/0x10 [ 1710.927626][T22366] ? raw_sendmsg+0x64a/0x18e0 [ 1710.927657][T22366] raw_sendmsg+0x1021/0x18e0 [ 1710.927682][T22366] ? raw_sendmsg+0x5e1/0x18e0 [ 1710.927708][T22366] ? __pfx_raw_sendmsg+0x10/0x10 [ 1710.927744][T22366] ? aa_sk_perm+0x7ee/0x920 [ 1710.927768][T22366] ? __pfx_aa_sk_perm+0x10/0x10 [ 1710.927786][T22366] ? tomoyo_socket_sendmsg_permission+0x216/0x300 [ 1710.927811][T22366] ? sock_rps_record_flow+0x19/0x410 [ 1710.927838][T22366] ? inet_sendmsg+0x2f4/0x370 [ 1710.927859][T22366] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1710.927879][T22366] __sock_sendmsg+0x19c/0x270 [ 1710.927907][T22366] __sys_sendto+0x3bd/0x520 [ 1710.927929][T22366] ? __pfx___sys_sendto+0x10/0x10 [ 1710.927947][T22366] ? __mutex_unlock_slowpath+0x1a1/0x730 [ 1710.927982][T22366] ? __fget_files+0x3a0/0x420 [ 1710.928012][T22366] ? ksys_write+0x22a/0x250 [ 1710.928032][T22366] ? __pfx_ksys_write+0x10/0x10 [ 1710.928054][T22366] __x64_sys_sendto+0xde/0x100 [ 1710.928077][T22366] do_syscall_64+0xec/0xf80 [ 1710.928098][T22366] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1710.928115][T22366] ? trace_irq_disable+0x37/0x100 [ 1710.928136][T22366] ? clear_bhb_loop+0x60/0xb0 [ 1710.928157][T22366] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1710.928174][T22366] RIP: 0033:0x7f5a6438f749 [ 1710.928190][T22366] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1710.928205][T22366] RSP: 002b:00007f5a652f5038 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 1710.928223][T22366] RAX: ffffffffffffffda RBX: 00007f5a645e5fa0 RCX: 00007f5a6438f749 [ 1710.928235][T22366] RDX: 000000000000ffec RSI: 0000200000000040 RDI: 0000000000000003 [ 1710.928246][T22366] RBP: 00007f5a652f5090 R08: 0000200000000340 R09: 0000000000000010 [ 1710.928258][T22366] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1710.928269][T22366] R13: 00007f5a645e6038 R14: 00007f5a645e5fa0 R15: 00007ffe29489ec8 [ 1710.928294][T22366] [ 1711.217175][T22371] IPv6: sit1: Disabled Multicast RS [ 1711.223791][T22371] sit1: entered promiscuous mode [ 1711.228957][T22371] sit1: entered allmulticast mode [ 1711.235532][T22373] tipc: Started in network mode [ 1711.240511][T22373] tipc: Node identity , cluster identity 4711 [ 1711.259467][T22373] tipc: Failed to obtain node identity [ 1711.265920][T22373] tipc: Enabling of bearer rejected, failed to enable media [ 1711.375016][T22379] netlink: 4 bytes leftover after parsing attributes in process `syz.1.14462'. [ 1711.440732][T22386] syz.4.14460 (22386) used obsolete PPPIOCDETACH ioctl [ 1711.561558][T22390] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 1711.644587][T22392] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1711.732294][T22394] syzkaller0: entered promiscuous mode [ 1711.752849][T22394] syzkaller0: entered allmulticast mode [ 1711.953392][T22399] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1711.961234][T22400] vlan2: entered allmulticast mode [ 1711.968707][T22400] netdevsim netdevsim1 netdevsim0: entered allmulticast mode [ 1712.132964][T18122] Bluetooth: hci5: command tx timeout [ 1712.867270][T32533] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1712.873398][T22432] bridge_slave_0: entered promiscuous mode [ 1712.881545][T22432] bridge_slave_0: entered allmulticast mode [ 1712.881622][T32533] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1712.896946][T32533] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1712.905642][T32533] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1712.915581][T32533] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1712.966176][T22433] lo speed is unknown, defaulting to 1000 [ 1712.973362][T22433] lo speed is unknown, defaulting to 1000 [ 1713.346627][T22433] chnl_net:caif_netlink_parms(): no params data found [ 1713.434654][T22448] __nla_validate_parse: 7 callbacks suppressed [ 1713.434674][T22448] netlink: 124 bytes leftover after parsing attributes in process `syz.1.14488'. [ 1713.655032][T22433] bridge0: port 1(bridge_slave_0) entered blocking state [ 1713.662672][T22433] bridge0: port 1(bridge_slave_0) entered disabled state [ 1713.670298][T22433] bridge_slave_0: entered allmulticast mode [ 1713.679731][T22433] bridge_slave_0: entered promiscuous mode [ 1713.691532][T22433] bridge0: port 2(bridge_slave_1) entered blocking state [ 1713.699603][T22433] bridge0: port 2(bridge_slave_1) entered disabled state [ 1713.724291][T22433] bridge_slave_1: entered allmulticast mode [ 1713.749523][T22433] bridge_slave_1: entered promiscuous mode [ 1713.892625][T22461] netlink: 4 bytes leftover after parsing attributes in process `syz.0.14491'. [ 1713.921650][T22458] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1713.942287][T22433] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1713.987778][T22433] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1714.029039][T22465] validate_nla: 28 callbacks suppressed [ 1714.029058][T22465] netlink: 'syz.1.14493': attribute type 1 has an invalid length. [ 1714.048675][T22465] netlink: 'syz.1.14493': attribute type 2 has an invalid length. [ 1714.087618][T22467] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 1714.106253][T22433] team0: Port device team_slave_0 added [ 1714.133303][T22433] team0: Port device team_slave_1 added [ 1714.220701][T22433] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1714.228767][T22433] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1714.256028][T22433] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1714.270651][T22433] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1714.278289][T22433] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1714.308601][T22472] netlink: 64 bytes leftover after parsing attributes in process `syz.1.14496'. [ 1714.322805][T22433] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1714.403259][T22474] netlink: 84 bytes leftover after parsing attributes in process `syz.0.14497'. [ 1714.420652][T22433] hsr_slave_0: entered promiscuous mode [ 1714.428772][T22433] hsr_slave_1: entered promiscuous mode [ 1714.435673][T22433] debugfs: 'hsr0' already exists in 'hsr' [ 1714.441510][T22433] Cannot create hsr debugfs directory [ 1714.595386][T22479] vlan2: entered allmulticast mode [ 1714.600657][T22479] netdevsim netdevsim0 netdevsim0: entered allmulticast mode [ 1714.840302][T22475] netlink: 32 bytes leftover after parsing attributes in process `syz.2.14495'. [ 1714.994929][T22483] netlink: 84 bytes leftover after parsing attributes in process `syz.2.14498'. [ 1715.015784][T32533] Bluetooth: hci2: command tx timeout [ 1715.072175][T22433] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 1715.099255][T22485] syzkaller0: entered promiscuous mode [ 1715.105278][T22485] syzkaller0: entered allmulticast mode [ 1715.124482][T22433] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 1715.146610][T22433] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 1715.194637][T22433] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 1715.252924][T22488] vlan2: entered allmulticast mode [ 1715.581109][T22506] FAULT_INJECTION: forcing a failure. [ 1715.581109][T22506] name failslab, interval 1, probability 0, space 0, times 0 [ 1715.632647][T22506] CPU: 0 UID: 0 PID: 22506 Comm: syz.0.14502 Not tainted syzkaller #0 PREEMPT(full) [ 1715.632673][T22506] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1715.632683][T22506] Call Trace: [ 1715.632691][T22506] [ 1715.632700][T22506] dump_stack_lvl+0xe8/0x150 [ 1715.632729][T22506] should_fail_ex+0x414/0x560 [ 1715.632763][T22506] should_failslab+0xa8/0x100 [ 1715.632786][T22506] __kmalloc_cache_noprof+0x84/0x700 [ 1715.632808][T22506] ? nf_tables_newflowtable+0x901/0x2390 [ 1715.632835][T22506] nf_tables_newflowtable+0x901/0x2390 [ 1715.632873][T22506] ? __pfx_nf_tables_newflowtable+0x10/0x10 [ 1715.632894][T22506] ? nfnl_pernet+0x23/0x240 [ 1715.632928][T22506] ? __nla_parse+0x40/0x60 [ 1715.632948][T22506] nfnetlink_rcv+0x11d9/0x2590 [ 1715.632999][T22506] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 1715.633028][T22506] ? ref_tracker_free+0x63a/0x7d0 [ 1715.633052][T22506] ? lockdep_hardirqs_on+0x7b/0x110 [ 1715.633064][T22506] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 1715.633075][T22506] ? rcu_preempt_deferred_qs_irqrestore+0x7b9/0xbc0 [ 1715.633096][T22506] netlink_unicast+0x82f/0x9e0 [ 1715.633113][T22506] ? __pfx_netlink_unicast+0x10/0x10 [ 1715.633126][T22506] ? netlink_sendmsg+0x642/0xb30 [ 1715.633142][T22506] ? skb_put+0x11b/0x210 [ 1715.633163][T22506] netlink_sendmsg+0x805/0xb30 [ 1715.633193][T22506] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1715.633219][T22506] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1715.633244][T22506] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1715.633268][T22506] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1715.633285][T22506] __sock_sendmsg+0x21c/0x270 [ 1715.633302][T22506] ____sys_sendmsg+0x505/0x820 [ 1715.633317][T22506] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1715.633334][T22506] ? import_iovec+0x74/0xa0 [ 1715.633348][T22506] ___sys_sendmsg+0x21f/0x2a0 [ 1715.633361][T22506] ? __pfx____sys_sendmsg+0x10/0x10 [ 1715.633392][T22506] ? __fget_files+0x2a/0x420 [ 1715.633404][T22506] ? __fget_files+0x3a0/0x420 [ 1715.633421][T22506] __x64_sys_sendmsg+0x19b/0x260 [ 1715.633434][T22506] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1715.633451][T22506] ? __pfx_ksys_write+0x10/0x10 [ 1715.633467][T22506] do_syscall_64+0xec/0xf80 [ 1715.633479][T22506] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1715.633489][T22506] ? trace_irq_disable+0x37/0x100 [ 1715.633501][T22506] ? clear_bhb_loop+0x60/0xb0 [ 1715.633513][T22506] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1715.633523][T22506] RIP: 0033:0x7f881f38f749 [ 1715.633534][T22506] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1715.633542][T22506] RSP: 002b:00007f881d5f6038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1715.633554][T22506] RAX: ffffffffffffffda RBX: 00007f881f5e5fa0 RCX: 00007f881f38f749 [ 1715.633562][T22506] RDX: 0000000000000000 RSI: 0000200000000380 RDI: 0000000000000003 [ 1715.633568][T22506] RBP: 00007f881d5f6090 R08: 0000000000000000 R09: 0000000000000000 [ 1715.633575][T22506] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1715.633580][T22506] R13: 00007f881f5e6038 R14: 00007f881f5e5fa0 R15: 00007ffd5d8d0578 [ 1715.633597][T22506] [ 1716.022166][T22433] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1716.045511][T22433] 8021q: adding VLAN 0 to HW filter on device team0 [ 1716.070629][T17066] bridge0: port 1(bridge_slave_0) entered blocking state [ 1716.077840][T17066] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1716.089057][T17066] bridge0: port 2(bridge_slave_1) entered blocking state [ 1716.096280][T17066] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1716.420012][T22508] lo speed is unknown, defaulting to 1000 [ 1716.451268][T22508] lo speed is unknown, defaulting to 1000 [ 1716.526072][T22521] netlink: 84 bytes leftover after parsing attributes in process `syz.0.14508'. [ 1716.777231][T22526] vlan2: entered allmulticast mode [ 1717.005382][T22433] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1717.098518][T22524] x_tables: ip6_tables: CLASSIFY target: used from hooks INPUT, but only usable from FORWARD/OUTPUT/POSTROUTING [ 1717.113575][T32533] Bluetooth: hci2: command tx timeout [ 1717.197240][T22532] netlink: 56 bytes leftover after parsing attributes in process `syz.3.14510'. [ 1717.251571][T22534] netlink: 8 bytes leftover after parsing attributes in process `syz.1.14509'. [ 1717.382190][T22539] netlink: 'syz.3.14512': attribute type 1 has an invalid length. [ 1717.807556][T22433] veth0_vlan: entered promiscuous mode [ 1717.847538][T22552] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci2/hci2:200/input15 [ 1717.864704][T22433] veth1_vlan: entered promiscuous mode [ 1717.939329][T22557] bridge_slave_0: left promiscuous mode [ 1718.115423][T22560] lo speed is unknown, defaulting to 1000 [ 1718.177613][T22560] lo speed is unknown, defaulting to 1000 [ 1718.189813][T22433] veth0_macvtap: entered promiscuous mode [ 1718.196342][T22563] FAULT_INJECTION: forcing a failure. [ 1718.196342][T22563] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1718.204506][T22433] veth1_macvtap: entered promiscuous mode [ 1718.210442][T22563] CPU: 0 UID: 0 PID: 22563 Comm: syz.2.14518 Not tainted syzkaller #0 PREEMPT(full) [ 1718.210468][T22563] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1718.210479][T22563] Call Trace: [ 1718.210487][T22563] [ 1718.210495][T22563] dump_stack_lvl+0xe8/0x150 [ 1718.210522][T22563] should_fail_ex+0x414/0x560 [ 1718.210553][T22563] _copy_to_user+0x31/0xb0 [ 1718.210577][T22563] generic_map_lookup_batch+0x89c/0xce0 [ 1718.210612][T22563] ? __pfx_generic_map_lookup_batch+0x10/0x10 [ 1718.210638][T22563] ? __pfx_generic_map_lookup_batch+0x10/0x10 [ 1718.210659][T22563] bpf_map_do_batch+0x285/0x630 [ 1718.210682][T22563] ? security_bpf+0x7e/0x300 [ 1718.210716][T22563] __sys_bpf+0x537/0x860 [ 1718.210740][T22563] ? __pfx___sys_bpf+0x10/0x10 [ 1718.210759][T22563] ? kmem_cache_free+0x197/0x620 [ 1718.210800][T22563] ? ksys_write+0x1e1/0x250 [ 1718.210820][T22563] ? __pfx_ksys_write+0x10/0x10 [ 1718.210843][T22563] __x64_sys_bpf+0x7c/0x90 [ 1718.210864][T22563] do_syscall_64+0xec/0xf80 [ 1718.210885][T22563] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1718.210902][T22563] ? trace_irq_disable+0x37/0x100 [ 1718.210923][T22563] ? clear_bhb_loop+0x60/0xb0 [ 1718.210943][T22563] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1718.210959][T22563] RIP: 0033:0x7f705f18f749 [ 1718.210976][T22563] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1718.210991][T22563] RSP: 002b:00007f705ffce038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1718.211009][T22563] RAX: ffffffffffffffda RBX: 00007f705f3e5fa0 RCX: 00007f705f18f749 [ 1718.211022][T22563] RDX: 0000000000000038 RSI: 00002000000001c0 RDI: 0000000000000018 [ 1718.211034][T22563] RBP: 00007f705ffce090 R08: 0000000000000000 R09: 0000000000000000 [ 1718.211045][T22563] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1718.211056][T22563] R13: 00007f705f3e6038 R14: 00007f705f3e5fa0 R15: 00007ffea6e68d58 [ 1718.211086][T22563] [ 1718.618482][T22571] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 1718.751130][T22433] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1718.929658][T22433] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1718.972808][T23222] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1718.981576][T23222] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1719.044262][T23222] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1719.053756][T23222] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1719.172447][T32533] Bluetooth: hci2: command tx timeout [ 1719.625027][T17066] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1719.640136][T17066] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1719.839619][T13013] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1719.848880][T13013] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1719.862311][T22595] FAULT_INJECTION: forcing a failure. [ 1719.862311][T22595] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1719.879111][T22595] CPU: 1 UID: 0 PID: 22595 Comm: syz.2.14528 Not tainted syzkaller #0 PREEMPT(full) [ 1719.879139][T22595] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1719.879150][T22595] Call Trace: [ 1719.879159][T22595] [ 1719.879168][T22595] dump_stack_lvl+0xe8/0x150 [ 1719.879194][T22595] should_fail_ex+0x414/0x560 [ 1719.879225][T22595] _copy_from_user+0x2d/0xb0 [ 1719.879247][T22595] wext_handle_ioctl+0xba/0x1c0 [ 1719.879271][T22595] ? __pfx_wext_handle_ioctl+0x10/0x10 [ 1719.879288][T22595] ? __mutex_unlock_slowpath+0x1a1/0x730 [ 1719.879326][T22595] sock_ioctl+0x15f/0x790 [ 1719.879353][T22595] ? __pfx_sock_ioctl+0x10/0x10 [ 1719.879376][T22595] ? __fget_files+0x2a/0x420 [ 1719.879395][T22595] ? __fget_files+0x3a0/0x420 [ 1719.879414][T22595] ? __fget_files+0x2a/0x420 [ 1719.879438][T22595] ? bpf_lsm_file_ioctl+0x9/0x20 [ 1719.879457][T22595] ? __pfx_sock_ioctl+0x10/0x10 [ 1719.879480][T22595] __se_sys_ioctl+0xfc/0x170 [ 1719.879509][T22595] do_syscall_64+0xec/0xf80 [ 1719.879529][T22595] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1719.879545][T22595] ? trace_irq_disable+0x37/0x100 [ 1719.879567][T22595] ? clear_bhb_loop+0x60/0xb0 [ 1719.879588][T22595] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1719.879605][T22595] RIP: 0033:0x7f705f18f749 [ 1719.879621][T22595] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1719.879634][T22595] RSP: 002b:00007f705ffce038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1719.879651][T22595] RAX: ffffffffffffffda RBX: 00007f705f3e5fa0 RCX: 00007f705f18f749 [ 1719.879664][T22595] RDX: 0000200000000040 RSI: 0000000000008b1a RDI: 0000000000000006 [ 1719.879674][T22595] RBP: 00007f705ffce090 R08: 0000000000000000 R09: 0000000000000000 [ 1719.879685][T22595] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1719.879695][T22595] R13: 00007f705f3e6038 R14: 00007f705f3e5fa0 R15: 00007ffea6e68d58 [ 1719.879724][T22595] [ 1720.174485][T22598] xt_hashlimit: max too large, truncated to 1048576 [ 1720.184971][T22598] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1720.583961][T22617] netlink: 6 bytes leftover after parsing attributes in process `syz.3.14531'. [ 1720.603294][T22617] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1720.899091][T18122] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 1720.913995][T18122] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 1720.931828][T18122] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 1720.942222][T18122] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 1720.950443][T18122] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 1721.085623][T22631] lo speed is unknown, defaulting to 1000 [ 1721.123906][T22631] lo speed is unknown, defaulting to 1000 [ 1721.236135][T22640] Cannot find del_set index 49151 as target [ 1721.243708][T22640] netlink: 4 bytes leftover after parsing attributes in process `syz.3.14542'. [ 1721.277277][T18122] Bluetooth: hci2: command tx timeout [ 1721.805950][T22664] netlink: 6 bytes leftover after parsing attributes in process `syz.5.14549'. [ 1721.849290][T22664] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1722.110452][T22631] chnl_net:caif_netlink_parms(): no params data found [ 1722.310791][T22631] bridge0: port 1(bridge_slave_0) entered blocking state [ 1722.319717][T22631] bridge0: port 1(bridge_slave_0) entered disabled state [ 1722.327377][T22631] bridge_slave_0: entered allmulticast mode [ 1722.335917][T22631] bridge_slave_0: entered promiscuous mode [ 1722.346476][T22631] bridge0: port 2(bridge_slave_1) entered blocking state [ 1722.354523][T22631] bridge0: port 2(bridge_slave_1) entered disabled state [ 1722.362056][T22631] bridge_slave_1: entered allmulticast mode [ 1722.371890][T22631] bridge_slave_1: entered promiscuous mode [ 1722.496862][T22631] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1722.585177][T22631] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1722.711348][T22699] IPv6: Can't replace route, no match found [ 1722.783410][T22696] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 1722.827862][T22631] team0: Port device team_slave_0 added [ 1722.849752][T22706] Unsupported ieee802154 address type: 0 [ 1722.864346][T22631] team0: Port device team_slave_1 added [ 1723.006387][T22631] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1723.013907][T18122] Bluetooth: hci4: command tx timeout [ 1723.041567][T22631] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1723.082420][T22631] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1723.114878][T22631] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1723.150158][T22631] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1723.203524][T22631] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1723.279063][T22724] netlink: 'syz.5.14567': attribute type 39 has an invalid length. [ 1725.102562][T18122] Bluetooth: hci4: command tx timeout [ 1725.942142][T22631] hsr_slave_0: entered promiscuous mode [ 1725.953818][T22631] hsr_slave_1: entered promiscuous mode [ 1725.960589][T22631] debugfs: 'hsr0' already exists in 'hsr' [ 1725.984440][T22631] Cannot create hsr debugfs directory [ 1726.093806][T22733] lo speed is unknown, defaulting to 1000 [ 1726.102980][T22736] FAULT_INJECTION: forcing a failure. [ 1726.102980][T22736] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1726.122643][T22733] lo speed is unknown, defaulting to 1000 [ 1726.150074][T22736] CPU: 0 UID: 0 PID: 22736 Comm: syz.0.14569 Not tainted syzkaller #0 PREEMPT(full) [ 1726.150100][T22736] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1726.150113][T22736] Call Trace: [ 1726.150121][T22736] [ 1726.150129][T22736] dump_stack_lvl+0xe8/0x150 [ 1726.150156][T22736] should_fail_ex+0x414/0x560 [ 1726.150195][T22736] _copy_from_iter+0x1cd/0x1630 [ 1726.150218][T22736] ? rcu_is_watching+0x15/0xb0 [ 1726.150240][T22736] ? trace_kmem_cache_alloc+0x1f/0xb0 [ 1726.150263][T22736] ? kmem_cache_alloc_node_noprof+0x48c/0x720 [ 1726.150289][T22736] ? kmalloc_reserve+0xbd/0x290 [ 1726.150310][T22736] ? __pfx__copy_from_iter+0x10/0x10 [ 1726.150338][T22736] ? netlink_sendmsg+0x642/0xb30 [ 1726.150359][T22736] ? skb_put+0x11b/0x210 [ 1726.150381][T22736] netlink_sendmsg+0x6b2/0xb30 [ 1726.150412][T22736] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1726.150438][T22736] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1726.150462][T22736] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1726.150479][T22736] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1726.150504][T22736] __sock_sendmsg+0x21c/0x270 [ 1726.150532][T22736] ____sys_sendmsg+0x505/0x820 [ 1726.150559][T22736] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1726.150589][T22736] ? import_iovec+0x74/0xa0 [ 1726.150613][T22736] ___sys_sendmsg+0x21f/0x2a0 [ 1726.150637][T22736] ? __pfx____sys_sendmsg+0x10/0x10 [ 1726.150694][T22736] ? __fget_files+0x2a/0x420 [ 1726.150714][T22736] ? __fget_files+0x3a0/0x420 [ 1726.150745][T22736] __x64_sys_sendmsg+0x19b/0x260 [ 1726.150768][T22736] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1726.150798][T22736] ? __pfx_ksys_write+0x10/0x10 [ 1726.150824][T22736] do_syscall_64+0xec/0xf80 [ 1726.150844][T22736] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1726.150860][T22736] ? trace_irq_disable+0x37/0x100 [ 1726.150881][T22736] ? clear_bhb_loop+0x60/0xb0 [ 1726.150903][T22736] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1726.150920][T22736] RIP: 0033:0x7f881f38f749 [ 1726.150937][T22736] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1726.150953][T22736] RSP: 002b:00007f881d5d5038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1726.150974][T22736] RAX: ffffffffffffffda RBX: 00007f881f5e6090 RCX: 00007f881f38f749 [ 1726.150989][T22736] RDX: 0000000000000800 RSI: 0000200000000200 RDI: 000000000000000a [ 1726.151001][T22736] RBP: 00007f881d5d5090 R08: 0000000000000000 R09: 0000000000000000 [ 1726.151013][T22736] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1726.151025][T22736] R13: 00007f881f5e6128 R14: 00007f881f5e6090 R15: 00007ffd5d8d0578 [ 1726.151056][T22736] [ 1726.461963][T22741] netlink: 'syz.5.14571': attribute type 1 has an invalid length. [ 1727.176964][T18122] Bluetooth: hci4: command tx timeout [ 1727.298213][T22631] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1727.450811][T22767] FAULT_INJECTION: forcing a failure. [ 1727.450811][T22767] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1727.465355][T22767] CPU: 0 UID: 0 PID: 22767 Comm: syz.1.14580 Not tainted syzkaller #0 PREEMPT(full) [ 1727.465382][T22767] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1727.465393][T22767] Call Trace: [ 1727.465401][T22767] [ 1727.465410][T22767] dump_stack_lvl+0xe8/0x150 [ 1727.465439][T22767] should_fail_ex+0x414/0x560 [ 1727.465471][T22767] _copy_to_user+0x31/0xb0 [ 1727.465495][T22767] simple_read_from_buffer+0xe1/0x170 [ 1727.465521][T22767] proc_fail_nth_read+0x1b3/0x220 [ 1727.465543][T22767] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1727.465565][T22767] ? rw_verify_area+0x2a6/0x4d0 [ 1727.465590][T22767] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1727.465611][T22767] vfs_read+0x200/0xa30 [ 1727.465627][T22767] ? fdget_pos+0x247/0x320 [ 1727.465652][T22767] ? __pfx___mutex_lock+0x10/0x10 [ 1727.465674][T22767] ? __pfx_vfs_read+0x10/0x10 [ 1727.465693][T22767] ? __fget_files+0x2a/0x420 [ 1727.465718][T22767] ? __fget_files+0x3a0/0x420 [ 1727.465738][T22767] ? __fget_files+0x2a/0x420 [ 1727.465768][T22767] ksys_read+0x145/0x250 [ 1727.465787][T22767] ? __pfx_ksys_read+0x10/0x10 [ 1727.465817][T22767] do_syscall_64+0xec/0xf80 [ 1727.465837][T22767] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1727.465854][T22767] ? trace_irq_disable+0x37/0x100 [ 1727.465875][T22767] ? clear_bhb_loop+0x60/0xb0 [ 1727.465896][T22767] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1727.465913][T22767] RIP: 0033:0x7f30dd98e15c [ 1727.465931][T22767] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 1727.465947][T22767] RSP: 002b:00007f30de7b9030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1727.465966][T22767] RAX: ffffffffffffffda RBX: 00007f30ddbe5fa0 RCX: 00007f30dd98e15c [ 1727.465980][T22767] RDX: 000000000000000f RSI: 00007f30de7b90a0 RDI: 0000000000000004 [ 1727.465992][T22767] RBP: 00007f30de7b9090 R08: 0000000000000000 R09: 0000000000000010 [ 1727.466011][T22767] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1727.466021][T22767] R13: 00007f30ddbe6038 R14: 00007f30ddbe5fa0 R15: 00007fff5facd3f8 [ 1727.466050][T22767] [ 1728.184342][T22795] netlink: 24 bytes leftover after parsing attributes in process `syz.3.14584'. [ 1728.270850][T22631] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1729.252808][T18122] Bluetooth: hci4: command tx timeout [ 1730.367937][T22631] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1730.383285][ T1297] aoe: packet could not be sent on bond0. consider increasing tx_queue_len [ 1730.515866][T22631] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1730.562807][T22804] netlink: 'syz.3.14588': attribute type 39 has an invalid length. [ 1730.570812][T22806] netlink: 64 bytes leftover after parsing attributes in process `syz.5.14589'. [ 1730.588125][T22808] IPVS: Error joining to the multicast group [ 1730.820202][T22631] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 1730.846644][T22631] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 1730.870150][T22631] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 1730.890329][T22631] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 1731.246182][T22631] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1731.296365][T22631] 8021q: adding VLAN 0 to HW filter on device team0 [ 1731.322852][T17887] bridge0: port 1(bridge_slave_0) entered blocking state [ 1731.330104][T17887] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1731.357475][T17887] bridge0: port 2(bridge_slave_1) entered blocking state [ 1731.364730][T17887] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1731.549800][T22844] bridge0: port 1(bridge_slave_0) entered disabled state [ 1731.618695][T22845] lo speed is unknown, defaulting to 1000 [ 1731.644491][T22845] lo speed is unknown, defaulting to 1000 [ 1731.848993][T22856] netlink: 24 bytes leftover after parsing attributes in process `syz.3.14598'. [ 1731.888368][T22856] netlink: 11 bytes leftover after parsing attributes in process `syz.3.14598'. [ 1732.131536][T22865] lo speed is unknown, defaulting to 1000 [ 1732.152169][T22865] lo speed is unknown, defaulting to 1000 [ 1732.248681][T22873] netlink: 'syz.3.14601': attribute type 39 has an invalid length. [ 1732.318146][T22631] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1732.438828][T22869] netlink: 12 bytes leftover after parsing attributes in process `syz.5.14600'. [ 1732.552031][T22881] FAULT_INJECTION: forcing a failure. [ 1732.552031][T22881] name failslab, interval 1, probability 0, space 0, times 0 [ 1732.573533][T22881] CPU: 1 UID: 0 PID: 22881 Comm: syz.3.14604 Not tainted syzkaller #0 PREEMPT(full) [ 1732.573572][T22881] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1732.573583][T22881] Call Trace: [ 1732.573590][T22881] [ 1732.573598][T22881] dump_stack_lvl+0xe8/0x150 [ 1732.573627][T22881] should_fail_ex+0x414/0x560 [ 1732.573657][T22881] should_failslab+0xa8/0x100 [ 1732.573680][T22881] kmem_cache_alloc_node_noprof+0x8c/0x720 [ 1732.573705][T22881] ? __alloc_skb+0x190/0x720 [ 1732.573724][T22881] ? __alloc_skb+0x1d5/0x720 [ 1732.573741][T22881] ? __local_bh_enable_ip+0xd0/0x130 [ 1732.573760][T22881] ? __alloc_skb+0x190/0x720 [ 1732.573779][T22881] __alloc_skb+0x1d5/0x720 [ 1732.573803][T22881] netlink_ack+0x146/0xa50 [ 1732.573831][T22881] ? __lock_acquire+0x6b6/0x2cf0 [ 1732.573858][T22881] netlink_rcv_skb+0x28c/0x470 [ 1732.573878][T22881] ? unwind_next_frame+0xa5/0x23d0 [ 1732.573899][T22881] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 1732.573922][T22881] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1732.573956][T22881] ? bpf_lsm_capable+0x9/0x20 [ 1732.573975][T22881] ? security_capable+0x7e/0x2e0 [ 1732.574002][T22881] nfnetlink_rcv+0x282/0x2590 [ 1732.574024][T22881] ? is_bpf_text_address+0x26/0x2b0 [ 1732.574051][T22881] ? kernel_text_address+0xa5/0xe0 [ 1732.574077][T22881] ? unwind_get_return_address+0x4d/0x90 [ 1732.574096][T22881] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 1732.574120][T22881] ? arch_stack_walk+0xfc/0x150 [ 1732.574151][T22881] ? __lock_acquire+0x6b6/0x2cf0 [ 1732.574171][T22881] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 1732.574192][T22881] ? stack_depot_save_flags+0x33/0x810 [ 1732.574215][T22881] ? __lock_acquire+0x6b6/0x2cf0 [ 1732.574240][T22881] ? __lock_acquire+0x6b6/0x2cf0 [ 1732.574268][T22881] ? __netlink_lookup+0xbd/0x8a0 [ 1732.574300][T22881] ? netlink_deliver_tap+0x2e/0x1b0 [ 1732.574324][T22881] ? netlink_deliver_tap+0x2e/0x1b0 [ 1732.574352][T22881] ? netlink_deliver_tap+0x2e/0x1b0 [ 1732.574382][T22881] netlink_unicast+0x82f/0x9e0 [ 1732.574411][T22881] ? __pfx_netlink_unicast+0x10/0x10 [ 1732.574434][T22881] ? netlink_sendmsg+0x642/0xb30 [ 1732.574455][T22881] ? skb_put+0x11b/0x210 [ 1732.574478][T22881] netlink_sendmsg+0x805/0xb30 [ 1732.574510][T22881] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1732.574536][T22881] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1732.574566][T22881] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1732.574582][T22881] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1732.574606][T22881] __sock_sendmsg+0x21c/0x270 [ 1732.574634][T22881] ____sys_sendmsg+0x505/0x820 [ 1732.574660][T22881] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1732.574690][T22881] ? import_iovec+0x74/0xa0 [ 1732.574714][T22881] ___sys_sendmsg+0x21f/0x2a0 [ 1732.574738][T22881] ? __pfx____sys_sendmsg+0x10/0x10 [ 1732.574794][T22881] ? __fget_files+0x2a/0x420 [ 1732.574813][T22881] ? __fget_files+0x3a0/0x420 [ 1732.574844][T22881] __x64_sys_sendmsg+0x19b/0x260 [ 1732.574866][T22881] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1732.574897][T22881] ? __pfx_ksys_write+0x10/0x10 [ 1732.574926][T22881] do_syscall_64+0xec/0xf80 [ 1732.574946][T22881] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1732.574960][T22881] ? trace_irq_disable+0x37/0x100 [ 1732.574979][T22881] ? clear_bhb_loop+0x60/0xb0 [ 1732.575001][T22881] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1732.575018][T22881] RIP: 0033:0x7ff46618f749 [ 1732.575035][T22881] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1732.575050][T22881] RSP: 002b:00007ff466f8b038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1732.575070][T22881] RAX: ffffffffffffffda RBX: 00007ff4663e5fa0 RCX: 00007ff46618f749 [ 1732.575083][T22881] RDX: 0000000000000000 RSI: 0000200000001080 RDI: 0000000000000003 [ 1732.575095][T22881] RBP: 00007ff466f8b090 R08: 0000000000000000 R09: 0000000000000000 [ 1732.575106][T22881] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1732.575118][T22881] R13: 00007ff4663e6038 R14: 00007ff4663e5fa0 R15: 00007ffcc17b4028 [ 1732.575148][T22881] [ 1733.121391][T22631] veth0_vlan: entered promiscuous mode [ 1733.273366][T22883] lo speed is unknown, defaulting to 1000 [ 1733.288783][T22631] veth1_vlan: entered promiscuous mode [ 1733.359130][T22889] netlink: 60 bytes leftover after parsing attributes in process `syz.3.14606'. [ 1733.386385][T22883] lo speed is unknown, defaulting to 1000 [ 1733.507228][T22631] veth0_macvtap: entered promiscuous mode [ 1733.557481][T22631] veth1_macvtap: entered promiscuous mode [ 1733.596293][T22631] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1733.627423][T22631] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1733.650591][T13013] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1733.661585][T13013] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1733.739028][T22888] netlink: 'syz.1.14603': attribute type 6 has an invalid length. [ 1733.742608][T13013] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1733.770468][T13013] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1734.205707][T20751] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1734.227238][T20751] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1734.574284][ T6028] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1734.593101][ T6028] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1734.889552][T22912] netlink: 32 bytes leftover after parsing attributes in process `syz.0.14611'. [ 1735.098977][T22912] ip6gre1: entered promiscuous mode [ 1735.118695][T22912] ip6gre1: entered allmulticast mode [ 1735.161955][T22912] netlink: 'syz.0.14611': attribute type 29 has an invalid length. [ 1735.397920][T22924] netlink: 'syz.5.14613': attribute type 6 has an invalid length. [ 1735.446512][T22924] netlink: 64 bytes leftover after parsing attributes in process `syz.5.14613'. [ 1736.795776][T22946] syzkaller0: entered promiscuous mode [ 1736.801331][T22946] syzkaller0: entered allmulticast mode [ 1736.825867][T22972] netlink: 16 bytes leftover after parsing attributes in process `syz.1.14619'. [ 1737.235934][T22984] lo speed is unknown, defaulting to 1000 [ 1737.266641][T22984] lo speed is unknown, defaulting to 1000 [ 1737.406377][T22996] tipc: Started in network mode [ 1737.418382][T22996] tipc: Node identity 4, cluster identity 4711 [ 1737.431725][T22996] tipc: Node number set to 4 [ 1737.604369][T23004] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 1737.624158][T23002] netlink: 12 bytes leftover after parsing attributes in process `syz.5.14628'. [ 1737.848568][T23010] netlink: 12 bytes leftover after parsing attributes in process `syz.5.14630'. [ 1737.858069][T23006] syzkaller0: entered promiscuous mode [ 1737.864170][T23006] syzkaller0: entered allmulticast mode [ 1738.576205][T23024] netlink: 'syz.3.14635': attribute type 39 has an invalid length. [ 1741.462857][T23034] tipc: Started in network mode [ 1741.472840][T23034] tipc: Node identity 4, cluster identity 4711 [ 1741.486039][T23034] tipc: Node number set to 4 [ 1741.605830][T23043] FAULT_INJECTION: forcing a failure. [ 1741.605830][T23043] name failslab, interval 1, probability 0, space 0, times 0 [ 1741.636580][T23043] CPU: 0 UID: 0 PID: 23043 Comm: syz.2.14642 Not tainted syzkaller #0 PREEMPT(full) [ 1741.636608][T23043] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1741.636620][T23043] Call Trace: [ 1741.636628][T23043] [ 1741.636636][T23043] dump_stack_lvl+0xe8/0x150 [ 1741.636664][T23043] should_fail_ex+0x414/0x560 [ 1741.636696][T23043] should_failslab+0xa8/0x100 [ 1741.636720][T23043] __kmalloc_noprof+0xdf/0x800 [ 1741.636738][T23043] ? ioctl_standard_iw_point+0x4d5/0xd40 [ 1741.636766][T23043] ioctl_standard_iw_point+0x4d5/0xd40 [ 1741.636799][T23043] ? __pfx_cfg80211_wext_siwessid+0x10/0x10 [ 1741.636826][T23043] ? __pfx_ioctl_standard_iw_point+0x10/0x10 [ 1741.636855][T23043] ? full_name_hash+0x92/0xe0 [ 1741.636877][T23043] ? __pfx_cfg80211_wext_siwessid+0x10/0x10 [ 1741.636896][T23043] ioctl_standard_call+0xaf/0x1b0 [ 1741.636919][T23043] ? __pfx_cfg80211_wext_siwessid+0x10/0x10 [ 1741.636935][T23043] wext_ioctl_dispatch+0xee/0x410 [ 1741.636953][T23043] ? __pfx_ioctl_standard_call+0x10/0x10 [ 1741.636977][T23043] wext_handle_ioctl+0x100/0x1c0 [ 1741.636999][T23043] ? __pfx_wext_handle_ioctl+0x10/0x10 [ 1741.637016][T23043] ? __mutex_unlock_slowpath+0x1a1/0x730 [ 1741.637055][T23043] sock_ioctl+0x15f/0x790 [ 1741.637083][T23043] ? __pfx_sock_ioctl+0x10/0x10 [ 1741.637106][T23043] ? __fget_files+0x2a/0x420 [ 1741.637126][T23043] ? __fget_files+0x3a0/0x420 [ 1741.637144][T23043] ? __fget_files+0x2a/0x420 [ 1741.637169][T23043] ? bpf_lsm_file_ioctl+0x9/0x20 [ 1741.637188][T23043] ? __pfx_sock_ioctl+0x10/0x10 [ 1741.637210][T23043] __se_sys_ioctl+0xfc/0x170 [ 1741.637239][T23043] do_syscall_64+0xec/0xf80 [ 1741.637260][T23043] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1741.637276][T23043] ? trace_irq_disable+0x37/0x100 [ 1741.637297][T23043] ? clear_bhb_loop+0x60/0xb0 [ 1741.637318][T23043] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1741.637335][T23043] RIP: 0033:0x7f620418f749 [ 1741.637350][T23043] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1741.637365][T23043] RSP: 002b:00007f6205111038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1741.637385][T23043] RAX: ffffffffffffffda RBX: 00007f62043e5fa0 RCX: 00007f620418f749 [ 1741.637396][T23043] RDX: 0000200000000040 RSI: 0000000000008b1a RDI: 0000000000000007 [ 1741.637407][T23043] RBP: 00007f6205111090 R08: 0000000000000000 R09: 0000000000000000 [ 1741.637418][T23043] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1741.637428][T23043] R13: 00007f62043e6038 R14: 00007f62043e5fa0 R15: 00007fffd67ff308 [ 1741.637456][T23043] [ 1741.904912][T23049] netlink: 'syz.0.14644': attribute type 4 has an invalid length. [ 1741.913198][T23049] netlink: 'syz.0.14644': attribute type 8 has an invalid length. [ 1741.921332][T23049] netlink: 200 bytes leftover after parsing attributes in process `syz.0.14644'. [ 1742.019749][T23053] netlink: 'syz.0.14646': attribute type 39 has an invalid length. [ 1742.198947][T23061] netlink: 24 bytes leftover after parsing attributes in process `syz.2.14647'. [ 1742.391688][T23070] netlink: 165 bytes leftover after parsing attributes in process `syz.1.14652'. [ 1742.495348][T23070] netlink: 277 bytes leftover after parsing attributes in process `syz.1.14652'. [ 1742.566124][T23076] tipc: Started in network mode [ 1742.571031][T23076] tipc: Node identity 4, cluster identity 4711 [ 1742.577556][T23076] tipc: Node number set to 4 [ 1742.685981][T23078] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 1742.925282][T23095] lo speed is unknown, defaulting to 1000 [ 1742.973587][T23095] lo speed is unknown, defaulting to 1000 [ 1743.015585][ T5898] IPVS: starting estimator thread 0... [ 1743.080688][T23110] FAULT_INJECTION: forcing a failure. [ 1743.080688][T23110] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1743.106054][T23110] CPU: 1 UID: 0 PID: 23110 Comm: syz.5.14665 Not tainted syzkaller #0 PREEMPT(full) [ 1743.106081][T23110] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1743.106093][T23110] Call Trace: [ 1743.106101][T23110] [ 1743.106109][T23110] dump_stack_lvl+0xe8/0x150 [ 1743.106137][T23110] should_fail_ex+0x414/0x560 [ 1743.106169][T23110] _copy_from_iter+0x1cd/0x1630 [ 1743.106190][T23110] ? rcu_is_watching+0x15/0xb0 [ 1743.106212][T23110] ? trace_kmem_cache_alloc+0x1f/0xb0 [ 1743.106235][T23110] ? kmem_cache_alloc_node_noprof+0x48c/0x720 [ 1743.106260][T23110] ? kmalloc_reserve+0xbd/0x290 [ 1743.106282][T23110] ? __pfx__copy_from_iter+0x10/0x10 [ 1743.106310][T23110] ? netlink_sendmsg+0x642/0xb30 [ 1743.106332][T23110] ? skb_put+0x11b/0x210 [ 1743.106355][T23110] netlink_sendmsg+0x6b2/0xb30 [ 1743.106388][T23110] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1743.106415][T23110] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1743.106440][T23110] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1743.106457][T23110] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1743.106482][T23110] __sock_sendmsg+0x21c/0x270 [ 1743.106510][T23110] ____sys_sendmsg+0x505/0x820 [ 1743.106538][T23110] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1743.106569][T23110] ? import_iovec+0x74/0xa0 [ 1743.106594][T23110] ___sys_sendmsg+0x21f/0x2a0 [ 1743.106619][T23110] ? __pfx____sys_sendmsg+0x10/0x10 [ 1743.106675][T23110] ? __fget_files+0x2a/0x420 [ 1743.106696][T23110] ? __fget_files+0x3a0/0x420 [ 1743.106728][T23110] __x64_sys_sendmsg+0x19b/0x260 [ 1743.106753][T23110] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1743.106784][T23110] ? __pfx_ksys_write+0x10/0x10 [ 1743.106814][T23110] do_syscall_64+0xec/0xf80 [ 1743.106835][T23110] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1743.106852][T23110] ? trace_irq_disable+0x37/0x100 [ 1743.106877][T23110] ? clear_bhb_loop+0x60/0xb0 [ 1743.106904][T23110] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1743.106921][T23110] RIP: 0033:0x7f284658f749 [ 1743.106938][T23110] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1743.106953][T23110] RSP: 002b:00007f28474e1038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1743.106973][T23110] RAX: ffffffffffffffda RBX: 00007f28467e6090 RCX: 00007f284658f749 [ 1743.106987][T23110] RDX: 0000000000000800 RSI: 0000200000000200 RDI: 000000000000000a [ 1743.107000][T23110] RBP: 00007f28474e1090 R08: 0000000000000000 R09: 0000000000000000 [ 1743.107012][T23110] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1743.107024][T23110] R13: 00007f28467e6128 R14: 00007f28467e6090 R15: 00007fff7c109018 [ 1743.107056][T23110] [ 1743.376122][T23107] IPVS: using max 33 ests per chain, 79200 per kthread [ 1744.662754][T23156] tipc: Started in network mode [ 1744.667768][T23156] tipc: Node identity 4, cluster identity 4711 [ 1744.685655][T23156] tipc: Node number set to 4 [ 1744.827233][T23161] lo speed is unknown, defaulting to 1000 [ 1744.855623][T23161] lo speed is unknown, defaulting to 1000 [ 1745.709306][T23194] netlink: 'syz.2.14696': attribute type 5 has an invalid length. [ 1745.717501][T23194] netlink: 'syz.2.14696': attribute type 5 has an invalid length. [ 1745.982152][T23199] netlink: 8 bytes leftover after parsing attributes in process `syz.5.14698'. [ 1745.996731][T23199] netlink: 4 bytes leftover after parsing attributes in process `syz.5.14698'. [ 1746.029746][T23199] netlink: 8 bytes leftover after parsing attributes in process `syz.5.14698'. [ 1746.183372][T23207] netlink: 64 bytes leftover after parsing attributes in process `syz.5.14701'. [ 1746.735412][T23237] FAULT_INJECTION: forcing a failure. [ 1746.735412][T23237] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1746.766333][T23237] CPU: 0 UID: 0 PID: 23237 Comm: syz.3.14709 Not tainted syzkaller #0 PREEMPT(full) [ 1746.766361][T23237] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1746.766372][T23237] Call Trace: [ 1746.766381][T23237] [ 1746.766390][T23237] dump_stack_lvl+0xe8/0x150 [ 1746.766419][T23237] should_fail_ex+0x414/0x560 [ 1746.766452][T23237] _copy_from_user+0x2d/0xb0 [ 1746.766475][T23237] kstrtouint_from_user+0xc4/0x170 [ 1746.766497][T23237] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 1746.766534][T23237] proc_fail_nth_write+0x88/0x200 [ 1746.766564][T23237] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 1746.766594][T23237] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 1746.766614][T23237] vfs_write+0x27e/0xb30 [ 1746.766641][T23237] ? __pfx_vfs_write+0x10/0x10 [ 1746.766658][T23237] ? __fget_files+0x2a/0x420 [ 1746.766682][T23237] ? __fget_files+0x3a0/0x420 [ 1746.766701][T23237] ? __fget_files+0x2a/0x420 [ 1746.766731][T23237] ksys_write+0x145/0x250 [ 1746.766752][T23237] ? __pfx_ksys_write+0x10/0x10 [ 1746.766782][T23237] do_syscall_64+0xec/0xf80 [ 1746.766803][T23237] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1746.766821][T23237] ? trace_irq_disable+0x37/0x100 [ 1746.766842][T23237] ? clear_bhb_loop+0x60/0xb0 [ 1746.766865][T23237] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1746.766883][T23237] RIP: 0033:0x7ff46618e1ff [ 1746.766900][T23237] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48 [ 1746.766916][T23237] RSP: 002b:00007ff466f8b030 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 1746.766936][T23237] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007ff46618e1ff [ 1746.766950][T23237] RDX: 0000000000000001 RSI: 00007ff466f8b0a0 RDI: 0000000000000004 [ 1746.766962][T23237] RBP: 00007ff466f8b090 R08: 0000000000000000 R09: 0000000000000010 [ 1746.766975][T23237] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000001 [ 1746.766986][T23237] R13: 00007ff4663e6038 R14: 00007ff4663e5fa0 R15: 00007ffcc17b4028 [ 1746.767019][T23237] [ 1747.100414][T23244] x_tables: ip6_tables: CLASSIFY target: used from hooks INPUT, but only usable from FORWARD/OUTPUT/POSTROUTING [ 1747.204437][T23247] netlink: 8 bytes leftover after parsing attributes in process `syz.3.14710'. [ 1747.251905][T23247] netlink: 48 bytes leftover after parsing attributes in process `syz.3.14710'. [ 1747.353119][T23247] geneve3: entered promiscuous mode [ 1747.358374][T23247] geneve3: entered allmulticast mode [ 1747.425801][ T12] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1747.468691][ T12] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1747.541636][T23260] lo speed is unknown, defaulting to 1000 [ 1747.548255][ T12] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1747.571487][T23260] lo speed is unknown, defaulting to 1000 [ 1747.592800][ T12] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1748.110947][T32533] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 1748.121990][T32533] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 1748.135776][T32533] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 1748.154731][T32533] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 1748.165564][T32533] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 1748.396533][T23282] lo speed is unknown, defaulting to 1000 [ 1748.438378][T23277] lo speed is unknown, defaulting to 1000 [ 1748.463199][T23277] lo speed is unknown, defaulting to 1000 [ 1748.716465][T23296] netlink: 666 bytes leftover after parsing attributes in process `syz.2.14720'. [ 1748.761771][T23295] netlink: 36 bytes leftover after parsing attributes in process `syz.5.14721'. [ 1748.851321][T23301] netlink: 8 bytes leftover after parsing attributes in process `syz.1.14722'. [ 1748.863178][T13063] Oops: general protection fault, probably for non-canonical address 0xdffffc000000000b: 0000 [#1] SMP KASAN PTI [ 1748.875123][T13063] KASAN: null-ptr-deref in range [0x0000000000000058-0x000000000000005f] [ 1748.883548][T13063] CPU: 0 UID: 0 PID: 13063 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) [ 1748.893104][T13063] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1748.903238][T13063] RIP: 0010:klist_remove+0x14a/0x340 [ 1748.908522][T13063] Code: 4d 89 f5 49 c1 ed 03 43 80 7c 3d 00 00 74 08 4c 89 f7 e8 19 55 d6 f6 4d 8b 26 49 83 e4 fe 49 8d 7c 24 58 48 89 f8 48 c1 e8 03 <42> 80 3c 38 00 74 05 e8 fa 54 d6 f6 49 8b 44 24 58 48 89 44 24 08 [ 1748.928134][T13063] RSP: 0018:ffffc9000419f620 EFLAGS: 00010202 [ 1748.934199][T13063] RAX: 000000000000000b RBX: ffff888030975b80 RCX: 0000000000000000 [ 1748.942251][T13063] RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000058 [ 1748.950214][T13063] RBP: ffffc9000419f720 R08: ffffffff8f68dd43 R09: 1ffffffff1ed1ba8 [ 1748.958265][T13063] R10: dffffc0000000000 R11: fffffbfff1ed1ba9 R12: 0000000000000000 [ 1748.966843][T13063] R13: 1ffff110064a740c R14: ffff88803253a060 R15: dffffc0000000000 [ 1748.974829][T13063] FS: 0000000000000000(0000) GS:ffff888125e1c000(0000) knlGS:0000000000000000 [ 1748.983936][T13063] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1748.990610][T13063] CR2: 00007fff7c107ff8 CR3: 000000008c13a000 CR4: 00000000003526f0 [ 1748.999184][T13063] Call Trace: [ 1749.002608][T13063] [ 1749.005529][T13063] ? __pfx_klist_remove+0x10/0x10 [ 1749.010546][T13063] ? kobject_move+0x5a6/0x6e0 [ 1749.015247][T13063] ? __pfx_kobject_move+0x10/0x10 [ 1749.020296][T13063] ? do_raw_spin_unlock+0x122/0x240 [ 1749.025594][T13063] ? get_device_parent+0x366/0x3a0 [ 1749.030709][T13063] device_move+0x193/0x730 [ 1749.035123][T13063] hci_conn_del_sysfs+0xb8/0x1a0 [ 1749.040063][T13063] hci_conn_del+0xc36/0x1240 [ 1749.044665][T13063] hci_conn_hash_flush+0x191/0x260 [ 1749.049870][T13063] hci_dev_close_sync+0x821/0x1100 [ 1749.055102][T13063] ? __pfx_hci_dev_close_sync+0x10/0x10 [ 1749.060649][T13063] ? up_write+0x1ac/0x410 [ 1749.065068][T13063] ? rcu_is_watching+0x15/0xb0 [ 1749.069834][T13063] hci_unregister_dev+0x21a/0x5b0 [ 1749.074854][T13063] vhci_release+0x152/0x1a0 [ 1749.079375][T13063] ? __pfx_vhci_release+0x10/0x10 [ 1749.084414][T13063] __fput+0x44c/0xa70 [ 1749.088422][T13063] task_work_run+0x1d4/0x260 [ 1749.093026][T13063] ? __pfx_task_work_run+0x10/0x10 [ 1749.098141][T13063] ? kmem_cache_free+0x197/0x620 [ 1749.103164][T13063] ? do_exit+0x68f/0x22f0 [ 1749.107484][T13063] do_exit+0x694/0x22f0 [ 1749.111652][T13063] ? __pfx_do_exit+0x10/0x10 [ 1749.116355][T13063] do_group_exit+0x21c/0x2d0 [ 1749.120945][T13063] ? _raw_spin_unlock_irq+0x23/0x50 [ 1749.126137][T13063] get_signal+0x1285/0x1340 [ 1749.130643][T13063] arch_do_signal_or_restart+0x9a/0x7a0 [ 1749.136187][T13063] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 1749.142351][T13063] ? ksys_read+0x1e1/0x250 [ 1749.146785][T13063] exit_to_user_mode_loop+0x87/0x4e0 [ 1749.152091][T13063] ? rcu_is_watching+0x15/0xb0 [ 1749.156865][T13063] do_syscall_64+0x2c1/0xf80 [ 1749.161560][T13063] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1749.167718][T13063] ? trace_irq_disable+0x37/0x100 [ 1749.172748][T13063] ? clear_bhb_loop+0x60/0xb0 [ 1749.177418][T13063] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1749.183403][T13063] RIP: 0033:0x7ff46618e15c [ 1749.187816][T13063] Code: Unable to access opcode bytes at 0x7ff46618e132. [ 1749.194903][T13063] RSP: 002b:00007ffcc17b4380 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1749.203320][T13063] RAX: fffffffffffffe00 RBX: 0000000000000003 RCX: 00007ff46618e15c [ 1749.211291][T13063] RDX: 0000000000000030 RSI: 00007ffcc17b4440 RDI: 00000000000000f9 [ 1749.219259][T13063] RBP: 00007ffcc17b43ec R08: 0000000000000000 R09: 0079746972756365 [ 1749.227234][T13063] R10: 00007ffcc17b3d40 R11: 0000000000000246 R12: 0000000000000258 [ 1749.235244][T13063] R13: 00000000000927c0 R14: 00000000001aab3a R15: 00007ffcc17b4440 [ 1749.243559][T13063] [ 1749.246663][T13063] Modules linked in: SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 1749.252951][T13063] ---[ end trace 0000000000000000 ]--- [ 1749.262578][T13063] RIP: 0010:klist_remove+0x14a/0x340 [ 1749.267926][T13063] Code: 4d 89 f5 49 c1 ed 03 43 80 7c 3d 00 00 74 08 4c 89 f7 e8 19 55 d6 f6 4d 8b 26 49 83 e4 fe 49 8d 7c 24 58 48 89 f8 48 c1 e8 03 <42> 80 3c 38 00 74 05 e8 fa 54 d6 f6 49 8b 44 24 58 48 89 44 24 08 [ 1749.296513][T13063] RSP: 0018:ffffc9000419f620 EFLAGS: 00010202 [ 1749.330440][T13063] RAX: 000000000000000b RBX: ffff888030975b80 RCX: 0000000000000000 [ 1749.339006][T13063] RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000058 [ 1749.349789][T13063] RBP: ffffc9000419f720 R08: ffffffff8f68dd43 R09: 1ffffffff1ed1ba8 [ 1749.442614][T13063] R10: dffffc0000000000 R11: fffffbfff1ed1ba9 R12: 0000000000000000 [ 1749.450804][T13063] R13: 1ffff110064a740c R14: ffff88803253a060 R15: dffffc0000000000 [ 1749.483206][T13063] FS: 0000000000000000(0000) GS:ffff888125f1c000(0000) knlGS:0000000000000000 [ 1749.497522][T13063] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1749.505036][T13063] CR2: 00005602633da000 CR3: 000000000dd3a000 CR4: 00000000003526f0 [ 1749.532562][T13063] Kernel panic - not syncing: Fatal exception [ 1749.539027][T13063] Kernel Offset: disabled [ 1749.543366][T13063] Rebooting in 86400 seconds..