last executing test programs: 2.881249291s ago: executing program 0 (id=3017): bpf$ENABLE_STATS(0x20, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000840)={{r0, 0xffffffffffffffff}, &(0x7f0000000040), &(0x7f00000003c0)='%ps \x00'}, 0x20) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000800)={r1, 0xffffffffffffffff}, 0x4) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x16, 0x10, &(0x7f0000000100)=ANY=[@ANYRES32=r2, @ANYBLOB="0000000000000000b70500000800000085000000a500000095"], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000640)={r3, 0x0, 0xe, 0x48000000, &(0x7f0000000300)="40f0538ef047b21fb60068305500", 0x0, 0xf00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 2.64712142s ago: executing program 0 (id=3020): r0 = syz_init_net_socket$ax25(0x3, 0x3, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB="bc01000019000100fcffffff10000000ffffffff000000000000000000000000fc00000000000000000000000000000100020000ffff20000a0080002e000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000000000000000000000000000000000009000000000000000800000000000000000000000000000000000000000000006309000000000000010000000000000009000000000000008000000000000000000000010000000000000000000000000100000300000000040105007f000001000000000000000000000000000004d43200000000000000ac14143b00000000000000000000000000000000000002000000000003000000fcffffff7f00000100000000000000000000f952fffffffc2b0000000000000000000000000000000000000000000000043500000000000000080000000000000000000020010000000000000000000000000001000004d43200000000000000000000000000000000000000000000000000e94433"], 0x1bc}}, 0x4048050) connect$ax25(r0, &(0x7f0000000040)={{0x3, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, 0x8}, [@default, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @null, @bcast, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x47) 2.643902857s ago: executing program 3 (id=3022): sendmsg$IPCTNL_MSG_CT_DELETE(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="2800000002"], 0x28}, 0x1, 0x0, 0x0, 0x24000083}, 0x20044804) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000480)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb0118000000000000aaffc637809ac22ddb00000f0000000f00ed12bb34c627b9a4dc1c948700"], 0x0, 0x2a, 0x0, 0x0, 0x7ff}, 0x28) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000880)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000010000000900010073797a30000000002c000000030a010200000000000000000100000b0900010073797a30000000000e000000000000000000000050000000060a010400000000000000000100000008000b400000000028000480240001800a000100717565756500000014000282060002400400000006000140000400000900010073797a3000000000140000001100010000000000000000000700000a"], 0xc4}, 0x1, 0x0, 0x0, 0x40000}, 0x0) sendmsg$IPCTNL_MSG_CT_GET_UNCONFIRMED(r0, &(0x7f00000006c0)={&(0x7f0000000600)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000680)={&(0x7f0000000640)={0x14, 0x7, 0x1, 0x3, 0x0, 0x0, {0x2, 0x0, 0x9}, ["", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x801}, 0x80) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r1, &(0x7f0000000680)=ANY=[], 0x3261e) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmsg$inet(r2, &(0x7f0000000f80)={&(0x7f0000000000)={0x2, 0x4e21, @rand_addr=0x64010101}, 0x10, &(0x7f0000000140)=[{&(0x7f0000000180)="8d", 0x1}], 0x1}, 0x2c044010) shutdown(0xffffffffffffffff, 0x1) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r2, 0x84, 0x1b, &(0x7f0000000040), &(0x7f00000001c0)=0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r1, 0x0) r3 = socket$inet_smc(0x2b, 0x1, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f00000004c0)={'vcan0\x00', 0x0}) connect$can_bcm(0xffffffffffffffff, &(0x7f0000000500)={0x1d, r4}, 0x10) r5 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r5, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) syz_emit_ethernet(0xbe, &(0x7f0000000700)=ANY=[@ANYBLOB="aaaaaaaaaa230180c20000000800450000b00000000000119078000000000000000000004e20009c907801000000040000007b4b143b7461fd777b1c012bd14efb9f49fcdb8f080c26a04883ad5c8c82b8af584cbf2649a50f2db05aaa41f6e819b83bc110c9e449e07fbc43efa8698d0a881c51852e4451b57d037ad3c045942824251d7d17b5191584bcd4fbe40a23424dbcfd56f1375461caaa2f19935e6996c7096ffeeb03000000000000649a3bfbc1f39cb307b3472eb9cdb042d2f1e1be9e60d1f74783d8f84236ed9dece7c21b7cb308"], 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000380)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x8, 0x0, 0x0, 0x41100}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={0xffffffffffffffff, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) recvmmsg(r5, &(0x7f0000002380)=[{{0x0, 0x0, &(0x7f00000009c0)=[{&(0x7f00000002c0)=""/71, 0x47}, {&(0x7f0000000180)=""/5, 0x5}, {0x0}], 0x3}, 0x7f}], 0x1, 0x40000000, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r3, 0x0, 0x60, &(0x7f0000000000)={'filter\x00', 0x7, 0x4, 0x3e0, 0x110, 0x110, 0x210, 0x2f8, 0x2f8, 0x2f8, 0x4, 0x0, {[{{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac, @mac=@remote, @loopback, @local, 0x1, 0x1}}}, {{@uncond, 0xc0, 0x100, 0xbfffff1f}, @unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "716ebd2e1aa0cc683e62f312359594df00da56317f76121697127951fdba"}}, {{@uncond, 0xc0, 0xe8}, @unspec=@NFQUEUE0={0x28}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x430) 2.536581437s ago: executing program 0 (id=3023): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = accept4(r0, &(0x7f0000000000)=@phonet, &(0x7f0000000100)=0xfffffffffffffd48, 0x0) r2 = bpf$ITER_CREATE(0x21, &(0x7f0000000140), 0x8) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000940)=@newqdisc={0x24, 0x24, 0x2, 0x70bd2c, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, {0xe, 0x1}, {0xfff3, 0x10}, {0xa, 0x1ffc0}}}, 0x24}, 0x1, 0x0, 0x0, 0x48811}, 0x40) r4 = gettid() syz_open_procfs$namespace(r4, &(0x7f0000000340)='ns/pid\x00') getuid() socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPVS_CMD_ZERO(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000080)=ANY=[@ANYRES32=r1, @ANYRES16=0x0, @ANYBLOB="0100000000000000000010000000280001801400030000000000000000000000ffffe000000106000200000000000600010002000000"], 0x3c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000300)='./cgroup/syz0\x00', 0x200002, 0x0) r7 = openat$cgroup_int(r6, &(0x7f0000000040)='cgroup.max.descendants\x00', 0x2, 0x0) write$cgroup_subtree(r7, &(0x7f0000000180)=ANY=[@ANYBLOB='-', @ANYRESHEX], 0x27) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r5, 0x8933, &(0x7f0000000040)={'batadv_slave_1\x00'}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[], 0x58}, 0x1, 0x0, 0x0, 0x20000001}, 0x20980) sendmsg$nl_netfilter(r2, &(0x7f0000000200)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000001c0)={&(0x7f0000001f40)={0x1590, 0x5, 0x6, 0x801, 0x70bd28, 0x25dfdbff, {0x0, 0x0, 0x6}, [@nested={0x43, 0xce, 0x0, 0x1, [@generic="916d5d2f9651c3c8b93f4de28bb404063d47642dc0a0d0d4e0f62c518922699712121382914681ae0532003f731171d6cd83a057a2e8c6e218dba9277fc454466b401ae5ad702c048ddbbe9daab97d06372f501648cbebf4763e2bba08d64946142b96361af0bfaef8bb72864053e1cff1a4a74c259d9d", @typed={0x8, 0x117, 0x0, 0x0, @ipv4=@initdev={0xac, 0x1e, 0x1, 0x0}}, @typed={0x8, 0xda, 0x0, 0x0, @fd=r3}, @generic="9e235ecfb956e44f53d21fe14ce1a9d67e42643980ef8500ee05fe13bc443be66687b8bd55509cf6e4616a"]}, @nested={0x20, 0x129, 0x0, 0x1, [@typed={0xc, 0xa2, 0x0, 0x0, @str='counter\x00'}, @nested={0x4, 0xfe}, @typed={0x4, 0xe6}, @typed={0x8, 0x1f, 0x0, 0x0, @pid=r4}]}, @generic="d5749af01bde3e7eb73a363322fd21bc9fffe266cf38c1b3c3aa52f85f5bbc1f5442948dd1ba1d4a75f2c28f3721c2df0e2a6d1497e1b87402a0e5dbaeb461c617bdc4d944c1db20d5b93aaa1e2af7559adf18444b0b9ff7125e309ac6b1389387c766c1274c606ebad6cbbdbab49f50f9fb568c2ab0e6c38fc5ec91414eb51039f2fa751e2530e8c9bc30e9be7ef18d91df9c50655e7df6a79bc3a234225231ffbf0aadea6a27b97ed12d9509fe411f", @nested={0x1250, 0xab, 0x0, 0x1, [@generic="80c649ddf3fb13c26d1a6ac4e4e2a0fe77fb5a4e96370cef949764789b86219c6b32f07b83d1bfdde19ee6f29244ccfccef8b87a90346c812d8059f17368b3e030756d522e54ed9c66f92d3fba420c1bb815f9b3b20e265f8f77663f5370eaf1d014dc427ea22d6e66194be8a5abcbabd1dca6a949a71c2695b5261fbd1c8d70e77651def564a484b59f3fef0307f318e9c497a8edbea9f2b55af24d582fb42e3fdc6f76f33c85cdac9ae77663895afece85dba3", @nested={0x198, 0x146, 0x0, 0x1, [@nested={0x4, 0xe0}, @nested={0x4, 0x90}, @generic="2a311ae0ee068d2a54c157820175e7fec530b739d4d09364a3cc4ab176fac549b9cb88949ab7234d92a0e258a14f80532e3581560b284e2a2efd93363f88be45580b8340aa5f41b12b758d4b1733bd6690accaa663", @nested={0x4, 0x5d}, @generic="d5a48eb98d1a3d69176c9f6e9884c8806bafc055f7f55aa6fb0da88ccf9e3ad9d978d51ded9e87f4e4daff7128c8e612f2cf5a43a1d07ee133ff4ef7262f3ff96a90cd5bffc16402b8ac8d1c068dab865db8096780e69b8b17b15879a325a0814fbe42467d33a7a5b81d5c76c3a2f5bdb98328b093ab7d89", @generic="4b551335aa9b97487c91dd26", @generic="5fc1f0703b6fa72aca3f627aa587cd2c2d0e6b3087e9cb287cef5fe7dc01abcef081bfa8f1dcdeec8540cfb082ccade4bd1c5760d7d6680390df914453deba285857b9f04eeb9d84f0fa79c3dee05cac23750e8baf4a452030f37fd01f77591fa87a529884ca55b9a35f01353fcf103eed9a327dc20bdd7a985334c78c5f2691a11b565f5b53cf1f80997e94b611cd848acb92b32f46c415bc1e4611de823baf8d6fd5ad9135ed9ce6f088b1826a95"]}, @generic="1e1ee164f1a8196c0502cf6b80e8a1b211b948716c41f253a8cfb57a86d4801edff2dfe68ac0725a043ff7e2cee6f554f56fec253b74bdede9b2d3d5726f775504e31912a017d2feee735fec20289891d7d809fd61c87982d1ecfc803c6799b9e38bcec080658238c2143e13a4604926eb8d4fdd1b2f4febe3f4c3b7b5186895b085d1a1e0321c09b181db23998bcd54135b35b02bc708a8dd38b9f7dd335dfd19b2954a268c0a0ad248141459a5215860cc006e9987d70c516349bc49cf7cc99eaa44c0318956f6975211b4d599f8ad7944b24a2bb8d893d7119d8b6765102ae3e76ad7a3e6113599696fd40a1ec1e8b19ccf3d0b48750e72b97a374bb42eb9147597fb27a2b32710b5ac170e615c2329c4822f4aa3d823a11bae582729581988b54701ff877e5c6b156f23130a9d00898eb334de801b185611e783b26c20cf2e6d440a12d9fcb1d2c4b245fd3a568948d33e5cb47196b431eec157124f6792fb67a664fd222c7c3b7e791986ca121f169b95354067000d4f736db7b7ca00cb76aacf965b4ed6f5a300503a7a580d254e33ad81358bb0a677cc8d2779acc078efaba3b24108ed29fa8c987ae74d6fcca5437dd4ada13291d8fe76237f8a2d0a238948f0ce8063d8b81f54ca7cf1c158a88a30858fe10c22a47c0f2e0b3670ce157dd591dc700bb64d0069f54457b3fbc868d8645166c4f192458de5e296ce0c2ed1cdc3bddb68ed689161f48ae438f80ecd19f7fc5ce182374ea3474a8b236701a35dd5641130374a32bcc9af8684ace9a835e07f933e902aef9f3ab6c63ae3c59e4bd17bef5f9e54059e56595ffe55bcca533592c45c6647b515ad11749974a82a383004cddd9bb600594240b302784b44d912a6ef76d54bf0f9ffed06e8f212f68220f6b3c1044c47563c9eac1ff63a63cf0a0a183cbfa776d6c3a9f1ad110967464e9908899f19d7b8ae4f113e9850f8a8057aba8bbf15f60cd4e2800652587403fd3a2fdaf4a616121b83c9b018987366631f1d6c47cd7bd60ae2e48771dd792c10b8acebbda380a0a9b9d98a842a4b2d0058e418e9ef06f74628a154ccae5db2fff15c71963aa65ae68b04ef2fd92e40674a94e8b951b14eabc406add7a3538e4b81525379d5490378e042399cacb3ee888d3ca40848e7be232ec0b068945380d9c790c8d8fa99c3aa5978aeeb8095dc561af0fdd157cf3dea0b881812cb54c67bd745eb6c1cf3cc240e6d98c2392a5982d4ddf17eb66559816b98cd8b2d9345d89a254be1eaba140c0a8b077181c52a60a012cc171634cb08a8be7c4d637f6de2e406ca0e845abbd4fdff7bf6e547c4fbbf2fbcbb8ddb2fcbfdb6a33a00f65da627a736c73d8f10929ef4a01deeeea944643b3c2a6813cec9e5849527c36709c1b2f5120f471db65162ef09d5a58bfa619c6952628a31a719567a52792fcefd6f09460d12758781df93986efa102b315fa023ee4995b1cada71b80f12b8211f0fe8ae6da0d8a57bca9c855f5561d4d81d2d8d75f7f5e4770fae51114e1a8245caf899f2f208b2dc027ae2bc79d06db8d2408b825a1e887ea6412784dcbd4e589a3183dd6563b9c3c7ce448027e0e54cc2d7b9c823bbbf3b16b031d599669600bd9305153bb1722f0807f045b6336374c56cd8b576d08af4cad2446fcd10cc97a54fffb0201db58a2567a7143817b7b4ffa6416d11c39908cc49977423201d77c9c89ccb73bce61d6f7e002eef7ed90903959d7c82b7368ffd9986e7b313700ea0f826408971be4f6c76047acf8a937214daefb5ba861ee15f421001123decda946a26086c3a42dff62b9413a371d8d3782995052309825b63609aeac66e14286b8f7b189460a7cc4da321d1a7861f853e2c54f53a1cafaf5dae23f63dcf8de590ca184a1977958e31e939d53b9a48839eaf1182e2f800f805a4ceaf6ad6836ca92eb222bd01786e0aaa30575d0bfeb5a32f1a3c2e17b16588ce7c1b247b6e31cd152b329d6dbe381b59e9ce824d541f8dfa380d5d236f965ec8b858da0ab43d3b5534b1b00f94344e42812fef62ec22b2964dd008ef5b9f96ad80bae08ddd338c4492ad890590be163ae159ae4e799f4ca6ba1b82d9156888084c8b5c82c4b2a428e17e663ccb439989a1f768783ed1afb2c53d56bd3dc6f82af251de4ff775571aa5fd391542f2de5fbe06e65a01e799c327e29547690dddaccecf149acf7efa1f605c43b21914fa5800b8d9b517588da6cba580a82f70b2d13848940e8fe138343f643d58d200124db8f99cc9caef81f91c7bd44b1eafe4ac3bb2040998b78de4bd23f7697ae08b9d13c9bf9508e30dcd1dfbb76ecb52dfc2b943107f2a0d9d519cba15d4927c020d2ed27cf8538c5e5b8b222882e4cde76d6a38e904921e1827ed2a150fff72104084322947c2867dc7d88fcf388e3b7576c75eec3dbb86543673b234c2b3236eda2ea89ac5d9a00b450db6694840a76e48107abf444e373251bbf5ccf5081e70784d03bfc0f6891e7cde574ff0319615ddf86e083410e320ae63e55b0b48622e9f3f2b699604f61c9887b7c1d31d0f3b75d3e12603d2cab0368e9b9e7c64d98cdedbbe4deda4d314989be2147a4117ae803fb3cb4ac4b851b3e654163ff79be6b64b08d32781a3bc27e9f9ea5b393243224ecb3688a35e5aa70289b6172a15da79c0df24dcdc10e122eae02c79c5dd402688d937d3be747288e6b15c5f3b19f6019361c93005693af147d6d7c484f02b26046ba10adde45777a5a49abe1016b62042a6d3318730ce29a9cf2315080516dfefef08acb36cb52fe9959148a699e5a6cd2569ebf35eb56e72a2cae5273bf1eaf5522309f6a7b63678aa2327815c00581792c81464db316b5e19193b8b67e629d1270d73fd31de532e8e67e3257fd9960de7d1f456c3796e7f6bd5b6abde0faf591fb846c9903bae4510bd519233491dcf822fa0a21e716a511074b4e4ede1d96a384011a048fcf617021fe0bddba04f78a82c0a1b736a16f03d125306f0c6d9082957ca9cd8be6224230e2c4e189101293425376f3d21818a97d0202508c2a948d479f35bd72f417f2d93468ec03641de628f4f2c4b1b3e2d675a8bd0edea2f4a276f58113d9d7955842fa9c5963de31fa0356bfa5fde74f27aefb96df4c2f2d246af6be814148b4ca1399df594a229a8af841090c039d22ba1045c9b865b9fe9dea494f890af522888765c6129491fbd714b779655024158a12d07f568c96b9100975a327c021f95732919ad9ba86b5bfa6fd0fa7af8b7e2fdc6f61e9af5a0f5fa258c7babf9ed21b32d89d919b83d57f4e592e7d4d64864af59fdf8017c5a978fc67ed7d56f2c601e067dd255662fdc29f8379bbec5da4e66f25077d2b998be80dd3ded3c22cdfc4c485ab63490050471bf5bc1b8704619e5f72b3b898e65e35038f7022073b01c281435f9b2e69e6795c11ec66f6fcb2493a7d55d3c4176f5aaac53077dfe029244a65227b6a436371d4ff1fcce65877340e069db09b98cae5629d9c95407e0fda9921ace486d82d1f7238c7cc937ff6c791bff7b36ba2b03df83428402491f8488013f769188ee01b20ea9fd3282f729004dfa4d8d4f4d8b5e7c295beecca7e6f35f3d1eac880b1164311f8b01a6aceeb989311ec47b975a63a7223cafaae24c73466d8f0440c3c55ee519ea31196c90eb9955c5cb04ad907bfedc399d0a4ff388d6da5af95993ed60a32b590940cd46795991e4b97e3757ea9df6687911f369b64a18d05069c6809075340167aaa139d202f438c5e4ea25bdb889ecfd67b657d6378a5f85a65de713f0db15738ac5c191dcf922da8c51d6a8a76266c36587cd437464b0fd8cb91e22b4c8c67194ef3fa498ac42ed90ac5f8fe8ebc9bb3089aa816c2e816c0be3c1d38e9816ebd59178cdc9b82391f2b5574bea7e64ac0bb62c00bfa9bfb177998d932faf8e9f407686de13d12d60c0d316700b1fe79aacd87b58a913918a706feec1c976883a62bf22d6accd32e19f5b52c1cf1a34a08cf24d28567fc6c1ed2347df7438e37681d68450d0e1f4eba42aa16af3deaa9a8342f50647fb7e0eebc11fdbf295313bde63f0218fcc432365ea9485bad6a85c29d6416f92072d8c25d932c6ba98706130f4f130ac69b2c6f15ec1a61cf0dffb55cb55665bdc0df0033bde0a4f9f5dc246cc65b0d4308bdce03eedae91c8b085a0ebe3c70eaf4e8909687bcfdf42202b9db4edc094eb376a954b3afb60a204e83f903b88ff4ee1d3f3941e1feaaaa439014a6fa2ada8b80fd2ee33f9cb90b88a9bf2ba8d03c26a0a2f5a4b186ab1edd4772f4ad4d51ce600286d433ae6362d8ca2d3ba2d303b88d196f8f0656107ed4c221f185bc1851c4a171fc5179a93ca901b5f68b5f07b16a0647152754e4ce46c9ff96c6827d2b680edf103ca22f93a2c96055e858f46727dd9a5dcaf13f1102c91ac4242019488ce5c77209b054e83fee3c4564f5eae79cb2f774fc6a445d74e09188fcba1b1cba824803ddae9f7471b437d68379d3c6ef38ab6bda6bf0721f867e5b7eebb21a7129d93b6dde6893d68113a543c8b2e2ae56fcd9e90d9ebd2f153e6653d58f368ccc0605318c548bc321f076a38d8643ba13016dbb02f610aaf8a78623e7c3714c5bd1852d6a9d6a70cef5821a72c0d2e5f6db90223d4e004434f5d849686269cf75b0502f37bd074535b4572be38861a73ba468ff802ada8c17ce17853da7328187df687d9512bc31ed5cda1858a42f2272dd8f353b0b17ea021942d326d140c0856bbbd3df4b2f8ef23cbf92c12e6842e197a843279b0997ba31de47256bca73350f016e8cffa8cbc040d04ec55921ff93d4b38ea128d89e5bd069a031d918f182782381fe0d9e564415640e64b6772b9cb6b5fb112cc6dc9f1c8cd39189227131d2c20b18469a2a43a5decfee93a2f92d4bd6fa97218c41ccb025be408ce528fd0045259668148fbc89556f74486808ea5f3260db136a9ed27103717a18b2b2c00f1bcf8a10f5c607bdfdfbe1a8a2717019c23a2760699edd95509f5d7b8e90e9e5a6794eb8565a42e33259246d5afa65fd6d5e2369cfc1208480506aa70f0b0bef542ef9a0796e752b86977a1bb461bad9b167183f664c468456f4e2e4252c41660d1bee4693b1a93dc2131f4d81e3b63a1d427efe2866f1e6d9fcf49f9e6ac9b5db56b68a73d3b4f5e4a15adde8e3e2b415678efbd46aedc1d69c67172dd36180262d27ddd1ea44526bb8b7f3331f38a7af8876bc545845dadbf67b801e85faacf3682aa4df903cf504d5d808b0f01b9fadb34a2959534517d9fed9372088c09f45974f7f516a8e02251ba92829a82061fcaf79f3ecf51135860f8a90f2ea40ee2ce0f04f851ed6b9048d554107fb6e3be987bffc207c44532ce9bdfc29dc5abb879092bb36eab272d919524029d59dc3deb4180bd77b88b93707e86afa17007b2ef9a2af3ce1b197281de6be51221c699a57251a5b72060b4f6e6afb5810434ff72bf482a02541d8aec9c5c5ca2c07d1884a69fe8ac8b781773a85791cf794165954ff76436e2b4912cd855636da1f32b55b7181169ba1cc8b12588d6f70b35b31aa7a3b3db1c7b7da2f30963990a0f0b561384fc7e40387358299f8b3b87af47b7ec3963b5685057d9d24e3c2f02da2f01b03343c99c21b3c2a41a27bf5ff2cfe2ab2f2e529a425569f580b36b46d742de6b0280dad4ae7b256e4b229bc1043f3eabd184a311a8533eac601cc9f9106e94e0dc72c243b538c961677b239de2046f1de4"]}, @generic="aa6308a692bdcdea658ce684630544800e3be291f31dbc5d713652bf87ccc8899a6de00f0b25898c", @nested={0xd3, 0x114, 0x0, 0x1, [@generic="fcfb0e", @generic="a91f2b34eddf8fd7dfb307849d0ab4297946ab4ecac6f64449f509f8d2abdbec25558b89bd204c50257cda016a4ddb4541d8aeeb5c612816e70a16c30368e5bf77af71d4362a068e62443cbffa3e702fb3cd914b292d0c908936d5049844dede642f365f2e2e8ac68825915e6a706f825cd63c6278281dc64f18c6c77dbd72b476752c2dfe206be5074b794d3646cfee3d3252b307a96ea850f93362900162a4af58a3ef19bdc26b4ca68314ad7120314ef0c43b7924aaa358472dbd0d2b2f7d103ce0412e1f659fa9c9a045"]}, @nested={0x10a, 0x12d, 0x0, 0x1, [@nested={0x4, 0x3d}, @nested={0x5f, 0x8c}, @typed={0x8, 0x144, 0x0, 0x0, @ipv4=@empty}, @generic="ae0e3a2733e7ca73314ea04d606d510a7344e2cd691032c0d79fbeb46e08316da84b734157c808", @nested={0x0, 0xd1, 0x0, 0x1, [@nested={0x0, 0x13b, 0x0, 0x1, [@nested={0x0, 0x124}, @generic="483a145c48212520fb6a07a4a27d16253cfdc6aa70170900be68bbf7ae487c74c846f03e2ed6769193039649ed777ddc97be3811b37ad6b8bfc11fc52ade9c5e65db8f59e03998b05cff3da51cfef9988d27273590931acc98aeda35c432ab4b2a323dc59922c14b867526de32e84df5d1abfe910989734a64cedb52d30e9b783c1960", @typed={0x0, 0xf8, 0x0, 0x0, @ipv6=@private1}, @nested={0x0, 0x93}]}, @generic="bc5b67da"]}, @typed={0x8, 0x8a, 0x0, 0x0, @ipv4=@dev={0xac, 0x14, 0x14, 0x31}}]}, @typed={0x8, 0x11a, 0x0, 0x0, @u32=0x8008}, @typed={0x8, 0x108, 0x0, 0x0, @uid}]}, 0x1590}, 0x1, 0x0, 0x0, 0x8000}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000840)=ANY=[@ANYBLOB="140000001000010000000000000000000100000a70000000090a010400000000000000000a0000040900020073797a310000000008000a40fffffffc0900010073797a3100000000080005400000000d2c00128020000180090001006c617374000000000600657200040002800800034000000130140000001100010000000000000000000100000a4b75df66e166951f21cae21c23a8333d2febf846a2dbbee9d97cc8f89195840f52b68f9c96dd722d16ee14a2ecc72c24122bd414dc0e180b0a3530"], 0x98}, 0x1, 0x0, 0x0, 0x4044050}, 0x40) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000800), 0xffffffffffffffff) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r8, 0x8933, &(0x7f0000000100)={'wpan0\x00', 0x0}) r10 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL802154_CMD_DEL_SEC_DEVKEY(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000045c0)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16=r10, @ANYBLOB="010025bd7000fddbdf251e00000038002f802800038008000100000000001c00038006000300feff0000080002000200000006000100020000000c000200000000000000000008000300", @ANYRES32=r9], 0x54}, 0x1, 0x0, 0x0, 0x4000891}, 0x20004044) r11 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f00000003c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r11, 0x8933, &(0x7f0000000000)={'wpan0\x00'}) 2.177313903s ago: executing program 0 (id=3026): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@newqdisc={0x50, 0x10, 0x1, 0x0, 0x10000000, {0x0, 0x0, 0x0, 0x0, {0x1}, {}, {0xe}}, [@TCA_INGRESS_BLOCK={0x8}, @TCA_STAB={0x24, 0x8, 0x0, 0x1, [{{0x1c, 0x1a}, {0x4, 0x1b}}]}]}, 0x50}, 0x1, 0x0, 0x800000000000000}, 0x0) 2.115145712s ago: executing program 0 (id=3028): r0 = socket(0x40000000015, 0x5, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x7, @dev={0xfe, 0x80, '\x00', 0x23}, 0x3}, 0x1c) bind$inet(r0, &(0x7f0000000340)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r0, 0x0, 0x0, 0xfffffffffffffff4, 0x0, 0x0) 2.06003817s ago: executing program 4 (id=3029): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="6000000002060103000000000000000000000004050001000700000013000300686173683a6e65742c696661636500000900020073797a30000000400500040000000000050005000a00000014000780050015000a00000008001240", @ANYRESDEC], 0x60}}, 0x0) sendmsg$IPSET_CMD_GET_BYNAME(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x14, 0xe, 0x6, 0x801, 0x0, 0x0, {0x2, 0x0, 0x6}}, 0x14}, 0x1, 0x0, 0x0, 0x40040}, 0x4) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)={0x14, 0x3d, 0x301, 0x70bd25, 0xfffffffc, {0x1}}, 0x14}, 0x1, 0x0, 0x0, 0x448d3}, 0x0) r4 = socket$kcm(0x2, 0xa, 0x2) r5 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000840)=ANY=[@ANYBLOB="020a00090700000026bd7000fbdbdf2505001a00ac14141c00", @ANYRESOCT, @ANYRES64], 0x38}}, 0x20000000) r6 = socket$igmp6(0xa, 0x3, 0x2) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r6, 0x8983, &(0x7f0000000300)={0x0, 'syzkaller1\x00'}) r7 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) write(r7, &(0x7f00000000c0)="f900fb69c595491567", 0x9) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) write$tun(r0, &(0x7f0000000340)=ANY=[@ANYBLOB="000088f888a800000000aaaac5aaaaaa88a8a00081"], 0x72) 1.976308685s ago: executing program 0 (id=3030): close(0xffffffffffffffff) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f0000000340)=ANY=[@ANYBLOB="9feb010018"], &(0x7f0000001f80)=""/226, 0x18, 0xe2, 0x2}, 0x28) r0 = socket$can_bcm(0x1d, 0x2, 0x2) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000040)=ANY=[@ANYBLOB="1800000002000000000000000000082295"], &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x1e00, 0x21}, 0x94) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'syz_tun\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000000c0)={r1, r3, 0x25, 0x2, @void}, 0x10) syz_emit_ethernet(0x56, &(0x7f00000005c0)=ANY=[], 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x3, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x5c, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x21}, @NFTA_SET_EXPR={0x20, 0x11, 0x0, 0x1, @quota={{0xa}, @val={0x10, 0x2, 0x0, 0x1, [@NFTA_QUOTA_BYTES={0xc}]}}}]}, @NFT_MSG_NEWSETELEM={0x3c, 0xc, 0xa, 0x101, 0x0, 0x0, {0x7}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x10, 0x3, 0x0, 0x1, [{0xc, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}]}]}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0xe0}}, 0x20008844) ioctl$FS_IOC_GETFLAGS(r0, 0x80086601, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0600000004000000080000000b"], 0x50) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f0000000fc0)=ANY=[@ANYBLOB="01000000080000000500000007"], 0x50) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x15, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000002300000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000007c0)={r6}, 0xc) sendmsg$IPSET_CMD_SAVE(0xffffffffffffffff, 0x0, 0x10) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f00000014c0)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c0000000600000003000000000000080500000000612e2eae"], 0x0, 0x2a, 0x0, 0x1, 0x10001}, 0x28) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x3, 0x0, 0x0) r7 = socket(0x10, 0x403, 0x7f) socket$nl_generic(0x10, 0x3, 0x10) close(0xffffffffffffffff) r8 = socket$kcm(0x2, 0x200000000000001, 0x106) sendmsg$kcm(r8, &(0x7f0000001900)={0x0, 0x0, 0x0}, 0x20040000) sendmsg$inet(r8, &(0x7f0000000080)={&(0x7f0000000140)={0x2, 0x4001, @local}, 0xfc, 0x0}, 0x30004001) getsockopt$inet_sctp6_SCTP_ADAPTATION_LAYER(r7, 0x84, 0x7, &(0x7f0000000000), &(0x7f0000000040)=0x4) syz_emit_ethernet(0xfdef, &(0x7f0000000100)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaaaa86dd6092c01f00082f00fe8000000000000000000000000000bb00000000000000000000070000000000242065580000000000000021000086dd080088be4305400f100000"], 0x0) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r9, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000001ac0)={&(0x7f0000000c40)={0x14, 0x24, 0x1, 0x70bd26, 0x25dfdbfc, {0x4}}, 0x14}, 0x1, 0x0, 0x0, 0x4000d}, 0x20044000) 1.975753421s ago: executing program 1 (id=3031): r0 = socket(0x40000000015, 0x5, 0x0) setsockopt$sock_int(r0, 0x1, 0x23, &(0x7f0000000000)=0x2, 0x4) socket$packet(0x11, 0x3, 0x300) r1 = socket$packet(0x11, 0x3, 0x300) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r3, 0x107, 0xa, &(0x7f0000000080)=0x1, 0x4) setsockopt$packet_rx_ring(r3, 0x107, 0x5, &(0x7f0000000140)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x7ff, 0xf83, 0x3}, 0x1c) r4 = socket(0x10, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$AUDIT_TTY_GET(r4, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x3f8, 0x100, 0x70bd2d, 0x25dfdbfb, "", ["", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x80}, 0x20000081) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000240)=@newlink={0x38, 0x10, 0x439, 0x0, 0x0, {0x0, 0x0, 0x0, r5, 0x69801}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gre={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GRE_REMOTE={0x8, 0x7, @dev}]}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x20040000}, 0x0) sendto$packet(r1, &(0x7f00000003c0)="11eb53", 0x3, 0x2404c081, &(0x7f0000000200)={0x11, 0x88a8, r5, 0x1, 0x4, 0x6, @local}, 0x14) 1.839365573s ago: executing program 2 (id=3032): socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) r3 = socket(0x11, 0x800000003, 0x0) bind$packet(r3, &(0x7f0000000d00)={0x11, 0x0, r2, 0x1, 0x7f, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xb5}}, 0x14) writev(r0, &(0x7f00000003c0)=[{&(0x7f0000000040)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fdd411efc4080004ffffffc300000000", 0x39}], 0x1) 1.780054869s ago: executing program 1 (id=3034): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xc, 0xf}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x8001}, 0x20008850) r4 = socket$unix(0x1, 0x1, 0x0) r5 = socket$kcm(0x11, 0x3, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r6) socket$unix(0x1, 0x1, 0x0) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r8 = socket(0x400000000010, 0x3, 0x0) r9 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, 0x0) sendmsg$nl_route_sched(r8, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000900)=@newtfilter={0x34, 0x2c, 0xd3f, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0xb, 0xfff3}, {}, {0x8, 0x300}}, [@filter_kind_options=@f_basic={{0xa}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x10}, 0x0) setsockopt$sock_attach_bpf(r5, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r5, &(0x7f0000000280)={&(0x7f0000000380)=@xdp={0x2c, 0x0, r7, 0x3e}, 0x80, &(0x7f00000001c0)=[{&(0x7f0000000180)="27030200000214000e00002fb96dffff1144ee163cddcb00"/38, 0x26}, {&(0x7f00000004c0)="f058fe7dad777f8f", 0x300}], 0x2}, 0x5) 1.693579896s ago: executing program 3 (id=3035): r0 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r0, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) r1 = socket(0x40000000015, 0x5, 0x0) bind$inet6(r1, &(0x7f0000000140)={0xa, 0x1, 0x0, @loopback={0xfec0ffff00000000}}, 0x1c) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'geneve1\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000040)=ANY=[@ANYBLOB="90000000100003040400"/20, @ANYRES32=0x0, @ANYBLOB="010102000000000008000500", @ANYRES32=r5, @ANYBLOB="0a000200aaaaaaaaaa4100005c00128009000100766c616e000000004c000280060001"], 0x90}, 0x1, 0xba01}, 0x810) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000540)={&(0x7f00000002c0)=ANY=[@ANYBLOB="54000000100005ff00000000f8ffffff0000004a", @ANYRES32=0x0, @ANYBLOB="4a840200000000002c0012800b00010067726574617000001c0002800800150002510e00080007007f000001060011004e24000008000a00", @ANYRES32=r2, @ANYBLOB="640031cba1c259c73b007db643ffaf973faa61e0b52203e938246c6cf6541fb0c130017853ea2a2cc4c9367990296d4254398100"/69], 0x54}}, 0x0) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), r0) sendmsg$NL80211_CMD_UPDATE_FT_IES(r0, &(0x7f0000000440)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x40, r7, 0x8, 0x70bd2a, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0xa701, 0x56}}}}, [@NL80211_ATTR_IE={0xf, 0x2a, [@sec_chan_ofs={0x3e, 0x1, 0x2}, @gcr_ga={0xbd, 0x6}]}, @NL80211_ATTR_MDID={0x6, 0xb1, 0x3}, @NL80211_ATTR_MDID={0x6, 0xb1, 0x3}]}, 0x40}, 0x1, 0x0, 0x0, 0x4000}, 0x8000) sendmsg$nl_route_sched(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000580)=@delchain={0x24, 0x11, 0x1, 0x1f, 0x25dfdbff, {0x0, 0x0, 0x0, r2, {0x6}}}, 0x24}}, 0x0) 1.597208889s ago: executing program 2 (id=3036): bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000680)=ANY=[@ANYBLOB="b4050000000000007110870000000000a6000400000000009500000004000000e43de4fbf0ba01ca0c758a65369a36f060837490a429835468fac65e0443bb873b66567f551a60f6b19ffd82f45d098f87ab1b3458de1908ec319901e5b1c0b201362c42ac016762b357a4e7f8d858cb10835016aed881e41f68f8317860bc002354ae8d26a1859253ea607dce6e004f7ad36323f15ee45e819e1fa7629a4dafc721ce6cdd5514e9fcdde608e21310be96d67c126d97b3cb1080a9f182490713ca05cac74b8a00c61a1a38179de33a46525ca4b6f04e342506ea2434d729e22800000000000000b216addd670d75c7bcd080203120b030c9207797aefd41004b917902295897b0e9c070f69f8fdbc6d50305"], 0x0, 0x5, 0x0, 0x0, 0x41000}, 0x94) r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f00000002c0)={0xa, 0x4e22, 0x0, @local, 0xb}, 0x1c) listen(r0, 0x2) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000940)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(blowfish)\x00'}, 0x58) bpf$PROG_LOAD(0x5, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0x7000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xa, 0x0, 0x0, 0x0, 0x4}, 0x94) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5", 0x4) r2 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r2, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r2, 0x0, 0x0) syz_emit_ethernet(0x4e, &(0x7f0000000600)={@local, @broadcast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "f900f5", 0x18, 0x6, 0x1, @local, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x6, 0x2, 0x0, 0x0, 0x0, {[@fastopen={0x1e, 0x2}]}}}}}}}}, 0x0) 1.585948293s ago: executing program 4 (id=3037): r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) bpf$TOKEN_CREATE(0x24, &(0x7f0000000080)={0x0, r0}, 0x8) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0x6, 0x8, &(0x7f0000000240)=ANY=[@ANYBLOB="18020000fbffbfff000000000300000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b6020000000000008500000086000000850000001100000095"], &(0x7f0000000000)='syzkaller\x00', 0x4, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffd}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r2, 0x0, 0xe, 0x0, &(0x7f00000003c0)="6f11ba816056a1827a33ae059cf3", 0x0, 0x1008, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x9}, 0x50) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), r4) getsockname$packet(r4, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) sendmsg$nl_route(r4, &(0x7f0000000440)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000380)=ANY=[@ANYBLOB="580000001000370400"/20, @ANYRES32=r5, @ANYBLOB="8304050000000000380012800b000100697036746e6c00002800028014000300ff0100000000000000000000000000010500090004"], 0x58}, 0x1, 0x0, 0x0, 0x9005}, 0x0) sendmsg$nl_route(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)=ANY=[@ANYBLOB="280000001000010029bd7000fddbdf2500000000", @ANYRES32=r5, @ANYBLOB="000000000300000008000400f1ff000090a61628c569fa76f7e21e3a9ad31f23cd60fd0800794f9437664ada893bb678e4c07602102301ec2b864c7fe4e938b9ab68d17fd75684fdbcc83a1b765562cbb141869635dada16da5754d9b999b3e85069caae45a6d22f156d7a4f045f771d0f4b13ea27344358394b5eb1a3e6005807b9cd7e9fe38b0de11889cb35e2edcf08a2868077d141f834"], 0x28}, 0x1, 0x0, 0x0, 0x801}, 0x4000000) r6 = socket$netlink(0x10, 0x3, 0x10) setsockopt$sock_int(r6, 0x1, 0x2c, &(0x7f0000000300)=0x2, 0x4) sendmsg$nl_route_sched(r6, &(0x7f0000001e00)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000001dc0)={&(0x7f0000001d80)=@newchain={0x34, 0x64, 0x400, 0x70bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0x5, 0x6}, {0x2, 0x4}, {0xffe0, 0xa}}, [@TCA_CHAIN={0x8, 0xb, 0x5}, @TCA_RATE={0x6, 0x5, {0x81, 0x77}}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000010}, 0x810) setsockopt$sock_attach_bpf(r6, 0x1, 0x32, &(0x7f0000000000), 0x4) clock_gettime(0x0, &(0x7f0000001d00)={0x0, 0x0}) recvmmsg$unix(r4, &(0x7f0000001c80)=[{{&(0x7f0000000800)=@abs, 0x6e, &(0x7f00000001c0)=[{&(0x7f0000000880)=""/178, 0xb2}, {&(0x7f0000000940)=""/123, 0x7b}, {&(0x7f0000000140)}], 0x3, &(0x7f00000009c0)=[@rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}], 0x88}}, {{&(0x7f0000000a80)=@abs, 0x6e, &(0x7f0000001c40)=[{&(0x7f0000000b00)=""/4096, 0x1000}, {&(0x7f0000000280)=""/23, 0x17}, {&(0x7f0000001b00)=""/216, 0xd8}, {&(0x7f0000001c00)=""/46, 0x2e}], 0x4}}], 0x2, 0x2001, &(0x7f0000001d40)={r7, r8+10000000}) setsockopt$IPT_SO_SET_REPLACE(r0, 0x4000000000000, 0x40, &(0x7f0000000300)=@raw={'raw\x00', 0x4001, 0x3, 0x268, 0x0, 0x700001b, 0x148, 0xf8, 0x148, 0x1d0, 0x206, 0x240, 0x1d0, 0x240, 0x7fffffe, 0x0, {[{{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @rand_addr, 0x0, 0xffffff00, 'veth1_macvtap\x00', 'bond_slave_1\x00', {0xff}, {}, 0x0, 0x1}, 0x1ea, 0xd8, 0xf8, 0x0, {0x390, 0x8f00}, [@inet=@rpfilter={{0x28}, {0xc}}, @common=@set={{0x40}, {{0x0, [0x5, 0x4, 0x2, 0x2, 0x1, 0x3], 0x1, 0x6}}}]}, @unspec=@NOTRACK={0x20}}, {{@uncond, 0x0, 0xb0, 0xd8, 0x0, {}, [@common=@set={{0x40}, {{0x0, [0x1, 0x6275dd3c01ecbf44, 0x2, 0x5, 0x2], 0x4, 0x2}}}]}, @common=@unspec=@NFQUEUE3={0x28, 'NFQUEUE\x00', 0x3, {0x0, 0x0, 0x3}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x2c8) 1.349206886s ago: executing program 2 (id=3038): socket(0x10, 0x80002, 0x0) socket$netlink(0x10, 0x3, 0x0) bpf$BPF_LINK_CREATE(0x1c, 0x0, 0x0) r0 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r0, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x2) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r2) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) sendmsg$NFC_CMD_START_POLL(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000400)={&(0x7f0000000340)={0x14, 0x0, 0x20, 0x70bd28, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x40}, 0x4044001) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffff11ffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r6, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)={0x28, r5, 0x603, 0x70bd2f, 0x25dfdbfc, {}, [@ETHTOOL_A_LINKINFO_TP_MDIX_CTRL={0x5, 0x5, 0x3}, @ETHTOOL_A_LINKINFO_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x42080}, 0x4000054) r7 = socket$nl_route(0x10, 0x3, 0x0) unshare(0x24020400) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(0xffffffffffffffff, 0x8004b709, 0x0) sendmsg$nl_route(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)=ANY=[@ANYBLOB="3c0000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="a4280400000000001400350076657468305f746f5f626f6e6400000008000a00", @ANYRES32=r4], 0x3c}, 0x1, 0x0, 0x0, 0x4008800}, 0x8000) 1.144017876s ago: executing program 1 (id=3039): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000900)=ANY=[@ANYBLOB="1b0000000000000000000000000001"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0xf, &(0x7f0000000100)=ANY=[@ANYBLOB="1800000003000000000000000700000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000400000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000010000008500000085000000b70000000000000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x20, '\x00', 0x0, @xdp=0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket(0x10, 0x803, 0x6) socket$netlink(0x10, 0x3, 0x0) socket(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) socket$igmp(0x2, 0x3, 0x2) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)=@base={0xe, 0x4, 0x4, 0x2, 0x0, 0x1, 0xfffffffc}, 0x50) socket$kcm(0x11, 0x200000000000002, 0x300) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000580)={0xffffffffffffffff}) recvmsg$unix(r3, 0x0, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0x14, &(0x7f00000001c0)=ANY=[@ANYBLOB="18000000000100000000000000000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000007000000850000000600000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000fcffffff7b8af8ff00000000bca2000000000000a6020000f8ffffffb703000018000000b704000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$inet_tcp(0x2, 0x1, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000480)={{r2}, &(0x7f0000000280), &(0x7f0000000340)=r4}, 0x20) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'syz_tun\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000002c0)={r4, r5, 0x25, 0x2, @void}, 0x10) syz_emit_ethernet(0x2a, &(0x7f0000000940)=ANY=[@ANYBLOB="ffffffffffff0180c2000000087800000000000000004e244e2200089078000000000000003f00000000"], 0x0) 780.535108ms ago: executing program 4 (id=3040): syz_emit_ethernet(0x5e, &(0x7f0000000080)={@local, @broadcast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "4dd318", 0x28, 0x6, 0x0, @private0={0xfc, 0x0, '\x00', 0x1}, @local, {[], {{0x4e21, 0x4001, 0x41424344, 0x41424344, 0x0, 0x0, 0xa, 0x2, 0x0, 0x0, 0x0, {[@generic={0x3, 0x2}, @exp_smc={0xfe, 0x6}, @timestamp={0x8, 0xa, 0x8, 0x8001}, @sack={0x5, 0x2}]}}}}}}}}, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="5c00000002060108000000000000000000004000050005000a000000050001000700000005000400000000000900020073797a310000000016000300686173683a6e65742c706f72742c6e6574"], 0x5c}}, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f00000011c0), 0xffffffffffffffff) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0), 0xffffffffffffffff) sendmsg$TIPC_NL_LINK_SET(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000140)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01060000000000000000090000003c0004801300010062726f6164636173742d6c696e6b000024000780080005000000000008000300ff00"], 0x50}}, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_STATS_CPU(r3, &(0x7f00000001c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x14, 0x4, 0x1, 0x5, 0x0, 0x0, {0xb, 0x0, 0x5}, [""]}, 0x14}, 0x1, 0x0, 0x0, 0x20004070}, 0x40) sendmsg$TIPC_NL_LINK_GET(0xffffffffffffffff, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000001500)={&(0x7f00000003c0)=ANY=[], 0x19}, 0x1, 0x0, 0x0, 0x20008000}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x18, 0xb, &(0x7f00000006c0)=ANY=[@ANYBLOB="1800000000f10000000000000020000018010000202070250000000000202020db1af87f00010000bfa100000000000007010000f8ffffffb702000008000000b703001d0000000085000000ca00000095"], &(0x7f0000000100)='syzkaller\x00', 0x8, 0x0, 0x0, 0x0, 0x41, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) r4 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r5, 0xf2a50000) writev(r4, &(0x7f0000019880)=[{&(0x7f0000000400)="fb", 0x1}, {0x0}], 0x2) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000780)=ANY=[@ANYBLOB="74000000090601020000000000000000030000000900020073797a310000000005000100070000004c0007801800018014000240fe8000000000000000000000000000aa1800148014000240fc000000000000000000000000000000060004404e1f0000050007008400000006000540"], 0x74}, 0x1, 0x0, 0x0, 0x10040003}, 0x0) 776.958736ms ago: executing program 2 (id=3041): write$cgroup_int(0xffffffffffffffff, 0x0, 0x0) connect$phonet_pipe(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_tcp_buf(r0, 0x6, 0x23, &(0x7f0000000040)=""/32, &(0x7f0000000080)=0x20) bpf$PROG_LOAD(0x5, 0x0, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000005c0)=@updpolicy={0xc4, 0x19, 0xfd3649826d894c67, 0x0, 0x0, {{@in6=@empty, @in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x1, 0x0, 0x0, 0x0, 0x0, 0x800000, 0x0, 0xfffffffffffffffc}, {0x0, 0xacb0, 0x400000000}, 0xfffd}, [@policy_type={0xa, 0x10, {0x1}}]}, 0xc4}}, 0x4c050) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_UNLABEL_C_STATICADD(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x8, 0x3000000000002, 0x0, 0x80}, 0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nbd(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000440)={0x14, r5, 0x1, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x40}, 0x400c000) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x38, r5, 0x800, 0x70bd26, 0x25dfdbff, {}, [@NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x120}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x3}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x9}]}, 0x38}, 0x1, 0x0, 0x0, 0x24004010}, 0x40000) sendmsg$nl_xfrm(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000780)=@updpolicy={0xb8, 0x15, 0x1, 0x0, 0x0, {{@in=@initdev={0xac, 0x1e, 0x1, 0x0}, @in=@multicast1, 0x4e20, 0x0, 0x4e23, 0x0, 0xa, 0x10, 0x0, 0x33}, {0x8, 0x3, 0x4, 0x0, 0xfffffffffffffffc, 0x9d3, 0xffffffff}, {0xfffffffffffffffd}, 0xfffffffd, 0x6e6bb5}}, 0xb8}}, 0x0) 700.10805ms ago: executing program 1 (id=3042): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000001d340e0034772400210021f600"/32], 0x1c}}, 0xcc010) 698.849427ms ago: executing program 4 (id=3043): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) setsockopt$bt_l2cap_L2CAP_OPTIONS(r0, 0x6, 0x1, &(0x7f0000000000)={0x3, 0x80, 0x6, 0x0, 0x8, 0x80, 0x7}, 0xc) bind$bt_l2cap(r0, &(0x7f00000002c0)={0x1f, 0x0, @any, 0xfffa}, 0xe) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000040)=0x42c3, 0x4) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000740)=@ipv6_getaddr={0x2c, 0x16, 0x1, 0x0, 0x0, {0xa, 0x0, 0xc0, 0xfe}, [@IFA_LOCAL={0x14, 0x2, @mcast1}]}, 0x2c}}, 0x0) connect$bt_l2cap(r0, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) sendmmsg(r0, &(0x7f00000024c0)=[{{0x0, 0x0, &(0x7f0000000800)}}], 0x1, 0x30040040) 637.039121ms ago: executing program 3 (id=3044): r0 = socket$unix(0x1, 0x1, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(r2, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) setsockopt$IP_VS_SO_SET_FLUSH(r2, 0x0, 0x485, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'bridge0\x00', 0x0}) r4 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r4, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x3, 0x0, 0x81, 0x1ff, 0x1, 0x1}, 0x1c) socket$igmp(0x2, 0x3, 0x2) sendmmsg(r4, &(0x7f00000030c0), 0x400000000000181, 0x20004050) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000040)={0x0, @in={{0x2, 0x4e22, @broadcast}}, 0xc, 0x3, 0x5, 0x8, 0x0, 0x0, 0x7}, &(0x7f0000000100)=0x9c) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) write$tun(r6, &(0x7f0000000b40)=ANY=[@ANYBLOB="0000080001050700f8ff80000600020c1f41c60e52d1f2478c345275e1d855c59c6a096095cd85b2f889071bb9be1cf7c761c1c0b82346333228d20e34b1e17b7f6cf76c912a10cf7951e5eb37f5a2b20c8d90353d9b506e1c1f4a4fdb5a102eec06bdbecde0d660b1bff30841fe3e4373cdce8e56d1570d7174715614a017fc94c9a9c813407d6c084872ac1ec359cdfd34a8351f6e"], 0x96) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r4, 0x84, 0x6, &(0x7f0000000200)={r5, @in={{0x2, 0x4e20, @remote}}}, &(0x7f0000000140)=0x84) r7 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$sock_int(r7, 0x1, 0x8, 0x0, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000026c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0x2}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x18, 0x1, {0x0, '\x00', 0x4, 0x7, 0xff, 0x8}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000300), r4) ioctl$TUNSETTXFILTER(r6, 0x400454d1, &(0x7f0000000440)={0x1, 0x2, [@broadcast, @local]}) sendmsg$NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH(r4, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x5c, r8, 0x20, 0x70bd2c, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0xfffffff7, 0x45}}}}, [@NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}]}, 0x5c}, 0x1, 0x0, 0x0, 0x20000000}, 0x4020090) 622.772786ms ago: executing program 2 (id=3045): bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1004c, '\x00', 0x0, @sk_reuseport, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0xffb5, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x43}, 0x90) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="3800000020000100fcfffffffedbdf250a00400000000003000000f5130002"], 0x38}, 0x1, 0x0, 0x0, 0xc011}, 0x40) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x2, 0x16, &(0x7f0000000180)=ANY=[@ANYBLOB="611230000000000061134c0000000000bf2000000000000016001000071b48013d030100000000001f02000000000000bc26100000000000bf67200000000000160200000fff0700670200000a000000360600000ee600f0bf050000000000000f650000000000006507f4ff02000000070700004c0040001f75000000000000bf54000000000000070500000300f9ffad430100000000009500000000000000050000000000000095000000000000004d9bd591d568253e9988431ec068e3a83683d58719d72183f2cb7f43dd55788be820b236dcb695dbfd737cbf5fe7030586"], &(0x7f0000000100)='GPL\x00'}, 0x48) 553.232376ms ago: executing program 4 (id=3046): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="6000000002060103000000000000000000000004050001000700000013000300686173683a6e65742c696661636500000900020073797a30000000400500040000000000050005000a00000014000780050015000a00000008001240", @ANYRESDEC], 0x60}}, 0x0) sendmsg$IPSET_CMD_GET_BYNAME(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x14, 0xe, 0x6, 0x801, 0x0, 0x0, {0x2, 0x0, 0x6}}, 0x14}, 0x1, 0x0, 0x0, 0x40040}, 0x4) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)={0x14, 0x3d, 0x301, 0x70bd25, 0xfffffffc, {0x1}}, 0x14}, 0x1, 0x0, 0x0, 0x448d3}, 0x0) r4 = socket$kcm(0x2, 0xa, 0x2) r5 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000840)=ANY=[@ANYBLOB="020a00090700000026bd7000fbdbdf2505001a00ac14141c00", @ANYRESOCT, @ANYRES64], 0x38}}, 0x20000000) r6 = socket$igmp6(0xa, 0x3, 0x2) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r6, 0x8983, &(0x7f0000000300)={0x0, 'syzkaller1\x00'}) r7 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) write(r7, &(0x7f00000000c0)="f900fb69c595491567", 0x9) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) write$tun(r0, &(0x7f0000000340)=ANY=[@ANYBLOB="000088f888a800000000aaaac5aaaaaa88a8a00081"], 0x72) 485.154491ms ago: executing program 1 (id=3047): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000300)={@in6={{0xa, 0x4e21, 0x5, @loopback, 0xa}}, 0x0, 0x0, 0x4, 0x0, "c1353738cbc7c9f1cf53b6a7b4e23602a3c364c241d6e5615445244740bd4c0b42a21dfd14bf92594925208a0e2f964e654dc534a6324f4993fcf19b25f3ee818a118a7c49462189316d556d2ccd00"}, 0xd8) (async) r1 = socket(0x2a, 0x2, 0xffffffff) sendmsg$nl_route_sched(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000a80)=@newqdisc={0x24, 0x24, 0x10, 0x70bd25, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x7, 0x1}, {}, {0xb, 0xfff2}}}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x24004001) (async) getsockname$packet(r1, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0xfffffcb7, &(0x7f0000000280)={&(0x7f00000001c0)=@newqdisc={0x2c, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}, {0x0, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000480)=@newtfilter={0x40, 0x2c, 0xd27, 0x70bd29, 0x0, {0x0, 0x0, 0x0, r2, {}, {}, {0x2, 0xf}}, [@filter_kind_options=@f_u32={{0x8}, {0x14, 0x2, [@TCA_U32_FLAGS={0x8, 0xb, 0x2}, @TCA_U32_DIVISOR={0x8, 0x4, 0x10}]}}]}, 0x40}}, 0x40808c4) (async) r3 = socket$netlink(0x10, 0x3, 0x0) (async) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) (async) sendmsg$NFT_BATCH(r4, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}]}, @NFT_MSG_NEWSETELEM={0x44, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x7}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x18, 0x3, 0x0, 0x1, [{0x14, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_USERDATA={0x5, 0x6, 0x1, 0x0, "06"}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xa8}, 0x1, 0x0, 0x0, 0x24000850}, 0x40) (async) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETSETELEM(r5, &(0x7f0000000100)={0x0, 0x20, &(0x7f0000000200)={&(0x7f0000002f40)=ANY=[@ANYBLOB="40000000210a010900000000000000000a0000010900020073797a31000000000900010073797a31"], 0x40}, 0x1, 0x0, 0x0, 0x24000801}, 0x8000) (async) sendmmsg(r3, &(0x7f00000002c0), 0x40000000000009f, 0x0) (async) sendto$inet6(r0, 0x0, 0x0, 0x1c255b4e9d816ae0, &(0x7f0000000000)={0xa, 0x2, 0x863b, @remote}, 0x1c) 411.097347ms ago: executing program 2 (id=3048): r0 = socket$inet6_sctp(0xa, 0x4, 0x84) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000100)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_hmac_sha512\x00'}, 0x58) r2 = accept4(r1, 0x0, 0x0, 0x0) recvmmsg(r2, &(0x7f0000002440), 0x3ffffffffffff67, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbee9, 0x8031, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x34, r0, 0x0) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) getsockopt$inet6_mreq(r4, 0x29, 0x12, 0x0, &(0x7f0000001140)) getsockopt$IP_VS_SO_GET_DESTS(r3, 0x0, 0x484, 0x0, &(0x7f0000000100)) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r6) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r7 = socket$unix(0x1, 0x5, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000026c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r9, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0x2}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x18, 0x1, {0x0, '\x00', 0x1, 0x7, 0x100, 0x8}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000000200)) r10 = socket$unix(0x1, 0x1, 0x0) r11 = socket$kcm(0x11, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000340)={'syzkaller0\x00', 0x0}) setsockopt$sock_attach_bpf(r11, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r11, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0x0, r12, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="27030200590214000600002fb96dbcf706e10500000086ddffff1144ee163cd4b8bf4a31accbe1ba0777cfbf6ae77256da82f6184b8a34f9015cc99e570000002b21c90b000000000000721a5dbb56a3d9e16e7c2179c9b5b24722944820e624fc5b17d0822ca4232c98a9936ba722475ca5", 0x72}, {&(0x7f0000000440)="63f805d7649496db72959832930469edc7b700c9e37eed5653ecb716cdb8981cd819af0b33254465cc904b7b31789d65c0e0d33330e2ef36205dd154e363bcadf8f2ea93f45503c6d9fd8dfe5a638cfeb9f79c930a4d18260e5a08ffd35ed8371cff78119319b2b62c7cd9378c73ae90c801681f55ef26cb00"/135, 0x87}, {&(0x7f0000001400)="7f4ba13c5a27118dc920175650f0c9ba1809dd13a6e2d5b38f40adfa278c09e0e3bd05add4d780cd753b50f06f3b51f43761c7783f38ceaefc2dad57889d8b3a2d21314410f64ec2fa92e3a14b0141b39c020021d1edd011fbccb808a317fff4cf49aab12da619d67102048ec43c76cdb9d395e8b7b6e589d788aeeecb5080fc3d5ec6ccd656e49c0a642671d3fc363b46240bbc46ad965399b71db3c8f2b269b20870a3d2a6a8de5213b0f9d41c510c827056b7284391da244ec7653648b670f9a3483b314d861992ed7fb369eda093e1643c300b94d996fc592adb22c379be070ce5cd806da85a492dd4199cceb4c5b750222485325cf1073bf87e93bdf7da8af8f5f626541afd142e24ee8f4be9f038453c0edf500deabfe4d1a7a9de51df012bc2f3b767b3c03be6ace8c37ad571323cd363116e01f98a8ff8148d3900a65b788e99ddf9d9a2383f1730c7868d2dd031034bce5a77bd1ef3385105968be7bd830bde788092f657be36f89ea55ced486e18982d01339ed04a934a43c7b3", 0x17f}], 0x3}, 0x4) 378.37582ms ago: executing program 1 (id=3049): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_group_source_req(r0, 0x0, 0x2e, &(0x7f0000000100)={0x4, {{0x2, 0x0, @multicast2}}, {{0x2, 0x0, @local}}}, 0x108) r1 = socket$netlink(0x10, 0x3, 0x0) writev(r1, &(0x7f0000000000)=[{&(0x7f0000000080)="390000001300090468fe0700000000000000ff3f04000000480100100000000004002b000a00010014a4ee1ee438d2fd000000000000007208", 0x39}], 0x1) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@newqdisc={0x54, 0x10, 0x1, 0x1000000, 0x10000000, {0x0, 0x0, 0x0, 0x0, {0x1}, {}, {0xe}}, [@TCA_INGRESS_BLOCK={0x8}, @TCA_STAB={0x28, 0x8, 0x0, 0x1, [{{0x1c, 0x1a, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}}, {0x8, 0x1b, [0x0, 0x0]}}]}]}, 0x54}}, 0x0) 273.199483ms ago: executing program 3 (id=3050): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000027c0)=ANY=[@ANYBLOB="d0000000190001000000000000000000000000000000000000000000000000010a010102000000000000000000000000000000840f5afb594a9a1e3f00000000000200000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000000000000000000fdffffffffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f"], 0xd0}, 0x1, 0x0, 0x0, 0x2001}, 0x40) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000002ec0)=[{{0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="e47ba91b", 0x4}], 0x1}}], 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x2000001, 0x12, r1, 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r2, 0x84, 0x72, &(0x7f0000000040)={0x0, 0x4, 0x30}, &(0x7f0000000080)=0xc) r3 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000740)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x400}, 0x50) r4 = accept4$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000000040)=0x14, 0x80000) getpeername$packet(r4, &(0x7f0000000080), &(0x7f00000000c0)=0x14) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f00000003c0)={{r3, 0xffffffffffffffff}, &(0x7f0000000140), &(0x7f0000000380)='%+9llu \x00'}, 0x20) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000580)={r5}, 0x4) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x18, &(0x7f00000001c0)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000000000018230000", @ANYRES32=r3, @ANYBLOB="0000000000000000b70500000000000085000000a5000000180100002020640500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000a50000000800000095"], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) 179.413973ms ago: executing program 3 (id=3051): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000040)=@newnexthop={0x24, 0x68, 0x1, 0x2, 0x7ffffffc, {}, [@NHA_GROUP={0xc, 0x2, [{0x1, 0x4}]}]}, 0x24}, 0x1, 0x0, 0x0, 0x24008000}, 0x4000) 21.477622ms ago: executing program 4 (id=3052): r0 = socket(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0xe64, 0x3, @local, 0x2}, 0x18) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) r4 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) connect$ax25(r4, &(0x7f0000000000)={{0x3, @null}, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @default, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x10) bind$ax25(r3, &(0x7f0000000100)={{0x3, @default, 0x1}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r5 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r5, 0x8914, &(0x7f0000000000)) setsockopt$ax25_SO_BINDTODEVICE(r3, 0x101, 0x19, &(0x7f0000000240)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={'rose', 0x0}, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default]}) r6 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[], 0x48) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x1f, 0x11, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000000000000000000000000008850000002a000000b7080000000000007baaf8ff00000000b5080000ffffffff7b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r6, @ANYBLOB="0000000000000000b7050002080000008500000000000000f300000000000000"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x10, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000000)={r7}, 0xc) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) syz_genetlink_get_family_id$nl80211(&(0x7f0000003340), r3) r8 = accept4$packet(0xffffffffffffffff, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000180)=0x14, 0x80000) listen(r8, 0x1) 0s ago: executing program 3 (id=3053): r0 = socket$unix(0x1, 0x1, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket$kcm(0x11, 0x3, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r3) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) setsockopt$sock_attach_bpf(r2, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r2, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0x0, r4, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000700)="27070200590214000600002fb96dbcf706e10500000086ddffff1144ee163cd4b8bf4a39accb99", 0x27}], 0x1, 0x0, 0x0, 0x1d00}, 0x1004) kernel console output (not intermixed with test programs): _bond) entered disabled state [ 316.682136][T12819] bond0: (slave bond_slave_0): Releasing backup interface [ 316.718331][T12819] bond0: (slave bond_slave_1): Releasing backup interface [ 316.750600][T12819] team0: Port device team_slave_0 removed [ 316.763675][T12819] team0: Port device team_slave_1 removed [ 316.772707][T12819] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 316.795694][ T7538] wg1 speed is unknown, defaulting to 1000 [ 318.397266][T12836] netlink: 64 bytes leftover after parsing attributes in process `syz.4.2007'. [ 318.668769][T12848] tipc: Enabled bearer , priority 0 [ 318.713515][T12852] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2013'. [ 318.742690][T12848] syzkaller0: entered promiscuous mode [ 318.748963][T12848] syzkaller0: entered allmulticast mode [ 318.755101][T12848] tipc: Resetting bearer [ 318.838924][T12845] tipc: Resetting bearer [ 319.357737][ C0] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 320.621132][T12845] tipc: Disabling bearer [ 320.646164][ T10] tipc: Node number set to 3537150083 [ 320.885289][T12896] syzkaller0: entered promiscuous mode [ 320.903318][T12896] syzkaller0: entered allmulticast mode [ 321.118579][T12908] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2021'. [ 321.175264][T12920] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2024'. [ 322.505954][T12923] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 322.542436][T12926] bridge3: port 1(veth0_to_bond) entered blocking state [ 322.568396][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 322.581157][T12926] bridge3: port 1(veth0_to_bond) entered disabled state [ 322.601553][T12926] veth0_to_bond: entered allmulticast mode [ 322.628104][T12926] veth0_to_bond: entered promiscuous mode [ 322.732853][T12935] netlink: 32 bytes leftover after parsing attributes in process `syz.2.2027'. [ 322.899899][T12946] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2034'. [ 322.911572][T12948] netlink: 88 bytes leftover after parsing attributes in process `syz.1.2033'. [ 323.045026][T12951] syzkaller0: entered promiscuous mode [ 323.061743][T12951] syzkaller0: entered allmulticast mode [ 323.081322][T12941] tipc: Enabled bearer , priority 0 [ 323.111737][T12940] tipc: Resetting bearer [ 323.397406][T12966] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2036'. [ 324.866232][T12940] tipc: Disabling bearer [ 324.974075][T12978] syzkaller0: entered promiscuous mode [ 324.981733][T12978] syzkaller0: entered allmulticast mode [ 325.185764][T12999] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2041'. [ 326.645579][T13003] bridge3: port 1(veth0_to_bond) entered blocking state [ 326.667166][T13003] bridge3: port 1(veth0_to_bond) entered disabled state [ 326.686183][T13003] veth0_to_bond: entered allmulticast mode [ 326.709175][T13003] veth0_to_bond: entered promiscuous mode [ 326.741433][T13007] geneve2: entered promiscuous mode [ 326.829064][T13013] netlink: 88 bytes leftover after parsing attributes in process `syz.2.2045'. [ 327.003314][T13026] Cannot find del_set index 2 as target [ 327.369009][T13044] IPVS: set_ctl: invalid protocol: 47 172.20.20.29:20004 [ 327.369500][T13041] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2056'. [ 327.421270][T13037] syzkaller0: entered promiscuous mode [ 327.426995][T13037] syzkaller0: entered allmulticast mode [ 327.443143][T13050] netlink: 'syz.2.2057': attribute type 23 has an invalid length. [ 329.002391][T13055] veth0_to_bond: left allmulticast mode [ 329.008502][T13055] veth0_to_bond: left promiscuous mode [ 329.014464][T13055] bridge3: port 1(veth0_to_bond) entered disabled state [ 329.104120][T13064] netlink: 68 bytes leftover after parsing attributes in process `syz.0.2060'. [ 329.243217][T13071] netlink: 'syz.1.2063': attribute type 1 has an invalid length. [ 329.294672][T13071] bond2: entered promiscuous mode [ 329.300748][T13071] 8021q: adding VLAN 0 to HW filter on device bond2 [ 329.388378][T13071] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 329.395771][T13071] IPv6: NLM_F_CREATE should be set when creating new route [ 329.403363][T13071] IPv6: NLM_F_CREATE should be set when creating new route [ 329.412607][T13077] 8021q: adding VLAN 0 to HW filter on device bond2 [ 329.420247][T13077] bond2: (slave wireguard0): The slave device specified does not support setting the MAC address [ 329.432224][T13077] bond2: (slave wireguard0): Setting fail_over_mac to active for active-backup mode [ 329.447862][T13071] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 329.460759][T13084] openvswitch: netlink: Actions may not be safe on all matching packets [ 329.472538][T13077] bond2: (slave wireguard0): making interface the new active one [ 329.481877][T13077] wireguard0: entered promiscuous mode [ 329.490337][T13077] bond2: (slave wireguard0): Enslaving as an active interface with an up link [ 329.523087][T13071] bond2: (slave wireguard1): The slave device specified does not support setting the MAC address [ 329.543822][T13071] bond2: (slave wireguard1): Enslaving as a backup interface with an up link [ 329.705701][T13091] netlink: 32 bytes leftover after parsing attributes in process `syz.4.2069'. [ 329.717072][T13091] netlink: 'syz.4.2069': attribute type 1 has an invalid length. [ 329.730037][T13092] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2070'. [ 329.786503][T13096] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2072'. [ 329.804762][T13094] syzkaller0: entered promiscuous mode [ 329.810705][T13094] syzkaller0: entered allmulticast mode [ 330.009461][T13103] FAULT_INJECTION: forcing a failure. [ 330.009461][T13103] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 330.023684][T13103] CPU: 1 UID: 0 PID: 13103 Comm: syz.4.2074 Not tainted syzkaller #0 PREEMPT(full) [ 330.023713][T13103] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 330.023726][T13103] Call Trace: [ 330.023735][T13103] [ 330.023744][T13103] dump_stack_lvl+0xe8/0x150 [ 330.023777][T13103] should_fail_ex+0x412/0x560 [ 330.023809][T13103] _copy_from_iter+0x1d3/0x1670 [ 330.023841][T13103] ? rep_movs_alternative+0x4a/0x90 [ 330.023883][T13103] ? __pfx__copy_from_iter+0x10/0x10 [ 330.023908][T13103] ? sock_alloc_send_pskb+0x896/0x990 [ 330.023947][T13103] ? __pfx__copy_from_iter+0x10/0x10 [ 330.023978][T13103] ? page_copy_sane+0x16a/0x270 [ 330.024008][T13103] copy_page_from_iter+0xdd/0x170 [ 330.024041][T13103] skb_copy_datagram_from_iter+0x306/0x710 [ 330.024087][T13103] unix_dgram_sendmsg+0x521/0x18e0 [ 330.024140][T13103] ? __pfx_unix_dgram_sendmsg+0x10/0x10 [ 330.024166][T13103] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 330.024205][T13103] ? unix_seqpacket_sendmsg+0x111/0x1e0 [ 330.024234][T13103] ? __pfx_unix_seqpacket_sendmsg+0x10/0x10 [ 330.024260][T13103] ____sys_sendmsg+0xa68/0xad0 [ 330.024290][T13103] ? __might_fault+0xaf/0x130 [ 330.024329][T13103] ? __pfx_____sys_sendmsg+0x10/0x10 [ 330.024368][T13103] ? import_iovec+0x73/0xa0 [ 330.024403][T13103] ___sys_sendmsg+0x2a5/0x360 [ 330.024430][T13103] ? __lock_acquire+0x6b5/0x2cf0 [ 330.024464][T13103] ? __pfx____sys_sendmsg+0x10/0x10 [ 330.024498][T13103] ? kstrtouint+0x6e/0xe0 [ 330.024553][T13103] ? __fget_files+0x2a/0x420 [ 330.024580][T13103] ? __fget_files+0x3a0/0x420 [ 330.024614][T13103] __sys_sendmmsg+0x27c/0x4e0 [ 330.024650][T13103] ? __pfx___sys_sendmmsg+0x10/0x10 [ 330.024677][T13103] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 330.024735][T13103] ? ksys_write+0x242/0x270 [ 330.024768][T13103] ? __pfx_ksys_write+0x10/0x10 [ 330.024803][T13103] __x64_sys_sendmmsg+0xa0/0xc0 [ 330.024834][T13103] do_syscall_64+0xe2/0xf80 [ 330.024868][T13103] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 330.024888][T13103] ? trace_irq_disable+0x37/0x100 [ 330.024909][T13103] ? clear_bhb_loop+0x60/0xb0 [ 330.024935][T13103] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 330.024955][T13103] RIP: 0033:0x7f642d99aeb9 [ 330.024974][T13103] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 330.024992][T13103] RSP: 002b:00007f642e823028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 330.025015][T13103] RAX: ffffffffffffffda RBX: 00007f642dc15fa0 RCX: 00007f642d99aeb9 [ 330.025030][T13103] RDX: 0400000000000292 RSI: 0000200000002c40 RDI: 0000000000000005 [ 330.025044][T13103] RBP: 00007f642e823090 R08: 0000000000000000 R09: 0000000000000000 [ 330.025057][T13103] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 330.025068][T13103] R13: 00007f642dc16038 R14: 00007f642dc15fa0 R15: 00007ffdd72348d8 [ 330.025101][T13103] [ 330.349063][T13105] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2076'. [ 330.434265][T13111] openvswitch: netlink: Actions may not be safe on all matching packets [ 330.462757][T13113] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2073'. [ 330.547305][T13112] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2077'. [ 331.066658][T13118] IPVS: set_ctl: invalid protocol: 8 100.1.1.0:21 [ 331.127462][T13118] mpoa:mpoad_close: () going down [ 332.220506][T13118] lo speed is unknown, defaulting to 1000 [ 332.240437][T13118] wg1 speed is unknown, defaulting to 1000 [ 332.259442][T13118] wg1 speed is unknown, defaulting to 1000 [ 332.490303][T13139] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2083'. [ 332.610120][T13139] veth0_to_bond: left allmulticast mode [ 332.631733][T13139] veth0_to_bond: left promiscuous mode [ 332.671607][T13148] netlink: 175008 bytes leftover after parsing attributes in process `syz.3.2082'. [ 332.686343][T13139] bridge2: port 1(veth0_to_bond) entered disabled state [ 332.910990][T13171] openvswitch: netlink: Actions may not be safe on all matching packets [ 333.186593][T13178] syzkaller0: entered promiscuous mode [ 333.192509][T13178] syzkaller0: entered allmulticast mode [ 333.797503][T13209] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2099'. [ 333.809611][T13210] netlink: 'syz.3.2097': attribute type 1 has an invalid length. [ 334.717779][ C0] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 335.091243][T13209] faux_driver regulatory: loading /lib/firmware/regulatory.db failed with error -4 [ 335.102177][T13209] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -4 [ 335.116382][T13209] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db [ 335.339381][T13222] syz_tun: entered allmulticast mode [ 335.367990][T13221] syz_tun: left allmulticast mode [ 335.576940][T13238] netlink: 104 bytes leftover after parsing attributes in process `syz.4.2110'. [ 335.612192][T13226] lo speed is unknown, defaulting to 1000 [ 335.621773][T13235] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 335.644524][T13226] wg1 speed is unknown, defaulting to 1000 [ 335.660754][T13235] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2109'. [ 335.676845][T13240] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2111'. [ 335.710756][T13226] wg1 speed is unknown, defaulting to 1000 [ 335.743564][T13235] syzkaller0: entered promiscuous mode [ 335.757088][T13235] syzkaller0: entered allmulticast mode [ 335.822258][T13235] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2109'. [ 335.906687][T13250] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2115'. [ 336.190340][T13248] syzkaller0: entered promiscuous mode [ 336.204060][T13248] syzkaller0: entered allmulticast mode [ 336.312355][T13271] netlink: 104 bytes leftover after parsing attributes in process `syz.3.2122'. [ 336.337790][T13268] tipc: Can't bind to reserved service type 1 [ 336.361969][T13261] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2118'. [ 336.483708][T13282] netlink: 'syz.3.2124': attribute type 1 has an invalid length. [ 336.535545][T13288] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2118'. [ 337.917834][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 338.312156][T13282] workqueue: Failed to create a rescuer kthread for wq "bond2": -EINTR [ 338.520052][T13316] syz_tun: entered allmulticast mode [ 338.538786][T13314] syz_tun: left allmulticast mode [ 338.838398][T13327] lo speed is unknown, defaulting to 1000 [ 338.844638][T13332] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2135'. [ 338.873979][T13327] wg1 speed is unknown, defaulting to 1000 [ 338.900508][T13327] wg1 speed is unknown, defaulting to 1000 [ 339.005437][T13333] lo speed is unknown, defaulting to 1000 [ 339.019924][T13333] wg1 speed is unknown, defaulting to 1000 [ 339.027617][T13333] wg1 speed is unknown, defaulting to 1000 [ 339.287301][T13357] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2141'. [ 339.336751][T13361] x_tables: duplicate underflow at hook 2 [ 341.849702][T13338] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 341.890730][T13333] netlink: 'syz.3.2136': attribute type 1 has an invalid length. [ 341.922482][T13333] netlink: 248 bytes leftover after parsing attributes in process `syz.3.2136'. [ 342.062062][T13375] netlink: 'syz.0.2144': attribute type 10 has an invalid length. [ 342.080057][T13375] syz_tun: entered promiscuous mode [ 342.094272][T13375] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 342.232069][T13387] netlink: 104 bytes leftover after parsing attributes in process `syz.4.2146'. [ 342.285082][T13374] lo speed is unknown, defaulting to 1000 [ 342.511439][T13374] wg1 speed is unknown, defaulting to 1000 [ 342.585752][T13374] wg1 speed is unknown, defaulting to 1000 [ 342.616315][T13399] netlink: zone id is out of range [ 342.627764][T13399] netlink: zone id is out of range [ 342.712140][T13403] netlink: 40 bytes leftover after parsing attributes in process `syz.4.2152'. [ 342.729709][T13405] netlink: 36 bytes leftover after parsing attributes in process `syz.3.2153'. [ 342.795137][T13398] netlink: set zone limit has 4 unknown bytes [ 342.912184][T13410] netlink: 104 bytes leftover after parsing attributes in process `syz.4.2154'. [ 342.984331][T13412] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2156'. [ 343.156977][T13374] syzkaller1: entered promiscuous mode [ 343.162882][T13374] syzkaller1: entered allmulticast mode [ 343.541383][T13427] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2161'. [ 343.595835][T13430] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 343.818878][T13441] netlink: 104 bytes leftover after parsing attributes in process `syz.0.2166'. [ 343.922617][T13438] lo speed is unknown, defaulting to 1000 [ 343.937440][T13438] wg1 speed is unknown, defaulting to 1000 [ 344.019332][T13438] wg1 speed is unknown, defaulting to 1000 [ 344.699522][T13483] raw_sendmsg: syz.1.2178 forgot to set AF_INET. Fix it! [ 344.774467][T13487] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 345.000913][T13493] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2183'. [ 345.010483][T13493] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2183'. [ 345.653279][T13520] FAULT_INJECTION: forcing a failure. [ 345.653279][T13520] name failslab, interval 1, probability 0, space 0, times 0 [ 345.670030][T13520] CPU: 1 UID: 0 PID: 13520 Comm: syz.3.2194 Not tainted syzkaller #0 PREEMPT(full) [ 345.670065][T13520] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 345.670078][T13520] Call Trace: [ 345.670088][T13520] [ 345.670098][T13520] dump_stack_lvl+0xe8/0x150 [ 345.670134][T13520] should_fail_ex+0x412/0x560 [ 345.670167][T13520] should_failslab+0xa8/0x100 [ 345.670192][T13520] kmem_cache_alloc_noprof+0x87/0x6e0 [ 345.670227][T13520] ? dst_alloc+0x105/0x170 [ 345.670255][T13520] ? __local_bh_enable_ip+0xd0/0x130 [ 345.670278][T13520] dst_alloc+0x105/0x170 [ 345.670306][T13520] ? ip_check_mc_rcu+0x632/0x680 [ 345.670333][T13520] ip_route_output_key_hash_rcu+0x14d0/0x25d0 [ 345.670374][T13520] ? ip_route_output_key_hash+0xd8/0x2a0 [ 345.670403][T13520] ip_route_output_key_hash+0x18d/0x2a0 [ 345.670451][T13520] ? __pfx_ip_route_output_key_hash+0x10/0x10 [ 345.670500][T13520] ip_route_output_flow+0x2a/0x150 [ 345.670524][T13520] ? security_sk_classify_flow+0x6d/0x150 [ 345.670561][T13520] raw_sendmsg+0x1196/0x1a50 [ 345.670608][T13520] ? __pfx_raw_sendmsg+0x10/0x10 [ 345.670650][T13520] ? aa_sk_perm+0x82d/0x960 [ 345.670683][T13520] ? __pfx_aa_sk_perm+0x10/0x10 [ 345.670716][T13520] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 345.670748][T13520] ? sock_rps_record_flow+0x19/0x400 [ 345.670782][T13520] ? inet_sendmsg+0x2f4/0x370 [ 345.670811][T13520] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 345.670838][T13520] sock_sendmsg+0x3b5/0x500 [ 345.670867][T13520] ? __pfx_sock_sendmsg+0x10/0x10 [ 345.670903][T13520] ? __asan_memset+0x22/0x50 [ 345.670934][T13520] ? iov_iter_bvec+0xb8/0x180 [ 345.670972][T13520] splice_to_socket+0xae2/0x11f0 [ 345.671022][T13520] ? __pfx_splice_to_socket+0x10/0x10 [ 345.671072][T13520] ? get_pid_task+0x20/0x1f0 [ 345.671114][T13520] ? bpf_lsm_file_permission+0x9/0x20 [ 345.671137][T13520] ? security_file_permission+0x75/0x260 [ 345.671160][T13520] ? rw_verify_area+0x255/0x4d0 [ 345.671191][T13520] ? __pfx_splice_to_socket+0x10/0x10 [ 345.671215][T13520] do_splice+0xee3/0x1910 [ 345.671265][T13520] ? __pfx_do_splice+0x10/0x10 [ 345.671299][T13520] __se_sys_splice+0x353/0x490 [ 345.671331][T13520] ? __pfx___se_sys_splice+0x10/0x10 [ 345.671361][T13520] ? __x64_sys_splice+0x21/0xf0 [ 345.671388][T13520] do_syscall_64+0xe2/0xf80 [ 345.671570][T13520] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 345.671603][T13520] ? trace_irq_disable+0x37/0x100 [ 345.671624][T13520] ? clear_bhb_loop+0x60/0xb0 [ 345.671650][T13520] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 345.671672][T13520] RIP: 0033:0x7f4578b9aeb9 [ 345.671692][T13520] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 345.671710][T13520] RSP: 002b:00007f45799c0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 345.671732][T13520] RAX: ffffffffffffffda RBX: 00007f4578e15fa0 RCX: 00007f4578b9aeb9 [ 345.671747][T13520] RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000000003 [ 345.671759][T13520] RBP: 00007f45799c0090 R08: 0000000000008000 R09: 0000000000000000 [ 345.671773][T13520] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 345.671785][T13520] R13: 00007f4578e16038 R14: 00007f4578e15fa0 R15: 00007fffb81445f8 [ 345.671820][T13520] [ 346.640860][T13554] lo speed is unknown, defaulting to 1000 [ 346.649208][T13554] wg1 speed is unknown, defaulting to 1000 [ 346.658283][T13554] wg1 speed is unknown, defaulting to 1000 [ 346.681462][T13556] sctp: [Deprecated]: syz.3.2208 (pid 13556) Use of int in max_burst socket option deprecated. [ 346.681462][T13556] Use struct sctp_assoc_value instead [ 346.739843][T13556] Cannot find set identified by id 65534 to match [ 346.977286][T13563] syzkaller0: entered promiscuous mode [ 346.984275][T13563] syzkaller0: entered allmulticast mode [ 347.251573][T13573] netlink: 'syz.0.2214': attribute type 2 has an invalid length. [ 347.297751][T13579] __nla_validate_parse: 2 callbacks suppressed [ 347.297773][T13579] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2216'. [ 347.298219][T13578] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2215'. [ 347.368309][T13583] FAULT_INJECTION: forcing a failure. [ 347.368309][T13583] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 347.394947][T13573] xt_SECMARK: only valid in 'mangle' or 'security' table, not 'filter' [ 347.412318][T13578] netlink: 'syz.2.2215': attribute type 10 has an invalid length. [ 347.437996][T13584] tipc: Enabled bearer , priority 0 [ 347.467636][T13583] CPU: 0 UID: 0 PID: 13583 Comm: syz.4.2217 Not tainted syzkaller #0 PREEMPT(full) [ 347.467666][T13583] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 347.467679][T13583] Call Trace: [ 347.467688][T13583] [ 347.467697][T13583] dump_stack_lvl+0xe8/0x150 [ 347.467733][T13583] should_fail_ex+0x412/0x560 [ 347.467765][T13583] _copy_from_user+0x2d/0xb0 [ 347.467800][T13583] bpf_test_init+0xd8/0x150 [ 347.467829][T13583] bpf_prog_test_run_skb+0x36f/0x1c90 [ 347.467866][T13583] ? __fget_files+0x2a/0x420 [ 347.467893][T13583] ? __fget_files+0x3a0/0x420 [ 347.467913][T13583] ? __fget_files+0x2a/0x420 [ 347.467941][T13583] ? __pfx_bpf_prog_test_run_skb+0x10/0x10 [ 347.467966][T13583] bpf_prog_test_run+0x2c7/0x340 [ 347.467993][T13583] __sys_bpf+0x5cb/0x920 [ 347.468016][T13583] ? __pfx___sys_bpf+0x10/0x10 [ 347.468054][T13583] ? ksys_write+0x242/0x270 [ 347.468089][T13583] ? __pfx_ksys_write+0x10/0x10 [ 347.468127][T13583] __x64_sys_bpf+0x7c/0x90 [ 347.468159][T13583] do_syscall_64+0xe2/0xf80 [ 347.468189][T13583] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 347.468209][T13583] ? trace_irq_disable+0x37/0x100 [ 347.468229][T13583] ? clear_bhb_loop+0x60/0xb0 [ 347.468254][T13583] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 347.468275][T13583] RIP: 0033:0x7f642d99aeb9 [ 347.468294][T13583] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 347.468312][T13583] RSP: 002b:00007f642e823028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 347.468334][T13583] RAX: ffffffffffffffda RBX: 00007f642dc15fa0 RCX: 00007f642d99aeb9 [ 347.468348][T13583] RDX: 000000000000002c RSI: 0000200000000080 RDI: 000000000000000a [ 347.468360][T13583] RBP: 00007f642e823090 R08: 0000000000000000 R09: 0000000000000000 [ 347.468373][T13583] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 347.468385][T13583] R13: 00007f642dc16038 R14: 00007f642dc15fa0 R15: 00007ffdd72348d8 [ 347.468419][T13583] [ 347.644406][T13589] netlink: 'syz.3.2218': attribute type 1 has an invalid length. [ 347.703259][T13576] tipc: Disabling bearer [ 347.911511][T13600] mapping of prio or/and queue is allowed only from OUTPUT/FORWARD/POSTROUTING chains [ 347.935162][T13604] FAULT_INJECTION: forcing a failure. [ 347.935162][T13604] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 347.967584][T13604] CPU: 0 UID: 0 PID: 13604 Comm: syz.0.2222 Not tainted syzkaller #0 PREEMPT(full) [ 347.967612][T13604] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 347.967624][T13604] Call Trace: [ 347.967632][T13604] [ 347.967642][T13604] dump_stack_lvl+0xe8/0x150 [ 347.967674][T13604] should_fail_ex+0x412/0x560 [ 347.967704][T13604] _copy_from_user+0x2d/0xb0 [ 347.967741][T13604] __sys_connect+0x156/0x450 [ 347.967772][T13604] ? __pfx___sys_connect+0x10/0x10 [ 347.967810][T13604] ? __pfx_ksys_write+0x10/0x10 [ 347.967849][T13604] __x64_sys_connect+0x7a/0x90 [ 347.967875][T13604] do_syscall_64+0xe2/0xf80 [ 347.967903][T13604] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 347.967922][T13604] ? trace_irq_disable+0x37/0x100 [ 347.967942][T13604] ? clear_bhb_loop+0x60/0xb0 [ 347.967967][T13604] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 347.967987][T13604] RIP: 0033:0x7fe8efb9aeb9 [ 347.968006][T13604] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 347.968023][T13604] RSP: 002b:00007fe8f09ac028 EFLAGS: 00000246 ORIG_RAX: 000000000000002a [ 347.968045][T13604] RAX: ffffffffffffffda RBX: 00007fe8efe16090 RCX: 00007fe8efb9aeb9 [ 347.968061][T13604] RDX: 0000000000000010 RSI: 00002000000001c0 RDI: 0000000000000008 [ 347.968074][T13604] RBP: 00007fe8f09ac090 R08: 0000000000000000 R09: 0000000000000000 [ 347.968086][T13604] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 347.968098][T13604] R13: 00007fe8efe16128 R14: 00007fe8efe16090 R15: 00007ffec6fa92a8 [ 347.968132][T13604] [ 348.147788][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 348.232431][T13611] xt_recent: hitcount (262143) is larger than allowed maximum (65535) [ 348.477091][T13623] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2231'. [ 348.607357][T13619] syzkaller0: entered promiscuous mode [ 348.634909][T13619] syzkaller0: entered allmulticast mode [ 350.538520][T13634] netdevsim netdevsim2 netdevsim0: entered promiscuous mode [ 350.677856][T13654] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2239'. [ 350.740705][T13657] netlink: 'syz.4.2239': attribute type 13 has an invalid length. [ 350.760172][T13657] netlink: 14589 bytes leftover after parsing attributes in process `syz.4.2239'. [ 350.788942][T13660] netlink: 212408 bytes leftover after parsing attributes in process `syz.3.2240'. [ 351.329529][T13686] xt_TPROXY: Can be used only with -p tcp or -p udp [ 351.506805][T13702] 8021q: adding VLAN 0 to HW filter on device bond3 [ 351.588336][T13711] netlink: 'syz.0.2257': attribute type 3 has an invalid length. [ 351.798377][T13720] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2260'. [ 351.826655][T13725] netlink: 32 bytes leftover after parsing attributes in process `syz.3.2262'. [ 351.862684][T13727] openvswitch: netlink: Actions may not be safe on all matching packets [ 351.926233][T13729] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2264'. [ 352.403622][T13758] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2274'. [ 352.563919][T13767] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2278'. [ 352.799034][T13780] netlink: 296 bytes leftover after parsing attributes in process `syz.2.2283'. [ 352.820335][T13784] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth0_to_bond, syncid = 0, id = 0 [ 352.834982][T13783] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2284'. [ 352.959103][T13789] Cannot find set identified by id 65534 to match [ 353.030608][T13794] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2287'. [ 353.110642][T13802] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2289'. [ 353.323052][T13815] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2292'. [ 353.350186][ T5826] Bluetooth: hci4: command 0x0406 tx timeout [ 353.533308][T13823] syzkaller0: entered promiscuous mode [ 353.539298][T13823] syzkaller0: entered allmulticast mode [ 353.709499][T13832] FAULT_INJECTION: forcing a failure. [ 353.709499][T13832] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 353.723264][T13832] CPU: 1 UID: 0 PID: 13832 Comm: syz.2.2299 Not tainted syzkaller #0 PREEMPT(full) [ 353.723304][T13832] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 353.723326][T13832] Call Trace: [ 353.723335][T13832] [ 353.723344][T13832] dump_stack_lvl+0xe8/0x150 [ 353.723378][T13832] should_fail_ex+0x412/0x560 [ 353.723409][T13832] _copy_from_iter+0x1d3/0x1670 [ 353.723448][T13832] ? rcu_is_watching+0x15/0xb0 [ 353.723473][T13832] ? __pfx__copy_from_iter+0x10/0x10 [ 353.723499][T13832] ? kmem_cache_alloc_node_noprof+0x473/0x6f0 [ 353.723542][T13832] ? netlink_sendmsg+0x650/0xb40 [ 353.723573][T13832] ? skb_put+0x11b/0x210 [ 353.723605][T13832] netlink_sendmsg+0x6c0/0xb40 [ 353.723639][T13832] ? __pfx_netlink_sendmsg+0x10/0x10 [ 353.723669][T13832] ? aa_sock_msg_perm+0xf1/0x1b0 [ 353.723698][T13832] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 353.723723][T13832] ? __pfx_netlink_sendmsg+0x10/0x10 [ 353.723746][T13832] ____sys_sendmsg+0xa68/0xad0 [ 353.723775][T13832] ? __might_fault+0xaf/0x130 [ 353.723813][T13832] ? __pfx_____sys_sendmsg+0x10/0x10 [ 353.723852][T13832] ? import_iovec+0x73/0xa0 [ 353.723888][T13832] ___sys_sendmsg+0x2a5/0x360 [ 353.723917][T13832] ? __lock_acquire+0x6b5/0x2cf0 [ 353.723960][T13832] ? __pfx____sys_sendmsg+0x10/0x10 [ 353.724028][T13832] ? __fget_files+0x2a/0x420 [ 353.724051][T13832] ? __fget_files+0x3a0/0x420 [ 353.724086][T13832] __x64_sys_sendmsg+0x1bd/0x2a0 [ 353.724119][T13832] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 353.724158][T13832] ? __pfx_ksys_write+0x10/0x10 [ 353.724202][T13832] do_syscall_64+0xe2/0xf80 [ 353.724230][T13832] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 353.724254][T13832] ? trace_irq_disable+0x37/0x100 [ 353.724274][T13832] ? clear_bhb_loop+0x60/0xb0 [ 353.724299][T13832] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 353.724320][T13832] RIP: 0033:0x7f590259aeb9 [ 353.724339][T13832] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 353.724357][T13832] RSP: 002b:00007f59034f0028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 353.724379][T13832] RAX: ffffffffffffffda RBX: 00007f5902815fa0 RCX: 00007f590259aeb9 [ 353.724394][T13832] RDX: 0000000000048000 RSI: 00002000000002c0 RDI: 0000000000000004 [ 353.724407][T13832] RBP: 00007f59034f0090 R08: 0000000000000000 R09: 0000000000000000 [ 353.724420][T13832] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 353.724433][T13832] R13: 00007f5902816038 R14: 00007f5902815fa0 R15: 00007ffd11ca9a48 [ 353.724465][T13832] [ 353.753311][T13830] syzkaller0: entered promiscuous mode [ 353.997752][ T10] IPVS: starting estimator thread 0... [ 354.003301][T13830] syzkaller0: entered allmulticast mode [ 354.087316][T13840] geneve2: entered promiscuous mode [ 354.105547][T13278] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 354.109637][T13833] IPVS: using max 29 ests per chain, 69600 per kthread [ 354.115216][T13278] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 354.132816][T13278] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 354.146700][T13278] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 354.279521][T13845] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2303'. [ 354.293205][T13843] tipc: Enabled bearer , priority 0 [ 354.325987][T13843] syzkaller0: entered promiscuous mode [ 354.333780][T13843] syzkaller0: entered allmulticast mode [ 354.370228][T13843] tipc: Resetting bearer [ 354.384162][T13847] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2304'. [ 354.653936][T13843] tipc: Disabling bearer [ 354.806166][T13864] syzkaller0: entered promiscuous mode [ 354.845553][T13864] syzkaller0: entered allmulticast mode [ 354.884570][T13868] vlan2: entered promiscuous mode [ 354.918355][T13868] bridge0: entered promiscuous mode [ 354.974345][T13877] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2313'. [ 355.167661][T13878] lo speed is unknown, defaulting to 1000 [ 355.201077][T13878] wg1 speed is unknown, defaulting to 1000 [ 355.249529][T13878] wg1 speed is unknown, defaulting to 1000 [ 355.845505][T13908] FAULT_INJECTION: forcing a failure. [ 355.845505][T13908] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 355.899001][T13908] CPU: 1 UID: 0 PID: 13908 Comm: syz.2.2323 Not tainted syzkaller #0 PREEMPT(full) [ 355.899039][T13908] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 355.899052][T13908] Call Trace: [ 355.899060][T13908] [ 355.899069][T13908] dump_stack_lvl+0xe8/0x150 [ 355.899102][T13908] should_fail_ex+0x412/0x560 [ 355.899132][T13908] _copy_from_user+0x2d/0xb0 [ 355.899164][T13908] kstrtouint_from_user+0xd6/0x180 [ 355.899193][T13908] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 355.899238][T13908] proc_fail_nth_write+0x8e/0x210 [ 355.899269][T13908] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 355.899306][T13908] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 355.899338][T13908] vfs_write+0x29a/0xb90 [ 355.899378][T13908] ? __pfx_vfs_write+0x10/0x10 [ 355.899410][T13908] ? __fget_files+0x2a/0x420 [ 355.899437][T13908] ? __fget_files+0x3a0/0x420 [ 355.899459][T13908] ? __fget_files+0x2a/0x420 [ 355.899492][T13908] ksys_write+0x150/0x270 [ 355.899525][T13908] ? __pfx_ksys_write+0x10/0x10 [ 355.899568][T13908] do_syscall_64+0xe2/0xf80 [ 355.899596][T13908] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 355.899616][T13908] ? trace_irq_disable+0x37/0x100 [ 355.899636][T13908] ? clear_bhb_loop+0x60/0xb0 [ 355.899661][T13908] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 355.899681][T13908] RIP: 0033:0x7f590255b78e [ 355.899699][T13908] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 355.899717][T13908] RSP: 002b:00007f59034effe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 355.899739][T13908] RAX: ffffffffffffffda RBX: 00007f59034f06c0 RCX: 00007f590255b78e [ 355.899755][T13908] RDX: 0000000000000001 RSI: 00007f59034f00a0 RDI: 0000000000000003 [ 355.899768][T13908] RBP: 00007f59034f0090 R08: 0000000000000000 R09: 0000000000000000 [ 355.899781][T13908] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 355.899798][T13908] R13: 00007f5902816038 R14: 00007f5902815fa0 R15: 00007ffd11ca9a48 [ 355.899833][T13908] [ 356.410697][T13926] tipc: Enabling of bearer rejected, failed to enable media [ 356.422050][T13924] A link change request failed with some changes committed already. Interface veth1 may have been left with an inconsistent configuration, please check. [ 356.905198][T13956] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 356.928684][T13956] netlink: 'syz.1.2342': attribute type 8 has an invalid length. [ 357.566266][T13993] __nla_validate_parse: 15 callbacks suppressed [ 357.566286][T13993] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2353'. [ 357.583354][T13993] FAULT_INJECTION: forcing a failure. [ 357.583354][T13993] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 357.600466][T13995] sctp: [Deprecated]: syz.4.2354 (pid 13995) Use of int in max_burst socket option deprecated. [ 357.600466][T13995] Use struct sctp_assoc_value instead [ 357.637062][T13996] netlink: 'syz.3.2355': attribute type 1 has an invalid length. [ 357.643123][T13993] CPU: 0 UID: 0 PID: 13993 Comm: syz.0.2353 Not tainted syzkaller #0 PREEMPT(full) [ 357.643211][T13993] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 357.643244][T13993] Call Trace: [ 357.643275][T13993] [ 357.643299][T13993] dump_stack_lvl+0xe8/0x150 [ 357.643387][T13993] should_fail_ex+0x412/0x560 [ 357.643473][T13993] _copy_to_user+0x31/0xb0 [ 357.643569][T13993] simple_read_from_buffer+0xe1/0x170 [ 357.643631][T13993] proc_fail_nth_read+0x1bb/0x230 [ 357.643722][T13993] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 357.643821][T13993] ? rw_verify_area+0x2a6/0x4d0 [ 357.644085][T13993] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 357.644199][T13993] vfs_read+0x20c/0xa70 [ 357.644283][T13993] ? fdget_pos+0x246/0x320 [ 357.644361][T13993] ? __pfx___mutex_lock+0x10/0x10 [ 357.644448][T13993] ? __pfx_vfs_read+0x10/0x10 [ 357.644545][T13993] ? __fget_files+0x2a/0x420 [ 357.644615][T13993] ? __fget_files+0x3a0/0x420 [ 357.644684][T13993] ? __fget_files+0x2a/0x420 [ 357.644772][T13993] ksys_read+0x150/0x270 [ 357.644896][T13993] ? __pfx_ksys_read+0x10/0x10 [ 357.644943][T13993] do_syscall_64+0xe2/0xf80 [ 357.644971][T13993] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 357.644994][T13993] ? trace_irq_disable+0x37/0x100 [ 357.645013][T13993] ? clear_bhb_loop+0x60/0xb0 [ 357.645038][T13993] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 357.645057][T13993] RIP: 0033:0x7fe8efb5b78e [ 357.645077][T13993] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 357.645097][T13993] RSP: 002b:00007fe8f09ccfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 357.645120][T13993] RAX: ffffffffffffffda RBX: 00007fe8f09cd6c0 RCX: 00007fe8efb5b78e [ 357.645137][T13993] RDX: 000000000000000f RSI: 00007fe8f09cd0a0 RDI: 0000000000000005 [ 357.645151][T13993] RBP: 00007fe8f09cd090 R08: 0000000000000000 R09: 0000000000000000 [ 357.645164][T13993] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 357.645177][T13993] R13: 00007fe8efe16038 R14: 00007fe8efe15fa0 R15: 00007ffec6fa92a8 [ 357.645215][T13993] [ 357.920971][T13996] netlink: 'syz.3.2355': attribute type 2 has an invalid length. [ 357.949418][T13996] netlink: 'syz.3.2355': attribute type 1 has an invalid length. [ 357.984539][T13996] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2355'. [ 358.083010][T14007] lo speed is unknown, defaulting to 1000 [ 358.091132][T14007] wg1 speed is unknown, defaulting to 1000 [ 358.100481][T14006] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2358'. [ 358.121948][T14007] wg1 speed is unknown, defaulting to 1000 [ 358.468857][T14024] netlink: 64 bytes leftover after parsing attributes in process `syz.1.2364'. [ 358.514389][T14030] netlink: 136 bytes leftover after parsing attributes in process `syz.2.2363'. [ 358.561672][T14029] dvmrp1: entered allmulticast mode [ 358.609232][T14029] dvmrp1: left allmulticast mode [ 358.710735][T14033] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2368'. [ 358.777467][T14029] syzkaller1: entered promiscuous mode [ 358.801142][T14029] syzkaller1: entered allmulticast mode [ 359.009027][T14044] lo speed is unknown, defaulting to 1000 [ 359.032148][T14044] wg1 speed is unknown, defaulting to 1000 [ 359.049340][T14044] wg1 speed is unknown, defaulting to 1000 [ 359.095795][T14053] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2374'. [ 359.170848][T14055] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2375'. [ 359.224914][T14061] bridge4: port 1(veth7) entered blocking state [ 359.233560][T14061] bridge4: port 1(veth7) entered disabled state [ 359.241040][T14061] veth7: entered allmulticast mode [ 359.251048][T14061] veth7: entered promiscuous mode [ 359.420621][T14067] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2380'. [ 359.458387][T14053] bridge4: port 2(veth0_to_bond) entered blocking state [ 359.466234][T14053] bridge4: port 2(veth0_to_bond) entered disabled state [ 359.496679][T14053] veth0_to_bond: entered allmulticast mode [ 359.506051][T14053] veth0_to_bond: entered promiscuous mode [ 359.559492][T14061] bridge4: port 3(veth9) entered blocking state [ 359.566127][T14061] bridge4: port 3(veth9) entered disabled state [ 359.608919][T14061] veth9: entered allmulticast mode [ 359.619247][T14061] veth9: entered promiscuous mode [ 359.678603][T14082] netlink: 'syz.1.2382': attribute type 12 has an invalid length. [ 359.978408][T14096] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2383'. [ 360.636333][T14120] lo speed is unknown, defaulting to 1000 [ 360.661178][T14119] lo speed is unknown, defaulting to 1000 [ 360.668606][T14120] wg1 speed is unknown, defaulting to 1000 [ 360.703248][T14119] wg1 speed is unknown, defaulting to 1000 [ 360.704114][T14120] wg1 speed is unknown, defaulting to 1000 [ 360.747168][T14124] lo speed is unknown, defaulting to 1000 [ 360.765086][T14126] netlink: 'syz.3.2394': attribute type 2 has an invalid length. [ 360.821120][T14128] netlink: 'syz.1.2395': attribute type 1 has an invalid length. [ 360.836191][T14119] wg1 speed is unknown, defaulting to 1000 [ 360.837435][T14124] wg1 speed is unknown, defaulting to 1000 [ 360.899468][T14124] wg1 speed is unknown, defaulting to 1000 [ 360.936036][T14128] veth1: entered promiscuous mode [ 360.945477][T14128] bond4: (slave veth1): Enslaving as a backup interface with a down link [ 360.979261][T14128] 8021q: adding VLAN 0 to HW filter on device bond4 [ 361.056713][T14135] netlink: 'syz.1.2396': attribute type 27 has an invalid length. [ 361.107381][T14130] lo speed is unknown, defaulting to 1000 [ 361.229367][T14130] wg1 speed is unknown, defaulting to 1000 [ 361.258470][T14130] wg1 speed is unknown, defaulting to 1000 [ 361.299643][T14137] netlink: 'syz.1.2397': attribute type 6 has an invalid length. [ 361.374035][T14148] netlink: 'syz.0.2400': attribute type 10 has an invalid length. [ 361.450131][T14139] syzkaller0: entered promiscuous mode [ 361.483022][T14139] syzkaller0: entered allmulticast mode [ 361.503517][T14148] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 361.824865][T14140] lo speed is unknown, defaulting to 1000 [ 361.887735][T14140] wg1 speed is unknown, defaulting to 1000 [ 361.895423][T14140] wg1 speed is unknown, defaulting to 1000 [ 363.711777][T14179] syzkaller0: entered promiscuous mode [ 363.717807][T14179] syzkaller0: entered allmulticast mode [ 364.149715][ C0] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 365.364431][T14207] FAULT_INJECTION: forcing a failure. [ 365.364431][T14207] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 365.378242][T14207] CPU: 1 UID: 0 PID: 14207 Comm: syz.2.2415 Not tainted syzkaller #0 PREEMPT(full) [ 365.378271][T14207] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 365.378288][T14207] Call Trace: [ 365.378296][T14207] [ 365.378304][T14207] dump_stack_lvl+0xe8/0x150 [ 365.378335][T14207] should_fail_ex+0x412/0x560 [ 365.378363][T14207] _copy_from_user+0x2d/0xb0 [ 365.378394][T14207] ___sys_sendmsg+0x1c6/0x360 [ 365.378421][T14207] ? __lock_acquire+0x6b5/0x2cf0 [ 365.378451][T14207] ? __pfx____sys_sendmsg+0x10/0x10 [ 365.378484][T14207] ? kstrtouint+0x6e/0xe0 [ 365.378529][T14207] ? __fget_files+0x2a/0x420 [ 365.378551][T14207] ? __fget_files+0x3a0/0x420 [ 365.378584][T14207] __sys_sendmmsg+0x27c/0x4e0 [ 365.378617][T14207] ? __pfx___sys_sendmmsg+0x10/0x10 [ 365.378642][T14207] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 365.378696][T14207] ? ksys_write+0x242/0x270 [ 365.378726][T14207] ? __pfx_ksys_write+0x10/0x10 [ 365.378761][T14207] __x64_sys_sendmmsg+0xa0/0xc0 [ 365.378791][T14207] do_syscall_64+0xe2/0xf80 [ 365.378818][T14207] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 365.378838][T14207] ? trace_irq_disable+0x37/0x100 [ 365.378856][T14207] ? clear_bhb_loop+0x60/0xb0 [ 365.378880][T14207] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 365.378906][T14207] RIP: 0033:0x7f590259aeb9 [ 365.378924][T14207] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 365.378942][T14207] RSP: 002b:00007f59034f0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 365.378963][T14207] RAX: ffffffffffffffda RBX: 00007f5902815fa0 RCX: 00007f590259aeb9 [ 365.378978][T14207] RDX: 04000000000001f2 RSI: 0000200000000000 RDI: 0000000000000003 [ 365.378991][T14207] RBP: 00007f59034f0090 R08: 0000000000000000 R09: 0000000000000000 [ 365.379003][T14207] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 365.379021][T14207] R13: 00007f5902816038 R14: 00007f5902815fa0 R15: 00007ffd11ca9a48 [ 365.379051][T14207] [ 365.621420][T14189] lo speed is unknown, defaulting to 1000 [ 365.663190][T14189] wg1 speed is unknown, defaulting to 1000 [ 365.678819][T14189] wg1 speed is unknown, defaulting to 1000 [ 365.723276][T14210] __nla_validate_parse: 4 callbacks suppressed [ 365.723296][T14210] netlink: 36 bytes leftover after parsing attributes in process `syz.2.2416'. [ 365.971122][T14218] xt_CT: You must specify a L4 protocol and not use inversions on it [ 365.975522][T14217] netlink: 56 bytes leftover after parsing attributes in process `syz.2.2419'. [ 366.100880][T14222] netlink: 72 bytes leftover after parsing attributes in process `syz.2.2422'. [ 366.155197][T14222] gretap0: left promiscuous mode [ 366.196856][T14222] 8021q: adding VLAN 0 to HW filter on device bond0 [ 366.205946][T14222] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 366.247041][T14226] syzkaller0: entered promiscuous mode [ 366.253430][ T5822] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 366.262305][T14226] syzkaller0: entered allmulticast mode [ 366.312463][T14229] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2425'. [ 366.433797][T14229] lo speed is unknown, defaulting to 1000 [ 366.446423][T14229] wg1 speed is unknown, defaulting to 1000 [ 366.471224][T14229] wg1 speed is unknown, defaulting to 1000 [ 366.530454][T14234] lo speed is unknown, defaulting to 1000 [ 366.559385][T14234] wg1 speed is unknown, defaulting to 1000 [ 366.603279][T14234] wg1 speed is unknown, defaulting to 1000 [ 366.613480][T14232] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2426'. [ 366.951654][ T7499] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 366.979274][T14252] netlink: 56 bytes leftover after parsing attributes in process `syz.2.2432'. [ 367.030214][T13278] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 367.225840][T14259] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2434'. [ 367.480134][T14266] syzkaller0: entered promiscuous mode [ 367.486136][T14266] syzkaller0: entered allmulticast mode [ 367.960876][T14302] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2447'. [ 369.297406][ T12] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 369.317125][ T12] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 369.334692][T14297] netlink: 56 bytes leftover after parsing attributes in process `syz.4.2445'. [ 369.699305][T14323] openvswitch: netlink: Missing valid actions attribute. [ 369.706906][T14323] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 369.739372][ T7533] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 369.911645][T14330] lo speed is unknown, defaulting to 1000 [ 369.956287][T14330] wg1 speed is unknown, defaulting to 1000 [ 369.976805][T14330] wg1 speed is unknown, defaulting to 1000 [ 369.980406][T14340] netlink: 56 bytes leftover after parsing attributes in process `syz.3.2461'. [ 370.329937][T14353] lo speed is unknown, defaulting to 1000 [ 370.338200][T14353] wg1 speed is unknown, defaulting to 1000 [ 370.345798][T14353] wg1 speed is unknown, defaulting to 1000 [ 370.502859][T14359] xt_SECMARK: only valid in 'mangle' or 'security' table, not 'filter' [ 370.887948][T14372] __nla_validate_parse: 1 callbacks suppressed [ 370.887971][T14372] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2469'. [ 371.218059][T14387] netlink: 56 bytes leftover after parsing attributes in process `syz.1.2474'. [ 371.320590][T14391] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2475'. [ 371.336205][T14400] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2477'. [ 371.357661][T14400] netlink: 'syz.3.2477': attribute type 21 has an invalid length. [ 371.471413][T14400] bridge_slave_0: entered promiscuous mode [ 371.511526][T14412] netlink: 'syz.2.2481': attribute type 10 has an invalid length. [ 371.535180][T14408] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2479'. [ 371.780620][T14415] veth0_to_bond: left allmulticast mode [ 371.787964][T14415] veth0_to_bond: left promiscuous mode [ 371.793774][T14415] bridge4: port 2(veth0_to_bond) entered disabled state [ 371.812651][T14415] bridge5: port 1(veth0_to_bond) entered blocking state [ 371.843860][T14415] bridge5: port 1(veth0_to_bond) entered disabled state [ 371.851340][T14415] veth0_to_bond: entered allmulticast mode [ 371.864072][T14415] veth0_to_bond: entered promiscuous mode [ 371.896451][T14430] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2485'. [ 372.005913][T14436] netlink: 56 bytes leftover after parsing attributes in process `syz.4.2488'. [ 372.170298][T14439] tipc: Enabled bearer , priority 0 [ 372.284247][T14439] syzkaller0: entered promiscuous mode [ 372.290189][T14439] syzkaller0: entered allmulticast mode [ 372.296848][T14439] tipc: Resetting bearer [ 372.362396][T14438] tipc: Resetting bearer [ 372.465200][T14456] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2494'. [ 372.586572][T14466] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2494'. [ 373.187802][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 374.194651][T14438] tipc: Disabling bearer [ 374.219247][T14475] FAULT_INJECTION: forcing a failure. [ 374.219247][T14475] name failslab, interval 1, probability 0, space 0, times 0 [ 374.236544][T14475] CPU: 0 UID: 0 PID: 14475 Comm: syz.0.2498 Not tainted syzkaller #0 PREEMPT(full) [ 374.236574][T14475] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 374.236588][T14475] Call Trace: [ 374.236597][T14475] [ 374.236606][T14475] dump_stack_lvl+0xe8/0x150 [ 374.236639][T14475] should_fail_ex+0x412/0x560 [ 374.236670][T14475] should_failslab+0xa8/0x100 [ 374.236697][T14475] __kmalloc_cache_noprof+0x83/0x6e0 [ 374.236720][T14475] ? nl80211_dump_wiphy+0x28e/0x6d0 [ 374.236749][T14475] nl80211_dump_wiphy+0x28e/0x6d0 [ 374.236782][T14475] genl_dumpit+0x10b/0x1b0 [ 374.236818][T14475] netlink_dump+0x722/0xe80 [ 374.236856][T14475] ? __pfx_netlink_dump+0x10/0x10 [ 374.236898][T14475] ? genl_start+0x499/0x6c0 [ 374.236937][T14475] __netlink_dump_start+0x5cb/0x7e0 [ 374.236971][T14475] genl_family_rcv_msg_dumpit+0x213/0x310 [ 374.237007][T14475] ? __pfx_genl_family_rcv_msg_dumpit+0x10/0x10 [ 374.237036][T14475] ? genl_get_cmd+0x7f4/0x930 [ 374.237068][T14475] ? __kernel_text_address+0xd/0x30 [ 374.237098][T14475] ? __pfx_genl_start+0x10/0x10 [ 374.237125][T14475] ? __pfx_genl_dumpit+0x10/0x10 [ 374.237152][T14475] ? __pfx_genl_done+0x10/0x10 [ 374.237183][T14475] ? __lock_acquire+0x6b5/0x2cf0 [ 374.237223][T14475] genl_rcv_msg+0x5e8/0x7a0 [ 374.237260][T14475] ? __pfx_genl_rcv_msg+0x10/0x10 [ 374.237290][T14475] ? __pfx_nl80211_dump_wiphy+0x10/0x10 [ 374.237310][T14475] ? __pfx_nl80211_dump_wiphy_done+0x10/0x10 [ 374.237347][T14475] netlink_rcv_skb+0x232/0x4b0 [ 374.237380][T14475] ? __pfx_genl_rcv_msg+0x10/0x10 [ 374.237411][T14475] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 374.237433][T14475] ? genl_rcv+0x19/0x40 [ 374.237483][T14475] ? down_read+0x272/0x2e0 [ 374.237511][T14475] ? genl_rcv+0xd/0x40 [ 374.237541][T14475] genl_rcv+0x28/0x40 [ 374.237567][T14475] netlink_unicast+0x80f/0x9b0 [ 374.237597][T14475] ? __pfx_netlink_unicast+0x10/0x10 [ 374.237621][T14475] ? netlink_sendmsg+0x650/0xb40 [ 374.237643][T14475] ? skb_put+0x11b/0x210 [ 374.237681][T14475] netlink_sendmsg+0x813/0xb40 [ 374.237717][T14475] ? __pfx_netlink_sendmsg+0x10/0x10 [ 374.237747][T14475] ? aa_sock_msg_perm+0xf1/0x1b0 [ 374.237774][T14475] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 374.237799][T14475] ? __pfx_netlink_sendmsg+0x10/0x10 [ 374.237822][T14475] ____sys_sendmsg+0xa68/0xad0 [ 374.237851][T14475] ? __might_fault+0xaf/0x130 [ 374.237889][T14475] ? __pfx_____sys_sendmsg+0x10/0x10 [ 374.237929][T14475] ? import_iovec+0x73/0xa0 [ 374.237965][T14475] ___sys_sendmsg+0x2a5/0x360 [ 374.237992][T14475] ? __lock_acquire+0x6b5/0x2cf0 [ 374.238026][T14475] ? __pfx____sys_sendmsg+0x10/0x10 [ 374.238097][T14475] ? __fget_files+0x2a/0x420 [ 374.238119][T14475] ? __fget_files+0x3a0/0x420 [ 374.238154][T14475] __x64_sys_sendmsg+0x1bd/0x2a0 [ 374.238187][T14475] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 374.238228][T14475] ? __pfx_ksys_write+0x10/0x10 [ 374.238273][T14475] do_syscall_64+0xe2/0xf80 [ 374.238300][T14475] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 374.238321][T14475] ? trace_irq_disable+0x37/0x100 [ 374.238340][T14475] ? clear_bhb_loop+0x60/0xb0 [ 374.238390][T14475] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 374.238411][T14475] RIP: 0033:0x7fe8efb9aeb9 [ 374.238430][T14475] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 374.238447][T14475] RSP: 002b:00007fe8f09cd028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 374.238471][T14475] RAX: ffffffffffffffda RBX: 00007fe8efe15fa0 RCX: 00007fe8efb9aeb9 [ 374.238486][T14475] RDX: 0000000024048840 RSI: 00002000000002c0 RDI: 0000000000000003 [ 374.238500][T14475] RBP: 00007fe8f09cd090 R08: 0000000000000000 R09: 0000000000000000 [ 374.238513][T14475] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 374.238525][T14475] R13: 00007fe8efe16038 R14: 00007fe8efe15fa0 R15: 00007ffec6fa92a8 [ 374.238562][T14475] [ 374.639854][T14459] lo speed is unknown, defaulting to 1000 [ 374.718224][T14459] wg1 speed is unknown, defaulting to 1000 [ 374.726072][T14459] wg1 speed is unknown, defaulting to 1000 [ 375.105009][T14498] RDS: rds_bind could not find a transport for fec0:ffff::1, load rds_tcp or rds_rdma? [ 375.134838][T14498] pimreg: entered allmulticast mode [ 375.167052][T14501] pim6reg1: entered allmulticast mode [ 375.322958][T14508] x_tables: duplicate underflow at hook 2 [ 375.346451][T14510] netlink: 84 bytes leftover after parsing attributes in process `syz.2.2508'. [ 375.559431][T14519] openvswitch: netlink: Actions may not be safe on all matching packets [ 375.856548][T14541] syzkaller1: entered promiscuous mode [ 375.863220][T14541] syzkaller1: entered allmulticast mode [ 375.979239][T14547] tipc: Enabled bearer , priority 0 [ 375.992601][T14547] syzkaller0: entered promiscuous mode [ 376.009721][T14547] syzkaller0: entered allmulticast mode [ 376.032457][T14549] bridge0: port 1(erspan0) entered blocking state [ 376.039416][T14549] bridge0: port 1(erspan0) entered disabled state [ 376.046051][T14549] erspan0: entered allmulticast mode [ 376.053524][T14549] erspan0: entered promiscuous mode [ 376.060688][T14549] bridge0: port 1(erspan0) entered blocking state [ 376.067643][T14549] bridge0: port 1(erspan0) entered forwarding state [ 376.117262][T14549] 8021q: adding VLAN 0 to HW filter on device bond2 [ 376.157055][T14549] 8021q: adding VLAN 0 to HW filter on device macvlan0 [ 376.167267][T14549] bond2: (slave macvlan0): Enslaving as a backup interface with a down link [ 376.179978][T14547] tipc: Resetting bearer [ 376.190417][ T5825] block nbd1: Receive control failed (result -32) [ 376.199249][T14546] tipc: Resetting bearer [ 376.225986][T14546] tipc: Disabling bearer [ 376.285538][T14554] __nla_validate_parse: 3 callbacks suppressed [ 376.285555][T14554] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2526'. [ 376.457734][T14561] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2529'. [ 376.501373][T14559] syzkaller0: entered promiscuous mode [ 376.507112][T14559] syzkaller0: entered allmulticast mode [ 376.771685][T14568] syzkaller0: entered promiscuous mode [ 376.777413][T14568] syzkaller0: entered allmulticast mode [ 376.986439][T14583] netlink: 72 bytes leftover after parsing attributes in process `syz.4.2537'. [ 377.131486][T14593] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2542'. [ 377.386933][T14607] netlink: 550 bytes leftover after parsing attributes in process `syz.3.2544'. [ 377.408522][T14607] geneve1: entered promiscuous mode [ 377.603908][T14617] FAULT_INJECTION: forcing a failure. [ 377.603908][T14617] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 377.617893][T14617] CPU: 0 UID: 0 PID: 14617 Comm: syz.1.2547 Not tainted syzkaller #0 PREEMPT(full) [ 377.617915][T14617] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 377.617924][T14617] Call Trace: [ 377.617930][T14617] [ 377.617938][T14617] dump_stack_lvl+0xe8/0x150 [ 377.617961][T14617] should_fail_ex+0x412/0x560 [ 377.617983][T14617] _copy_from_user+0x2d/0xb0 [ 377.618007][T14617] ___sys_recvmsg+0x175/0x590 [ 377.618034][T14617] ? __pfx____sys_recvmsg+0x10/0x10 [ 377.618066][T14617] ? __fget_files+0x2a/0x420 [ 377.618105][T14617] do_recvmmsg+0x334/0x800 [ 377.618133][T14617] ? __pfx_do_recvmmsg+0x10/0x10 [ 377.618163][T14617] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 377.618198][T14617] __x64_sys_recvmmsg+0x198/0x250 [ 377.618252][T14617] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 377.618296][T14617] do_syscall_64+0xe2/0xf80 [ 377.618325][T14617] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 377.618348][T14617] ? trace_irq_disable+0x37/0x100 [ 377.618362][T14617] ? clear_bhb_loop+0x60/0xb0 [ 377.618380][T14617] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 377.618395][T14617] RIP: 0033:0x7f0d6839aeb9 [ 377.618408][T14617] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 377.618421][T14617] RSP: 002b:00007f0d691e9028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 377.618436][T14617] RAX: ffffffffffffffda RBX: 00007f0d68615fa0 RCX: 00007f0d6839aeb9 [ 377.618447][T14617] RDX: 000000000000f000 RSI: 0000200000000d00 RDI: 0000000000000003 [ 377.618457][T14617] RBP: 00007f0d691e9090 R08: 0000000000000000 R09: 0000000000000000 [ 377.618466][T14617] R10: 0000000000010002 R11: 0000000000000246 R12: 0000000000000001 [ 377.618474][T14617] R13: 00007f0d68616038 R14: 00007f0d68615fa0 R15: 00007ffdc4f22938 [ 377.618498][T14617] [ 378.004570][T14630] netlink: 72 bytes leftover after parsing attributes in process `syz.1.2552'. [ 378.231926][T14640] FAULT_INJECTION: forcing a failure. [ 378.231926][T14640] name failslab, interval 1, probability 0, space 0, times 0 [ 378.245030][T14640] CPU: 0 UID: 0 PID: 14640 Comm: syz.1.2557 Not tainted syzkaller #0 PREEMPT(full) [ 378.245059][T14640] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 378.245073][T14640] Call Trace: [ 378.245081][T14640] [ 378.245090][T14640] dump_stack_lvl+0xe8/0x150 [ 378.245124][T14640] should_fail_ex+0x412/0x560 [ 378.245156][T14640] should_failslab+0xa8/0x100 [ 378.245183][T14640] kmem_cache_alloc_noprof+0x87/0x6e0 [ 378.245213][T14640] ? __netlink_lookup+0xc6/0x8b0 [ 378.245239][T14640] ? skb_clone+0x212/0x3a0 [ 378.245275][T14640] skb_clone+0x212/0x3a0 [ 378.245308][T14640] __netlink_deliver_tap+0x404/0x850 [ 378.245347][T14640] ? netlink_deliver_tap+0x2e/0x1b0 [ 378.245373][T14640] netlink_deliver_tap+0x19c/0x1b0 [ 378.245400][T14640] netlink_unicast+0x7e3/0x9b0 [ 378.245431][T14640] ? __pfx_netlink_unicast+0x10/0x10 [ 378.245455][T14640] ? netlink_sendmsg+0x650/0xb40 [ 378.245477][T14640] ? skb_put+0x11b/0x210 [ 378.245508][T14640] netlink_sendmsg+0x813/0xb40 [ 378.245544][T14640] ? __pfx_netlink_sendmsg+0x10/0x10 [ 378.245573][T14640] ? aa_sock_msg_perm+0xf1/0x1b0 [ 378.245601][T14640] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 378.245626][T14640] ? __pfx_netlink_sendmsg+0x10/0x10 [ 378.245649][T14640] ____sys_sendmsg+0xa68/0xad0 [ 378.245678][T14640] ? __might_fault+0xaf/0x130 [ 378.245715][T14640] ? __pfx_____sys_sendmsg+0x10/0x10 [ 378.245755][T14640] ? import_iovec+0x73/0xa0 [ 378.245791][T14640] ___sys_sendmsg+0x2a5/0x360 [ 378.245820][T14640] ? __lock_acquire+0x6b5/0x2cf0 [ 378.245854][T14640] ? __pfx____sys_sendmsg+0x10/0x10 [ 378.245926][T14640] ? __fget_files+0x2a/0x420 [ 378.245947][T14640] ? __fget_files+0x3a0/0x420 [ 378.245987][T14640] __x64_sys_sendmsg+0x1bd/0x2a0 [ 378.246029][T14640] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 378.246070][T14640] ? __pfx_ksys_write+0x10/0x10 [ 378.246113][T14640] do_syscall_64+0xe2/0xf80 [ 378.246141][T14640] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 378.246160][T14640] ? trace_irq_disable+0x37/0x100 [ 378.246180][T14640] ? clear_bhb_loop+0x60/0xb0 [ 378.246205][T14640] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 378.246226][T14640] RIP: 0033:0x7f0d6839aeb9 [ 378.246244][T14640] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 378.246262][T14640] RSP: 002b:00007f0d691e9028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 378.246284][T14640] RAX: ffffffffffffffda RBX: 00007f0d68615fa0 RCX: 00007f0d6839aeb9 [ 378.246300][T14640] RDX: 0000000000000000 RSI: 00002000000018c0 RDI: 0000000000000004 [ 378.246313][T14640] RBP: 00007f0d691e9090 R08: 0000000000000000 R09: 0000000000000000 [ 378.246326][T14640] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 378.246338][T14640] R13: 00007f0d68616038 R14: 00007f0d68615fa0 R15: 00007ffdc4f22938 [ 378.246374][T14640] [ 378.668565][T14646] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2560'. [ 378.729233][T14643] netlink: 296 bytes leftover after parsing attributes in process `syz.2.2559'. [ 378.801835][T14648] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2562'. [ 378.820981][T14643] netlink: 44 bytes leftover after parsing attributes in process `syz.2.2559'. [ 379.082451][T14667] veth0_to_bond: left allmulticast mode [ 379.088886][T14667] veth0_to_bond: left promiscuous mode [ 379.096179][T14667] bridge5: port 1(veth0_to_bond) entered disabled state [ 379.181658][T14670] lo speed is unknown, defaulting to 1000 [ 379.204681][T14670] wg1 speed is unknown, defaulting to 1000 [ 379.221929][T14670] wg1 speed is unknown, defaulting to 1000 [ 380.078408][T14697] vlan4: entered allmulticast mode [ 380.084680][T14697] veth0_to_bond: entered allmulticast mode [ 380.244644][T14706] tipc: Enabled bearer , priority 0 [ 380.552596][T14707] syzkaller0: entered promiscuous mode [ 380.558309][T14707] syzkaller0: entered allmulticast mode [ 380.564679][T14707] tipc: Resetting bearer [ 380.629680][T14699] tipc: Resetting bearer [ 380.673747][T14727] FAULT_INJECTION: forcing a failure. [ 380.673747][T14727] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 380.707837][T14727] CPU: 0 UID: 0 PID: 14727 Comm: syz.0.2579 Not tainted syzkaller #0 PREEMPT(full) [ 380.707868][T14727] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 380.707880][T14727] Call Trace: [ 380.707889][T14727] [ 380.707899][T14727] dump_stack_lvl+0xe8/0x150 [ 380.707931][T14727] should_fail_ex+0x412/0x560 [ 380.707963][T14727] _copy_from_iter+0x1d3/0x1670 [ 380.707990][T14727] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 380.708022][T14727] ? __pfx_policy_nodemask+0x10/0x10 [ 380.708051][T14727] ? __pfx__copy_from_iter+0x10/0x10 [ 380.708095][T14727] ? set_page_refcounted+0xa0/0x1e0 [ 380.708119][T14727] ? page_copy_sane+0x4e/0x270 [ 380.708149][T14727] copy_page_from_iter+0xdd/0x170 [ 380.708182][T14727] tun_get_user+0x1d4b/0x3dd0 [ 380.708204][T14727] ? tun_get_user+0x6ff/0x3dd0 [ 380.708246][T14727] ? aa_file_perm+0x440/0x1630 [ 380.708273][T14727] ? __pfx_tun_get_user+0x10/0x10 [ 380.708298][T14727] ? __lock_acquire+0x6b5/0x2cf0 [ 380.708343][T14727] ? ref_tracker_alloc+0x363/0x4d0 [ 380.708373][T14727] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 380.708401][T14727] ? tun_get+0x1c/0x2f0 [ 380.708423][T14727] ? tun_get+0x1c/0x2f0 [ 380.708472][T14727] ? tun_get+0x1c/0x2f0 [ 380.708493][T14727] ? tun_get+0x1c/0x2f0 [ 380.708519][T14727] tun_chr_write_iter+0x113/0x200 [ 380.708543][T14727] vfs_write+0x61d/0xb90 [ 380.708579][T14727] ? __pfx_vfs_write+0x10/0x10 [ 380.708615][T14727] ? __fget_files+0x2a/0x420 [ 380.708646][T14727] ksys_write+0x150/0x270 [ 380.708677][T14727] ? __pfx_ksys_write+0x10/0x10 [ 380.708718][T14727] do_syscall_64+0xe2/0xf80 [ 380.708746][T14727] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 380.708765][T14727] ? trace_irq_disable+0x37/0x100 [ 380.708782][T14727] ? clear_bhb_loop+0x60/0xb0 [ 380.708805][T14727] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 380.708825][T14727] RIP: 0033:0x7fe8efb5b78e [ 380.708844][T14727] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 380.708862][T14727] RSP: 002b:00007fe8f09abfb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 380.708884][T14727] RAX: ffffffffffffffda RBX: 00007fe8f09ac6c0 RCX: 00007fe8efb5b78e [ 380.708899][T14727] RDX: 0000000000000032 RSI: 0000200000000000 RDI: 00000000000000c8 [ 380.708911][T14727] RBP: 00007fe8f09ac090 R08: 0000000000000000 R09: 0000000000000000 [ 380.708924][T14727] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 380.708936][T14727] R13: 00007fe8efe16128 R14: 00007fe8efe16090 R15: 00007ffec6fa92a8 [ 380.708967][T14727] [ 380.788940][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 382.514648][T14699] tipc: Disabling bearer [ 382.562481][ T7533] tipc: Node number set to 75521818 [ 382.631158][T14738] FAULT_INJECTION: forcing a failure. [ 382.631158][T14738] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 382.670258][T14738] CPU: 1 UID: 0 PID: 14738 Comm: syz.3.2582 Not tainted syzkaller #0 PREEMPT(full) [ 382.670288][T14738] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 382.670302][T14738] Call Trace: [ 382.670310][T14738] [ 382.670319][T14738] dump_stack_lvl+0xe8/0x150 [ 382.670353][T14738] should_fail_ex+0x412/0x560 [ 382.670384][T14738] _copy_from_user+0x2d/0xb0 [ 382.670417][T14738] ___sys_sendmsg+0x1c6/0x360 [ 382.670446][T14738] ? __lock_acquire+0x6b5/0x2cf0 [ 382.670479][T14738] ? __pfx____sys_sendmsg+0x10/0x10 [ 382.670514][T14738] ? kstrtouint+0x6e/0xe0 [ 382.670566][T14738] ? __fget_files+0x2a/0x420 [ 382.670588][T14738] ? __fget_files+0x3a0/0x420 [ 382.670622][T14738] __sys_sendmmsg+0x27c/0x4e0 [ 382.670657][T14738] ? __pfx___sys_sendmmsg+0x10/0x10 [ 382.670684][T14738] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 382.670741][T14738] ? ksys_write+0x242/0x270 [ 382.670773][T14738] ? __pfx_ksys_write+0x10/0x10 [ 382.670810][T14738] __x64_sys_sendmmsg+0xa0/0xc0 [ 382.670842][T14738] do_syscall_64+0xe2/0xf80 [ 382.670870][T14738] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 382.670889][T14738] ? trace_irq_disable+0x37/0x100 [ 382.670917][T14738] ? clear_bhb_loop+0x60/0xb0 [ 382.670942][T14738] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 382.670962][T14738] RIP: 0033:0x7f4578b9aeb9 [ 382.670981][T14738] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 382.670999][T14738] RSP: 002b:00007f45799c0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 382.671021][T14738] RAX: ffffffffffffffda RBX: 00007f4578e15fa0 RCX: 00007f4578b9aeb9 [ 382.671036][T14738] RDX: 0000000000000001 RSI: 0000200000000a80 RDI: 0000000000000003 [ 382.671049][T14738] RBP: 00007f45799c0090 R08: 0000000000000000 R09: 0000000000000000 [ 382.671061][T14738] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 382.671074][T14738] R13: 00007f4578e16038 R14: 00007f4578e15fa0 R15: 00007fffb81445f8 [ 382.671107][T14738] [ 383.002063][T14749] __nla_validate_parse: 3 callbacks suppressed [ 383.002087][T14749] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2588'. [ 383.035264][T14748] netlink: 'syz.4.2587': attribute type 10 has an invalid length. [ 383.117051][T14748] vxcan1: entered promiscuous mode [ 383.129595][T14748] team0: Device vxcan1 is of different type [ 383.259064][T14765] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2593'. [ 383.291375][T14765] veth0_to_bond: left promiscuous mode [ 383.297314][T14765] bridge3: port 1(veth0_to_bond) entered disabled state [ 383.308731][T14763] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2591'. [ 383.461698][T14775] FAULT_INJECTION: forcing a failure. [ 383.461698][T14775] name failslab, interval 1, probability 0, space 0, times 0 [ 383.474932][T14775] CPU: 1 UID: 0 PID: 14775 Comm: syz.4.2597 Not tainted syzkaller #0 PREEMPT(full) [ 383.474959][T14775] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 383.474971][T14775] Call Trace: [ 383.474980][T14775] [ 383.474988][T14775] dump_stack_lvl+0xe8/0x150 [ 383.475021][T14775] should_fail_ex+0x412/0x560 [ 383.475051][T14775] should_failslab+0xa8/0x100 [ 383.475076][T14775] kmem_cache_alloc_noprof+0x87/0x6e0 [ 383.475109][T14775] ? skb_clone+0x212/0x3a0 [ 383.475145][T14775] skb_clone+0x212/0x3a0 [ 383.475179][T14775] bpf_clone_redirect+0x16a/0x4b0 [ 383.475212][T14775] ? bpf_test_run+0x1d1/0x830 [ 383.475236][T14775] bpf_prog_4653d16e8163849f+0x22/0x2a [ 383.475257][T14775] bpf_test_run+0x354/0x830 [ 383.475304][T14775] ? __pfx_bpf_test_run+0x10/0x10 [ 383.475344][T14775] ? __kasan_krealloc+0xeb/0x110 [ 383.475367][T14775] ? eth_type_trans+0x35e/0x6d0 [ 383.475403][T14775] ? convert___skb_to_skb+0x3d/0x5b0 [ 383.475430][T14775] bpf_prog_test_run_skb+0xd22/0x1c90 [ 383.475468][T14775] ? __fget_files+0x2a/0x420 [ 383.475490][T14775] ? __fget_files+0x3a0/0x420 [ 383.475512][T14775] ? __fget_files+0x2a/0x420 [ 383.475540][T14775] ? __pfx_bpf_prog_test_run_skb+0x10/0x10 [ 383.475564][T14775] bpf_prog_test_run+0x2c7/0x340 [ 383.475591][T14775] __sys_bpf+0x5cb/0x920 [ 383.475615][T14775] ? __pfx___sys_bpf+0x10/0x10 [ 383.475653][T14775] ? ksys_write+0x242/0x270 [ 383.475687][T14775] ? __pfx_ksys_write+0x10/0x10 [ 383.475726][T14775] __x64_sys_bpf+0x7c/0x90 [ 383.475758][T14775] do_syscall_64+0xe2/0xf80 [ 383.475786][T14775] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 383.475806][T14775] ? trace_irq_disable+0x37/0x100 [ 383.475826][T14775] ? clear_bhb_loop+0x60/0xb0 [ 383.475860][T14775] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 383.475881][T14775] RIP: 0033:0x7f642d99aeb9 [ 383.475899][T14775] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 383.475918][T14775] RSP: 002b:00007f642e823028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 383.475941][T14775] RAX: ffffffffffffffda RBX: 00007f642dc15fa0 RCX: 00007f642d99aeb9 [ 383.475956][T14775] RDX: 0000000000000050 RSI: 00002000000003c0 RDI: 000000000000000a [ 383.475969][T14775] RBP: 00007f642e823090 R08: 0000000000000000 R09: 0000000000000000 [ 383.475981][T14775] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 383.475993][T14775] R13: 00007f642dc16038 R14: 00007f642dc15fa0 R15: 00007ffdd72348d8 [ 383.476029][T14775] [ 383.908108][T14782] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2599'. [ 383.964776][T14777] syzkaller0: entered promiscuous mode [ 383.994955][T14777] syzkaller0: entered allmulticast mode [ 384.005629][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 384.039638][T14784] tipc: Enabling of bearer rejected, failed to enable media [ 384.073584][T14788] xt_bpf: check failed: parse error [ 384.080429][T14788] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2599'. [ 384.224852][T14797] FAULT_INJECTION: forcing a failure. [ 384.224852][T14797] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 384.239945][T14797] CPU: 0 UID: 0 PID: 14797 Comm: syz.3.2604 Not tainted syzkaller #0 PREEMPT(full) [ 384.239973][T14797] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 384.239985][T14797] Call Trace: [ 384.239993][T14797] [ 384.240001][T14797] dump_stack_lvl+0xe8/0x150 [ 384.240032][T14797] should_fail_ex+0x412/0x560 [ 384.240061][T14797] _copy_from_user+0x2d/0xb0 [ 384.240091][T14797] ___sys_sendmsg+0x1c6/0x360 [ 384.240118][T14797] ? __lock_acquire+0x6b5/0x2cf0 [ 384.240149][T14797] ? __pfx____sys_sendmsg+0x10/0x10 [ 384.240174][T14797] ? __lock_acquire+0x6b5/0x2cf0 [ 384.240205][T14797] ? kstrtouint+0x6e/0xe0 [ 384.240269][T14797] __sys_sendmmsg+0x27c/0x4e0 [ 384.240301][T14797] ? __pfx___sys_sendmmsg+0x10/0x10 [ 384.240326][T14797] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 384.240379][T14797] ? ksys_write+0x242/0x270 [ 384.240419][T14797] ? __pfx_ksys_write+0x10/0x10 [ 384.240453][T14797] __x64_sys_sendmmsg+0xa0/0xc0 [ 384.240482][T14797] do_syscall_64+0xe2/0xf80 [ 384.240508][T14797] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 384.240527][T14797] ? trace_irq_disable+0x37/0x100 [ 384.240545][T14797] ? clear_bhb_loop+0x60/0xb0 [ 384.240568][T14797] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 384.240586][T14797] RIP: 0033:0x7f4578b9aeb9 [ 384.240610][T14797] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 384.240627][T14797] RSP: 002b:00007f45799c0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 384.240649][T14797] RAX: ffffffffffffffda RBX: 00007f4578e15fa0 RCX: 00007f4578b9aeb9 [ 384.240663][T14797] RDX: 000000000000fdef RSI: 00002000000020c0 RDI: 0000000000000006 [ 384.240676][T14797] RBP: 00007f45799c0090 R08: 0000000000000000 R09: 0000000000000000 [ 384.240687][T14797] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 384.240699][T14797] R13: 00007f4578e16038 R14: 00007f4578e15fa0 R15: 00007fffb81445f8 [ 384.240731][T14797] [ 384.569163][T14806] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2607'. [ 384.619555][T14804] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2606'. [ 384.701714][T14808] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 386.303338][T14824] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2614'. [ 386.460406][T14837] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2617'. [ 386.511671][T14829] netlink: 164 bytes leftover after parsing attributes in process `syz.0.2615'. [ 386.555268][T14825] lo speed is unknown, defaulting to 1000 [ 386.555314][ T10] lo speed is unknown, defaulting to 1000 [ 386.585667][T14837] geneve3: entered promiscuous mode [ 386.597663][ T10] syz2: Port: 1 Link DOWN [ 386.631069][T14837] geneve3: entered allmulticast mode [ 386.667687][T14825] wg1 speed is unknown, defaulting to 1000 [ 386.675483][T14825] wg1 speed is unknown, defaulting to 1000 [ 386.812821][T14849] gretap1: entered promiscuous mode [ 387.501401][T14889] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 387.943693][T14915] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 387.980786][T14917] tipc: Failed to remove unknown binding: 66,1,1/75521818:1300883293/1300883295 [ 388.012680][T14917] tipc: Failed to remove unknown binding: 66,1,1/75521818:1300883293/1300883295 [ 388.087780][T14917] tipc: Failed to remove unknown binding: 66,1,1/75521818:1300883293/1300883295 [ 388.527636][T14932] FAULT_INJECTION: forcing a failure. [ 388.527636][T14932] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 388.573403][T14932] CPU: 1 UID: 0 PID: 14932 Comm: syz.3.2639 Not tainted syzkaller #0 PREEMPT(full) [ 388.573434][T14932] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 388.573448][T14932] Call Trace: [ 388.573456][T14932] [ 388.573465][T14932] dump_stack_lvl+0xe8/0x150 [ 388.573498][T14932] should_fail_ex+0x412/0x560 [ 388.573529][T14932] _copy_from_user+0x2d/0xb0 [ 388.573561][T14932] bpf_test_init+0xd8/0x150 [ 388.573594][T14932] bpf_prog_test_run_xdp+0x529/0x1160 [ 388.573637][T14932] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 388.573667][T14932] ? __fget_files+0x2a/0x420 [ 388.573696][T14932] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 388.573721][T14932] bpf_prog_test_run+0x2c7/0x340 [ 388.573748][T14932] __sys_bpf+0x5cb/0x920 [ 388.573771][T14932] ? __pfx___sys_bpf+0x10/0x10 [ 388.573809][T14932] ? ksys_write+0x242/0x270 [ 388.573842][T14932] ? __pfx_ksys_write+0x10/0x10 [ 388.573878][T14932] __x64_sys_bpf+0x7c/0x90 [ 388.573909][T14932] do_syscall_64+0xe2/0xf80 [ 388.573938][T14932] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 388.573958][T14932] ? trace_irq_disable+0x37/0x100 [ 388.573978][T14932] ? clear_bhb_loop+0x60/0xb0 [ 388.574003][T14932] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 388.574023][T14932] RIP: 0033:0x7f4578b9aeb9 [ 388.574042][T14932] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 388.574059][T14932] RSP: 002b:00007f45799c0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 388.574082][T14932] RAX: ffffffffffffffda RBX: 00007f4578e15fa0 RCX: 00007f4578b9aeb9 [ 388.574097][T14932] RDX: 0000000000000050 RSI: 0000200000000280 RDI: 000000000000000a [ 388.574110][T14932] RBP: 00007f45799c0090 R08: 0000000000000000 R09: 0000000000000000 [ 388.574122][T14932] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 388.574134][T14932] R13: 00007f4578e16038 R14: 00007f4578e15fa0 R15: 00007fffb81445f8 [ 388.574169][T14932] [ 388.980915][T14941] __nla_validate_parse: 5 callbacks suppressed [ 388.980937][T14941] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2642'. [ 389.074355][T14948] x_tables: ip6_tables: mh match: only valid for protocol 135 [ 389.249733][T14957] tipc: Enabled bearer , priority 0 [ 389.259776][T14957] syzkaller0: entered promiscuous mode [ 389.266147][T14957] syzkaller0: entered allmulticast mode [ 389.363108][T14966] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2648'. [ 389.406916][T14968] tipc: Resetting bearer [ 389.429188][T14955] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2648'. [ 389.446178][ T5826] block nbd2: Receive control failed (result -32) [ 389.473453][T14971] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2652'. [ 389.487869][T14956] tipc: Resetting bearer [ 389.515775][T14956] tipc: Disabling bearer [ 389.569789][ T13] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 389.585614][ T13] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 389.597742][ T10] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 389.711964][T14973] lo speed is unknown, defaulting to 1000 [ 389.719756][T14979] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2655'. [ 389.731265][T14973] wg1 speed is unknown, defaulting to 1000 [ 389.739175][T14973] wg1 speed is unknown, defaulting to 1000 [ 389.745416][T14979] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2655'. [ 389.949343][T14987] syzkaller0: entered promiscuous mode [ 389.955079][T14987] syzkaller0: entered allmulticast mode [ 390.020852][T14991] netlink: 'syz.1.2659': attribute type 1 has an invalid length. [ 390.070987][T14991] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 390.080826][ T10] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 390.098426][ T10] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 390.107792][T14997] netlink: 56 bytes leftover after parsing attributes in process `syz.0.2660'. [ 390.139023][T15002] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2662'. [ 390.471201][T15012] netlink: 'syz.2.2665': attribute type 3 has an invalid length. [ 390.612850][T15022] xt_SECMARK: only valid in 'mangle' or 'security' table, not 'filter' [ 390.742633][T15024] netlink: 7 bytes leftover after parsing attributes in process `syz.2.2668'. [ 390.955074][T15032] lo speed is unknown, defaulting to 1000 [ 390.992076][T15032] wg1 speed is unknown, defaulting to 1000 [ 391.056531][T15032] wg1 speed is unknown, defaulting to 1000 [ 391.081483][T15029] lo speed is unknown, defaulting to 1000 [ 391.234166][T15029] wg1 speed is unknown, defaulting to 1000 [ 391.244894][T15049] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 391.280502][T15050] openvswitch: netlink: IP tunnel dst address not specified [ 391.295708][T15029] wg1 speed is unknown, defaulting to 1000 [ 391.481401][T15059] netlink: 48 bytes leftover after parsing attributes in process `syz.0.2679'. [ 391.660978][T15067] lo speed is unknown, defaulting to 1000 [ 391.673168][T15067] wg1 speed is unknown, defaulting to 1000 [ 391.685042][T15067] wg1 speed is unknown, defaulting to 1000 [ 391.769921][T15074] openvswitch: netlink: Actions may not be safe on all matching packets [ 392.005285][T15077] netlink: 'syz.2.2684': attribute type 1 has an invalid length. [ 392.328813][T15093] sctp: [Deprecated]: syz.4.2687 (pid 15093) Use of int in max_burst socket option. [ 392.328813][T15093] Use struct sctp_assoc_value instead [ 392.636679][T15100] FAULT_INJECTION: forcing a failure. [ 392.636679][T15100] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 392.697592][T15100] CPU: 0 UID: 0 PID: 15100 Comm: syz.3.2691 Not tainted syzkaller #0 PREEMPT(full) [ 392.697623][T15100] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 392.697636][T15100] Call Trace: [ 392.697645][T15100] [ 392.697654][T15100] dump_stack_lvl+0xe8/0x150 [ 392.697687][T15100] should_fail_ex+0x412/0x560 [ 392.697719][T15100] _copy_from_user+0x2d/0xb0 [ 392.697751][T15100] ___sys_recvmsg+0x175/0x590 [ 392.697789][T15100] ? __pfx____sys_recvmsg+0x10/0x10 [ 392.697824][T15100] ? __fget_files+0x2a/0x420 [ 392.697882][T15100] do_recvmmsg+0x334/0x800 [ 392.697931][T15100] ? __pfx_do_recvmmsg+0x10/0x10 [ 392.697980][T15100] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 392.698029][T15100] __x64_sys_recvmmsg+0x198/0x250 [ 392.698063][T15100] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 392.698106][T15100] do_syscall_64+0xe2/0xf80 [ 392.698134][T15100] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 392.698153][T15100] ? trace_irq_disable+0x37/0x100 [ 392.698172][T15100] ? clear_bhb_loop+0x60/0xb0 [ 392.698198][T15100] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 392.698217][T15100] RIP: 0033:0x7f4578b9aeb9 [ 392.698237][T15100] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 392.698255][T15100] RSP: 002b:00007f45799c0028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 392.698278][T15100] RAX: ffffffffffffffda RBX: 00007f4578e15fa0 RCX: 00007f4578b9aeb9 [ 392.698294][T15100] RDX: 000000000000f000 RSI: 0000200000000d00 RDI: 0000000000000003 [ 392.698307][T15100] RBP: 00007f45799c0090 R08: 0000000000000000 R09: 0000000000000000 [ 392.698320][T15100] R10: 0000000000010002 R11: 0000000000000246 R12: 0000000000000001 [ 392.698333][T15100] R13: 00007f4578e16038 R14: 00007f4578e15fa0 R15: 00007fffb81445f8 [ 392.698368][T15100] [ 393.290475][T15114] tipc: Enabling of bearer rejected, already enabled [ 393.428029][ C0] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 393.916175][T15149] xt_hashlimit: size too large, truncated to 1048576 [ 394.000443][T15157] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2704'. [ 394.180720][T15162] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2706'. [ 394.461163][T15180] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2709'. [ 394.735127][T15191] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 394.971751][T15209] vlan2: entered allmulticast mode [ 394.986162][T15209] veth0_to_bond: entered allmulticast mode [ 395.032423][T15210] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2721'. [ 395.829483][T15246] syzkaller0: entered promiscuous mode [ 395.843005][T15246] syzkaller0: entered allmulticast mode [ 395.849798][T15248] FAULT_INJECTION: forcing a failure. [ 395.849798][T15248] name failslab, interval 1, probability 0, space 0, times 0 [ 395.863002][T15248] CPU: 0 UID: 0 PID: 15248 Comm: syz.3.2734 Not tainted syzkaller #0 PREEMPT(full) [ 395.863030][T15248] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 395.863042][T15248] Call Trace: [ 395.863050][T15248] [ 395.863059][T15248] dump_stack_lvl+0xe8/0x150 [ 395.863089][T15248] should_fail_ex+0x412/0x560 [ 395.863119][T15248] should_failslab+0xa8/0x100 [ 395.863145][T15248] kmem_cache_alloc_noprof+0x87/0x6e0 [ 395.863178][T15248] ? __inet_hash_connect+0xd48/0x2440 [ 395.863206][T15248] __inet_hash_connect+0xd48/0x2440 [ 395.863234][T15248] ? __pfx___inet6_check_established+0x10/0x10 [ 395.863269][T15248] ? __inet_hash_connect+0x4cf/0x2440 [ 395.863299][T15248] ? __pfx___inet_hash_connect+0x10/0x10 [ 395.863332][T15248] ? inet6_hash_connect+0xd8/0x170 [ 395.863361][T15248] tcp_v6_connect+0xf93/0x1940 [ 395.863403][T15248] ? __pfx_tcp_v6_connect+0x10/0x10 [ 395.863424][T15248] ? tcp_sendmsg+0x2f/0x50 [ 395.863442][T15248] ? do_syscall_64+0xe2/0xf80 [ 395.863470][T15248] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 395.863520][T15248] __inet_stream_connect+0x25a/0xdd0 [ 395.863567][T15248] ? __pfx___inet_stream_connect+0x10/0x10 [ 395.863605][T15248] ? __kasan_kmalloc+0x93/0xb0 [ 395.863628][T15248] ? __kmalloc_cache_noprof+0x3d1/0x6e0 [ 395.863650][T15248] ? tcp_sendmsg_fastopen+0x1de/0x5e0 [ 395.863700][T15248] tcp_sendmsg_fastopen+0x3a7/0x5e0 [ 395.863740][T15248] tcp_sendmsg_locked+0x4b59/0x5430 [ 395.863765][T15248] ? tcp_sendmsg_locked+0x361/0x5430 [ 395.863784][T15248] ? __pfx_aa_label_sk_perm+0x10/0x10 [ 395.863821][T15248] ? __lock_acquire+0x6b5/0x2cf0 [ 395.863879][T15248] ? aa_sk_perm+0x15a/0x960 [ 395.863910][T15248] ? __pfx_tcp_sendmsg_locked+0x10/0x10 [ 395.863944][T15248] ? __local_bh_enable_ip+0xd0/0x130 [ 395.863970][T15248] tcp_sendmsg+0x2f/0x50 [ 395.863989][T15248] __sys_sendto+0x4a7/0x7a0 [ 395.864019][T15248] ? __pfx___sys_sendto+0x10/0x10 [ 395.864043][T15248] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 395.864087][T15248] ? __fget_files+0x3a0/0x420 [ 395.864121][T15248] ? ksys_write+0x242/0x270 [ 395.864154][T15248] ? __pfx_ksys_write+0x10/0x10 [ 395.864190][T15248] __x64_sys_sendto+0xde/0x100 [ 395.864220][T15248] do_syscall_64+0xe2/0xf80 [ 395.864246][T15248] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 395.864265][T15248] ? trace_irq_disable+0x37/0x100 [ 395.864285][T15248] ? clear_bhb_loop+0x60/0xb0 [ 395.864311][T15248] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 395.864332][T15248] RIP: 0033:0x7f4578b9aeb9 [ 395.864352][T15248] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 395.864369][T15248] RSP: 002b:00007f45799c0028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 395.864392][T15248] RAX: ffffffffffffffda RBX: 00007f4578e15fa0 RCX: 00007f4578b9aeb9 [ 395.864407][T15248] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000008 [ 395.864420][T15248] RBP: 00007f45799c0090 R08: 00002000000001c0 R09: 000000000000001c [ 395.864435][T15248] R10: 0000000020008045 R11: 0000000000000246 R12: 0000000000000001 [ 395.864448][T15248] R13: 00007f4578e16038 R14: 00007f4578e15fa0 R15: 00007fffb81445f8 [ 395.864483][T15248] [ 396.660364][T15279] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 396.668555][T15279] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 396.676341][T15279] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 396.684698][T15279] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 396.695668][T15279] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 396.704200][T15279] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 396.712146][T15279] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 396.732723][T15279] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 396.754043][T15279] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 396.964832][T15288] FAULT_INJECTION: forcing a failure. [ 396.964832][T15288] name failslab, interval 1, probability 0, space 0, times 0 [ 396.997683][T15288] CPU: 0 UID: 0 PID: 15288 Comm: syz.0.2748 Not tainted syzkaller #0 PREEMPT(full) [ 396.997714][T15288] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 396.997733][T15288] Call Trace: [ 396.997742][T15288] [ 396.997751][T15288] dump_stack_lvl+0xe8/0x150 [ 396.997791][T15288] should_fail_ex+0x412/0x560 [ 396.997823][T15288] should_failslab+0xa8/0x100 [ 396.997850][T15288] __kmalloc_cache_noprof+0x83/0x6e0 [ 396.997870][T15288] ? __sctp_v6_cmp_addr+0x1dc/0x510 [ 396.997897][T15288] ? sctp_add_bind_addr+0x8c/0x370 [ 396.997934][T15288] sctp_add_bind_addr+0x8c/0x370 [ 396.997964][T15288] sctp_copy_local_addr_list+0x314/0x4f0 [ 396.997994][T15288] ? sctp_copy_local_addr_list+0xa4/0x4f0 [ 396.998020][T15288] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 396.998048][T15288] ? sctp_v6_is_any+0x64/0x80 [ 396.998075][T15288] ? sctp_copy_one_addr+0x93/0x360 [ 396.998108][T15288] sctp_bind_addr_copy+0xb3/0x3c0 [ 396.998134][T15288] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 396.998161][T15288] sctp_connect_new_asoc+0x2ff/0x6b0 [ 396.998196][T15288] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 396.998234][T15288] ? __local_bh_enable_ip+0xd0/0x130 [ 396.998252][T15288] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 396.998276][T15288] ? security_sctp_bind_connect+0x7e/0x2c0 [ 396.998301][T15288] sctp_sendmsg+0x1528/0x2c10 [ 396.998348][T15288] ? __pfx_sctp_sendmsg+0x10/0x10 [ 396.998374][T15288] ? aa_sk_perm+0x15a/0x960 [ 396.998399][T15288] ? aa_sk_perm+0x82d/0x960 [ 396.998432][T15288] ? __pfx_aa_sk_perm+0x10/0x10 [ 396.998458][T15288] ? sock_rps_record_flow+0x19/0x400 [ 396.998494][T15288] ? inet_sendmsg+0x2f4/0x370 [ 396.998530][T15288] ____sys_sendmsg+0x894/0xad0 [ 396.998571][T15288] ? __pfx_____sys_sendmsg+0x10/0x10 [ 396.998610][T15288] ? import_iovec+0x73/0xa0 [ 396.998645][T15288] ___sys_sendmsg+0x2a5/0x360 [ 396.998672][T15288] ? __lock_acquire+0x6b5/0x2cf0 [ 396.998707][T15288] ? __pfx____sys_sendmsg+0x10/0x10 [ 396.998742][T15288] ? kstrtouint+0x6e/0xe0 [ 396.998800][T15288] ? __fget_files+0x2a/0x420 [ 396.998823][T15288] ? __fget_files+0x3a0/0x420 [ 396.998857][T15288] __sys_sendmmsg+0x27c/0x4e0 [ 396.998892][T15288] ? __pfx___sys_sendmmsg+0x10/0x10 [ 396.998919][T15288] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 396.998977][T15288] ? ksys_write+0x242/0x270 [ 396.999009][T15288] ? __pfx_ksys_write+0x10/0x10 [ 396.999047][T15288] __x64_sys_sendmmsg+0xa0/0xc0 [ 396.999079][T15288] do_syscall_64+0xe2/0xf80 [ 396.999106][T15288] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 396.999126][T15288] ? trace_irq_disable+0x37/0x100 [ 396.999145][T15288] ? clear_bhb_loop+0x60/0xb0 [ 396.999170][T15288] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 396.999191][T15288] RIP: 0033:0x7fe8efb9aeb9 [ 396.999210][T15288] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 396.999226][T15288] RSP: 002b:00007fe8f09cd028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 396.999249][T15288] RAX: ffffffffffffffda RBX: 00007fe8efe15fa0 RCX: 00007fe8efb9aeb9 [ 396.999264][T15288] RDX: 0000000000000001 RSI: 00002000000007c0 RDI: 0000000000000003 [ 396.999277][T15288] RBP: 00007fe8f09cd090 R08: 0000000000000000 R09: 0000000000000000 [ 396.999290][T15288] R10: 0000000000000040 R11: 0000000000000246 R12: 0000000000000002 [ 396.999302][T15288] R13: 00007fe8efe16038 R14: 00007fe8efe15fa0 R15: 00007ffec6fa92a8 [ 396.999338][T15288] [ 397.475667][T15294] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2750'. [ 397.539053][T15294] netlink: 44 bytes leftover after parsing attributes in process `syz.0.2750'. [ 397.598701][T15298] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2753'. [ 397.671131][T15303] syzkaller0: entered promiscuous mode [ 397.713441][T15303] syzkaller0: entered allmulticast mode [ 397.901384][T15309] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 398.663986][T15334] syzkaller0: entered promiscuous mode [ 398.687713][T15334] syzkaller0: entered allmulticast mode [ 399.436634][T15347] Cannot find del_set index 4 as target [ 400.019333][T15365] netlink: 71 bytes leftover after parsing attributes in process `syz.1.2768'. [ 400.075925][T15363] @0Ù: renamed from dummy0 (while UP) [ 400.309237][T15374] syzkaller0: entered promiscuous mode [ 400.337674][T15374] syzkaller0: entered allmulticast mode [ 400.615511][T15380] netlink: 108 bytes leftover after parsing attributes in process `syz.4.2773'. [ 400.811998][T15386] syzkaller0: entered promiscuous mode [ 400.819902][T15386] syzkaller0: entered allmulticast mode [ 401.200267][T15396] lo speed is unknown, defaulting to 1000 [ 401.211657][T15396] wg1 speed is unknown, defaulting to 1000 [ 401.219634][T15396] wg1 speed is unknown, defaulting to 1000 [ 401.267726][ C0] ip6_tnl_xmit_ctl: 1 callbacks suppressed [ 401.267750][ C0] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 401.327300][T15402] netlink: 71 bytes leftover after parsing attributes in process `syz.4.2780'. [ 401.581308][T15408] lo speed is unknown, defaulting to 1000 [ 401.606974][T15408] wg1 speed is unknown, defaulting to 1000 [ 401.624774][T15408] wg1 speed is unknown, defaulting to 1000 [ 401.747275][T15414] vcan0: tx drop: invalid sa for name 0x0000000000000004 [ 401.800178][T15419] openvswitch: netlink: Actions may not be safe on all matching packets [ 401.912090][T15420] syzkaller0: entered promiscuous mode [ 401.938739][T15420] syzkaller0: entered allmulticast mode [ 402.025676][T15422] unsupported nlmsg_type 40 [ 402.389289][T15439] netlink: 192 bytes leftover after parsing attributes in process `syz.0.2791'. [ 402.425896][T15432] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2790'. [ 402.440324][T15432] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2790'. [ 402.463040][T15428] syzkaller1: entered promiscuous mode [ 402.470095][T15428] syzkaller1: entered allmulticast mode [ 402.530089][T15444] netlink: 71 bytes leftover after parsing attributes in process `syz.3.2792'. [ 402.884645][T15452] syzkaller1: entered promiscuous mode [ 402.911729][T15452] syzkaller1: entered allmulticast mode [ 402.961134][T15458] netlink: 'syz.0.2797': attribute type 1 has an invalid length. [ 403.050137][T15458] bond4: entered promiscuous mode [ 403.082639][T15458] bond4: entered allmulticast mode [ 403.100419][T15458] 8021q: adding VLAN 0 to HW filter on device bond4 [ 403.180042][T15462] erspan1: entered allmulticast mode [ 403.312381][T15462] bond4: (slave erspan1): making interface the new active one [ 403.338013][T15462] erspan1: entered promiscuous mode [ 403.347132][T15462] bond4: (slave erspan1): Enslaving as an active interface with an up link [ 403.481368][T15474] syzkaller0: entered promiscuous mode [ 403.488564][T15474] syzkaller0: entered allmulticast mode [ 403.619963][T15479] openvswitch: netlink: Actions may not be safe on all matching packets [ 403.812497][T15485] syzkaller0: entered promiscuous mode [ 403.822347][T15485] syzkaller0: entered allmulticast mode [ 403.842192][T15492] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2809'. [ 404.188898][T15504] netlink: 'syz.3.2814': attribute type 1 has an invalid length. [ 404.214338][T15504] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2814'. [ 404.269294][T15510] openvswitch: netlink: Actions may not be safe on all matching packets [ 404.358527][T15513] xt_recent: hitcount (262143) is larger than allowed maximum (65535) [ 404.397806][T15517] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2820'. [ 404.536432][T15530] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 405.211686][T15551] IPVS: Scheduler module ip_vs_ not found [ 405.427134][T15561] FAULT_INJECTION: forcing a failure. [ 405.427134][T15561] name failslab, interval 1, probability 0, space 0, times 0 [ 405.440005][T15561] CPU: 1 UID: 0 PID: 15561 Comm: syz.0.2833 Not tainted syzkaller #0 PREEMPT(full) [ 405.440033][T15561] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 405.440046][T15561] Call Trace: [ 405.440057][T15561] [ 405.440067][T15561] dump_stack_lvl+0xe8/0x150 [ 405.440106][T15561] should_fail_ex+0x412/0x560 [ 405.440138][T15561] should_failslab+0xa8/0x100 [ 405.440164][T15561] kmem_cache_alloc_noprof+0x87/0x6e0 [ 405.440196][T15561] ? is_bpf_text_address+0x26/0x2b0 [ 405.440221][T15561] ? skb_clone+0x212/0x3a0 [ 405.440256][T15561] skb_clone+0x212/0x3a0 [ 405.440290][T15561] bpf_clone_redirect+0x16a/0x4b0 [ 405.440317][T15561] ? __lock_acquire+0x6b5/0x2cf0 [ 405.440351][T15561] ? bpf_test_run+0x1d1/0x830 [ 405.440375][T15561] bpf_prog_170f4aa34f32f3f3+0x5f/0x68 [ 405.440399][T15561] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 405.440426][T15561] ? arch_stack_walk+0xfb/0x150 [ 405.440458][T15561] ? ktime_get+0x45/0x200 [ 405.440494][T15561] ? seqcount_lockdep_reader_access+0xa9/0x100 [ 405.440517][T15561] ? lockdep_hardirqs_on+0x7a/0x110 [ 405.440542][T15561] ? ktime_get+0x45/0x200 [ 405.440563][T15561] ? seqcount_lockdep_reader_access+0xea/0x100 [ 405.440588][T15561] ? read_tsc+0x9/0x20 [ 405.440613][T15561] ? ktime_get+0x1d2/0x200 [ 405.440645][T15561] bpf_test_run+0x354/0x830 [ 405.440691][T15561] ? __pfx_bpf_test_run+0x10/0x10 [ 405.440731][T15561] ? __kasan_krealloc+0xeb/0x110 [ 405.440752][T15561] ? eth_type_trans+0x35e/0x6d0 [ 405.440789][T15561] ? convert___skb_to_skb+0x3d/0x5b0 [ 405.440815][T15561] bpf_prog_test_run_skb+0xd22/0x1c90 [ 405.440852][T15561] ? __fget_files+0x2a/0x420 [ 405.440874][T15561] ? __fget_files+0x3a0/0x420 [ 405.440895][T15561] ? __fget_files+0x2a/0x420 [ 405.440923][T15561] ? __pfx_bpf_prog_test_run_skb+0x10/0x10 [ 405.440947][T15561] bpf_prog_test_run+0x2c7/0x340 [ 405.440975][T15561] __sys_bpf+0x5cb/0x920 [ 405.440998][T15561] ? __pfx___sys_bpf+0x10/0x10 [ 405.441036][T15561] ? ksys_write+0x242/0x270 [ 405.441067][T15561] ? __pfx_ksys_write+0x10/0x10 [ 405.441113][T15561] __x64_sys_bpf+0x7c/0x90 [ 405.441144][T15561] do_syscall_64+0xe2/0xf80 [ 405.441173][T15561] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 405.441192][T15561] ? trace_irq_disable+0x37/0x100 [ 405.441212][T15561] ? clear_bhb_loop+0x60/0xb0 [ 405.441237][T15561] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 405.441258][T15561] RIP: 0033:0x7fe8efb9aeb9 [ 405.441276][T15561] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 405.441295][T15561] RSP: 002b:00007fe8f09cd028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 405.441318][T15561] RAX: ffffffffffffffda RBX: 00007fe8efe15fa0 RCX: 00007fe8efb9aeb9 [ 405.441333][T15561] RDX: 000000000000002c RSI: 0000200000000080 RDI: 000000000000000a [ 405.441346][T15561] RBP: 00007fe8f09cd090 R08: 0000000000000000 R09: 0000000000000000 [ 405.441359][T15561] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 405.441371][T15561] R13: 00007fe8efe16038 R14: 00007fe8efe15fa0 R15: 00007ffec6fa92a8 [ 405.441405][T15561] [ 406.159838][T15580] __nla_validate_parse: 1 callbacks suppressed [ 406.159868][T15580] netlink: 71 bytes leftover after parsing attributes in process `syz.3.2837'. [ 407.408675][T15592] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2842'. [ 407.446474][T15588] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2839'. [ 407.456254][T15588] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2839'. [ 407.574577][T15600] netlink: 'syz.2.2845': attribute type 7 has an invalid length. [ 407.617292][T15601] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2846'. [ 407.627072][T15601] openvswitch: netlink: Flow actions attr not present in new flow. [ 407.723871][T15607] netlink: 64 bytes leftover after parsing attributes in process `syz.0.2849'. [ 408.180702][T15622] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2851'. [ 408.579126][T15628] tipc: Enabled bearer , priority 0 [ 408.586954][T15628] syzkaller0: entered promiscuous mode [ 408.609923][T15628] syzkaller0: entered allmulticast mode [ 408.622960][T15630] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2854'. [ 408.720616][T15628] tipc: Resetting bearer [ 408.746695][ T5825] block nbd3: Receive control failed (result -32) [ 408.762528][T15627] tipc: Resetting bearer [ 408.831779][T15627] tipc: Disabling bearer [ 408.915746][T15641] netlink: 'syz.2.2856': attribute type 83 has an invalid length. [ 409.234682][T15653] netlink: 1 bytes leftover after parsing attributes in process `syz.0.2859'. [ 409.469264][T15671] delete_channel: no stack [ 409.500221][T15671] netlink: 36 bytes leftover after parsing attributes in process `syz.4.2864'. [ 409.667045][T15672] syzkaller0: entered promiscuous mode [ 409.680880][T15672] syzkaller0: entered allmulticast mode [ 411.862439][T15716] syzkaller0: entered promiscuous mode [ 411.863288][T15717] netlink: 'syz.2.2874': attribute type 6 has an invalid length. [ 411.873654][T15716] syzkaller0: entered allmulticast mode [ 411.910646][T15713] delete_channel: no stack [ 411.946067][T15719] __nla_validate_parse: 4 callbacks suppressed [ 411.946088][T15719] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2875'. [ 411.965854][T15719] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2875'. [ 411.987898][T15725] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2877'. [ 412.097069][T15730] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2878'. [ 412.246047][T15736] xt_CT: No such helper "syz0" [ 413.703246][T15727] lo: entered allmulticast mode [ 413.719912][T15731] lo: left allmulticast mode [ 413.728508][T15743] workqueue: Failed to create a rescuer kthread for wq "wg-crypt-wireguard%d": -EINTR [ 413.886687][T15754] syzkaller0: entered promiscuous mode [ 413.917148][T15754] syzkaller0: entered allmulticast mode [ 413.937891][T15767] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2890'. [ 413.947245][T15767] netlink: 'syz.4.2890': attribute type 1 has an invalid length. [ 414.339716][T15776] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2891'. [ 414.366549][T15776] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2891'. [ 414.386976][T15776] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2891'. [ 414.410446][T15776] netlink: 'syz.1.2891': attribute type 2 has an invalid length. [ 414.944250][T15788] netlink: 'syz.0.2893': attribute type 1 has an invalid length. [ 415.357784][ C0] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 416.122177][T15788] netlink: 132 bytes leftover after parsing attributes in process `syz.0.2893'. [ 416.182415][T15790] syzkaller0: entered promiscuous mode [ 416.192760][T15790] syzkaller0: entered allmulticast mode [ 416.340798][T15794] tipc: Enabled bearer , priority 0 [ 416.453685][T15794] syzkaller0: entered promiscuous mode [ 416.463294][T15804] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2896'. [ 416.472799][T15794] syzkaller0: entered allmulticast mode [ 416.482447][T15794] tipc: Resetting bearer [ 416.530139][T15806] Cannot find del_set index 4 as target [ 416.562087][T15793] tipc: Resetting bearer [ 418.278110][T15793] tipc: Disabling bearer [ 418.287422][T15816] bridge0: port 1(erspan0) entered disabled state [ 418.294856][T15816] bridge0: entered allmulticast mode [ 418.450905][T15845] netlink: 'syz.2.2908': attribute type 10 has an invalid length. [ 418.459221][T15846] __nla_validate_parse: 4 callbacks suppressed [ 418.459238][T15846] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2907'. [ 418.498227][T15846] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2907'. [ 418.507272][T15846] netlink: 'syz.3.2907': attribute type 19 has an invalid length. [ 418.508411][T15845] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2908'. [ 418.537572][T15845] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 418.555553][T15846] netlink: 'syz.3.2907': attribute type 20 has an invalid length. [ 418.570445][T15849] openvswitch: netlink: Actions may not be safe on all matching packets [ 418.931056][T15870] netlink: 132 bytes leftover after parsing attributes in process `syz.2.2916'. [ 419.077723][T15881] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2919'. [ 419.101523][T15881] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2919'. [ 419.364680][T15892] openvswitch: netlink: Actions may not be safe on all matching packets [ 419.457928][T15896] ref_tracker: memory allocation failure, unreliable refcount tracker. [ 419.511439][T15898] xt_CT: You must specify a L4 protocol and not use inversions on it [ 419.522057][T15898] Unknown options in mask b7f2 [ 419.846883][T15904] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2929'. [ 419.870485][T15904] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 420.279716][T15921] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2934'. [ 420.587057][T15933] tipc: Enabled bearer , priority 0 [ 420.611489][T15933] syzkaller0: entered promiscuous mode [ 420.622680][T15933] syzkaller0: entered allmulticast mode [ 420.736736][T15933] tipc: Resetting bearer [ 420.753289][ T5825] block nbd4: Receive control failed (result -32) [ 420.765438][T15932] tipc: Resetting bearer [ 420.796220][T15932] tipc: Disabling bearer [ 420.893489][T15955] syzkaller0: entered promiscuous mode [ 420.906116][T15955] syzkaller0: entered allmulticast mode [ 420.947398][T15955] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2944'. [ 421.374337][T15973] openvswitch: netlink: Actions may not be safe on all matching packets [ 421.528695][ T5826] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 421.539612][ T5826] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 421.557993][ T5826] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 421.571591][ T5826] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 421.582398][ T5826] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 421.660795][T15984] lo speed is unknown, defaulting to 1000 [ 421.668953][T15978] lo speed is unknown, defaulting to 1000 [ 421.676623][T15978] wg1 speed is unknown, defaulting to 1000 [ 421.684569][T15984] wg1 speed is unknown, defaulting to 1000 [ 421.692022][T15978] wg1 speed is unknown, defaulting to 1000 [ 421.723189][T15984] wg1 speed is unknown, defaulting to 1000 [ 422.029285][T15978] chnl_net:caif_netlink_parms(): no params data found [ 422.334368][T16001] netlink: 212 bytes leftover after parsing attributes in process `syz.0.2957'. [ 422.359223][T16001] sctp: [Deprecated]: syz.0.2957 (pid 16001) Use of int in max_burst socket option deprecated. [ 422.359223][T16001] Use struct sctp_assoc_value instead [ 422.417352][T16001] Cannot find set identified by id 65534 to match [ 422.629688][T15978] bridge0: port 1(bridge_slave_0) entered blocking state [ 422.644479][T15978] bridge0: port 1(bridge_slave_0) entered disabled state [ 422.653385][T15978] bridge_slave_0: entered allmulticast mode [ 422.661553][T15978] bridge_slave_0: entered promiscuous mode [ 422.679278][T15978] bridge0: port 2(bridge_slave_1) entered blocking state [ 422.686568][T15978] bridge0: port 2(bridge_slave_1) entered disabled state [ 422.697789][T15978] bridge_slave_1: entered allmulticast mode [ 422.706013][T15978] bridge_slave_1: entered promiscuous mode [ 422.809643][T15978] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 422.825261][T15978] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 422.937133][T15978] team0: Port device team_slave_0 added [ 422.948531][T15978] team0: Port device team_slave_1 added [ 423.054662][T15978] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 423.071958][T15978] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 423.128324][T15978] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 423.156139][T15978] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 423.173830][T15978] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 423.229211][T15978] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 423.254413][T16023] syzkaller0: entered promiscuous mode [ 423.275551][T16023] syzkaller0: entered allmulticast mode [ 423.489604][T15978] hsr_slave_0: entered promiscuous mode [ 423.514324][T15978] hsr_slave_1: entered promiscuous mode [ 423.534018][T15978] debugfs: 'hsr0' already exists in 'hsr' [ 423.553929][T15978] Cannot create hsr debugfs directory [ 423.668683][ T5826] Bluetooth: hci5: command tx timeout [ 423.790722][T16052] netlink: 'syz.3.2970': attribute type 4 has an invalid length. [ 423.818561][T16052] __nla_validate_parse: 2 callbacks suppressed [ 423.818581][T16052] netlink: 152 bytes leftover after parsing attributes in process `syz.3.2970'. [ 423.881422][T16054] netlink: 'syz.3.2970': attribute type 2 has an invalid length. [ 423.901236][T16052] .`: renamed from bond0 (while UP) [ 424.161598][T15978] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 424.216627][T16069] netlink: 64 bytes leftover after parsing attributes in process `syz.1.2974'. [ 424.269921][T16072] syzkaller0: entered promiscuous mode [ 424.275765][T16072] syzkaller0: entered allmulticast mode [ 424.360131][T15978] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 424.462173][T16078] block nbd1: NBD_DISCONNECT [ 424.477128][T15978] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 424.495565][T16078] block nbd1: Send disconnect failed -32 [ 424.519169][T16078] block nbd1: shutting down sockets [ 424.621568][T15978] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 424.795745][ T13] bridge_slave_0: left allmulticast mode [ 424.822903][ T13] bridge_slave_0: left promiscuous mode [ 424.849340][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 425.203893][T16101] FAULT_INJECTION: forcing a failure. [ 425.203893][T16101] name failslab, interval 1, probability 0, space 0, times 0 [ 425.220616][T16101] CPU: 0 UID: 0 PID: 16101 Comm: syz.3.2982 Not tainted syzkaller #0 PREEMPT(full) [ 425.220644][T16101] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 425.220657][T16101] Call Trace: [ 425.220665][T16101] [ 425.220674][T16101] dump_stack_lvl+0xe8/0x150 [ 425.220705][T16101] should_fail_ex+0x412/0x560 [ 425.220736][T16101] should_failslab+0xa8/0x100 [ 425.220760][T16101] __kmalloc_cache_noprof+0x83/0x6e0 [ 425.220776][T16101] ? __sctp_v6_cmp_addr+0x1e6/0x510 [ 425.220795][T16101] ? sctp_add_bind_addr+0x8c/0x370 [ 425.220817][T16101] sctp_add_bind_addr+0x8c/0x370 [ 425.220838][T16101] sctp_copy_local_addr_list+0x314/0x4f0 [ 425.220859][T16101] ? sctp_copy_local_addr_list+0xa4/0x4f0 [ 425.220877][T16101] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 425.220897][T16101] ? sctp_v6_is_any+0x64/0x80 [ 425.220916][T16101] ? sctp_copy_one_addr+0x93/0x360 [ 425.220937][T16101] sctp_bind_addr_copy+0xb3/0x3c0 [ 425.220988][T16101] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 425.221014][T16101] sctp_connect_new_asoc+0x2ff/0x6b0 [ 425.221049][T16101] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 425.221089][T16101] ? __local_bh_enable_ip+0xd0/0x130 [ 425.221103][T16101] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 425.221120][T16101] ? security_sctp_bind_connect+0x7e/0x2c0 [ 425.221138][T16101] sctp_sendmsg+0x1528/0x2c10 [ 425.221170][T16101] ? __pfx_sctp_sendmsg+0x10/0x10 [ 425.221190][T16101] ? aa_sk_perm+0x15a/0x960 [ 425.221207][T16101] ? aa_sk_perm+0x82d/0x960 [ 425.221222][T16101] ? __might_fault+0xaf/0x130 [ 425.221249][T16101] ? __pfx_aa_sk_perm+0x10/0x10 [ 425.221268][T16101] ? sock_rps_record_flow+0x19/0x400 [ 425.221298][T16101] ? inet_sendmsg+0x2f4/0x370 [ 425.221322][T16101] __sys_sendto+0x627/0x7a0 [ 425.221345][T16101] ? __pfx___sys_sendto+0x10/0x10 [ 425.221361][T16101] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 425.221391][T16101] ? __fget_files+0x3a0/0x420 [ 425.221415][T16101] ? ksys_write+0x242/0x270 [ 425.221439][T16101] ? __pfx_ksys_write+0x10/0x10 [ 425.221463][T16101] __x64_sys_sendto+0xde/0x100 [ 425.221485][T16101] do_syscall_64+0xe2/0xf80 [ 425.221504][T16101] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 425.221518][T16101] ? trace_irq_disable+0x37/0x100 [ 425.221531][T16101] ? clear_bhb_loop+0x60/0xb0 [ 425.221550][T16101] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 425.221565][T16101] RIP: 0033:0x7f4578b9aeb9 [ 425.221578][T16101] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 425.221592][T16101] RSP: 002b:00007f45799c0028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 425.221608][T16101] RAX: ffffffffffffffda RBX: 00007f4578e15fa0 RCX: 00007f4578b9aeb9 [ 425.221618][T16101] RDX: 0000000000000001 RSI: 0000200000000840 RDI: 0000000000000004 [ 425.221628][T16101] RBP: 00007f45799c0090 R08: 0000200000000340 R09: 000000000000001c [ 425.221638][T16101] R10: 0000000000065055 R11: 0000000000000246 R12: 0000000000000002 [ 425.221647][T16101] R13: 00007f4578e16038 R14: 00007f4578e15fa0 R15: 00007fffb81445f8 [ 425.221672][T16101] [ 425.747715][ T5826] Bluetooth: hci5: command tx timeout [ 426.206385][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 426.218416][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 426.230405][ T13] bond0 (unregistering): (slave bridge_slave_1): Releasing backup interface [ 426.240770][ T13] bond0 (unregistering): Released all slaves [ 426.374595][ T13] tipc: Left network mode [ 426.391987][T16106] FAULT_INJECTION: forcing a failure. [ 426.391987][T16106] name failslab, interval 1, probability 0, space 0, times 0 [ 426.404747][T16106] CPU: 1 UID: 0 PID: 16106 Comm: syz.1.2984 Not tainted syzkaller #0 PREEMPT(full) [ 426.404775][T16106] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 426.404786][T16106] Call Trace: [ 426.404794][T16106] [ 426.404803][T16106] dump_stack_lvl+0xe8/0x150 [ 426.404834][T16106] should_fail_ex+0x412/0x560 [ 426.404864][T16106] should_failslab+0xa8/0x100 [ 426.404889][T16106] kmem_cache_alloc_noprof+0x87/0x6e0 [ 426.404921][T16106] ? skb_clone+0x212/0x3a0 [ 426.404956][T16106] skb_clone+0x212/0x3a0 [ 426.404989][T16106] bpf_clone_redirect+0x16a/0x4b0 [ 426.405012][T16106] ? seqcount_lockdep_reader_access+0xea/0x100 [ 426.405041][T16106] ? read_tsc+0x9/0x20 [ 426.405067][T16106] ? ktime_get+0x1d2/0x200 [ 426.405095][T16106] ? bpf_test_run+0x1d1/0x830 [ 426.405119][T16106] bpf_prog_43388ee67a65acbd+0x22/0x2a [ 426.405140][T16106] bpf_test_run+0x354/0x830 [ 426.405187][T16106] ? __pfx_bpf_test_run+0x10/0x10 [ 426.405228][T16106] ? __kasan_krealloc+0xeb/0x110 [ 426.405251][T16106] ? eth_type_trans+0x35e/0x6d0 [ 426.405287][T16106] ? convert___skb_to_skb+0x3d/0x5b0 [ 426.405314][T16106] bpf_prog_test_run_skb+0xd22/0x1c90 [ 426.405353][T16106] ? __fget_files+0x2a/0x420 [ 426.405375][T16106] ? __fget_files+0x3a0/0x420 [ 426.405397][T16106] ? __fget_files+0x2a/0x420 [ 426.405425][T16106] ? __pfx_bpf_prog_test_run_skb+0x10/0x10 [ 426.405458][T16106] bpf_prog_test_run+0x2c7/0x340 [ 426.405486][T16106] __sys_bpf+0x5cb/0x920 [ 426.405509][T16106] ? __pfx___sys_bpf+0x10/0x10 [ 426.405546][T16106] ? ksys_write+0x242/0x270 [ 426.405579][T16106] ? __pfx_ksys_write+0x10/0x10 [ 426.405619][T16106] __x64_sys_bpf+0x7c/0x90 [ 426.405650][T16106] do_syscall_64+0xe2/0xf80 [ 426.405678][T16106] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 426.405698][T16106] ? trace_irq_disable+0x37/0x100 [ 426.405717][T16106] ? clear_bhb_loop+0x60/0xb0 [ 426.405741][T16106] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 426.405761][T16106] RIP: 0033:0x7f0d6839aeb9 [ 426.405781][T16106] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 426.405799][T16106] RSP: 002b:00007f0d691e9028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 426.405821][T16106] RAX: ffffffffffffffda RBX: 00007f0d68615fa0 RCX: 00007f0d6839aeb9 [ 426.405836][T16106] RDX: 0000000000000050 RSI: 00002000000003c0 RDI: 000000000000000a [ 426.405850][T16106] RBP: 00007f0d691e9090 R08: 0000000000000000 R09: 0000000000000000 [ 426.405862][T16106] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 426.405875][T16106] R13: 00007f0d68616038 R14: 00007f0d68615fa0 R15: 00007ffdc4f22938 [ 426.405909][T16106] [ 426.407413][T16108] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2985'. [ 426.765687][T15978] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 426.840810][T15978] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 426.877947][T16116] syzkaller0: entered promiscuous mode [ 426.883628][T16116] syzkaller0: entered allmulticast mode [ 426.922329][T15978] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 426.937406][T15978] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 426.988950][T16115] lo: entered allmulticast mode [ 426.996163][T16113] lo: left allmulticast mode [ 427.085479][T16118] lo speed is unknown, defaulting to 1000 [ 427.113398][T16130] nbd: socks must be embedded in a SOCK_ITEM attr [ 427.121626][T16118] wg1 speed is unknown, defaulting to 1000 [ 427.173252][T16118] wg1 speed is unknown, defaulting to 1000 [ 427.288100][T16130] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2989'. [ 427.386265][T16139] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2992'. [ 427.420599][ T13] hsr_slave_0: left promiscuous mode [ 427.438738][ T13] hsr_slave_1: left promiscuous mode [ 427.489606][ T13] pimreg (unregistering): left allmulticast mode [ 427.554822][T16146] netlink: 56 bytes leftover after parsing attributes in process `syz.1.2993'. [ 427.635850][T16149] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2994'. [ 427.783761][T16155] IPVS: set_ctl: invalid protocol: 47 172.20.20.29:20004 [ 427.791532][T16153] netlink: 'syz.0.2994': attribute type 5 has an invalid length. [ 427.791560][T16153] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2994'. [ 427.834244][ T5826] Bluetooth: hci5: command tx timeout [ 427.868609][T16158] netlink: 'syz.1.2996': attribute type 23 has an invalid length. [ 428.603724][T15978] 8021q: adding VLAN 0 to HW filter on device bond0 [ 428.626515][T15978] 8021q: adding VLAN 0 to HW filter on device team0 [ 428.655556][ T6098] bridge0: port 1(bridge_slave_0) entered blocking state [ 428.662811][ T6098] bridge0: port 1(bridge_slave_0) entered forwarding state [ 428.765368][ T6098] bridge0: port 2(bridge_slave_1) entered blocking state [ 428.772652][ T6098] bridge0: port 2(bridge_slave_1) entered forwarding state [ 428.830133][T16172] syzkaller0: entered promiscuous mode [ 428.835730][T16172] syzkaller0: entered allmulticast mode [ 428.915086][T16178] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3003'. [ 428.936877][T16181] netlink: 80 bytes leftover after parsing attributes in process `syz.4.3004'. [ 428.954594][T16181] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3004'. [ 429.051742][T15978] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 429.062738][T16181] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3004'. [ 429.084531][ T13] IPVS: stop unused estimator thread 0... [ 429.207736][T16188] netlink: 165 bytes leftover after parsing attributes in process `syz.3.3006'. [ 429.223645][T16189] xt_CT: You must specify a L4 protocol and not use inversions on it [ 429.488360][T16201] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3011'. [ 429.529264][T16204] netlink: 'syz.4.3011': attribute type 9 has an invalid length. [ 429.550146][T16200] delete_channel: no stack [ 429.592188][T15978] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 429.631009][T16210] Cannot find del_set index 2 as target [ 429.663793][T16211] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3012'. [ 429.694521][T16211] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3012'. [ 429.716546][T15978] veth0_vlan: entered promiscuous mode [ 429.762996][T15978] veth1_vlan: entered promiscuous mode [ 429.784092][T16213] syzkaller0: entered promiscuous mode [ 429.791788][T16213] syzkaller0: entered allmulticast mode [ 429.834261][T16215] tipc: Enabling of bearer rejected, failed to enable media [ 429.883909][T15978] veth0_macvtap: entered promiscuous mode [ 429.896857][T15978] veth1_macvtap: entered promiscuous mode [ 429.909194][ T5826] Bluetooth: hci5: command tx timeout [ 429.947615][T15978] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 429.964537][T15978] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 429.994577][ T13] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 430.018740][ T13] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 430.069725][ T13] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 430.091137][ T13] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 430.123842][T16223] syzkaller1: entered promiscuous mode [ 430.132105][T16223] syzkaller1: entered allmulticast mode [ 430.244087][T16231] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3022'. [ 430.351993][T16234] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3023'. [ 430.362490][T16232] tipc: Enabled bearer , priority 0 [ 430.379615][T16232] syzkaller0: entered promiscuous mode [ 430.396192][T16232] syzkaller0: entered allmulticast mode [ 430.404703][T16237] sctp: [Deprecated]: syz.1.3024 (pid 16237) Use of int in max_burst socket option deprecated. [ 430.404703][T16237] Use struct sctp_assoc_value instead [ 430.422949][ T6098] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 430.437891][ T6098] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 430.470081][T16237] Cannot find set identified by id 65534 to match [ 430.547047][T16225] tipc: Resetting bearer [ 430.586311][T16225] tipc: Disabling bearer [ 430.650787][ T6098] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 430.663430][ T6098] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 430.920372][T16259] ieee802154 phy0 wpan0: encryption failed: -22 [ 431.059260][T16266] netlink: 'syz.2.3032': attribute type 4 has an invalid length. [ 431.175310][T16268] syzkaller0: entered promiscuous mode [ 431.197800][T16268] syzkaller0: entered allmulticast mode [ 431.211191][T16270] RDS: rds_bind could not find a transport for fec0:ffff::1, load rds_tcp or rds_rdma? [ 431.270813][T16270] vlan2: entered promiscuous mode [ 431.298454][T16272] netlink: 'syz.3.3035': attribute type 1 has an invalid length. [ 431.572128][T16272] 8021q: adding VLAN 0 to HW filter on device bond0 [ 431.604655][T16276] bond0: (slave gretap1): making interface the new active one [ 431.614675][T16276] bond0: (slave gretap1): Enslaving as an active interface with an up link [ 431.668596][T16284] set match dimension is over the limit! [ 431.688484][ T5825] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 431.698831][ T5820] bond0: (slave syz_tun): Releasing backup interface [ 431.706936][ T5825] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 431.716602][ T5825] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 431.730844][ T5825] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 431.742032][ T5825] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 431.885032][T16278] bond0 (unregistering): (slave gretap1): Releasing active interface [ 431.899165][T16278] bond0 (unregistering): Released all slaves [ 432.065506][T16285] lo speed is unknown, defaulting to 1000 [ 432.093299][T16285] wg1 speed is unknown, defaulting to 1000 [ 432.105289][T16285] wg1 speed is unknown, defaulting to 1000 [ 432.135882][T16295] nbd: must specify an index to disconnect [ 432.480075][T16307] ieee802154 phy0 wpan0: encryption failed: -22 [ 432.563960][T16320] gretap0: entered promiscuous mode [ 432.669651][T16320] gretap0: left promiscuous mode [ 432.682826][T16320] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 432.729311][ T5822] lo speed is unknown, defaulting to 1000 [ 432.735119][ T5822] syz2: Port: 1 Link ACTIVE [ 432.739361][T16285] chnl_net:caif_netlink_parms(): no params data found [ 432.921396][T16327] [ 432.923807][T16327] ====================================================== [ 432.930908][T16327] WARNING: possible circular locking dependency detected [ 432.938004][T16327] syzkaller #0 Not tainted [ 432.942479][T16327] ------------------------------------------------------ [ 432.949622][T16327] syz.4.3052/16327 is trying to acquire lock: [ 432.955745][T16327] ffffffff8fb297b8 (nr_node_list_lock){+...}-{3:3}, at: nr_rt_device_down+0xbe/0x860 [ 432.965278][T16327] [ 432.965278][T16327] but task is already holding lock: [ 432.972663][T16327] ffffffff8fb29758 (nr_neigh_list_lock){+...}-{3:3}, at: nr_rt_device_down+0x28/0x860 [ 432.982380][T16327] [ 432.982380][T16327] which lock already depends on the new lock. [ 432.982380][T16327] [ 432.992902][T16327] [ 432.992902][T16327] the existing dependency chain (in reverse order) is: [ 433.001942][T16327] [ 433.001942][T16327] -> #2 (nr_neigh_list_lock){+...}-{3:3}: [ 433.009965][T16327] _raw_spin_lock_bh+0x36/0x50 [ 433.015292][T16327] nr_rt_ioctl+0x40c/0xf90 [ 433.020261][T16327] sock_do_ioctl+0x101/0x320 [ 433.025490][T16327] sock_ioctl+0x5c6/0x7f0 [ 433.030375][T16327] __se_sys_ioctl+0xfc/0x170 [ 433.035521][T16327] do_syscall_64+0xe2/0xf80 [ 433.040582][T16327] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 433.047203][T16327] [ 433.047203][T16327] -> #1 (&nr_node->node_lock){+...}-{3:3}: [ 433.055325][T16327] _raw_spin_lock_bh+0x36/0x50 [ 433.060640][T16327] nr_rt_ioctl+0x215/0xf90 [ 433.065614][T16327] sock_do_ioctl+0x101/0x320 [ 433.070853][T16327] sock_ioctl+0x5c6/0x7f0 [ 433.075728][T16327] __se_sys_ioctl+0xfc/0x170 [ 433.080905][T16327] do_syscall_64+0xe2/0xf80 [ 433.085963][T16327] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 433.092426][T16327] [ 433.092426][T16327] -> #0 (nr_node_list_lock){+...}-{3:3}: [ 433.100622][T16327] __lock_acquire+0x15a5/0x2cf0 [ 433.106124][T16327] lock_acquire+0x106/0x330 [ 433.111178][T16327] _raw_spin_lock_bh+0x36/0x50 [ 433.116494][T16327] nr_rt_device_down+0xbe/0x860 [ 433.121898][T16327] nr_device_event+0x137/0x150 [ 433.127217][T16327] notifier_call_chain+0x19d/0x3a0 [ 433.132878][T16327] __dev_notify_flags+0x16d/0x310 [ 433.138553][T16327] netif_change_flags+0xe8/0x1a0 [ 433.144125][T16327] dev_change_flags+0x130/0x260 [ 433.149550][T16327] dev_ioctl+0x7b4/0x1150 [ 433.154549][T16327] sock_do_ioctl+0x23e/0x320 [ 433.159681][T16327] sock_ioctl+0x5c6/0x7f0 [ 433.164550][T16327] __se_sys_ioctl+0xfc/0x170 [ 433.169798][T16327] do_syscall_64+0xe2/0xf80 [ 433.174889][T16327] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 433.181369][T16327] [ 433.181369][T16327] other info that might help us debug this: [ 433.181369][T16327] [ 433.191632][T16327] Chain exists of: [ 433.191632][T16327] nr_node_list_lock --> &nr_node->node_lock --> nr_neigh_list_lock [ 433.191632][T16327] [ 433.205492][T16327] Possible unsafe locking scenario: [ 433.205492][T16327] [ 433.212991][T16327] CPU0 CPU1 [ 433.218412][T16327] ---- ---- [ 433.223793][T16327] lock(nr_neigh_list_lock); [ 433.228500][T16327] lock(&nr_node->node_lock); [ 433.235808][T16327] lock(nr_neigh_list_lock); [ 433.243125][T16327] lock(nr_node_list_lock); [ 433.247828][T16327] [ 433.247828][T16327] *** DEADLOCK *** [ 433.247828][T16327] [ 433.255993][T16327] 2 locks held by syz.4.3052/16327: [ 433.261217][T16327] #0: ffffffff8f9ac708 (rtnl_mutex){+.+.}-{4:4}, at: dev_ioctl+0x7a4/0x1150 [ 433.270057][T16327] #1: ffffffff8fb29758 (nr_neigh_list_lock){+...}-{3:3}, at: nr_rt_device_down+0x28/0x860 [ 433.280211][T16327] [ 433.280211][T16327] stack backtrace: [ 433.286145][T16327] CPU: 0 UID: 0 PID: 16327 Comm: syz.4.3052 Not tainted syzkaller #0 PREEMPT(full) [ 433.286174][T16327] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 433.286186][T16327] Call Trace: [ 433.286196][T16327] [ 433.286203][T16327] dump_stack_lvl+0xe8/0x150 [ 433.286230][T16327] print_circular_bug+0x2e1/0x300 [ 433.286252][T16327] check_noncircular+0x12e/0x150 [ 433.286273][T16327] __lock_acquire+0x15a5/0x2cf0 [ 433.286307][T16327] ? nr_rt_device_down+0xbe/0x860 [ 433.286333][T16327] lock_acquire+0x106/0x330 [ 433.286355][T16327] ? nr_rt_device_down+0xbe/0x860 [ 433.286381][T16327] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 433.286402][T16327] ? nr_rt_device_down+0xbe/0x860 [ 433.286427][T16327] _raw_spin_lock_bh+0x36/0x50 [ 433.286446][T16327] ? nr_rt_device_down+0xbe/0x860 [ 433.286470][T16327] nr_rt_device_down+0xbe/0x860 [ 433.286499][T16327] nr_device_event+0x137/0x150 [ 433.286523][T16327] notifier_call_chain+0x19d/0x3a0 [ 433.286544][T16327] __dev_notify_flags+0x16d/0x310 [ 433.286568][T16327] ? __pfx___dev_notify_flags+0x10/0x10 [ 433.286589][T16327] ? __dev_change_flags+0x4c6/0x690 [ 433.286614][T16327] ? __pfx___dev_change_flags+0x10/0x10 [ 433.286637][T16327] ? full_name_hash+0x92/0xe0 [ 433.286664][T16327] netif_change_flags+0xe8/0x1a0 [ 433.286688][T16327] dev_change_flags+0x130/0x260 [ 433.286711][T16327] dev_ioctl+0x7b4/0x1150 [ 433.286732][T16327] sock_do_ioctl+0x23e/0x320 [ 433.286749][T16327] ? __pfx_sock_do_ioctl+0x10/0x10 [ 433.286764][T16327] ? do_futex+0x333/0x420 [ 433.286794][T16327] sock_ioctl+0x5c6/0x7f0 [ 433.286810][T16327] ? __pfx_sock_ioctl+0x10/0x10 [ 433.286825][T16327] ? __fget_files+0x2a/0x420 [ 433.286843][T16327] ? __fget_files+0x3a0/0x420 [ 433.286860][T16327] ? __fget_files+0x2a/0x420 [ 433.286879][T16327] ? bpf_lsm_file_ioctl+0x9/0x20 [ 433.286900][T16327] ? __pfx_sock_ioctl+0x10/0x10 [ 433.286915][T16327] __se_sys_ioctl+0xfc/0x170 [ 433.286938][T16327] do_syscall_64+0xe2/0xf80 [ 433.286960][T16327] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 433.286977][T16327] ? trace_irq_disable+0x37/0x100 [ 433.286992][T16327] ? clear_bhb_loop+0x60/0xb0 [ 433.287011][T16327] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 433.287027][T16327] RIP: 0033:0x7f642d99aeb9 [ 433.287044][T16327] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 433.287058][T16327] RSP: 002b:00007f642e823028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 433.287077][T16327] RAX: ffffffffffffffda RBX: 00007f642dc15fa0 RCX: 00007f642d99aeb9 [ 433.287090][T16327] RDX: 0000200000000000 RSI: 0000000000008914 RDI: 0000000000000005 [ 433.287101][T16327] RBP: 00007f642da08c1f R08: 0000000000000000 R09: 0000000000000000 [ 433.287111][T16327] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 433.287121][T16327] R13: 00007f642dc16038 R14: 00007f642dc15fa0 R15: 00007ffdd72348d8 [ 433.287142][T16327] SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=-1 (errno 104: Connection reset by peer) [ 433.827900][ T5825] Bluetooth: hci1: command tx timeout [ 434.493700][ T12] bond0 (unregistering): Released all slaves [ 434.924906][ T12] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 434.964692][ T12] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 435.023816][ T12] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 435.082353][ T12] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 435.163311][ T12] bridge_slave_1: left allmulticast mode [ 435.169239][ T12] bridge_slave_1: left promiscuous mode [ 435.175204][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 435.184554][ T12] bridge_slave_0: left allmulticast mode [ 435.191930][ T12] bridge_slave_0: left promiscuous mode [ 435.197849][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 435.311975][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 435.322299][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 435.332464][ T12] bond0 (unregistering): Released all slaves [ 435.596606][ T12] hsr_slave_0: left promiscuous mode [ 435.602861][ T12] hsr_slave_1: left promiscuous mode [ 435.609064][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 435.616535][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 435.628303][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 435.635768][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 435.648891][ T12] veth1_macvtap: left promiscuous mode [ 435.654528][ T12] veth0_macvtap: left promiscuous mode [ 435.660764][ T12] veth1_vlan: left promiscuous mode [ 435.666206][ T12] veth0_vlan: left promiscuous mode [ 435.848352][ T12] team0 (unregistering): Port device team_slave_1 removed [ 435.878244][ T12] team0 (unregistering): Port device team_slave_0 removed