last executing test programs: 4.822933057s ago: executing program 2 (id=1397): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'macvlan1\x00'}) socket$rxrpc(0x21, 0x2, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) r1 = bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x5, &(0x7f0000000680)=@framed={{0x18, 0x8}, [@map_fd={0x18, 0x0, 0x1, 0x0, r1}]}, &(0x7f0000000000)='GPL\x00', 0x8}, 0x90) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x800, r1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x2}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xf, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYBLOB="0000000000000000b702000000e5000085000000860000001801000020786c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x200000000000011, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000010200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000080)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f00000000c0)={0x0, 0x86dd, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="3800000054001ffff7ff60000800000007000000", @ANYRES32=r4, @ANYBLOB="20000100", @ANYRES32=r6, @ANYBLOB="01000000ff"], 0x38}}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) 4.612625595s ago: executing program 2 (id=1399): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x13, &(0x7f0000000500)=ANY=[@ANYBLOB="180a00000000000000000000eeffffff8510000006000000181000000e6fe2e84b2d79eef31fc8c3cf7313a623b35ac496ce07961c50d6682fdbed0b807eb66aa79bc8a28f2000e774cdf67a290b051a9ced62529f8dd51d0614bfa991fb5bef8ea7d6631794ba37ab9f8a58ee23d5c07c956d88584183b7b9ffb20dc176bd2bdef2490f00a78dff33369c1815302d93fe0e5eebef902b76339ac5a86f86d2ccab2426873a6e2950f096d6a152b3c36d057c647519707e8068a5c0f66a1847d1051967c80e382b63d6725381daaedcec08d872c6ff4992c10e491a599704eb40997472b08fa443f166bf426468fb4b0466ecd4d058f62f4e62744821a5891c324e5c386437996b9a720f6df71933d6b6c7cc5d4856377cf778bbf64288b34499657b8efde2f66865f34c22ee119ccebab9f47a903663e8800e8544b844763c7e7c4873864784ef1661cd7290dfb87def9aadaa0f15f4b8049b58bc7de44a7f6e531f27", @ANYRES32, @ANYBLOB="000000000000000000000000000000001800000000000000000000000000000095000000000000000000000000000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70200000000000085000000060000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0x4, 0x13, &(0x7f0000000340)=""/222}, 0x21) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(0xffffffffffffffff, 0x84, 0x76, &(0x7f0000444ff8)={0x0, 0x7}, 0x8) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(0xffffffffffffffff, 0x84, 0x75, &(0x7f0000000000)={0x0, 0xca}, 0x8) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, &(0x7f0000000200)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000003c40)=[{{&(0x7f0000000080)={0xa, 0x4e23, 0x0, @loopback}, 0x1c, &(0x7f0000000240)=[{&(0x7f0000000140)='\v', 0x1}], 0x1}}], 0x1, 0x0) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f00000002c0)=ANY=[@ANYRES32, @ANYBLOB="fe0f09"], 0x1a) bind$inet6(r2, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) bpf$PROG_LOAD(0x5, 0x0, 0x0) r3 = socket$nl_rdma(0x10, 0x3, 0x14) recvmmsg(r3, &(0x7f0000000fc0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) sendmsg$RDMA_NLDEV_CMD_RES_PD_GET(r3, &(0x7f0000000000)={0x0, 0xc041, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="180000000e1443eb0000000000001900080001000000000018783457bc179203700646d1a78ebc37bf30902c99dfd0593f07797c4760ebbffe44b34f172f8d889a564c350bade7fdba6712"], 0x18}}, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r2, 0x0, 0x0, 0x22004001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="640000001000010000000000000000da2481d800", @ANYRES32=0x0, @ANYBLOB="0000000000000000440012800e00010069703665727370616e0000003000028008001500feffffff0500160001000000080014000000000005000b0000000000040012"], 0x64}}, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000340)={@in6={{0xa, 0x0, 0x0, @loopback}}, 0x0, 0x0, 0x39, 0x0, "b0fd7b07ff8a216915a8d3215a3225178096acf74c85ad01ba95fd9d0543750fb5a62a045888e8febca073f1f821abb8083f4d192383c47b3800abd4d841e2d4b56039653b95d0cd0a00a6ea35bdfaf6"}, 0xd8) sendto$inet6(r2, &(0x7f0000000080)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090000006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a54049f0c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5753444fe05f33e5f91045540836c3cd6af10f0cd018f0c6f57f926ac959a5628c45088fbe0c87fbe6cbcda4662d2a12f6d00"/215, 0xd0d0c2ac, 0x0, 0x0, 0x32) splice(r2, 0x0, r1, 0x0, 0x406f408, 0x0) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000040)={0x3fa6, 0x0}, 0x8) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000240)={@ifindex, 0x10, 0x1, 0xcf50, &(0x7f0000000700)=[0x0], 0x1, 0x0, &(0x7f0000000180)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000001c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000200)=[0x0, 0x0], 0x0}, 0x40) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000280)={@cgroup=r1, r0, 0x2c, 0x1000, r0, @prog_id=r5, r6}, 0x20) 2.829491958s ago: executing program 1 (id=1415): bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x0, 0xe, &(0x7f0000000380)=ANY=[@ANYBLOB="b702000007000000bfa30000000000000703000000feffff"], 0x0}, 0x90) (async) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000d00)=ANY=[@ANYBLOB="85000000130000005d0000000000000095000000000000000a0500f434b9eaafdc0a00e9bfde908990817b364e51afe9c01a97f0570759f1cae63487ff68fffffffffffe8e3932e2b7185a25a4cf8a9453c0eeba864400000000000000d8e5b1dc91c5499bea097700400000000000000000000000000000000000002819788d86205d947db7ad62b6e98f722ec61dc101adbfa8d0d057e307342511e1e33c25fead122ddacd0aaff826821627a99e8e9c65c5086bcb1df5ea822fb450ef904aed1c6822f05b7604ec9691e8d0c471fba901bf90dea634b2edea2e25c09fbae059aca9ace1b3baf1baf1f0a4f5f1386cd30b9f7019527f91379c1662dcb8"], &(0x7f0000000000)='GPL\x00', 0x5, 0x487, &(0x7f000000cf3d)=""/195}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r0, 0x0, 0xd00, 0xf20c0000, &(0x7f0000000380)="263abd030e98ff4dc870bd6688a8640888a8", 0x0, 0x1200}, 0x28) (async) sendmsg$NL80211_CMD_REQ_SET_REG(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000240)={0x2c8, 0x0, 0x0, 0x0, 0x0, {}, [@NL80211_ATTR_REG_RULES={0x2c, 0x22, 0x0, 0x1, [{0x24, 0x0, 0x0, 0x1, [@NL80211_ATTR_FREQ_RANGE_END={0x8}, @NL80211_ATTR_FREQ_RANGE_MAX_BW={0x8}, @NL80211_ATTR_FREQ_RANGE_END={0x8}, @NL80211_ATTR_FREQ_RANGE_MAX_BW={0x8}]}, {0x4}]}, @NL80211_ATTR_SOCKET_OWNER={0x4}, @NL80211_ATTR_REG_RULES={0x14c, 0x22, 0x0, 0x1, [{0x2c, 0x0, 0x0, 0x1, [@NL80211_ATTR_FREQ_RANGE_END={0x8}, @NL80211_ATTR_FREQ_RANGE_MAX_BW={0x8}, @NL80211_ATTR_POWER_RULE_MAX_EIRP={0x8}, @NL80211_ATTR_FREQ_RANGE_END={0x8}, @NL80211_ATTR_REG_RULE_FLAGS={0x8}]}, {0x4c, 0x0, 0x0, 0x1, [@NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN={0x8}, @NL80211_ATTR_DFS_CAC_TIME={0x8}, @NL80211_ATTR_FREQ_RANGE_END={0x8}, @NL80211_ATTR_DFS_CAC_TIME={0x8}, @NL80211_ATTR_REG_RULE_FLAGS={0x8}, @NL80211_ATTR_FREQ_RANGE_START={0x8}, @NL80211_ATTR_DFS_CAC_TIME={0x8}, @NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN={0x8}, @NL80211_ATTR_DFS_CAC_TIME={0x8}]}, {0x3c, 0x0, 0x0, 0x1, [@NL80211_ATTR_FREQ_RANGE_END={0x8}, @NL80211_ATTR_REG_RULE_FLAGS={0x8}, @NL80211_ATTR_FREQ_RANGE_END={0x8}, @NL80211_ATTR_FREQ_RANGE_START={0x8}, @NL80211_ATTR_DFS_CAC_TIME={0x8}, @NL80211_ATTR_POWER_RULE_MAX_EIRP={0x8}, @NL80211_ATTR_FREQ_RANGE_END={0x8}]}, {0x24, 0x0, 0x0, 0x1, [@NL80211_ATTR_FREQ_RANGE_MAX_BW={0x8}, @NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN={0x8}, @NL80211_ATTR_FREQ_RANGE_MAX_BW={0x8}, @NL80211_ATTR_FREQ_RANGE_MAX_BW={0x8}]}, {0x44, 0x0, 0x0, 0x1, [@NL80211_ATTR_FREQ_RANGE_END={0x8}, @NL80211_ATTR_FREQ_RANGE_END={0x8}, @NL80211_ATTR_FREQ_RANGE_START={0x8}, @NL80211_ATTR_REG_RULE_FLAGS={0x8}, @NL80211_ATTR_REG_RULE_FLAGS={0x8}, @NL80211_ATTR_REG_RULE_FLAGS={0x8}, @NL80211_ATTR_FREQ_RANGE_START={0x8}, @NL80211_ATTR_FREQ_RANGE_START={0x8}]}, {0x2c, 0x0, 0x0, 0x1, [@NL80211_ATTR_POWER_RULE_MAX_EIRP={0x8}, @NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN={0x8}, @NL80211_ATTR_POWER_RULE_MAX_EIRP={0x8}, @NL80211_ATTR_FREQ_RANGE_END={0x8}, @NL80211_ATTR_FREQ_RANGE_MAX_BW={0x8}]}]}, @NL80211_ATTR_REG_RULES={0x128, 0x22, 0x0, 0x1, [{0x3c, 0x0, 0x0, 0x1, [@NL80211_ATTR_POWER_RULE_MAX_EIRP={0x8}, @NL80211_ATTR_DFS_CAC_TIME={0x8}, @NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN={0x8}, @NL80211_ATTR_REG_RULE_FLAGS={0x8}, @NL80211_ATTR_DFS_CAC_TIME={0x8}, @NL80211_ATTR_DFS_CAC_TIME={0x8}, @NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN={0x8}]}, {0x34, 0x0, 0x0, 0x1, [@NL80211_ATTR_DFS_CAC_TIME={0x8}, @NL80211_ATTR_DFS_CAC_TIME={0x8}, @NL80211_ATTR_FREQ_RANGE_END={0x8}, @NL80211_ATTR_DFS_CAC_TIME={0x8}, @NL80211_ATTR_FREQ_RANGE_END={0x8}, @NL80211_ATTR_FREQ_RANGE_END={0x8}]}, {0x24, 0x0, 0x0, 0x1, [@NL80211_ATTR_POWER_RULE_MAX_EIRP={0x8}, @NL80211_ATTR_POWER_RULE_MAX_EIRP={0x8}, @NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN={0x8}, @NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN={0x8}]}, {0x14, 0x0, 0x0, 0x1, [@NL80211_ATTR_POWER_RULE_MAX_EIRP={0x8}, @NL80211_ATTR_FREQ_RANGE_START={0x8}]}, {0x44, 0x0, 0x0, 0x1, [@NL80211_ATTR_DFS_CAC_TIME={0x8}, @NL80211_ATTR_POWER_RULE_MAX_EIRP={0x8}, @NL80211_ATTR_FREQ_RANGE_END={0x8}, @NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN={0x8}, @NL80211_ATTR_DFS_CAC_TIME={0x8}, @NL80211_ATTR_FREQ_RANGE_MAX_BW={0x8}, @NL80211_ATTR_FREQ_RANGE_END={0x8}, @NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN={0x8}]}, {0x24, 0x0, 0x0, 0x1, [@NL80211_ATTR_POWER_RULE_MAX_EIRP={0x8, 0x6, 0x6}, @NL80211_ATTR_DFS_CAC_TIME={0x8}, @NL80211_ATTR_DFS_CAC_TIME={0x8}, @NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN={0x8}]}, {0x14, 0x0, 0x0, 0x1, [@NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN={0x8}, @NL80211_ATTR_FREQ_RANGE_END={0x8}]}]}, @NL80211_ATTR_DFS_REGION={0x5}, @NL80211_ATTR_REG_ALPHA2={0x6, 0x21, 'b\x00'}]}, 0x2c8}}, 0x0) r1 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) sendmmsg$sock(r1, &(0x7f0000002900)=[{{&(0x7f00000002c0)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @loopback}}}, 0x80, 0x0}}, {{&(0x7f0000000500)=@caif, 0x80, 0x0}}], 0x2, 0x0) 2.624546069s ago: executing program 1 (id=1418): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'bridge_slave_0\x00'}) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2c00000011000100000000000000000007000000", @ANYRES32, @ANYBLOB="00000002000000000c001a800800058004000780"], 0x2c}}, 0x0) r2 = socket$kcm(0x10, 0x100000000002, 0x4) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)) sendmsg$kcm(r2, &(0x7f00000039c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000200)="39000000140081ae00002c000500015601618575e285af0180000000", 0x1c}], 0x1, 0x0, 0x0, 0xc00e}, 0x0) r3 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r3, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/5, 0x1c000, 0x800}, 0x20) setsockopt$XDP_TX_RING(r3, 0x11b, 0x3, &(0x7f0000000100)=0x800, 0x4) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r4, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x0, 0x0}, &(0x7f0000000140)=0x10) r5 = socket$inet(0x2, 0x80001, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r5, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000000300)=0x8) setsockopt$inet_sctp6_SCTP_RTOINFO(r4, 0x84, 0x0, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, &(0x7f0000000140)=0x400, 0x4) epoll_create(0x3) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) r6 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r6, 0x84, 0x64, &(0x7f0000000080)=[@in={0x2, 0x0, @empty}], 0x10) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r6, 0x84, 0x6f, &(0x7f0000000040)={0x0, 0x1c, &(0x7f0000000000)=[@in6={0xa, 0x0, 0x0, @loopback={0x0, 0xac14140b}}]}, &(0x7f00000002c0)=0x10) sendto$inet6(r6, &(0x7f00000006c0)="f3272b2f42af4bf1a7326036d39d6db8db8c460d265b8157c1013b3232bb8c48759139e87d8535f02def00464804885b6eb7", 0x32, 0x0, &(0x7f0000000180)={0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x5}, 0x1c) r7 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$SOCK_DIAG_BY_FAMILY(r7, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000000c0)=ANY=[@ANYBLOB="580000001400010627bd7000000000040a84bfc6fc"], 0x58}}, 0x0) setsockopt$XDP_UMEM_FILL_RING(r3, 0x11b, 0x5, &(0x7f00000000c0)=0x100000, 0x2c) bind$xdp(r3, &(0x7f00000001c0), 0x10) socket$xdp(0x2c, 0x3, 0x0) 2.600266346s ago: executing program 0 (id=1420): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=0xffffffffffffffff, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000800)={{0x1, 0xffffffffffffffff}, &(0x7f0000000780), &(0x7f00000007c0)=r0}, 0x20) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'lo\x00', 0x0}) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xe, 0x4, 0xfffffffd, 0xd, 0x1100, r2, 0x2, '\x00', r4, 0xffffffffffffffff, 0x3, 0x1, 0x4}, 0x48) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000f80), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000040)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_NEW_STATION(r5, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000001040)={&(0x7f0000000300)={0x48, r6, 0xb97534d5fe9704cf, 0x0, 0x0, {{}, {@val={0x8, 0x3, r7}, @void}}, [@NL80211_ATTR_STA_SUPPORTED_RATES={0x4}, @NL80211_ATTR_STA_LISTEN_INTERVAL={0x6}, @NL80211_ATTR_PEER_AID={0x6, 0xb5, 0x185}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_STA_FLAGS2={0xc}]}, 0x48}}, 0x0) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) sendmsg$NBD_CMD_STATUS(r8, &(0x7f0000000640)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x10480}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)={0x2c, r9, 0x4, 0x70bd2b, 0x25dfdbfe, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0xe8}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x105}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000890}, 0xc000) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000740)=ANY=[@ANYRES64, @ANYRESOCT=r1, @ANYBLOB="0000000000000000b70800000008"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r10 = bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000004c0)={r10, 0xf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r11, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="640000000001010400000000141a000002000000240001801400018008000100e000000108000200e00000010c00028005000100000000002400028014000180080001000000000008000200ac1e00010c00028005000100000000000800074000000001"], 0x64}}, 0x0) r12 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000580)={0x0, 0x9, &(0x7f0000000140)=ANY=[@ANYBLOB="180000000000000000000000000000000000000000000000950000000000000018200000", @ANYRES32, @ANYBLOB="000000000000000018200000", @ANYRES32, @ANYBLOB="00000000000000009500000000001efd"], 0x0}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f0000000900)={0x0, 0xe42868ff8e4d9a55, &(0x7f0000000040)=@framed={{0x18, 0x0, 0x0, 0x0, 0x200}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff, r12}, 0x90) r13 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xb, 0xb9, 0x10001, 0x9, 0x1}, 0x48) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000080)={r13, &(0x7f0000000040), &(0x7f0000000440)=""/183}, 0x20) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000000)={r13, &(0x7f0000000180), &(0x7f0000000680)=""/141}, 0x20) socketpair$unix(0x1, 0x0, 0x0, &(0x7f00000000c0)) r14 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r14, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000380)={0x118, 0x28, 0x1, 0x0, 0x0, "", [@nested={0x107, 0x0, 0x0, 0x1, [@typed={0xe, 0x0, 0x0, 0x0, @str='\n\x00LETIMER\x00'}, @typed={0x14, 0x0, 0x0, 0x0, @ipv6=@dev}, @generic="50bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b504681000000000000009ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076eb43d9621dc08c029d1608a487f26fbe816b89f7cb81bff81a8b9482565856555ee923c65973deb0a99b962bc0fe94a3fcae3697bd7b85b3a682167c43dbf137115a40ebddcad74875ec58e9a3ddb9ad02a078cf0d972df9e99f079767734f69ce475f55ac64337803f5eb4e5842f4d98fe3fa370d47eb640dc5061dc35817c8a66c29be82fd3f8c"]}]}, 0x118}], 0x1}, 0x0) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000100)={r13, &(0x7f00000000c0)="0e", &(0x7f0000000280)=""/239}, 0x20) r15 = socket$nl_netfilter(0x10, 0x3, 0xc) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPCTNL_MSG_CT_NEW(r15, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=ANY=[@ANYBLOB="5400000000010108000000000000000002000000240001801400018008000100e000000108000200e00000010c00028005000100000000001c001880080001400000000008000240e8ffffff070003"], 0x54}, 0x1, 0x0, 0x0, 0x1}, 0x0) 2.382467666s ago: executing program 0 (id=1422): socket$kcm(0x10, 0x3, 0x10) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x0, 0x12, r0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001240)={0x8, 0x14, &(0x7f0000001600)=@raw=[@cb_func={0x18, 0xb, 0x4, 0x0, 0x5}, @call={0x85, 0x0, 0x0, 0x51}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x4}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x5b1efbf9}}, @initr0={0x18, 0x0, 0x0, 0x0, 0x11001, 0x0, 0x0, 0x0, 0x4}, @map_idx={0x18, 0x4, 0x5, 0x0, 0xe}, @map_val={0x18, 0xb, 0x2, 0x0, r0, 0x0, 0x0, 0x0, 0x101}], &(0x7f0000000200)='syzkaller\x00', 0xa, 0x100b, &(0x7f0000003140)=""/4107}, 0x90) 2.234305802s ago: executing program 0 (id=1424): r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0xf00, &(0x7f0000000080)={&(0x7f0000003bc0)={0x14, 0x16, 0x1, 0x0, 0x0, {0x0, 0x0, 0x2}}, 0x14}}, 0x0) 2.116310949s ago: executing program 0 (id=1427): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) r2 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@struct]}}, 0x0, 0x26}, 0x20) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000500)={0x6, 0xa, &(0x7f0000000cc0)=@framed={{}, [@func, @exit, @tail_call={{0x18, 0x2, 0x1, 0x0, 0xffffffffffffffff, 0x38}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, r2, 0x8, 0x0, 0x0, 0x10, &(0x7f00000004c0), 0x10}, 0x90) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000340), 0xffffffffffffffff) accept$alg(0xffffffffffffffff, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast1={0xff, 0x5}}, 0x1c) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r4, 0x8933, &(0x7f0000000380)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, &(0x7f0000000440)={0x0, 0xa00, &(0x7f0000000400)={&(0x7f00000003c0)={0x1c, r3, 0x701, 0x1000000, 0x25dfdbfe, {0x6}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r5}]}, 0x1c}}, 0x0) socket$tipc(0x1e, 0x0, 0x0) bind$tipc(0xffffffffffffffff, &(0x7f0000000100)=@name, 0x10) sendmsg$tipc(0xffffffffffffffff, 0x0, 0x0) sendmsg$NL80211_CMD_VENDOR(r0, &(0x7f0000006d00)={0x0, 0x0, &(0x7f0000006cc0)={&(0x7f0000000280)={0x30, 0x0, 0x1, 0x0, 0x0, {{}, {@void, @val={0x8}, @val={0xc}}}, [@NL80211_ATTR_VENDOR_ID={0x8}]}, 0x30}}, 0x0) 2.040911724s ago: executing program 4 (id=1428): r0 = socket(0x10, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f00000002c0)={'ip6_vti0\x00', &(0x7f0000000000)={'syztnl1\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xfe, 0x80, '\x00', 0x19}, @dev}}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPVS_CMD_NEW_DAEMON(0xffffffffffffffff, 0x0, 0x0) syz_emit_ethernet(0x0, 0x0, 0x0) socket(0x400000000010, 0x3, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="340000003e0007010000000000000000017c0000040000001c00018008000000", @ANYRES32=0x0, @ANYBLOB="08000ba530c427"], 0x34}}, 0x0) ioctl$FIBMAP(0xffffffffffffffff, 0x1, &(0x7f0000000080)) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000001ac0)={0x0, 0x0}, &(0x7f0000001b00)=0xc) r4 = getgid() r5 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0xc, &(0x7f0000000040)={0x8604}, 0x10) sendmsg$nl_route(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="a00000001a006d87000000000000000081"], 0xa0}}, 0x0) r6 = accept(0xffffffffffffffff, &(0x7f0000001b40), 0x0) setsockopt$inet_tcp_TLS_TX(r5, 0x6, 0x1, &(0x7f00000001c0)=@gcm_256={{0x304}, "cefda6ef485e567e", "44fde961db43b4dfb1888f25f2b7b3ae75831e8a4d79cd871377a69b1e61db0b", "8f429d95", "2b9fbbe5172d5f05"}, 0x38) r7 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0xffffffffffffffff, 0x8, 0x8}, 0xc) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000001c40), &(0x7f0000001c80)=0xc) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000001d80)=[{{0x0, 0x0, &(0x7f0000001240)=[{&(0x7f00000000c0)}, {&(0x7f0000000240)="0c44c667a4a9665400adc7f35fee128093f309ec12567219fb7dc5a36779d578d51501d44586a7e92ed8d768aa949e83d590c3a5cbe62a766559d956ba3b00fc5429ca78a4fbc6ac0414e7c60dcc925d9b03e056020b8b6667c93289e3720aeb18012c53400f83835993bc68fbe7c2e9c1dc1e00d3820c70c2df1ca2821a5ddbe8892d5454fc6a00c821ff0505b1a3b1f87f58a17f55dcc81b9f6cb6e06938dcfefd265129061cc9657c5d48a28b960730ac5bf3ab597ac5186528f1b6700f7a14b06762601e4d69ff67a1662e7948c9a5b15184a2666437f4bf6518cdd45928abd2b769d38402fbe017ea956a848bf43958a2295678cabf5dc49c7964b21d0a36bf2fba03b7ed96f9bd73a9f63fa006af750e0cf70f60fc6dbb63ca8a94bb59c7426e46dab9ad6a2015cdb7cda7ff31779068257aa4b567b15b235e79b70329bbe0d8d400023255ca79f77594013ad4507783f102a3a380e83491a20d923201d81813ca5398cc0a4aa1280130ee448ed9cfd0f41967a844ac9877b4a2c5d44567bd257799a6da3f0e1b1472803fcadf685ce46612641b02ed2dd57ae4d1e2ee17afe5d5a6fcfbe45709aed42d434b8a5eeb552ed3ec03ab4989b8af06b7ed3b028e32dd7e1559cb181a4234677a9150de20e7fcb128d9105cf5496d08e35ac936af5002bdc4d4326b9934b4ae32040ee64de730b4040fd225ffea2eab4a7af4d838821f7f8f5155520d36da4e506206305092846b2ef9016309fe14f3e2c91d47b2484715d46738a874fde2ecc248a96c242da1f22011fcc3b52be56d0bf2188e491cc385d5e087acf24972333e627e78631fc0cfa716c39d956c56d2f9d1461917df279b68f8a32daf27f1902013c5f5e2052620c6b1c78810448f7a066619a4dba3157bc050d71d830122484048a9d62a62f15dc41c4098e872cfae803c1f0933d58862d8102017d5f3e347762e7df1f706e8e0316263ae8a939247372f638c8b3e953d566f5c3e05f1b497c9a1ae17208e05608a861caa34bdc44fc4567ada0c743cf91c28a1315bfa4f1fab9553498f51d057998df0d2d84f141de60e020b0d9e1136d0ce744f82478dba4252aaa1342c2d78fa5569bb7affec4a5dcb76b698b3f2a2b997f869056f2c8d3bac6fce9937eaad7a0b5cf70d8ccbb646eaf37c248d0126f51cf113ae4b9569f8ff2b713073723b4f943e4c496cad245048993da81e2377bc3e0f80103e6396730080bb2723d737fb64655f9179b2854c7adb086328e0dfce30d2dc55c712377a37ddaa0d001db93128013341e17ad94b6a048aafff62f3901ae6b9905d07d1e8558d978c24d72c0558f955a87701767978079605c15a80ad3bad05d68cc4808bc608325d7f57fce69b1cf4b5b994796c0f096b3d9828ab3ac99538bfa73e041aa4bed7be7286a0141e16ce07d5de210199ac022e64f8cc537ee4fa81ac7d5869716ded603b71fe3a7b17fd08314e44a77d5438d411aa43d1c56d84feaf6767dcaeaa969e94651b7bc9f4edb2737810e705e21f1f9bf4ae82ad76f52cc23bfeba54d1416455410635c841f1fedcf7e0e3edd864f450f2028ca5e74b8323bafd865779ead02c8a5171bea2197e2532465f904833046f39ab9f340dd95d736574cdf5e6ff36051a00f0caf488083a341d2992c627c6d086f39ab9d5f47cb315b83cc9e367aa6fcf0a0a53b77c26e63000a22e6ea476b4bf4024a886a87c990722893e6de99b2be1203274c3bd4a6607cbe6a56ae4d673fb184cbeb8a0f6d802d4c215e533cd2ef6edc87a627daa8e56be403aadf1ac47d45fb13535ebc2ea1c554f7f8ba3091744292fb72c6f8e13f4b587cdfef82cf579c86d96b91defbcc918e6569575c7d97134c9ee70a241c3fe2bbd5788b60ada8d81441cfb4fe7029224a63a4e7270eff38d3c727f4e4541e0220cbd5fdee0768c11d4a917c3398c9739338e8f0c9021c8ec57f661614b706e18c8fd0e119dc3ce43e96927a789abb26ef2ce5fe16aee1db3b6fb2c1b662929ac5fc1710a8d372c0f1de2dea2d39da42d1d5504f79a390bd588d8051e612ad86600d5078b86cde78b481ad4c8bb897ca30022ea96c74decbba5890818222f1f549c6446d1127b0ab050055119855c9d8102c34f77e5f42d2c414df1f98170b14d3fc6a0953330228607ae34f2dbb25f3e14ced13a168473d9b8aa8ade63c46095ce571590656398f264dcbc02fc5293807c90005c7784f26063898b6fd783363527efc2d20def85acfe5e262f4a7fc818d07c2e4729917ba29f5beb0225c62393be533d7dd669bc460c206c01fbc299499479abc01a5274c68deca71ff588d13fb788c6631e3a659ab2c57a6011b2d74bc77293aca603de4a0ddd57da1a02bb9a73d5ed7e7c5e9d9f602df058dda127e4003003d660ce3d62d75ed4dc7fcb7e871bf5baf8478d3c987b6f2489421c275fbd79c0d7b8101f584aeb3352ededcfdc344956ee0500f88befb263658b88a3ed4982647dd72c7cfb7a448d5954b979c714c8eb16476be8c8e516426dac9729ee17222e4b04023a2cdabf2b5bd90bb3026d827248eed6c498823f5307776ae6ead43c40b1bc4784cb66289a0668031e7a25e674d6cf739c3e1e1c298247da58f84b0d228f0103dd4d2761dcd1bea03e09537e6eda8ffef12dd8d446aded421c731249f646941b92ecfe3890fa14f07820169371d7b6941ae15d460a96dcbfa0b7954cfe8e3d906f2f882268bb230fde95a250299e8733842367082d3fdcad2662d4c2475e6e6fecd912e07b359abdc434a1600ee34cece0120cef220d691604b215ab024b1a0f79948edcd16ff9b134f05ccb8b5e9a875308c27192bdfda05bc2ab932ac0dd23b4ae861ccec98eb53402aebb8df1b4033c9add59e761f7f8e7971d18bf8550534170a0eb35a39785fd29c41fadb518ec8e8346af88e6e456afb42558193996db916a218a57753697be824e1b0d532dc6f7d5d0b8421f620685203e745e59cbfd9fde8c0f15abf2f92797bfeca256c0248ae4fc5c54b7831edf52d725b8845f02d8a9d762b2aa724dd7eaca28da5caa2d0df7c8ba3b8d4da870f4b016efe95ba8f47e6be9b6e21912f4c8a6571f0c7ec23d6d8eaf51b33aeb28ae11d097522f02d6247e520b53060040e4b5123f1ec72bb6f9fa7ee177f8330758ae4d202935c0b26dffb30f18953a56bb3adc0e21867faa2b5a083de221d1fcfc63ef78316179d160e6194cadbfb93acf979912a61f7ac314dc7775ab6bb69a3533b191edc0f26613f8b136662c7680028cd71006128cecbce0c57477bfbfe4baa384f665c53844d86e7a0176d4b433e3fd7b461f3a8e66811d84f0e2feda840804b398e57faac1711a5d1296d9dcce99e9298ba6c4b4c585f4ce7dc2431be73fb9ee37a759fb5065a427b72ec336204cd5496da75a239b5ae82b692a145837ac260bd996a32ff8742063c1a4916b2296db25edbf5df8e6139a956bfdbc710b40d5c9e7210f5b0f65cf6a80105379f47b2d80ab2750202faef8c500f8952273532dab59d4395a17b4328b79f66871541deb1f24d6bd50a210b4094aebd736f1ec08386b4cb1f5ae324ec3c460f1ff669e4c8d8eff65e59d38691459285ae51b0f91def881150c53d5f557ad0f6930ea3c954195dedaa10472031bbf9f7d312895ae8f232b168c217a99b1346e28f4b040862ee291ec1940074a0138ff162f76de77273b2342ee3ded9deb4e7f9833dd33c492a54ce9bc449fca01be0a8fc073ebb2a8afdbf9062465712a7215484045ab5e66a35093e77e97142c0e9c8472ea45a4ee820383ec8ebce53fa0a0c2d3da86c7345e075c9a04c82d628223ab168c610b397eb9bcfdd77322b0415df7e308ca2c781fa8459a400bc12322042e32cbcca0e5040a2928ca0711ab6f72466d0c3e7c080804014751e06e6e18c79ed8660534db09807fb2cf0df96beb64feccfe97432744e90eef633ce29f76ff4c1aae786fe4e0bd013b091c8b74685f299acad021d1fcc0accb054e54d7cfa54370889889b66bcb9e8d0f0326123355d9d3ec6272bcb1a9aac0b87b83d693563f24f11430fe60430bbe7a272196aef8b950ff0e7889cd5b9e050319641297ba35326810e55680653e4fd03d510068eb800fc300c3c3afc268e5c2052ae5a132d52cfbe93055cc6888d8c0ed1216a2e251b856e7c0eb0dbc92e96dab41d5229f7b46dcdf3a5f19deb11e0c1e253ff95b0079b0758a96df426d8182cc429f738479df23c2b8631f79a39600e4327851e53b4e7fa0150e8d5f2ec483b3327ad684cb7d193349569eab33f9bb71432f12a932c16f412a229a677965c569a36469a7d6090cd3612b4854441d5432a763afca784196dbf81b0b30de31ea02e18c6cfd819ceef77c7aa5361ac47f38d9cdcd3717988e74b8ae8d281b409dc40c70fe0a8bcbbff49bdd09629f59f3063e47378556a5c33da1befdc529a8f7e33c7abf08ded55f90ec700be367f2dbf871112200ea1f6efe527a345a0743c2d35810a0e51ca8a5718fe7eec64e89605cb65f53ca26856d811712e7b982c8df0aee4b16b912c797cd0efc0f50abd0d60b969055bad2587aa172dfab029af5bdd71fe449881c7365621e3a72d94892e6f3f6b4b5bbc4be8a82285cb3b361212e15114015d6582593248f9812114bbc8169f3d31b9958a604e067a85dfb4537c2e9d4c653bebfbf227a7ba9db566450d8e71ae4c2608bdfd3394c80d48eef84281556c967ddfc430d37c1fd253559a939fbae51ffb36b8edb6bff847ea77d6ca4eea6f1956b107d9dc250c22e0cdaea4e962ff8d4fcd68963031ce0c717520296d5a6b44784a0041e3322817cff0133c48357a4dae8a3a8a58061e930b8ae6d402fcf41b7657173b7f8b5bd46d2e71646e8e58b6579b9090b172e409099860705e4334ab692ef179a9d7f7856f277fcf001a19c43d00911d60f57dc57ae56aeea3a1e2d4a8aed3b695ff7f245ea526b320fd887d0ca97e0732926cdfcdabf0b9711d997e68ae8c0a7bbd7f5c53c8c210f402cb422668eae0d530f9d55a4fab968c33f167296e035853e4081870e195155e728cd2253387034ad105bec48d7e71c1a878e693b3faea18c9d6bf97724f0695b8ea7aea22c7ce423454f5c54fadd5c6b7685d6ca3085c224c19e2fb1a139dde81eb99bc82c80bfc8e5ea29a872a054f1fa989fab05e35dc42f65340b34a6353d38567ebfc536e0164e2eb25a31ec35a60fc4a25c8592a022fb071f4b7c2ea51afd9c79cefdffe86fa643e6611385da5359e396f14579fda7f537a32ff2790e442c6bcf0d38b3553b5c7d3d7f9b6edf2c7b60a422a569a2c27f62bfbfa031a65c4c402e35a95c39bbda2b4d4c2e143e8b1f786dec723c51031014934b6420684d712d620d105541bfcdbfae47056c2cfd8c436d352e257b1c4f1fed0075d1c4fe5394d145ef5ad6f81dec842103d72875cc72553ec79dd352e7823435dabedb13cf3d4a2efaca31cae8511f5b9952057a9ba37e06c8bfa074bb5760a8107c47503f921e2e70356529cd1e9975e96322b2ae72775b874ffa3b72c0418df94b886fd6bcf82b8ad81ca9", 0xf7d}], 0x2, &(0x7f0000001280)=ANY=[@ANYRES64=r2, @ANYRES32, @ANYBLOB="0000000024000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="06f27d00"], 0x40, 0x10}}, {{&(0x7f0000001940)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000001a40)=[{&(0x7f00000019c0)="78997a937123be8ce1f32cc20047a4593f05b74d191e9495b8d3423d9514bdef9132765e29e64b854ce9bc6024b0dc1df918f6f6ce806a8d3334b9bd6e8af4531c6aaa3819cd2076d0e00021c1173be95350f5ea520e04aa43b9acaf8eaf70415857a05fb5e0b2dd4d49c788693f1766ec23ea970d05a20e43c642883e23f1", 0x7f}], 0x1, &(0x7f0000001380)=ANY=[@ANYBLOB="2000000000012d2185b02283330ec98c0900", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32=r7, @ANYBLOB="1c00000000000000", @ANYRES32=0x0, @ANYRES32=r3, @ANYRES32=r4, @ANYBLOB="0000000030000000000000000100000001000000", @ANYRES32, @ANYRES32=r6, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESHEX=r2, @ANYRES32=r7, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32, @ANYRES32=0x0, @ANYRES8=r2, @ANYBLOB], 0x90, 0x8001}}], 0x2, 0x10) getuid() getgid() epoll_create1(0x80000) r8 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCETHTOOL(r8, 0x8946, &(0x7f0000000280)={'batadv_slave_1\x00', &(0x7f00000012c0)=@ethtool_flash={0x33, 0x9, './file0\x00'}}) openat$tun(0xffffffffffffff9c, &(0x7f0000000f40), 0x404440, 0x0) accept$packet(0xffffffffffffffff, &(0x7f0000000f80)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000000fc0)=0x14) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x6, &(0x7f0000001e40)=ANY=[], &(0x7f00000000c0)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, 0x35, 0xffffffffffffffff, 0x6, 0x0, 0x0, 0x10, 0x0, 0x1d}, 0x90) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000040)=ANY=[], 0x33fe0}}, 0x0) socket$kcm(0x10, 0x0, 0x10) 2.023539334s ago: executing program 3 (id=1429): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) getsockname$packet(r1, &(0x7f00000001c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) bind$inet6(0xffffffffffffffff, 0x0, 0x0) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000180)=@framed, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r3}, 0x10) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(r4, 0x11b, 0x6, &(0x7f0000000040)=0x100000, 0x4) getsockopt$XDP_STATISTICS(0xffffffffffffffff, 0x11b, 0x8, 0x0, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x32, &(0x7f00000000c0)={&(0x7f0000000140)=@newlink={0x3c, 0x10, 0x503, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @vcan={{0x9}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r2}]}, 0x3c}}, 0x0) 1.948401073s ago: executing program 0 (id=1430): socket$packet(0x11, 0x0, 0x300) socket$packet(0x11, 0x3, 0x300) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x9}, 0x90) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f00005d3000/0x4000)=nil, 0x4000, 0x0, 0x12, r0, 0xd7a21000) mmap(&(0x7f00004a3000/0x1000)=nil, 0x1000, 0x0, 0x13, r0, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x12, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x2000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000280)={0x0, 0x5, 0x0, 0x0}, 0x90) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000002f80)={0x0, 0x0, &(0x7f0000002f40)={&(0x7f0000000040)=@newtaction={0x70, 0x30, 0x9, 0x0, 0x0, {}, [{0x5c, 0x1, [@m_skbedit={0x58, 0x1, 0x0, 0x0, {{0xc}, {0x2c, 0x2, 0x0, 0x1, [@TCA_SKBEDIT_MARK={0xfffffffffffffe56}, @TCA_SKBEDIT_PARMS={0x18}, @TCA_SKBEDIT_PRIORITY={0x8}]}, {0x4}, {0xc}, {0xffffffffffffffc7, 0x9}}}]}]}, 0x70}}, 0x0) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000540)={0x11, 0x3, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000418d0000000000000000000095"], &(0x7f00000000c0)='GPL\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r2}, 0x10) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180100001c0000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f00000000c0)='sys_enter\x00', r5}, 0x10) write(r4, &(0x7f0000000000)="fc0000001d000724ab09254ec100070007ab08001b000000f0ffff002100057e0000000000000e000039000000039815fad151ba0101099cecb94b46fe0000000a00020025", 0xffffff0c) r6 = socket$inet_udp(0x2, 0x2, 0x0) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r7, 0x0, r4, 0x0, 0xffffffffffff8000, 0x0) close(r8) close(r6) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)) splice(r3, 0x0, r6, 0x0, 0x1100000000f336, 0x0) close(0xffffffffffffffff) bpf$BPF_MAP_GET_FD_BY_ID(0xe, 0x0, 0x0) r9 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_SET(r9, &(0x7f0000000f40)={0x0, 0xfffffff0, &(0x7f0000000f00)={&(0x7f0000000e80)={0x24, 0x1402, 0x1, 0x0, 0x5, "", [@RDMA_NLDEV_ATTR_DEV_NAME={0x9, 0x2, 'syz1\x00'}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}]}, 0x24}}, 0x0) 1.812538324s ago: executing program 4 (id=1431): openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='cgroup.controllers\x00', 0x275a, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0xac) socket(0x11, 0x3, 0x0) socket$packet(0x11, 0x2, 0x300) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000040), 0x4) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x19) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYRES32], 0x0}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r0 = bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0x16, 0x4, &(0x7f0000000080)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0x6a, 0xa, 0xff00}, [@call={0xc}, @exit, @map_fd, @jmp]}, &(0x7f0000000140)='GPL\x00', 0x2, 0xffa0, &(0x7f0000000180)=""/149, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x1e, 0x10, 0x0, 0x1e}, 0x2d) bpf$BPF_PROG_DETACH(0x8, &(0x7f00000002c0)={@ifindex, r0, 0x11, 0x2, 0x0, @prog_id}, 0x20) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={0xffffffffffffffff, 0xf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x3}, 0x50) syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x4) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000080)={0x12, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="11000000000000000000d932dcaf78e5bcfb"], &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xe, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffeb9}, 0x90) socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'lo\x00'}) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL802154_CMD_NEW_INTERFACE(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="01000000000000000000070000000c0017000000000000000000080005000000000008000100000000000a0004"], 0x3c}}, 0x0) r4 = socket$inet6_sctp(0xa, 0x0, 0x84) setsockopt$inet_sctp6_SCTP_EVENTS(r4, 0x84, 0xb, &(0x7f0000000340)={0x0, 0x2}, 0xe) bpf$ENABLE_STATS(0x20, &(0x7f0000000080), 0x4) shutdown(r4, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000006000)=[@in={0x2, 0x0, @local}]}, &(0x7f0000005ec0)=0x10) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) r5 = syz_open_procfs$namespace(0x0, &(0x7f0000000000)) close(r5) 1.68247556s ago: executing program 3 (id=1432): socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), 0xffffffffffffffff) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='memory.events\x00', 0x26e1, 0x0) ioctl$TUNSETOFFLOAD(r1, 0x40086607, 0x20001419) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(0xffffffffffffffff, 0x84, 0x72, &(0x7f0000000a00)={0x0, 0x81, 0x10}, &(0x7f0000000c00)=0xc) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r1, 0x84, 0x6, &(0x7f0000000c40)={r2, @in6={{0xa, 0x4e21, 0x5, @loopback, 0x4}}}, &(0x7f0000000d00)=0x84) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000680), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000140)={0x44, r4, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @private=0xa010100}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @multicast2}]}, 0x44}}, 0x0) sendmsg$L2TP_CMD_SESSION_GET(r3, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x0, 0x200, 0x70bd2d, 0x25dfdbff, {}, [@L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x4}]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x0) r5 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f00000028c0)={'wlan0\x00'}) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_TID_CONFIG(r6, &(0x7f0000002b00)={0x0, 0x0, &(0x7f0000002ac0)={&(0x7f0000002900)={0xff45, r0, 0x135, 0x0, 0x0, {{}, {@void, @void}}, [@NL80211_ATTR_TID_CONFIG={0x18, 0x11d, 0x0, 0x1, [{0x14}]}]}, 0x2c}}, 0x800) socket$nl_route(0x10, 0x3, 0x0) 1.555811828s ago: executing program 2 (id=1433): socket$inet_udplite(0x2, 0x2, 0x88) socket(0x0, 0x0, 0x100) setsockopt$WPAN_SECURITY_LEVEL(0xffffffffffffffff, 0x0, 0x2, 0x0, 0x0) connect$inet(0xffffffffffffffff, 0x0, 0x0) sendmmsg$inet(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e20}, 0x1c) listen(r1, 0x80080400) socket$kcm(0x21, 0x0, 0xa) r2 = socket$inet_dccp(0x2, 0x6, 0x0) connect$inet(r2, &(0x7f0000000100)={0x2, 0x4e20, @local}, 0x10) getsockopt$inet_int(r2, 0x10d, 0xd2, &(0x7f0000000180), &(0x7f0000000080)=0x4) socket$inet(0x2, 0x3, 0x2) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000100)="4c000000140097f87059ae08060c040002ff0f0200000000000001870182fa73a69d35a2cca84708f7abca1b4e7d06a6bd7c493872f750375ed08a560400000003c48f93b82a03000000461e", 0x4c}], 0x1}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x7, 0x4, 0x8, 0x1, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0xfffffffb}, 0x48) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000380)=ANY=[@ANYBLOB="4400000010000507000000000000000000000006", @ANYRES32=0x0, @ANYBLOB="0000000000001a00240012800b00010062726964676500001400028005002b0003000000080004"], 0x44}}, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r3, 0x8933, &(0x7f0000000180)={'wpan0\x00', 0x0}) r5 = syz_genetlink_get_family_id$nl802154(&(0x7f00000000c0), r3) sendmsg$NL802154_CMD_NEW_SEC_KEY(r3, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000040)={&(0x7f00000001c0)={0x82, r5, 0x8, 0x70bd28, 0x25dfdbfd, {}, [@NL802154_ATTR_SEC_KEY={0x28, 0x30, 0x0, 0x1, [@NL802154_KEY_ATTR_USAGE_CMDS={0x24, 0x3, "ad86a9f1cc93c1076d43c48b37a4fbdb161b8f9999f9a5609293993efe4edc28"}]}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}, @NL802154_ATTR_IFINDEX={0x5, 0x3, r4}]}, 0x5c}, 0x1, 0x0, 0x0, 0x60008840}, 0x4005) 1.523657991s ago: executing program 1 (id=1434): socket$kcm(0x10, 0x3, 0x10) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x0, 0x12, r0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001240)={0x8, 0x14, &(0x7f0000001600)=@raw=[@cb_func={0x18, 0xb, 0x4, 0x0, 0x5}, @call={0x85, 0x0, 0x0, 0x51}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x4}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x5b1efbf9}}, @initr0={0x18, 0x0, 0x0, 0x0, 0x11001, 0x0, 0x0, 0x0, 0x4}, @map_idx={0x18, 0x4, 0x5, 0x0, 0xe}, @map_val={0x18, 0xb, 0x2, 0x0, r0, 0x0, 0x0, 0x0, 0x101}], &(0x7f0000000200)='syzkaller\x00', 0xa, 0x100b, &(0x7f0000003140)=""/4107}, 0x90) 1.452286977s ago: executing program 3 (id=1435): socket(0x10, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$TIPC_NL_UDP_GET_REMOTEIP(r1, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="48000000100005070000", @ANYRES32=r2, @ANYBLOB="00000000000000002800120009000100766574"], 0x48}}, 0x0) recvmsg(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000380)=""/156, 0x9c}], 0x1}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=@newqdisc={0x44, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_USC={0x10}}}]}, 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000009240)={&(0x7f0000000880)=@newtfilter={0xce8, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0x3}, {}, {0xf}}, [@filter_kind_options=@f_cgroup={{0xb}, {0xcb8, 0x2, [@TCA_CGROUP_POLICE={0xcb4, 0x2, [@TCA_POLICE_RESULT={0x8, 0x5, 0x400}, @TCA_POLICE_PEAKRATE64={0xc, 0x9, 0x6}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x4, 0x3, 0x8000, 0x7b97, 0x1, 0x8, 0x5, 0x10001, 0x5, 0x8, 0x7, 0x8d3b, 0x9, 0x3, 0x2, 0x9, 0x6, 0x4, 0x5, 0x0, 0x7ff, 0x80000000, 0x0, 0xfffffffe, 0xfffff800, 0x1, 0xff, 0x5, 0x8fdb937, 0xd, 0xb1, 0x8, 0xffffffff, 0x4, 0xc, 0x7, 0x3, 0x29, 0x4, 0xffff, 0x4, 0x240bcac7, 0x9, 0x7, 0xffffff80, 0x71a, 0xc0fa, 0x5, 0x3, 0xff, 0x2, 0xfffffffb, 0x8, 0x1, 0x7, 0x5, 0x2, 0x5, 0x5, 0x9, 0xab, 0x2, 0x3, 0x3, 0x5, 0x4326, 0x8, 0x3, 0x4d10c7eb, 0xb, 0x80000000, 0x9, 0xb0000000, 0x0, 0x3, 0x0, 0x5, 0x1, 0x3, 0x2, 0xffff, 0x2, 0x7a4, 0x1, 0x1, 0x6, 0x7, 0x2, 0x9, 0x3, 0x8, 0x66, 0x1ff, 0x1, 0x5, 0x400, 0x101, 0xfffffc00, 0x0, 0x1, 0x9, 0x3, 0xba5, 0xfffffff8, 0x80000001, 0x400, 0xe, 0x2, 0x5, 0x1, 0x7, 0x1, 0x6480, 0x10, 0x8000, 0x2b04, 0xa4, 0x8, 0xc02, 0x28000000, 0x6, 0x81, 0x101, 0x60, 0x3, 0x0, 0x3, 0xfffffffc, 0x3, 0x3, 0x6, 0x0, 0x7, 0x7, 0x7, 0x2, 0x5, 0x200, 0x6, 0xfffffffb, 0x1, 0x1, 0xfffffff7, 0x4, 0x90, 0x7f, 0x4, 0x4, 0x4, 0x20000, 0x4, 0x37d9, 0x1, 0x7, 0x4, 0x1, 0x9, 0x1, 0x80, 0x3, 0x80000000, 0x3e4, 0xff, 0x2, 0x3, 0x81, 0xffff, 0x70, 0xd, 0x4, 0x8fc, 0x5, 0x1, 0x401, 0x8e, 0x3, 0x0, 0x0, 0x5, 0x7, 0x2, 0x7, 0x287, 0x8001, 0xffffffff, 0x4, 0x6, 0x1, 0xfff, 0x57859845, 0x659, 0x7f, 0xfffffffb, 0x5, 0xfffffff8, 0x3, 0x8, 0x2, 0x80000000, 0x4, 0x800, 0x8, 0x7, 0x7, 0xa, 0x7fffffff, 0x8, 0x3e, 0xe, 0x2, 0x6, 0x1, 0xffff, 0xa, 0xfffffffe, 0x5, 0x5b3, 0xfffff000, 0x2, 0xffffffff, 0x452, 0x8, 0x3, 0x8, 0x8, 0xd04, 0x9, 0xd2d, 0x800, 0x2, 0x2, 0x3, 0x4, 0x9, 0xb97, 0x8001, 0x2, 0x2, 0x97, 0x9, 0x80000000, 0x8001, 0x9, 0x1, 0x6, 0x8, 0xfffffffc, 0xc35, 0x2be634b3, 0x7, 0x9, 0x200, 0xbe, 0xffffff7f, 0x6, 0x7]}, @TCA_POLICE_TBF={0x3c, 0x1, {0x9, 0x20000000, 0x0, 0xfffffff8, 0x1ff, {0x2, 0x1, 0x0, 0x2, 0x1000}, {0x7, 0x1, 0x5361, 0x80, 0x0, 0x80}, 0x1, 0xffff}}, @TCA_POLICE_RATE64={0xc, 0x8, 0xa}, @TCA_POLICE_TBF={0x3c, 0x1, {0x3, 0x3, 0x2, 0x100, 0x5, {0x4, 0x2, 0x3, 0x9, 0xc7, 0x3ff}, {0x2, 0x1, 0x8, 0x8, 0x6, 0x7a28}, 0x9, 0x8001, 0x6}}, @TCA_POLICE_RATE64={0xc, 0x8, 0x8}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0xc, 0x0, 0x6, 0x86, 0x5, 0x8, 0x3, 0x6, 0x0, 0x8000, 0xec2d, 0xa, 0x80, 0x1, 0x3, 0x553, 0x4, 0x7, 0x2, 0xe6, 0x1000, 0xf2a92430, 0x8, 0x0, 0x0, 0x5, 0x6451, 0x887, 0x1, 0x5, 0xfffffff8, 0xcf, 0xb, 0x7, 0xfffffee9, 0xd, 0xc2, 0xffffff01, 0x7, 0xa0, 0xdb, 0x2, 0x3, 0x1, 0x8, 0x9, 0x8, 0x8, 0x4, 0x2, 0x3c63, 0x4, 0x522a8945, 0x7, 0xe, 0x1, 0x0, 0x2, 0xffffffff, 0x1, 0x2, 0x2, 0x8, 0x9, 0x10, 0x7, 0x4, 0x0, 0x400, 0x768d, 0x200, 0x125, 0xca, 0xfffffff8, 0x100, 0x7fffffff, 0x7f, 0x9, 0x1, 0x1, 0x1, 0x7ff, 0x63, 0xb48, 0xffffff00, 0x5, 0x9, 0x7, 0x8, 0x9, 0x401, 0x41, 0x3ff, 0xbedc, 0xd1, 0xfffffc01, 0x5, 0x7, 0x3ff, 0x3, 0x7, 0x1, 0x6, 0x1, 0x502, 0x6, 0x8, 0x1ff, 0xfffffffa, 0x2, 0xfffffffc, 0x169d, 0x6, 0x2, 0x4, 0x2, 0x6, 0x7106, 0x8000, 0x278000, 0x4, 0x3, 0xb, 0x6bb, 0x0, 0x8, 0x7fff, 0xffffc5a6, 0x1c75ad3f, 0x0, 0x1000, 0x401, 0x2, 0x6, 0x9, 0xfffffff8, 0x7f, 0x0, 0x1000, 0x9, 0xfff, 0x40, 0x8, 0xfffffff0, 0x800, 0x111b3f5b, 0x8000, 0x6, 0x100, 0x5, 0x9, 0x6, 0x7, 0x2, 0x0, 0x4bc, 0x5, 0x6, 0x10, 0xe, 0x9, 0x8000, 0x81, 0xb6, 0x0, 0x7774, 0xe85, 0x6, 0x8, 0x4, 0x80000001, 0x9, 0x12f535da, 0x3, 0x7, 0x3, 0xfffff989, 0xeaf, 0x3, 0x3, 0x7, 0x2, 0x81, 0x9, 0xffffffff, 0x9, 0x4, 0x4, 0xfffffffa, 0x5, 0x2, 0x51c, 0xffff2d51, 0xd4a9, 0x5, 0xff, 0x0, 0xe43, 0x0, 0x10000000, 0x9, 0x1000, 0x6, 0x9, 0xc, 0x2, 0x3, 0x5, 0x4, 0x9, 0x6, 0x0, 0x80, 0x0, 0x6, 0x9, 0x9, 0x56f, 0x8000, 0x3, 0x8, 0x811708c, 0x8, 0xfffffff7, 0xfffffffb, 0x7fff, 0x9, 0x5, 0x9, 0x2, 0x7, 0xca85, 0x4, 0x5, 0xb43e, 0xf00000, 0x1, 0x1, 0x4, 0x40, 0xb0000, 0x9, 0x3, 0x4, 0x3, 0x51, 0x3, 0xf7, 0x4, 0x3, 0x5, 0xffffffff, 0x6, 0x3, 0x5, 0x9]}, @TCA_POLICE_RATE={0x404, 0x2, [0x5, 0x1, 0xfffffff7, 0x9, 0x8, 0xfffffc01, 0x8, 0x0, 0x9, 0x9, 0x5, 0x2, 0x400, 0x5, 0x3, 0xffffff27, 0x0, 0xffffd833, 0xf8, 0x9, 0x80, 0x3, 0xb, 0xffff, 0x2, 0x5, 0x800, 0xffff, 0x7fff, 0x7, 0xb, 0x1, 0xffff281b, 0x5fa5dcff, 0x3, 0x0, 0xfffffffa, 0x92d, 0x3, 0x39, 0x0, 0x10001, 0x400, 0x200, 0x6, 0x2cbe, 0x9, 0x9, 0x0, 0x5, 0x10000, 0x7ff, 0x10000, 0x40, 0x2, 0x7, 0xc0000000, 0x8001, 0xd259, 0x0, 0xffffffd0, 0x1, 0x7fffffff, 0x88, 0x660, 0x0, 0x835, 0x69, 0x5, 0x40, 0xf, 0x1, 0x1, 0xe88, 0x6, 0x30, 0x40, 0x400, 0x7fff, 0x7fffffff, 0x6, 0xfffffc01, 0x3, 0x2f, 0xc20, 0xf, 0x3, 0x3, 0x5, 0x7, 0x7, 0x4, 0x0, 0x8000, 0xf606, 0xaa4, 0xb, 0xc3, 0x7466, 0x6, 0xac5, 0xfff, 0x7, 0x8, 0x2, 0x8, 0x9, 0x9, 0x0, 0x6de28f0b, 0xee, 0x0, 0x0, 0xb, 0x80, 0x0, 0x5, 0xba6ea26, 0x6, 0x0, 0x4, 0x8, 0x7ff, 0x0, 0x2, 0x8001, 0x3, 0x0, 0xfff, 0x7, 0x200, 0x1, 0xa, 0x7, 0x80000001, 0x4, 0x585, 0x3, 0x2, 0x401, 0x4, 0x81, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x6, 0x9, 0xfffffffa, 0x3, 0x59d7, 0x7, 0x8, 0x6, 0x1eb, 0x8, 0x2, 0x0, 0x0, 0x8, 0x2, 0x9, 0x8001, 0x7ff, 0x6, 0x4, 0x9, 0x6, 0x4, 0x3, 0xa, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x67, 0x100, 0x0, 0x7, 0x2, 0xb8, 0x0, 0x0, 0x0, 0x0, 0x7, 0xe72, 0x200, 0xb, 0xd, 0x5, 0x0, 0xffffffff, 0x1, 0x0, 0x7, 0x8, 0x6, 0xc14, 0x1, 0x490, 0x0, 0x6, 0x9f4, 0x7, 0x0, 0x0, 0x0, 0x2cd, 0x9, 0xfffffffc, 0x1, 0x8, 0x3, 0x1, 0x9, 0x8, 0x2, 0x5, 0x3, 0x3, 0x0, 0x3, 0x4, 0x10001, 0x401, 0x6, 0xfff, 0x8, 0x16, 0x7cb1, 0x80000000, 0x4, 0xff, 0x3, 0x5, 0x4, 0x95, 0x80000001, 0x0, 0x4, 0x3ff, 0x92, 0xa8f, 0x1, 0x7, 0x5, 0x5, 0x4]}]}]}}]}, 0xce8}, 0x1, 0x0, 0x0, 0x24048861}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r3, &(0x7f00000002c0), 0x40000000000009f, 0x0) 1.370950339s ago: executing program 4 (id=1436): socket$inet6_tcp(0xa, 0x1, 0x0) socket$packet(0x11, 0x3, 0x300) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000100)=0x9, 0x4) socket(0x10, 0x3, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x100002, 0x0) write$cgroup_freezer_state(0xffffffffffffffff, 0x0, 0x0) bpf$MAP_UPDATE_CONST_STR(0x2, 0x0, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x7ffc, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x4}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0x14, &(0x7f0000000340)=ANY=[@ANYBLOB, @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000d6c300850000008200000018010000696c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb706000008000000b70300000000e4ff85000000710000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="240000001800010000000000000000001d01000008000900", @ANYRES32=r4, @ANYBLOB="b69c132410ff09fcba94202529ebce05662d6ab99494dce5ea89c9db555068acefc9871251eb76fedb0e1dd9ae6fa956992349dc72b615ac96f8e911d925cf54df2057bf6db3e53c046fad1c193663eb995911dc5600f7ed569c5be929ea94708bbe27bf0a2f4eb3eb2802026a78f8eab0db", @ANYRES32=r4, @ANYBLOB], 0x24}}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000280)={0x0, 0x5, 0x0, 0x0}, 0x90) bpf$BPF_MAP_GET_FD_BY_ID(0xe, 0x0, 0x0) r5 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@bloom_filter={0x1e, 0x0, 0x6, 0x0, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, r5, 0x2, 0x0, 0x0, 0x9}, 0x48) socket(0x2, 0x2, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$ipvs(0x0, 0xffffffffffffffff) socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_SET(0xffffffffffffffff, 0x0, 0x0) socket$packet(0x11, 0x0, 0x300) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000180)={0x0, {0x2, 0x4e24, @multicast2}, {0x2, 0x4e24, @loopback}, {0x2, 0x0, @multicast2}, 0x0, 0x0, 0x0, 0x0, 0x3ff, &(0x7f0000000000)='geneve1\x00', 0x7f}) 1.317428283s ago: executing program 1 (id=1437): listen(0xffffffffffffffff, 0x0) r0 = socket$inet(0xa, 0x801, 0x84) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r2 = openat$cgroup_int(r1, &(0x7f0000000100)='cpuset.cpus\x00', 0x2, 0x0) write$cgroup_subtree(r2, &(0x7f0000000240)=ANY=[@ANYBLOB='1-', @ANYRESOCT, @ANYBLOB='E'], 0x31) r3 = socket$isdn_base(0x22, 0x3, 0x0) accept(r3, 0x0, 0x0) listen(r0, 0x8) socket$inet(0xa, 0x801, 0x0) sendmmsg$inet(0xffffffffffffffff, 0x0, 0x0, 0x0) socket$inet(0xa, 0x801, 0x84) listen(0xffffffffffffffff, 0x0) listen(0xffffffffffffffff, 0x8) syz_genetlink_get_family_id$ethtool(&(0x7f0000000740), 0xffffffffffffffff) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000800)) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, 0x0, 0x0}, 0x90) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000700)={[{0x2b, 'pids'}, {0x2d, 'blkio'}, {0x2b, 'cpu'}, {0x2b, 'pids'}, {0x71, 'cpuacct'}, {0x2d, 'rlimit'}, {0x2b, 'net_cls'}]}, 0x32) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) writev(0xffffffffffffffff, 0x0, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r4, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x690, 0x300, 0xd0, 0x448, 0x0, 0xd0, 0x5c0, 0x5c0, 0x5c0, 0x5c0, 0x5c0, 0x6, 0x0, {[{{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE2={0x28, 'NFQUEUE\x00', 0x2, {0x0, 0x5}}}, {{@ipv6={@mcast1, @local, [], [], 'macvtap0\x00', 'ip6tnl0\x00', {}, {}, 0x6}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x0, 0x0, @ipv4=@broadcast}}}, {{@ipv6={@mcast2, @loopback, [], [], 'veth0_to_team\x00', 'syzkaller0\x00'}, 0x0, 0x100, 0x148, 0x0, {}, [@common=@unspec=@connmark={{0x30}}, @common=@inet=@socket1={{0x28}}]}, @SNPT={0x48, 'SNPT\x00', 0x0, {@ipv6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @ipv4=@private}}}, {{@uncond, 0x0, 0x120, 0x148, 0x0, {}, [@common=@frag={{0x30}}, @common=@hbh={{0x48}}]}, @inet=@DSCP={0x28}}, {{@uncond, 0x0, 0x138, 0x178, 0x0, {}, [@common=@dst={{0x48}}, @common=@dst={{0x48}}]}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x0, 0x0, @ipv4=@dev}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x6f0) syz_80211_join_ibss(0x0, 0x0, 0x0, 0x1) r5 = socket$netlink(0x10, 0x3, 0x4) syz_genetlink_get_family_id$devlink(&(0x7f0000000080), r5) 1.286121239s ago: executing program 2 (id=1438): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) socket$nl_route(0x10, 0x3, 0x0) syz_80211_join_ibss(&(0x7f00000002c0)='wlan1\x00', 0x0, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) openat$cgroup_pressure(0xffffffffffffffff, &(0x7f0000000000)='io.pressure\x00', 0x2, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r2, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_CONNECT(r1, &(0x7f00000001c0)={0x0, 0xf0ff, &(0x7f0000000200)={&(0x7f0000000240)={0x28, r2, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}]}, 0x28}}, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x1c, 0x0, 0x0, 0x0, 0x0, {{}, {@val={0x8}, @void}}}, 0x1c}}, 0x0) 1.212672724s ago: executing program 3 (id=1439): r0 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e21, @empty}, 0x10) connect$inet(r0, &(0x7f0000000140)={0x2, 0x4e21, @empty}, 0x10) sendto(r0, &(0x7f0000000380)='%', 0x1, 0x0, 0x0, 0x0) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f00000003c0)=',', 0x1}], 0x1, &(0x7f0000000a00)=ANY=[], 0x520}, 0x0) r1 = socket$kcm(0x10, 0x3, 0x4) sendmsg$kcm(r1, &(0x7f0000000000)={0x0, 0x6000, &(0x7f0000000080)=[{&(0x7f0000000280)="89f0ff00120081ae08060cdc030000007f03e3f7000000006ee29bca1b1f0000000004c00e72f750375ed08a563b1dbf48d79268c48c0000000000a5880c406a90033a0093b837dc6cc01e32efaec8c7a6ec00120c0001400b080c00bdad01409bbc7a46e3988285dcdf12f21308f868fece01955fed0009d78f0a947ee2b49e33538afa8af9234751", 0x89}], 0x1}, 0x0) 1.172699386s ago: executing program 4 (id=1440): syz_emit_ethernet(0x2a, &(0x7f0000000080)={@local, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2f, 0x0, @remote, @dev}, @address_request}}}}, 0x0) r0 = socket$unix(0x1, 0x5, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) r4 = socket$nl_generic(0x10, 0x3, 0x10) socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x3, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$ipvs(&(0x7f00000001c0), r5) sendmsg$IPVS_CMD_DEL_DAEMON(r6, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000400)={0xfc, r7, 0x8, 0x70bd29, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x7}, @IPVS_CMD_ATTR_DEST={0xc, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_TYPE={0x5, 0xd, 0x1}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x9}, @IPVS_CMD_ATTR_DEST={0x48, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_ADDR_FAMILY={0x6}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x3e50}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x7fffffff}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e22}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x3ff}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@dev={0xfe, 0x80, '\x00', 0xc}}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xffffffff}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x8}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xb01}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x6}, @IPVS_CMD_ATTR_DEST={0xfcc8, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0x6}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x1}]}, @IPVS_CMD_ATTR_SERVICE={0x58}]}, 0xfc}, 0x1, 0x0, 0x0, 0x80}, 0x4a0e0) write(r5, &(0x7f0000000200)="fc0000001a000700ab0925000900070081ab0700a90100001d4d369321000100ff0300000005d0000000000000039815fa2c1ec28656aaa79bb94b46fe000000bc0003000500000014000027000089fee1434f1e596534d07302ade0bbc91a3e3280772c05defd5a32e20000000082f605f70c9ddef2fe082038f4f8b29d3ef3d92c83170e5bba4a46d284a710af333ae4f5566f91cf190201800015b2ccd243f295ed94e0ad91bd0734babc7c3f2eeb00d43dd16b17e583df150c3b880f411f46a6b567b4d5715587e658a1ad0a4f01731d05b0350b0041f0d48a99c03f080548deac270e33429fd3000175e63fb8d37a3843d970f84d6b18613c8a", 0xfc) r8 = socket$can_raw(0x1d, 0x3, 0x1) r9 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000900)={&(0x7f00000007c0)=ANY=[@ANYBLOB="9feb01001800000000000000240000002400000015000000050000000000000803000000020000000000000801000000000000000000000d0000000000006100005f00"], 0x0, 0x43}, 0x20) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000000)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, r9, 0x2, 0x3}, 0x48) setsockopt$CAN_RAW_FD_FRAMES(r8, 0x65, 0x7, 0x0, 0x2) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) syz_genetlink_get_family_id$l2tp(0x0, 0xffffffffffffffff) socket$packet(0x11, 0x0, 0x300) r10 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000900)=[{&(0x7f0000000280)="89000000120081ae08060cdc030000017f03e3f7000000006ee2ffca1b1f00ff0f00000000000050375ed08a56331dbf9ed78105001ad6e747033a0093b837dc6cc01e32efaec8c7a6ec00120c00010004080c00bdad01409bbc7a46e39a54cbbda812176679df069163ce955fed0009d78f0a947ee2b49e33538afaeb2713f450ebd010a20ff27fff", 0x89}], 0x1, 0x0, 0x0, 0x7}, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff}) connect$can_bcm(r11, &(0x7f0000000140), 0x10) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000540)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_KEY(r4, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000000)={0x4c, r3, 0x801, 0x0, 0x0, {{}, {@val={0x8, 0x3, r12}, @void}}, [@NL80211_ATTR_KEY={0x30, 0x50, 0x0, 0x1, [@NL80211_KEY_DATA_WEP104={0x11, 0x1, "4abee339084eeef16f162471f4"}, @NL80211_KEY_MODE={0x5, 0x9, 0x1}, @NL80211_KEY_IDX={0x5}, @NL80211_KEY_CIPHER={0x8, 0x3, 0xfac05}]}]}, 0x4c}}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000a00)={&(0x7f0000000640)={0x2c, r2, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r13}, @void}}, [@NL80211_ATTR_TX_RATES={0x10, 0x5a, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xc, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HT={0x4}, @NL80211_TXRATE_LEGACY={0x4}]}]}]}, 0x2c}}, 0x0) syz_emit_ethernet(0x32, &(0x7f0000000300)={@link_local, @link_local, @void, {@ipv4={0x800, @udp={{0x6, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x11, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @dev, {[@generic={0x7, 0x3, "02"}]}}, {0x0, 0x0, 0xc, 0x0, @gue={{0x1, 0x0, 0x0, 0x0, 0x0, @void}}}}}}}, 0x0) r14 = socket$inet6_udplite(0xa, 0x2, 0x88) getsockopt$inet6_int(r14, 0x29, 0x1, 0x0, &(0x7f00000015c0)) 1.068439424s ago: executing program 1 (id=1441): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xb, 0x7, 0x8, 0x8, 0x5}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000040)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001000000850000007d00000095"], &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000280)='rpcgss_svc_seqno_bad\x00', r1}, 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000240)={{r0}, &(0x7f0000000000)=0x2, &(0x7f0000000200)}, 0x20) r2 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r1, 0x84009422, &(0x7f0000000380)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}}) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) r5 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000b80)={0x0, 0x0, &(0x7f0000000b40)={&(0x7f00000008c0)=@setlink={0x30, 0x13, 0x709, 0x0, 0x0, {}, [@IFLA_NET_NS_PID={0x8}, @IFLA_TARGET_NETNSID={0x8}]}, 0x30}}, 0x0) r6 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_TCP_ULP(r6, 0x6, 0x1f, &(0x7f0000000080), 0x4) r7 = socket$inet6_udp(0xa, 0x2, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)=@newlink={0x40, 0x10, 0x403, 0x300, 0x0, {}, [@IFLA_ALT_IFNAME={0x14, 0x35, 'bond0\x00'}, @IFLA_ADDRESS={0xa, 0x1, @random="ef05b9b215d0"}]}, 0x40}}, 0x0) r9 = socket$inet_smc(0x2b, 0x1, 0x0) ioctl$int_in(r9, 0x5421, &(0x7f0000000100)=0x100000001) setsockopt$inet_tcp_int(r9, 0x6, 0x1e, &(0x7f0000000180)=0x1, 0x4) connect$inet(r9, &(0x7f0000000280)={0x2, 0x0, @dev}, 0x10) close(r9) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r7, 0x8933, &(0x7f0000000000)={'batadv0\x00', 0x0}) ioctl$sock_inet6_SIOCADDRT(r7, 0x890b, &(0x7f0000002180)={@loopback={0xfec0ffff00000000}, @empty, @mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2020013, r10}) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r4, 0x84, 0x1b, 0x0, &(0x7f0000000040)) ioctl$BTRFS_IOC_DEV_INFO(r2, 0xd000941e, &(0x7f0000000a40)={r3, "819dc153085f814bbbda505cefddbc0a"}) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000001a40)={&(0x7f0000000880)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x74, 0x74, 0x3, [@volatile={0x4, 0x0, 0x0, 0x9, 0x4}, @enum={0x1, 0xa, 0x0, 0x6, 0x4, [{0x2, 0xfffffffb}, {0x0, 0x3}, {0x2, 0x7fff}, {0xe, 0x3}, {0x9, 0x7}, {0x8, 0x7fffffff}, {0x7, 0x3}, {0xd, 0xffffffff}, {0x3, 0xfff}, {0x8}]}, @const={0xc, 0x0, 0x0, 0xa, 0x4}]}, {0x0, [0x2e]}}, &(0x7f0000000940)=""/111, 0x8f, 0x6f, 0x0, 0x1}, 0x20) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000000600)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x5, [@func_proto={0x2, 0x0, 0x0, 0xf, 0x2}]}, {0x0, [0x0, 0x2e, 0x61]}}, 0x0, 0x29}, 0x20) r11 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0x100, 0x100, 0x9, 0x1, 0x1}, 0x48) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000140)={r11, 0x58, &(0x7f0000000280)}, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) recvmsg$unix(r12, &(0x7f0000004100)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=[@rights], 0x18}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x90) 1.054218941s ago: executing program 2 (id=1442): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_DEL(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x14, 0xa, 0x6, 0x101}, 0x14}}, 0x0) (fail_nth: 6) 1.049131035s ago: executing program 3 (id=1443): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x13, &(0x7f0000000500)=ANY=[@ANYBLOB="180a00000000000000000000eeffffff8510000006000000181000000e6fe2e84b2d79eef31fc8c3cf7313a623b35ac496ce07961c50d6682fdbed0b807eb66aa79bc8a28f2000e774cdf67a290b051a9ced62529f8dd51d0614bfa991fb5bef8ea7d6631794ba37ab9f8a58ee23d5c07c956d88584183b7b9ffb20dc176bd2bdef2490f00a78dff33369c1815302d93fe0e5eebef902b76339ac5a86f86d2ccab2426873a6e2950f096d6a152b3c36d057c647519707e8068a5c0f66a1847d1051967c80e382b63d6725381daaedcec08d872c6ff4992c10e491a599704eb40997472b08fa443f166bf426468fb4b0466ecd4d058f62f4e62744821a5891c324e5c386437996b9a720f6df71933d6b6c7cc5d4856377cf778bbf64288b34499657b8efde2f66865f34c22ee119ccebab9f47a903663e8800e8544b844763c7e7c4873864784ef1661cd7290dfb87def9aadaa0f15f4b8049b58bc7de44a7f6e531f27", @ANYRES32, @ANYBLOB="000000000000000000000000000000001800000000000000000000000000000095000000000000000000000000000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70200000000000085000000060000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0x4, 0x13, &(0x7f0000000340)=""/222}, 0x21) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(0xffffffffffffffff, 0x84, 0x76, &(0x7f0000444ff8)={0x0, 0x7}, 0x8) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(0xffffffffffffffff, 0x84, 0x75, &(0x7f0000000000)={0x0, 0xca}, 0x8) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, &(0x7f0000000200)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000003c40)=[{{&(0x7f0000000080)={0xa, 0x4e23, 0x0, @loopback}, 0x1c, &(0x7f0000000240)=[{&(0x7f0000000140)='\v', 0x1}], 0x1}}], 0x1, 0x0) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f00000002c0)=ANY=[@ANYRES32, @ANYBLOB="fe0f09"], 0x1a) bind$inet6(r2, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) bpf$PROG_LOAD(0x5, 0x0, 0x0) r3 = socket$nl_rdma(0x10, 0x3, 0x14) recvmmsg(r3, &(0x7f0000000fc0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) sendmsg$RDMA_NLDEV_CMD_RES_PD_GET(r3, &(0x7f0000000000)={0x0, 0xc041, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="180000000e1443eb0000000000001900080001000000000018783457bc179203700646d1a78ebc37bf30902c99dfd0593f07797c4760ebbffe44b34f172f8d889a564c350bade7fdba6712"], 0x18}}, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r2, 0x0, 0x0, 0x22004001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="640000001000010000000000000000da2481d800", @ANYRES32=0x0, @ANYBLOB="0000000000000000440012800e00010069703665727370616e0000003000028008001500feffffff0500160001000000080014000000000005000b0000000000040012"], 0x64}}, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000340)={@in6={{0xa, 0x0, 0x0, @loopback}}, 0x0, 0x0, 0x39, 0x0, "b0fd7b07ff8a216915a8d3215a3225178096acf74c85ad01ba95fd9d0543750fb5a62a045888e8febca073f1f821abb8083f4d192383c47b3800abd4d841e2d4b56039653b95d0cd0a00a6ea35bdfaf6"}, 0xd8) sendto$inet6(r2, &(0x7f0000000080)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090000006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a54049f0c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5753444fe05f33e5f91045540836c3cd6af10f0cd018f0c6f57f926ac959a5628c45088fbe0c87fbe6cbcda4662d2a12f6d00"/215, 0xd0d0c2ac, 0x0, 0x0, 0x32) splice(r2, 0x0, r1, 0x0, 0x406f408, 0x0) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000040)={0x3fa6, 0x0}, 0x8) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000240)={@ifindex, 0x10, 0x1, 0xcf50, &(0x7f0000000700)=[0x0], 0x1, 0x0, &(0x7f0000000180)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000001c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000200)=[0x0, 0x0], 0x0}, 0x40) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000280)={@cgroup=r1, r0, 0x2c, 0x1000, r0, @prog_id=r5, r6}, 0x20) 968.628346ms ago: executing program 0 (id=1444): r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e23, 0x0, @empty}, 0x1c) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000001500)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, &(0x7f0000001240)="0da951", 0x0, 0x9}, 0x50) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, 0x0) listen(r0, 0x400000001ffffffd) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) ioctl$FS_IOC_FIEMAP(0xffffffffffffffff, 0xc020660b, &(0x7f00000001c0)={0x0, 0x88e, 0x7}) r2 = accept4(r0, 0x0, 0x0, 0x0) getsockopt$llc_int(r2, 0x10c, 0x4, 0x0, 0x0) sendmsg$NL80211_CMD_SET_PMKSA(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000380)={0x0}}, 0x0) r3 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000001940)={0x20, 0x21, 0x1, 0x0, 0x0, "", [@nested={0x10, 0x0, 0x0, 0x1, [@typed={0xc, 0x1, 0x0, 0x0, @u64}, @generic]}]}, 0x20}], 0x1}, 0x0) sendmmsg$inet6(r1, &(0x7f0000000780)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f00000002c0)="17693397c085d00ca00de7c545cb84cf9b87063c05614d2d762a7c", 0x1b}, {&(0x7f0000000300)="785a1104eec2b96c0028d2175ac4bab209eafec5a9d128a262821f0de8d885bf01a6f12ca7c78aa4644b3726c261e43574a7701efbb5c8d1da2664d7c9a57c7611ea448264adea4764eaacafd29a27f6b468a06eebb3d13d88b918be87b36c84dab491272a421feb", 0x68}], 0x2}}, {{&(0x7f0000000480)={0xa, 0x4e24, 0x55, @remote, 0x9}, 0x1c, &(0x7f0000000740)=[{&(0x7f00000004c0)}, {&(0x7f0000000580)="aed4c9572f1829d8cd60be097dd9abdf8e7557c13f7ce997c6a81c4bd751eea10a0cc196297203cf3444d2f93d7f720734ce4edb2f10cb00b40ac5654af3cf5d7ebc6574dd0dbad2474f5079fd293733c40d7a89a10d778b8ce0e1870618dc47d84376eb992088bdac79c4ecbabf", 0x6e}, {&(0x7f0000000640)="b965ffa9929fe8288e4c4441929a71aa8e8ea49433363fd799da6ba33a0c99bcbf8bc5570544afdabfc36a8827f26381a48f9b09ac4cc530740bebe8fd4fa1398b0efef7ca651247e7819a0d3a1285a6673bcc5a70371e9ad69f1cfcc75e02359e8939d02dd8b488a6d872bc7da5d3312ff53d5983157e43b400799d12cc9ef4d6770d9b9db5369b750c858c98d38e000040cb3b4f7fcbf2565f6be13466836906068dfc12df420d39352416b27de091df3bd4aa5ba8aac3e2fce8181e12d040dcfa12649eb77437e41bc511e75cd35f90dff75a00680e00b195bc0d789e", 0xde}], 0x3}}], 0x4, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000080), r2) (fail_nth: 8) 918.342117ms ago: executing program 4 (id=1445): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001240)={0x8, 0x0, 0x0, &(0x7f0000000200)='syzkaller\x00', 0xa, 0x100b, &(0x7f0000003140)=""/4107}, 0x90) 839.680066ms ago: executing program 4 (id=1446): socket$inet6_mptcp(0xa, 0x1, 0x106) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=@delneigh={0x7c, 0x1d, 0x400, 0x70bd28, 0x25dfdbfc, {0xa, 0x0, 0x0, 0x0, 0x40, 0x20, 0x3}, [@NDA_DST_IPV4={0x8, 0x1, @initdev={0xac, 0x1e, 0x0, 0x0}}, @NDA_LLADDR={0xa, 0x2, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}, @NDA_LINK_NETNSID={0x8, 0xa, 0xd}, @NDA_PROTOCOL={0x5, 0xc, 0x6}, @NDA_VLAN={0x6, 0x5, 0x1}, @NDA_FDB_EXT_ATTRS={0x34, 0xe, 0x0, 0x1, [@NFEA_DONT_REFRESH={0x4}, @NFEA_DONT_REFRESH={0x4}, @NFEA_ACTIVITY_NOTIFY={0x5, 0x1, 0x6}, @NFEA_DONT_REFRESH={0x4}, @NFEA_ACTIVITY_NOTIFY={0x5, 0x1, 0xb}, @NFEA_DONT_REFRESH={0x4}, @NFEA_ACTIVITY_NOTIFY={0x5, 0x1, 0x2}, @NFEA_ACTIVITY_NOTIFY={0x5, 0x1, 0x8}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x80}, 0x0) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000040)={0x1, &(0x7f0000000340)=[{0x6, 0x0, 0x0, 0x67b}]}, 0x10) bind$inet6(r1, &(0x7f00004b8fe4)={0xa, 0x4e22, 0x0, @private1={0xfc, 0x1, '\x00', 0x1}, 0xfffffffd}, 0x1c) sendto$inet6(r1, &(0x7f0000847fff)='X', 0xfee4, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r1, 0x84, 0x73, &(0x7f0000000080)={0x0, 0x0, 0x30}, &(0x7f00000001c0)=0x18) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0x7, 0x10001, 0x9, 0x1}, 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000280)={{r2, 0xffffffffffffffff}, &(0x7f0000000040)=0x2, &(0x7f0000000200)}, 0x20) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cgroup.events\x00', 0x275a, 0x0) write$cgroup_int(r4, &(0x7f0000000100), 0x12) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_DELETE(r5, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000780)={0x44, 0x2, 0x1, 0x401, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x30, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @private2}, {0x14, 0x4, @private1}}}]}]}, 0x44}}, 0x0) r6 = socket$kcm(0x10, 0x2, 0x10) getsockopt$inet_pktinfo(r4, 0x0, 0x8, &(0x7f0000000240)={0x0, @multicast1, @multicast1}, &(0x7f0000000300)=0xc) bpf$MAP_CREATE(0x0, &(0x7f0000000340)=@bloom_filter={0x1e, 0x3, 0x7f, 0x9, 0x48, r2, 0x7ff, '\x00', r7, r4, 0x1, 0x1, 0x4, 0x2}, 0x48) sendmsg$kcm(r6, &(0x7f0000000000)={0x0, 0xffffff2d, &(0x7f0000000080)=[{&(0x7f0000000040)="c00e020023000b02d25a806f8c6394f94c24fc60040f030047000000053582c137153e370248018000f01700d1bd", 0x33fe0}], 0x1}, 0x0) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYRES64=0x0], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000280)={&(0x7f00000010c0)='ext4_ext_remove_space_done\x00', r8}, 0x10) r9 = socket(0xa, 0x2400000001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(0xffffffffffffffff, 0x29, 0x2a, &(0x7f0000034000)={0x0, {{0xa, 0x0, 0x0, @mcast2}}}, 0x88) setsockopt$inet6_MCAST_JOIN_GROUP(r9, 0x29, 0x2a, &(0x7f0000000040)={0x0, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) setsockopt$inet6_MCAST_JOIN_GROUP(r9, 0x29, 0x2a, &(0x7f0000000100)={0x0, {{0xa, 0x0, 0x0, @mcast2}}}, 0x88) getsockopt$inet6_buf(r9, 0x29, 0x10000000000030, &(0x7f0000034000)=""/144, &(0x7f0000e5f000)=0x90) r10 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r10, 0x400448c9, 0x0) r11 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r11, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000800)=@ipv6_getroute={0x1c, 0x1a, 0x800, 0x70bd2a, 0x21dfdbfc, {0xa, 0x0, 0x14, 0x68, 0xff, 0x0, 0xc9, 0xa, 0x2b00}}, 0x1c}}, 0x0) ioctl$SIOCSIFHWADDR(r4, 0x4030582b, &(0x7f0000000280)={'lo\x00', @link_local={0x1, 0x80, 0xc2, 0xe}}) 20.620642ms ago: executing program 1 (id=1447): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x0, 0x12, r0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001240)={0x8, 0x14, &(0x7f0000001600)=@raw=[@cb_func={0x18, 0xb, 0x4, 0x0, 0x5}, @call={0x85, 0x0, 0x0, 0x51}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x4}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x5b1efbf9}}, @initr0={0x18, 0x0, 0x0, 0x0, 0x11001, 0x0, 0x0, 0x0, 0x4}, @map_idx={0x18, 0x4, 0x5, 0x0, 0xe}, @map_val={0x18, 0xb, 0x2, 0x0, r0, 0x0, 0x0, 0x0, 0x101}], &(0x7f0000000200)='syzkaller\x00', 0xa, 0x100b, &(0x7f0000003140)=""/4107}, 0x90) 20.177535ms ago: executing program 2 (id=1448): socket$inet_udplite(0x2, 0x2, 0x88) socket(0x0, 0x0, 0x100) setsockopt$WPAN_SECURITY_LEVEL(0xffffffffffffffff, 0x0, 0x2, 0x0, 0x0) connect$inet(0xffffffffffffffff, 0x0, 0x0) sendmmsg$inet(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e20}, 0x1c) listen(r1, 0x80080400) socket$kcm(0x21, 0x0, 0xa) r2 = socket$inet_dccp(0x2, 0x6, 0x0) connect$inet(r2, &(0x7f0000000100)={0x2, 0x4e20, @local}, 0x10) getsockopt$inet_int(r2, 0x10d, 0xd2, &(0x7f0000000180), &(0x7f0000000080)=0x4) socket$inet(0x2, 0x3, 0x2) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000100)="4c000000140097f87059ae08060c040002ff0f0200000000000001870182fa73a69d35a2cca84708f7abca1b4e7d06a6bd7c493872f750375ed08a560400000003c48f93b82a03000000461e", 0x4c}], 0x1}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x7, 0x4, 0x8, 0x1, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0xfffffffb}, 0x48) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000380)=ANY=[@ANYBLOB="4400000010000507000000000000000000000006", @ANYRES32=0x0, @ANYBLOB="0000000000001a00240012800b00010062726964676500001400028005002b0003000000080004"], 0x44}}, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r3, 0x8933, &(0x7f0000000180)={'wpan0\x00', 0x0}) r5 = syz_genetlink_get_family_id$nl802154(&(0x7f00000000c0), r3) sendmsg$NL802154_CMD_NEW_SEC_KEY(r3, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000040)={&(0x7f00000001c0)={0x82, r5, 0x8, 0x70bd28, 0x25dfdbfd, {}, [@NL802154_ATTR_SEC_KEY={0x28, 0x30, 0x0, 0x1, [@NL802154_KEY_ATTR_USAGE_CMDS={0x24, 0x3, "ad86a9f1cc93c1076d43c48b37a4fbdb161b8f9999f9a5609293993efe4edc28"}]}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}, @NL802154_ATTR_IFINDEX={0x5, 0x3, r4}]}, 0x5c}, 0x1, 0x0, 0x0, 0x60008840}, 0x4005) 0s ago: executing program 3 (id=1449): unshare(0x22020600) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCETHTOOL(r0, 0x89f1, &(0x7f00000002c0)={'sit0\x00', &(0x7f0000000140)=@ethtool_cmd={0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x45}}) r1 = socket(0x10, 0x80002, 0x0) r2 = socket$l2tp(0x2, 0x2, 0x73) bind$inet(r2, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) socket$nl_route(0x10, 0x3, 0x0) connect$inet(r2, &(0x7f0000000200)={0x2, 0x0, @local}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000000)={0x8, 0x4, &(0x7f00000002c0)=ANY=[], &(0x7f0000000100)='GPL\x00'}, 0x90) socket$nl_route(0x10, 0x3, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r3, 0x10e, 0xc, &(0x7f0000000640)=0x4, 0x4) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x50, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x28, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @tproxy={{0xb}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_TPROXY_FAMILY={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_TPROXY_REG_ADDR={0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0xc4}}, 0x0) sendmsg$netlink(r3, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000006c00)={0x28, 0x12, 0x1, 0x0, 0x0, "", [@nested={0x10, 0x0, 0x0, 0x0, [@typed={0xc, 0x0, 0x0, 0x0, @u64}]}, @typed={0x5, 0x35, 0x0, 0x0, @binary="1b"}]}, 0x28}], 0x1}, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x32, &(0x7f0000000100)={@link_local, @broadcast, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x11, 0x0, @remote, @multicast1}, {0x0, 0x4e20, 0x10, 0x0, @gue={{0x2}}}}}}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000880)=@newtaction={0x60, 0x30, 0x53b, 0x0, 0x0, {0x9}, [{0x4c, 0x1, [@m_sample={0x48, 0x1, 0x0, 0x0, {{0xb}, {0x1c, 0x2, 0x0, 0x1, [@TCA_SAMPLE_PARMS={0x18, 0x2, {0x9d}}]}, {0x4}, {0xc}, {0xc, 0x4}}}]}]}, 0x60}}, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{}, &(0x7f0000000040), &(0x7f0000000140)=r5}, 0x20) connect$netrom(0xffffffffffffffff, &(0x7f0000000000)={{0xa, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x48) bpf$MAP_DELETE_ELEM(0x4, &(0x7f0000000080)={0xffffffffffffffff, &(0x7f0000000040), 0x20000000}, 0x20) kernel console output (not intermixed with test programs): tainted 6.10.0-rc6-syzkaller-00165-g0ec986ed7bab #0 [ 136.490272][ T7044] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 [ 136.500474][ T7044] Call Trace: [ 136.503802][ T7044] [ 136.506772][ T7044] dump_stack_lvl+0x241/0x360 [ 136.511508][ T7044] ? __pfx_dump_stack_lvl+0x10/0x10 [ 136.516779][ T7044] ? __pfx__printk+0x10/0x10 [ 136.521511][ T7044] ? bpf_send_signal_common+0x34a/0x430 [ 136.527203][ T7044] should_fail_ex+0x3b0/0x4e0 [ 136.531937][ T7044] prepare_alloc_pages+0x1da/0x5d0 [ 136.537120][ T7044] __alloc_pages_noprof+0x166/0x6c0 [ 136.542397][ T7044] ? __pfx___alloc_pages_noprof+0x10/0x10 [ 136.548203][ T7044] ? __pfx_validate_chain+0x10/0x10 [ 136.553473][ T7044] alloc_pages_mpol_noprof+0x3e8/0x680 [ 136.559050][ T7044] ? __pfx_alloc_pages_mpol_noprof+0x10/0x10 [ 136.565125][ T7044] vma_alloc_folio_noprof+0xf3/0x1f0 [ 136.570498][ T7044] ? __pfx_vma_alloc_folio_noprof+0x10/0x10 [ 136.576436][ T7044] ? do_raw_spin_unlock+0x13c/0x8b0 [ 136.576576][ T7044] folio_prealloc+0x31/0x170 [ 136.576605][ T7044] do_wp_page+0x11cc/0x52f0 [ 136.576656][ T7044] ? __pfx_do_wp_page+0x10/0x10 [ 136.576697][ T7044] ? __pfx_lock_acquire+0x10/0x10 [ 136.576727][ T7044] ? do_raw_spin_lock+0x14f/0x370 [ 136.576769][ T7044] ? try_to_wake_up+0x939/0x1470 [ 136.576808][ T7044] handle_pte_fault+0x117e/0x7090 [ 136.576834][ T7044] ? __pfx_mod_objcg_state+0x10/0x10 [ 136.576879][ T7044] ? mark_lock+0x9a/0x350 [ 136.576910][ T7044] ? __pfx_handle_pte_fault+0x10/0x10 [ 136.576939][ T7044] ? __lock_acquire+0x1346/0x1fd0 [ 136.577008][ T7044] ? __pfx_lock_release+0x10/0x10 [ 136.577042][ T7044] handle_mm_fault+0x10df/0x1ba0 [ 136.577111][ T7044] ? __pfx_handle_mm_fault+0x10/0x10 [ 136.577172][ T7044] ? __mmap_lock_do_trace_acquire_returned+0x2f2/0x630 [ 136.577201][ T7044] ? __mmap_lock_do_trace_acquire_returned+0x8f/0x630 [ 136.577235][ T7044] ? lock_mm_and_find_vma+0x9c/0x2f0 [ 136.577272][ T7044] exc_page_fault+0x2b9/0x8c0 [ 136.577312][ T7044] asm_exc_page_fault+0x26/0x30 [ 136.577347][ T7044] RIP: 0010:rep_movs_alternative+0x4a/0x70 [ 136.577371][ T7044] Code: 75 f1 c3 cc cc cc cc 66 0f 1f 84 00 00 00 00 00 48 8b 06 48 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 df 83 f9 08 73 e8 eb c9 a4 c3 cc cc cc cc 48 89 c8 48 c1 e9 03 83 e0 07 f3 48 a5 89 c1 [ 136.577389][ T7044] RSP: 0018:ffffc9000361fcb0 EFLAGS: 00050206 [ 136.577412][ T7044] RAX: ffffffff84aede01 RBX: 0000000020008400 RCX: 0000000000005400 [ 136.577430][ T7044] RDX: 0000000000000000 RSI: ffff8880594d3000 RDI: 0000000020003000 [ 136.727931][ T7044] RBP: 0000000000008400 R08: ffff8880594d83ff R09: 1ffff1100b29b07f [ 136.735936][ T7044] R10: dffffc0000000000 R11: ffffed100b29b080 R12: 0000000000008400 [ 136.743926][ T7044] R13: ffffc9000a03a158 R14: 0000000020000000 R15: ffff8880594d0000 [ 136.751923][ T7044] ? _copy_to_user+0x1/0xb0 [ 136.756449][ T7044] _copy_to_user+0x86/0xb0 [ 136.760903][ T7044] map_lookup_and_delete_elem+0x89a/0xa70 [ 136.766654][ T7044] ? __might_fault+0xc6/0x120 [ 136.771360][ T7044] __sys_bpf+0x5be/0x810 [ 136.775656][ T7044] ? __pfx___sys_bpf+0x10/0x10 [ 136.780466][ T7044] ? lockdep_hardirqs_on_prepare+0x43d/0x780 [ 136.786499][ T7044] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 136.792849][ T7044] ? do_syscall_64+0x100/0x230 [ 136.797652][ T7044] __x64_sys_bpf+0x7c/0x90 [ 136.802122][ T7044] do_syscall_64+0xf3/0x230 [ 136.806647][ T7044] ? clear_bhb_loop+0x35/0x90 [ 136.811345][ T7044] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 136.817275][ T7044] RIP: 0033:0x7f0243175bd9 [ 136.821724][ T7044] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 136.841368][ T7044] RSP: 002b:00007f0244005048 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 136.849820][ T7044] RAX: ffffffffffffffda RBX: 00007f0243303f60 RCX: 00007f0243175bd9 [ 136.857861][ T7044] RDX: 0000000000000020 RSI: 0000000020000400 RDI: 0000000000000015 [ 136.865955][ T7044] RBP: 00007f02440050a0 R08: 0000000000000000 R09: 0000000000000000 [ 136.873964][ T7044] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 136.881977][ T7044] R13: 000000000000000b R14: 00007f0243303f60 R15: 00007ffef664d278 [ 136.889981][ T7044] [ 137.063665][ T7056] bridge0: port 1(bridge_slave_0) entered blocking state [ 137.070888][ T7056] bridge0: port 1(bridge_slave_0) entered forwarding state [ 137.143273][ T7060] netlink: 168 bytes leftover after parsing attributes in process `syz.2.579'. [ 137.190567][ T7057] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 137.299702][ T7067] netlink: 16178 bytes leftover after parsing attributes in process `syz.1.582'. [ 138.096691][ T7102] tipc: Enabled bearer , priority 10 [ 138.252338][ T7109] netlink: 20 bytes leftover after parsing attributes in process `syz.2.599'. [ 138.281207][ T7109] netlink: 12 bytes leftover after parsing attributes in process `syz.2.599'. [ 138.338824][ T7113] Cannot find add_set index 0 as target [ 138.655136][ C0] TCP: MD5 Hash mismatch for [::1].2->[::1].2 [.]L3 index 0 [ 138.663042][ C0] TCP: MD5 Hash mismatch for [::1].2->[::1].2 [P.]L3 index 0 [ 138.690931][ T7125] netlink: 40 bytes leftover after parsing attributes in process `syz.0.605'. [ 138.983298][ T7138] netlink: 209848 bytes leftover after parsing attributes in process `syz.0.608'. [ 139.072954][ T7138] openvswitch: netlink: Message has 2 unknown bytes. [ 139.499646][ T7153] netlink: 40 bytes leftover after parsing attributes in process `syz.3.614'. [ 139.635215][ T7161] FAULT_INJECTION: forcing a failure. [ 139.635215][ T7161] name failslab, interval 1, probability 0, space 0, times 0 [ 139.701505][ T7157] netlink: 100 bytes leftover after parsing attributes in process `syz.2.617'. [ 139.712591][ T7161] CPU: 1 PID: 7161 Comm: syz.1.616 Not tainted 6.10.0-rc6-syzkaller-00165-g0ec986ed7bab #0 [ 139.722649][ T7161] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 [ 139.732803][ T7161] Call Trace: [ 139.736136][ T7161] [ 139.739094][ T7161] dump_stack_lvl+0x241/0x360 [ 139.743878][ T7161] ? __pfx_dump_stack_lvl+0x10/0x10 [ 139.749145][ T7161] ? __pfx__printk+0x10/0x10 [ 139.753810][ T7161] ? ref_tracker_alloc+0x332/0x490 [ 139.758988][ T7161] should_fail_ex+0x3b0/0x4e0 [ 139.763729][ T7161] ? skb_clone+0x20c/0x390 [ 139.768213][ T7161] should_failslab+0x9/0x20 [ 139.772782][ T7161] kmem_cache_alloc_noprof+0x6c/0x2a0 [ 139.778224][ T7161] skb_clone+0x20c/0x390 [ 139.782535][ T7161] __netlink_deliver_tap+0x3cc/0x7c0 [ 139.787910][ T7161] ? netlink_deliver_tap+0x2e/0x1b0 [ 139.793177][ T7161] netlink_deliver_tap+0x19d/0x1b0 [ 139.798443][ T7161] netlink_unicast+0x7b8/0x980 [ 139.803361][ T7161] ? __pfx_netlink_unicast+0x10/0x10 [ 139.808775][ T7161] ? __virt_addr_valid+0x183/0x520 [ 139.813966][ T7161] ? __check_object_size+0x49c/0x900 [ 139.819319][ T7161] ? bpf_lsm_netlink_send+0x9/0x10 [ 139.824524][ T7161] netlink_sendmsg+0x8db/0xcb0 [ 139.830166][ T7161] ? __pfx_netlink_sendmsg+0x10/0x10 [ 139.835521][ T7161] ? __import_iovec+0x536/0x820 [ 139.840432][ T7161] ? aa_sock_msg_perm+0x91/0x160 [ 139.845431][ T7161] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 139.850773][ T7161] ? security_socket_sendmsg+0x87/0xb0 [ 139.856300][ T7161] ? __pfx_netlink_sendmsg+0x10/0x10 [ 139.861646][ T7161] __sock_sendmsg+0x221/0x270 [ 139.866392][ T7161] ____sys_sendmsg+0x525/0x7d0 [ 139.871222][ T7161] ? __pfx_____sys_sendmsg+0x10/0x10 [ 139.876587][ T7161] __sys_sendmsg+0x2b0/0x3a0 [ 139.881241][ T7161] ? __pfx___sys_sendmsg+0x10/0x10 [ 139.886411][ T7161] ? vfs_write+0x7c4/0xc90 [ 139.890946][ T7161] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 139.897342][ T7161] ? do_syscall_64+0x100/0x230 [ 139.902186][ T7161] ? do_syscall_64+0xb6/0x230 [ 139.906937][ T7161] do_syscall_64+0xf3/0x230 [ 139.911506][ T7161] ? clear_bhb_loop+0x35/0x90 [ 139.916251][ T7161] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 139.922206][ T7161] RIP: 0033:0x7f63ca575bd9 [ 139.926673][ T7161] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 139.946336][ T7161] RSP: 002b:00007f63cb321048 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 139.954805][ T7161] RAX: ffffffffffffffda RBX: 00007f63ca703f60 RCX: 00007f63ca575bd9 [ 139.962845][ T7161] RDX: 0000000000000000 RSI: 0000000020000000 RDI: 0000000000000005 [ 139.970896][ T7161] RBP: 00007f63cb3210a0 R08: 0000000000000000 R09: 0000000000000000 [ 139.978945][ T7161] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 139.987056][ T7161] R13: 000000000000000b R14: 00007f63ca703f60 R15: 00007fffdb88e898 [ 139.995358][ T7161] [ 140.059057][ T7170] FAULT_INJECTION: forcing a failure. [ 140.059057][ T7170] name failslab, interval 1, probability 0, space 0, times 0 [ 140.071862][ T7170] CPU: 0 PID: 7170 Comm: syz.2.620 Not tainted 6.10.0-rc6-syzkaller-00165-g0ec986ed7bab #0 [ 140.082027][ T7170] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 [ 140.092128][ T7170] Call Trace: [ 140.095448][ T7170] [ 140.098473][ T7170] dump_stack_lvl+0x241/0x360 [ 140.103221][ T7170] ? __pfx_dump_stack_lvl+0x10/0x10 [ 140.108570][ T7170] ? __pfx__printk+0x10/0x10 [ 140.113229][ T7170] ? __asan_memset+0x23/0x50 [ 140.117878][ T7170] should_fail_ex+0x3b0/0x4e0 [ 140.122625][ T7170] should_failslab+0x9/0x20 [ 140.127183][ T7170] kmalloc_node_track_caller_noprof+0xda/0x440 [ 140.133395][ T7170] ? nf_ct_ext_add+0x1a2/0x3e0 [ 140.138224][ T7170] krealloc_noprof+0x7d/0x120 [ 140.142957][ T7170] nf_ct_ext_add+0x1a2/0x3e0 [ 140.147606][ T7170] init_conntrack+0x8bf/0x1310 [ 140.152430][ T7170] ? __pfx_init_conntrack+0x10/0x10 [ 140.157681][ T7170] ? __pfx___nf_conntrack_find_get+0x10/0x10 [ 140.163686][ T7170] ? __local_bh_enable_ip+0x168/0x200 [ 140.169087][ T7170] nf_conntrack_in+0xd59/0x1880 [ 140.174009][ T7170] ? __pfx_nf_conntrack_in+0x10/0x10 [ 140.179326][ T7170] ? ipt_do_table+0x312/0x1860 [ 140.184124][ T7170] ? __pfx_ipt_do_table+0x10/0x10 [ 140.189179][ T7170] ? ipv4_conntrack_defrag+0x2a2/0x5a0 [ 140.194772][ T7170] ? ip_sabotage_in+0x55/0x290 [ 140.199566][ T7170] ? __pfx_ipv4_conntrack_in+0x10/0x10 [ 140.205041][ T7170] nf_hook_slow+0xc3/0x220 [ 140.209514][ T7170] ? __pfx_ip_rcv_finish+0x10/0x10 [ 140.214648][ T7170] ? __pfx_ip_rcv_finish+0x10/0x10 [ 140.219781][ T7170] NF_HOOK+0x29e/0x450 [ 140.223888][ T7170] ? NF_HOOK+0x9a/0x450 [ 140.228066][ T7170] ? __pfx_NF_HOOK+0x10/0x10 [ 140.232680][ T7170] ? ip_rcv_core+0x7ff/0xd10 [ 140.237296][ T7170] ? __pfx_ip_rcv_finish+0x10/0x10 [ 140.242438][ T7170] ? __pfx_ip_rcv+0x10/0x10 [ 140.246963][ T7170] __netif_receive_skb+0x2bf/0x650 [ 140.252200][ T7170] ? __pfx_lock_acquire+0x10/0x10 [ 140.257240][ T7170] ? seqcount_lockdep_reader_access+0x1d7/0x220 [ 140.263508][ T7170] ? __pfx___netif_receive_skb+0x10/0x10 [ 140.269174][ T7170] ? __kasan_slab_alloc+0x66/0x80 [ 140.274219][ T7170] ? read_tsc+0x9/0x20 [ 140.278322][ T7170] ? timekeeping_get_ns+0x2c0/0x420 [ 140.283601][ T7170] ? netif_receive_skb+0x131/0x890 [ 140.288824][ T7170] ? netif_receive_skb+0x131/0x890 [ 140.293959][ T7170] netif_receive_skb+0x1e8/0x890 [ 140.299010][ T7170] ? tun_rx_batched+0x160/0x8f0 [ 140.303900][ T7170] ? __pfx_netif_receive_skb+0x10/0x10 [ 140.309391][ T7170] ? tun_rx_batched+0x160/0x8f0 [ 140.314260][ T7170] tun_rx_batched+0x1b7/0x8f0 [ 140.319218][ T7170] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 140.325566][ T7170] ? __pfx_lock_acquire+0x10/0x10 [ 140.330607][ T7170] ? __pfx_tun_rx_batched+0x10/0x10 [ 140.335850][ T7170] tun_get_user+0x2f35/0x4560 [ 140.340556][ T7170] ? tun_get_user+0x2a2f/0x4560 [ 140.345441][ T7170] ? __pfx_tun_get_user+0x10/0x10 [ 140.350578][ T7170] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 140.356329][ T7170] ? tun_get+0x1e/0x2f0 [ 140.360522][ T7170] ? tun_get+0x1e/0x2f0 [ 140.364695][ T7170] ? tun_get+0x27d/0x2f0 [ 140.368974][ T7170] tun_chr_write_iter+0x113/0x1f0 [ 140.374044][ T7170] vfs_write+0xa72/0xc90 [ 140.378306][ T7170] ? __pfx_tun_chr_write_iter+0x10/0x10 [ 140.383873][ T7170] ? __pfx_vfs_write+0x10/0x10 [ 140.388697][ T7170] ksys_write+0x1a0/0x2c0 [ 140.393051][ T7170] ? __pfx_ksys_write+0x10/0x10 [ 140.397940][ T7170] ? do_syscall_64+0x100/0x230 [ 140.402731][ T7170] ? do_syscall_64+0xb6/0x230 [ 140.407433][ T7170] do_syscall_64+0xf3/0x230 [ 140.411961][ T7170] ? clear_bhb_loop+0x35/0x90 [ 140.416667][ T7170] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 140.422580][ T7170] RIP: 0033:0x7f26ab77475f [ 140.427010][ T7170] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 29 8c 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 7c 8c 02 00 48 [ 140.446641][ T7170] RSP: 002b:00007f26ac4bb010 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 140.455073][ T7170] RAX: ffffffffffffffda RBX: 00007f26ab903f60 RCX: 00007f26ab77475f [ 140.463056][ T7170] RDX: 0000000000000032 RSI: 0000000020000100 RDI: 00000000000000c8 [ 140.471132][ T7170] RBP: 00007f26ac4bb0a0 R08: 0000000000000000 R09: 0000000000000000 [ 140.479129][ T7170] R10: 0000000000000032 R11: 0000000000000293 R12: 0000000000000001 [ 140.487129][ T7170] R13: 000000000000000b R14: 00007f26ab903f60 R15: 00007ffe3ee03ea8 [ 140.495131][ T7170] [ 140.815628][ T7188] __nla_validate_parse: 2 callbacks suppressed [ 140.815653][ T7188] netlink: 16 bytes leftover after parsing attributes in process `syz.3.627'. [ 140.922906][ T7191] netlink: 24 bytes leftover after parsing attributes in process `syz.0.628'. [ 140.968973][ T7194] netlink: 8 bytes leftover after parsing attributes in process `syz.1.629'. [ 141.002204][ T7194] FAULT_INJECTION: forcing a failure. [ 141.002204][ T7194] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 141.050545][ T7194] CPU: 0 PID: 7194 Comm: syz.1.629 Not tainted 6.10.0-rc6-syzkaller-00165-g0ec986ed7bab #0 [ 141.060597][ T7194] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 [ 141.070693][ T7194] Call Trace: [ 141.074004][ T7194] [ 141.076964][ T7194] dump_stack_lvl+0x241/0x360 [ 141.081712][ T7194] ? __pfx_dump_stack_lvl+0x10/0x10 [ 141.086948][ T7194] ? __pfx__printk+0x10/0x10 [ 141.091582][ T7194] ? snprintf+0xda/0x120 [ 141.095868][ T7194] should_fail_ex+0x3b0/0x4e0 [ 141.100594][ T7194] _copy_to_user+0x2f/0xb0 [ 141.105036][ T7194] simple_read_from_buffer+0xca/0x150 [ 141.110437][ T7194] proc_fail_nth_read+0x1e9/0x250 [ 141.115486][ T7194] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 141.121068][ T7194] ? rw_verify_area+0x520/0x6b0 [ 141.125950][ T7194] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 141.131529][ T7194] vfs_read+0x204/0xbc0 [ 141.135714][ T7194] ? __pfx_lock_release+0x10/0x10 [ 141.140789][ T7194] ? __pfx_vfs_read+0x10/0x10 [ 141.145506][ T7194] ? __fget_files+0x29/0x470 [ 141.150131][ T7194] ? __fget_files+0x3f6/0x470 [ 141.154857][ T7194] ksys_read+0x1a0/0x2c0 [ 141.159139][ T7194] ? __pfx_ksys_read+0x10/0x10 [ 141.163945][ T7194] ? do_syscall_64+0x100/0x230 [ 141.168756][ T7194] ? do_syscall_64+0xb6/0x230 [ 141.173481][ T7194] do_syscall_64+0xf3/0x230 [ 141.178036][ T7194] ? clear_bhb_loop+0x35/0x90 [ 141.182759][ T7194] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 141.188692][ T7194] RIP: 0033:0x7f63ca5746bc [ 141.193134][ T7194] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 c9 8c 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 1f 8d 02 00 48 [ 141.212823][ T7194] RSP: 002b:00007f63cb321040 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 141.221291][ T7194] RAX: ffffffffffffffda RBX: 00007f63ca703f60 RCX: 00007f63ca5746bc [ 141.229293][ T7194] RDX: 000000000000000f RSI: 00007f63cb3210b0 RDI: 0000000000000004 [ 141.237290][ T7194] RBP: 00007f63cb3210a0 R08: 0000000000000000 R09: 0000000000000000 [ 141.245291][ T7194] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 141.253289][ T7194] R13: 000000000000000b R14: 00007f63ca703f60 R15: 00007fffdb88e898 [ 141.261306][ T7194] [ 141.288103][ T7202] netlink: 40 bytes leftover after parsing attributes in process `syz.4.632'. [ 141.363760][ T7203] netlink: 180 bytes leftover after parsing attributes in process `syz.2.634'. [ 141.453380][ T7203] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 141.572409][ T7203] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 141.607222][ T7214] netlink: 28 bytes leftover after parsing attributes in process `syz.4.638'. [ 141.643349][ T7213] netlink: 8 bytes leftover after parsing attributes in process `syz.0.637'. [ 141.659792][ T7214] netlink: 'syz.4.638': attribute type 2 has an invalid length. [ 141.673050][ T7207] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 141.820497][ T7227] netlink: 16 bytes leftover after parsing attributes in process `syz.4.642'. [ 141.866642][ T7227] netlink: 760 bytes leftover after parsing attributes in process `syz.4.642'. [ 142.013146][ T7233] FAULT_INJECTION: forcing a failure. [ 142.013146][ T7233] name failslab, interval 1, probability 0, space 0, times 0 [ 142.039610][ T7234] netlink: 165 bytes leftover after parsing attributes in process `syz.1.644'. [ 142.067007][ T7233] CPU: 1 PID: 7233 Comm: syz.3.645 Not tainted 6.10.0-rc6-syzkaller-00165-g0ec986ed7bab #0 [ 142.077038][ T7233] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 [ 142.087172][ T7233] Call Trace: [ 142.090475][ T7233] [ 142.093445][ T7233] dump_stack_lvl+0x241/0x360 [ 142.098178][ T7233] ? __pfx_dump_stack_lvl+0x10/0x10 [ 142.103422][ T7233] ? __pfx__printk+0x10/0x10 [ 142.108051][ T7233] ? __pfx___might_resched+0x10/0x10 [ 142.113357][ T7233] should_fail_ex+0x3b0/0x4e0 [ 142.118052][ T7233] ? register_vlan_dev+0x342/0x810 [ 142.123189][ T7233] should_failslab+0x9/0x20 [ 142.127712][ T7233] kmalloc_trace_noprof+0x6c/0x2c0 [ 142.132848][ T7233] register_vlan_dev+0x342/0x810 [ 142.137806][ T7233] vlan_newlink+0x476/0x5c0 [ 142.142343][ T7233] ? __pfx_vlan_newlink+0x10/0x10 [ 142.147376][ T7233] rtnl_newlink+0x158f/0x20a0 [ 142.152064][ T7233] ? __kernel_text_address+0xd/0x40 [ 142.157300][ T7233] ? __pfx_rtnl_newlink+0x10/0x10 [ 142.162335][ T7233] ? __pfx___mutex_trylock_common+0x10/0x10 [ 142.168252][ T7233] ? rcu_is_watching+0x15/0xb0 [ 142.173036][ T7233] ? trace_contention_end+0x3c/0x120 [ 142.178330][ T7233] ? __mutex_lock+0x2ef/0xd70 [ 142.183020][ T7233] ? __pfx_lock_release+0x10/0x10 [ 142.188086][ T7233] ? __pfx_rtnl_newlink+0x10/0x10 [ 142.193133][ T7233] rtnetlink_rcv_msg+0x89b/0x1180 [ 142.198208][ T7233] ? rtnetlink_rcv_msg+0x208/0x1180 [ 142.203430][ T7233] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 142.208910][ T7233] ? lockdep_hardirqs_on_prepare+0x43d/0x780 [ 142.214919][ T7233] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 142.221295][ T7233] ? __local_bh_enable_ip+0x168/0x200 [ 142.226678][ T7233] ? lockdep_hardirqs_on+0x99/0x150 [ 142.231907][ T7233] ? __local_bh_enable_ip+0x168/0x200 [ 142.237292][ T7233] ? dev_hard_start_xmit+0x773/0x7e0 [ 142.242588][ T7233] ? __dev_queue_xmit+0x2d2/0x3d30 [ 142.247719][ T7233] ? __pfx___local_bh_enable_ip+0x10/0x10 [ 142.253458][ T7233] ? __dev_queue_xmit+0x2d2/0x3d30 [ 142.258592][ T7233] ? __dev_queue_xmit+0x16c9/0x3d30 [ 142.263821][ T7233] ? __dev_queue_xmit+0x2d2/0x3d30 [ 142.268974][ T7233] ? ref_tracker_free+0x643/0x7e0 [ 142.274020][ T7233] netlink_rcv_skb+0x1e3/0x430 [ 142.278801][ T7233] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 142.284311][ T7233] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 142.289628][ T7233] ? netlink_deliver_tap+0x2e/0x1b0 [ 142.294837][ T7233] netlink_unicast+0x7ea/0x980 [ 142.299619][ T7233] ? __pfx_netlink_unicast+0x10/0x10 [ 142.304932][ T7233] ? __virt_addr_valid+0x183/0x520 [ 142.310051][ T7233] ? __check_object_size+0x49c/0x900 [ 142.315343][ T7233] ? bpf_lsm_netlink_send+0x9/0x10 [ 142.320467][ T7233] netlink_sendmsg+0x8db/0xcb0 [ 142.325246][ T7233] ? __pfx_netlink_sendmsg+0x10/0x10 [ 142.330541][ T7233] ? __import_iovec+0x536/0x820 [ 142.335389][ T7233] ? aa_sock_msg_perm+0x91/0x160 [ 142.340330][ T7233] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 142.345618][ T7233] ? security_socket_sendmsg+0x87/0xb0 [ 142.351086][ T7233] ? __pfx_netlink_sendmsg+0x10/0x10 [ 142.356379][ T7233] __sock_sendmsg+0x221/0x270 [ 142.361070][ T7233] ____sys_sendmsg+0x525/0x7d0 [ 142.365843][ T7233] ? __pfx_____sys_sendmsg+0x10/0x10 [ 142.371143][ T7233] __sys_sendmsg+0x2b0/0x3a0 [ 142.375754][ T7233] ? __pfx___sys_sendmsg+0x10/0x10 [ 142.380877][ T7233] ? vfs_write+0x7c4/0xc90 [ 142.385340][ T7233] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 142.391684][ T7233] ? do_syscall_64+0x100/0x230 [ 142.396467][ T7233] ? do_syscall_64+0xb6/0x230 [ 142.401160][ T7233] do_syscall_64+0xf3/0x230 [ 142.405680][ T7233] ? clear_bhb_loop+0x35/0x90 [ 142.410375][ T7233] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 142.416278][ T7233] RIP: 0033:0x7f0243175bd9 [ 142.420701][ T7233] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 142.440422][ T7233] RSP: 002b:00007f0244005048 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 142.448843][ T7233] RAX: ffffffffffffffda RBX: 00007f0243303f60 RCX: 00007f0243175bd9 [ 142.456818][ T7233] RDX: 0000000000000000 RSI: 0000000020000040 RDI: 0000000000000006 [ 142.464790][ T7233] RBP: 00007f02440050a0 R08: 0000000000000000 R09: 0000000000000000 [ 142.472778][ T7233] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 142.480766][ T7233] R13: 000000000000000b R14: 00007f0243303f60 R15: 00007ffef664d278 [ 142.488751][ T7233] [ 142.548948][ T7240] tipc: Enabled bearer , priority 10 [ 142.769029][ T7247] bridge0: port 2(bridge_slave_1) entered disabled state [ 142.776490][ T7247] bridge0: port 1(bridge_slave_0) entered disabled state [ 142.842768][ T7247] Bluetooth: MGMT ver 1.22 [ 142.869211][ T7247] netlink: 'syz.1.652': attribute type 1 has an invalid length. [ 142.902239][ T7259] Bluetooth: MGMT ver 1.22 [ 142.906746][ T7259] Bluetooth: hci3: service_discovery: too big uuid_count value 65280 [ 142.919353][ T7247] netlink: 'syz.1.652': attribute type 1 has an invalid length. [ 142.948391][ T7247] netlink: 'syz.1.652': attribute type 2 has an invalid length. [ 142.973259][ T7247] netlink: 'syz.1.652': attribute type 1 has an invalid length. [ 143.369288][ T7284] IPv6: NLM_F_CREATE should be specified when creating new route [ 143.422615][ T7284] IPv6: Can't replace route, no match found [ 143.452357][ T7282] FAULT_INJECTION: forcing a failure. [ 143.452357][ T7282] name failslab, interval 1, probability 0, space 0, times 0 [ 143.482072][ T7282] CPU: 1 PID: 7282 Comm: syz.0.664 Not tainted 6.10.0-rc6-syzkaller-00165-g0ec986ed7bab #0 [ 143.492122][ T7282] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 [ 143.502205][ T7282] Call Trace: [ 143.505514][ T7282] [ 143.508470][ T7282] dump_stack_lvl+0x241/0x360 [ 143.513210][ T7282] ? __pfx_dump_stack_lvl+0x10/0x10 [ 143.518454][ T7282] ? __pfx__printk+0x10/0x10 [ 143.523094][ T7282] ? _raw_spin_unlock_irqrestore+0xdd/0x140 [ 143.529040][ T7282] should_fail_ex+0x3b0/0x4e0 [ 143.533759][ T7282] ? __request_module+0x2b9/0x650 [ 143.538824][ T7282] should_failslab+0x9/0x20 [ 143.543367][ T7282] kmalloc_trace_noprof+0x6c/0x2c0 [ 143.548502][ T7282] __request_module+0x2b9/0x650 [ 143.553360][ T7282] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 143.559688][ T7282] ? crypto_alg_mod_lookup+0xac/0x720 [ 143.565057][ T7282] ? __pfx___request_module+0x10/0x10 [ 143.570449][ T7282] ? __up_read+0x2c2/0x6b0 [ 143.574961][ T7282] ? __pfx___up_read+0x10/0x10 [ 143.579742][ T7282] ? crypto_alg_lookup+0x2d6/0x360 [ 143.584860][ T7282] crypto_alg_mod_lookup+0xe8/0x720 [ 143.590065][ T7282] crypto_type_has_alg+0x2c/0x60 [ 143.595015][ T7282] xfrm_aalg_get_byname+0x182/0x230 [ 143.600229][ T7282] xfrm_add_sa+0x1a80/0x3b20 [ 143.604868][ T7282] ? __pfx_xfrm_add_sa+0x10/0x10 [ 143.609813][ T7282] ? __nla_parse+0x40/0x60 [ 143.614235][ T7282] xfrm_user_rcv_msg+0x75d/0xa80 [ 143.619183][ T7282] ? __pfx_xfrm_user_rcv_msg+0x10/0x10 [ 143.624764][ T7282] ? __mutex_trylock_common+0x183/0x2e0 [ 143.630334][ T7282] ? __pfx___might_resched+0x10/0x10 [ 143.635636][ T7282] netlink_rcv_skb+0x1e3/0x430 [ 143.640410][ T7282] ? __pfx_xfrm_user_rcv_msg+0x10/0x10 [ 143.645877][ T7282] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 143.651200][ T7282] xfrm_netlink_rcv+0x79/0x90 [ 143.655882][ T7282] netlink_unicast+0x7ea/0x980 [ 143.660660][ T7282] ? __pfx_netlink_unicast+0x10/0x10 [ 143.665949][ T7282] ? __virt_addr_valid+0x183/0x520 [ 143.671074][ T7282] ? __check_object_size+0x49c/0x900 [ 143.676371][ T7282] ? bpf_lsm_netlink_send+0x9/0x10 [ 143.681495][ T7282] netlink_sendmsg+0x8db/0xcb0 [ 143.686279][ T7282] ? __pfx_netlink_sendmsg+0x10/0x10 [ 143.691614][ T7282] ? __import_iovec+0x536/0x820 [ 143.696488][ T7282] ? aa_sock_msg_perm+0x91/0x160 [ 143.701494][ T7282] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 143.706790][ T7282] ? security_socket_sendmsg+0x87/0xb0 [ 143.712263][ T7282] ? __pfx_netlink_sendmsg+0x10/0x10 [ 143.717559][ T7282] __sock_sendmsg+0x221/0x270 [ 143.722263][ T7282] ____sys_sendmsg+0x525/0x7d0 [ 143.727045][ T7282] ? __pfx_____sys_sendmsg+0x10/0x10 [ 143.732364][ T7282] __sys_sendmsg+0x2b0/0x3a0 [ 143.736978][ T7282] ? __pfx___sys_sendmsg+0x10/0x10 [ 143.742114][ T7282] ? vfs_write+0x7c4/0xc90 [ 143.746568][ T7282] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 143.752898][ T7282] ? do_syscall_64+0x100/0x230 [ 143.757672][ T7282] ? do_syscall_64+0xb6/0x230 [ 143.762365][ T7282] do_syscall_64+0xf3/0x230 [ 143.766881][ T7282] ? clear_bhb_loop+0x35/0x90 [ 143.771573][ T7282] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 143.777474][ T7282] RIP: 0033:0x7f669f975bd9 [ 143.781894][ T7282] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 143.801518][ T7282] RSP: 002b:00007f66a0711048 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 143.809940][ T7282] RAX: ffffffffffffffda RBX: 00007f669fb03f60 RCX: 00007f669f975bd9 [ 143.817914][ T7282] RDX: 0000000000000000 RSI: 0000000020000300 RDI: 0000000000000003 [ 143.825889][ T7282] RBP: 00007f66a07110a0 R08: 0000000000000000 R09: 0000000000000000 [ 143.833864][ T7282] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 143.841839][ T7282] R13: 000000000000000b R14: 00007f669fb03f60 R15: 00007ffcffd3d8a8 [ 143.849827][ T7282] [ 144.154681][ T7299] netlink: 'syz.1.670': attribute type 15 has an invalid length. [ 144.180880][ T7299] netlink: 'syz.1.670': attribute type 18 has an invalid length. [ 144.648592][ T7320] FAULT_INJECTION: forcing a failure. [ 144.648592][ T7320] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 144.677562][ T7321] FAULT_INJECTION: forcing a failure. [ 144.677562][ T7321] name failslab, interval 1, probability 0, space 0, times 0 [ 144.712153][ T7320] CPU: 1 PID: 7320 Comm: syz.3.681 Not tainted 6.10.0-rc6-syzkaller-00165-g0ec986ed7bab #0 [ 144.722201][ T7320] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 [ 144.732271][ T7320] Call Trace: [ 144.735548][ T7320] [ 144.738482][ T7320] dump_stack_lvl+0x241/0x360 [ 144.743202][ T7320] ? __pfx_dump_stack_lvl+0x10/0x10 [ 144.748415][ T7320] ? __pfx__printk+0x10/0x10 [ 144.753012][ T7320] ? __pfx_lock_release+0x10/0x10 [ 144.758044][ T7320] should_fail_ex+0x3b0/0x4e0 [ 144.762739][ T7320] _copy_from_user+0x2f/0xe0 [ 144.767339][ T7320] generic_map_update_batch+0x567/0x900 [ 144.772905][ T7320] ? __pfx_generic_map_update_batch+0x10/0x10 [ 144.778983][ T7320] ? __pfx_generic_map_update_batch+0x10/0x10 [ 144.785063][ T7320] bpf_map_do_batch+0x3e0/0x690 [ 144.789927][ T7320] __sys_bpf+0x377/0x810 [ 144.794193][ T7320] ? __pfx___sys_bpf+0x10/0x10 [ 144.798982][ T7320] ? lockdep_hardirqs_on_prepare+0x43d/0x780 [ 144.804973][ T7320] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 144.811306][ T7320] ? do_syscall_64+0x100/0x230 [ 144.816087][ T7320] __x64_sys_bpf+0x7c/0x90 [ 144.820514][ T7320] do_syscall_64+0xf3/0x230 [ 144.825047][ T7320] ? clear_bhb_loop+0x35/0x90 [ 144.829741][ T7320] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 144.835651][ T7320] RIP: 0033:0x7f0243175bd9 [ 144.840069][ T7320] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 144.859675][ T7320] RSP: 002b:00007f0244005048 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 144.868181][ T7320] RAX: ffffffffffffffda RBX: 00007f0243303f60 RCX: 00007f0243175bd9 [ 144.876152][ T7320] RDX: 0000000000000038 RSI: 0000000020000780 RDI: 000000000000001a [ 144.884128][ T7320] RBP: 00007f02440050a0 R08: 0000000000000000 R09: 0000000000000000 [ 144.892133][ T7320] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 144.900128][ T7320] R13: 000000000000000b R14: 00007f0243303f60 R15: 00007ffef664d278 [ 144.908228][ T7320] [ 145.002657][ T7321] CPU: 1 PID: 7321 Comm: syz.1.680 Not tainted 6.10.0-rc6-syzkaller-00165-g0ec986ed7bab #0 [ 145.012700][ T7321] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 [ 145.022761][ T7321] Call Trace: [ 145.026040][ T7321] [ 145.028967][ T7321] dump_stack_lvl+0x241/0x360 [ 145.033660][ T7321] ? __pfx_dump_stack_lvl+0x10/0x10 [ 145.038881][ T7321] ? __pfx__printk+0x10/0x10 [ 145.043490][ T7321] ? lockdep_init_map_type+0xa1/0x910 [ 145.048873][ T7321] ? __asan_memset+0x23/0x50 [ 145.053474][ T7321] should_fail_ex+0x3b0/0x4e0 [ 145.058192][ T7321] ? security_inode_alloc+0x28/0x120 [ 145.063491][ T7321] should_failslab+0x9/0x20 [ 145.068014][ T7321] kmem_cache_alloc_noprof+0x6c/0x2a0 [ 145.073409][ T7321] security_inode_alloc+0x28/0x120 [ 145.078535][ T7321] inode_init_always+0x947/0xc70 [ 145.083490][ T7321] ? __pfx_sock_alloc_inode+0x10/0x10 [ 145.088881][ T7321] new_inode_pseudo+0x9e/0x1e0 [ 145.093658][ T7321] __sock_create+0x123/0x920 [ 145.098273][ T7321] ? __asan_memset+0x23/0x50 [ 145.102872][ T7321] udp_sock_create6+0xe7/0x870 [ 145.107644][ T7321] ? __pfx_lockdep_init_map_type+0x10/0x10 [ 145.113491][ T7321] ? __pfx_udp_sock_create6+0x10/0x10 [ 145.118885][ T7321] ? rxrpc_lookup_local+0xcdb/0x1890 [ 145.124192][ T7321] rxrpc_lookup_local+0xd86/0x1890 [ 145.129326][ T7321] ? __pfx_rxrpc_lookup_local+0x10/0x10 [ 145.134884][ T7321] ? __local_bh_enable_ip+0x168/0x200 [ 145.140262][ T7321] ? __pfx___local_bh_enable_ip+0x10/0x10 [ 145.145981][ T7321] ? do_raw_spin_unlock+0x13c/0x8b0 [ 145.151214][ T7321] rxrpc_sendmsg+0x4d9/0x920 [ 145.155825][ T7321] ? __pfx_rxrpc_sendmsg+0x10/0x10 [ 145.160948][ T7321] __sock_sendmsg+0x221/0x270 [ 145.165651][ T7321] ____sys_sendmsg+0x525/0x7d0 [ 145.170455][ T7321] ? __pfx_____sys_sendmsg+0x10/0x10 [ 145.175783][ T7321] __sys_sendmsg+0x2b0/0x3a0 [ 145.180400][ T7321] ? __pfx___sys_sendmsg+0x10/0x10 [ 145.185526][ T7321] ? vfs_write+0x7c4/0xc90 [ 145.190004][ T7321] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 145.196345][ T7321] ? do_syscall_64+0x100/0x230 [ 145.201168][ T7321] ? do_syscall_64+0xb6/0x230 [ 145.205892][ T7321] do_syscall_64+0xf3/0x230 [ 145.210443][ T7321] ? clear_bhb_loop+0x35/0x90 [ 145.215153][ T7321] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 145.221303][ T7321] RIP: 0033:0x7f63ca575bd9 [ 145.225761][ T7321] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 145.245481][ T7321] RSP: 002b:00007f63cb321048 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 145.253912][ T7321] RAX: ffffffffffffffda RBX: 00007f63ca703f60 RCX: 00007f63ca575bd9 [ 145.261910][ T7321] RDX: 0000000000000000 RSI: 0000000020000080 RDI: 0000000000000003 [ 145.269979][ T7321] RBP: 00007f63cb3210a0 R08: 0000000000000000 R09: 0000000000000000 [ 145.277957][ T7321] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 145.285937][ T7321] R13: 000000000000000b R14: 00007f63ca703f60 R15: 00007fffdb88e898 [ 145.293957][ T7321] [ 145.438280][ T7321] socket: no more sockets [ 145.571421][ T7331] bridge0: port 1(bridge_slave_0) entered disabled state [ 145.631390][ T7330] tipc: Started in network mode [ 145.651822][ T7330] tipc: Node identity 00000000000000000000000000000001, cluster identity 4711 [ 145.672649][ T7330] tipc: Enabled bearer , priority 10 [ 146.201715][ T7359] bridge0: port 3(team0) entered disabled state [ 146.220486][ T7362] netlink: 'syz.4.695': attribute type 17 has an invalid length. [ 146.242731][ T7362] __nla_validate_parse: 14 callbacks suppressed [ 146.242752][ T7362] netlink: 40 bytes leftover after parsing attributes in process `syz.4.695'. [ 146.452249][ T8] IPVS: starting estimator thread 0... [ 146.552653][ T7369] IPVS: using max 16 ests per chain, 38400 per kthread [ 146.584925][ T7372] netlink: 180 bytes leftover after parsing attributes in process `syz.4.697'. [ 146.635504][ T7372] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 146.748041][ T7372] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 146.792592][ T7377] netlink: 20 bytes leftover after parsing attributes in process `syz.3.699'. [ 146.801959][ T7379] ɶƣ0G1w: entered promiscuous mode [ 146.817311][ T5198] tipc: Node number set to 1 [ 146.829301][ T7372] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 146.974839][ T7385] FAULT_INJECTION: forcing a failure. [ 146.974839][ T7385] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 146.993529][ T7385] CPU: 1 PID: 7385 Comm: syz.3.703 Not tainted 6.10.0-rc6-syzkaller-00165-g0ec986ed7bab #0 [ 147.003597][ T7385] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 [ 147.013779][ T7385] Call Trace: [ 147.017184][ T7385] [ 147.020186][ T7385] dump_stack_lvl+0x241/0x360 [ 147.024946][ T7385] ? __pfx_dump_stack_lvl+0x10/0x10 [ 147.030214][ T7385] ? __pfx__printk+0x10/0x10 [ 147.034869][ T7385] ? __pfx_lock_release+0x10/0x10 [ 147.039948][ T7385] should_fail_ex+0x3b0/0x4e0 [ 147.044681][ T7385] _copy_from_user+0x2f/0xe0 [ 147.049328][ T7385] do_sys_poll+0x23a/0x1300 [ 147.053882][ T7385] ? _parse_integer_limit+0x1b5/0x200 [ 147.059292][ T7385] ? mark_lock+0x9a/0x350 [ 147.063653][ T7385] ? __pfx_do_sys_poll+0x10/0x10 [ 147.068677][ T7385] ? __pfx_rcu_read_lock_any_held+0x10/0x10 [ 147.074591][ T7385] ? ksys_write+0x23e/0x2c0 [ 147.079107][ T7385] ? __pfx_lock_release+0x10/0x10 [ 147.084190][ T7385] ? __fget_files+0x3f6/0x470 [ 147.088892][ T7385] __se_sys_poll+0x1c5/0x400 [ 147.093509][ T7385] ? lockdep_hardirqs_on_prepare+0x43d/0x780 [ 147.099499][ T7385] ? __pfx___se_sys_poll+0x10/0x10 [ 147.104624][ T7385] ? do_syscall_64+0x100/0x230 [ 147.109406][ T7385] ? do_syscall_64+0xb6/0x230 [ 147.114102][ T7385] do_syscall_64+0xf3/0x230 [ 147.118621][ T7385] ? clear_bhb_loop+0x35/0x90 [ 147.123496][ T7385] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 147.129403][ T7385] RIP: 0033:0x7f0243175bd9 [ 147.133828][ T7385] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 147.153456][ T7385] RSP: 002b:00007f0244005048 EFLAGS: 00000246 ORIG_RAX: 0000000000000007 [ 147.161907][ T7385] RAX: ffffffffffffffda RBX: 00007f0243303f60 RCX: 00007f0243175bd9 [ 147.169881][ T7385] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000020000000 [ 147.177946][ T7385] RBP: 00007f02440050a0 R08: 0000000000000000 R09: 0000000000000000 [ 147.185943][ T7385] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 147.193943][ T7385] R13: 000000000000000b R14: 00007f0243303f60 R15: 00007ffef664d278 [ 147.201939][ T7385] [ 147.223727][ C1] Dead loop on virtual device ipvlan1, fix it urgently! [ 147.277506][ T7389] netlink: 40 bytes leftover after parsing attributes in process `syz.2.706'. [ 147.538000][ T7397] sctp: [Deprecated]: syz.0.708 (pid 7397) Use of struct sctp_assoc_value in delayed_ack socket option. [ 147.538000][ T7397] Use struct sctp_sack_info instead [ 147.648393][ T7406] netlink: 'syz.2.712': attribute type 10 has an invalid length. [ 147.723613][ T7406] dummy0: entered promiscuous mode [ 147.729069][ T7406] dummy0: entered allmulticast mode [ 147.763325][ T7411] netlink: 20 bytes leftover after parsing attributes in process `syz.4.713'. [ 147.786793][ T7406] team0: Port device dummy0 added [ 147.885192][ T7416] netlink: 'syz.0.716': attribute type 9 has an invalid length. [ 147.925557][ T7416] netlink: 911 bytes leftover after parsing attributes in process `syz.0.716'. [ 147.975931][ T7423] netlink: 72 bytes leftover after parsing attributes in process `syz.2.718'. [ 148.006249][ T7424] netlink: 8 bytes leftover after parsing attributes in process `syz.0.716'. [ 148.049765][ T7423] tap1: tun_chr_ioctl cmd 1074025694 [ 148.056513][ T7425] tipc: Started in network mode [ 148.062785][ T7425] tipc: Node identity cea8, cluster identity 4711 [ 148.071605][ T7425] tipc: Node number set to 52904 [ 148.099573][ T7429] netlink: 12 bytes leftover after parsing attributes in process `syz.0.716'. [ 148.418835][ T7440] netlink: 'syz.2.723': attribute type 4 has an invalid length. [ 148.427930][ T7440] netlink: 224 bytes leftover after parsing attributes in process `syz.2.723'. [ 148.432668][ T7438] pim6reg1: entered promiscuous mode [ 148.451100][ T7438] pim6reg1: entered allmulticast mode [ 149.061589][ T7449] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 149.086752][ T7470] netlink: 'syz.0.731': attribute type 7 has an invalid length. [ 149.098798][ T7470] netlink: 'syz.0.731': attribute type 39 has an invalid length. [ 149.133941][ T7470] bridge4: port 1(gretap1) entered blocking state [ 149.160607][ T7470] bridge4: port 1(gretap1) entered disabled state [ 149.177973][ T7470] gretap1: entered allmulticast mode [ 149.198193][ T7470] gretap1: entered promiscuous mode [ 149.276355][ T7471] netlink: 'syz.0.731': attribute type 7 has an invalid length. [ 149.284961][ T7471] netlink: 'syz.0.731': attribute type 39 has an invalid length. [ 149.391613][ T7476] FAULT_INJECTION: forcing a failure. [ 149.391613][ T7476] name failslab, interval 1, probability 0, space 0, times 0 [ 149.406961][ T7476] CPU: 0 PID: 7476 Comm: syz.0.733 Not tainted 6.10.0-rc6-syzkaller-00165-g0ec986ed7bab #0 [ 149.416969][ T7476] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 [ 149.427034][ T7476] Call Trace: [ 149.430326][ T7476] [ 149.433256][ T7476] dump_stack_lvl+0x241/0x360 [ 149.437950][ T7476] ? __pfx_dump_stack_lvl+0x10/0x10 [ 149.443170][ T7476] ? __pfx__printk+0x10/0x10 [ 149.447806][ T7476] ? __pfx___might_resched+0x10/0x10 [ 149.453123][ T7476] should_fail_ex+0x3b0/0x4e0 [ 149.457850][ T7476] ? apparmor_sk_alloc_security+0x77/0x100 [ 149.463696][ T7476] should_failslab+0x9/0x20 [ 149.468239][ T7476] kmalloc_trace_noprof+0x6c/0x2c0 [ 149.473370][ T7476] apparmor_sk_alloc_security+0x77/0x100 [ 149.479027][ T7476] security_sk_alloc+0x75/0xb0 [ 149.483894][ T7476] sk_prot_alloc+0xfa/0x210 [ 149.488416][ T7476] sk_alloc+0x38/0x370 [ 149.492502][ T7476] inet_create+0x652/0xe70 [ 149.496939][ T7476] ? inet_create+0x9c/0xe70 [ 149.501443][ T7476] ? __sock_create+0x337/0x920 [ 149.506209][ T7476] __sock_create+0x490/0x920 [ 149.510811][ T7476] udp_sock_create4+0xda/0x670 [ 149.515590][ T7476] ? __pfx_lockdep_init_map_type+0x10/0x10 [ 149.521399][ T7476] ? __pfx_debug_check_no_locks_freed+0x10/0x10 [ 149.527642][ T7476] ? __pfx_udp_sock_create4+0x10/0x10 [ 149.533034][ T7476] rxrpc_lookup_local+0xd9d/0x1890 [ 149.538168][ T7476] ? __pfx_rxrpc_lookup_local+0x10/0x10 [ 149.543731][ T7476] ? __local_bh_enable_ip+0x168/0x200 [ 149.549111][ T7476] ? __pfx___local_bh_enable_ip+0x10/0x10 [ 149.554832][ T7476] ? do_raw_spin_unlock+0x13c/0x8b0 [ 149.560050][ T7476] rxrpc_sendmsg+0x4d9/0x920 [ 149.564664][ T7476] ? __pfx_rxrpc_sendmsg+0x10/0x10 [ 149.569779][ T7476] __sock_sendmsg+0x221/0x270 [ 149.574485][ T7476] ____sys_sendmsg+0x525/0x7d0 [ 149.579267][ T7476] ? __pfx_____sys_sendmsg+0x10/0x10 [ 149.584570][ T7476] __sys_sendmmsg+0x3b2/0x740 [ 149.589261][ T7476] ? __pfx___sys_sendmmsg+0x10/0x10 [ 149.594500][ T7476] ? __pfx_rcu_read_lock_any_held+0x10/0x10 [ 149.600401][ T7476] ? ksys_write+0x23e/0x2c0 [ 149.604915][ T7476] ? __pfx_lock_release+0x10/0x10 [ 149.609945][ T7476] ? vfs_write+0x7c4/0xc90 [ 149.614383][ T7476] ? __mutex_unlock_slowpath+0x21d/0x750 [ 149.620015][ T7476] ? __pfx_vfs_write+0x10/0x10 [ 149.624811][ T7476] ? lockdep_hardirqs_on_prepare+0x43d/0x780 [ 149.630803][ T7476] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 149.637137][ T7476] ? do_syscall_64+0x100/0x230 [ 149.641919][ T7476] __x64_sys_sendmmsg+0xa0/0xb0 [ 149.646786][ T7476] do_syscall_64+0xf3/0x230 [ 149.651302][ T7476] ? clear_bhb_loop+0x35/0x90 [ 149.655993][ T7476] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 149.661908][ T7476] RIP: 0033:0x7f669f975bd9 [ 149.666334][ T7476] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 149.685939][ T7476] RSP: 002b:00007f66a0711048 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 149.694373][ T7476] RAX: ffffffffffffffda RBX: 00007f669fb03f60 RCX: 00007f669f975bd9 [ 149.702363][ T7476] RDX: 0000000000000002 RSI: 0000000020000480 RDI: 0000000000000003 [ 149.710333][ T7476] RBP: 00007f66a07110a0 R08: 0000000000000000 R09: 0000000000000000 [ 149.718306][ T7476] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 149.726281][ T7476] R13: 000000000000000b R14: 00007f669fb03f60 R15: 00007ffcffd3d8a8 [ 149.734270][ T7476] [ 149.939928][ T7481] dccp_invalid_packet: P.CsCov 5 exceeds packet length 132 [ 150.171608][ T7493] FAULT_INJECTION: forcing a failure. [ 150.171608][ T7493] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 150.230870][ T7493] CPU: 0 PID: 7493 Comm: syz.4.740 Not tainted 6.10.0-rc6-syzkaller-00165-g0ec986ed7bab #0 [ 150.240916][ T7493] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 [ 150.250997][ T7493] Call Trace: [ 150.254303][ T7493] [ 150.257266][ T7493] dump_stack_lvl+0x241/0x360 [ 150.261984][ T7493] ? __pfx_dump_stack_lvl+0x10/0x10 [ 150.267228][ T7493] ? __pfx__printk+0x10/0x10 [ 150.271859][ T7493] ? __pfx_lock_release+0x10/0x10 [ 150.276923][ T7493] should_fail_ex+0x3b0/0x4e0 [ 150.281649][ T7493] _copy_from_user+0x2f/0xe0 [ 150.286276][ T7493] copy_msghdr_from_user+0xae/0x680 [ 150.291519][ T7493] ? __pfx___might_resched+0x10/0x10 [ 150.296841][ T7493] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 150.302693][ T7493] ? __might_fault+0xaa/0x120 [ 150.307414][ T7493] do_recvmmsg+0x40f/0xae0 [ 150.311872][ T7493] ? __pfx_lock_release+0x10/0x10 [ 150.316923][ T7493] ? __pfx_do_recvmmsg+0x10/0x10 [ 150.321912][ T7493] ? __pfx_rcu_read_lock_any_held+0x10/0x10 [ 150.327842][ T7493] ? ksys_write+0x23e/0x2c0 [ 150.332394][ T7493] ? __pfx_lock_release+0x10/0x10 [ 150.337478][ T7493] ? vfs_write+0x7c4/0xc90 [ 150.341930][ T7493] ? __mutex_unlock_slowpath+0x21d/0x750 [ 150.347607][ T7493] ? __fget_files+0x3f6/0x470 [ 150.352355][ T7493] __x64_sys_recvmmsg+0x199/0x250 [ 150.357462][ T7493] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 150.363043][ T7493] ? do_syscall_64+0x100/0x230 [ 150.367842][ T7493] ? do_syscall_64+0xb6/0x230 [ 150.372567][ T7493] do_syscall_64+0xf3/0x230 [ 150.377110][ T7493] ? clear_bhb_loop+0x35/0x90 [ 150.381831][ T7493] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 150.387775][ T7493] RIP: 0033:0x7f193af75bd9 [ 150.389017][ T7492] netlink: 'syz.2.739': attribute type 23 has an invalid length. [ 150.392191][ T7493] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 150.392211][ T7493] RSP: 002b:00007f193bd11048 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 150.392235][ T7493] RAX: ffffffffffffffda RBX: 00007f193b103f60 RCX: 00007f193af75bd9 [ 150.392251][ T7493] RDX: 0000000004000359 RSI: 0000000020000500 RDI: 0000000000000004 [ 150.392264][ T7493] RBP: 00007f193bd110a0 R08: 0000000000000000 R09: 0000000000000000 [ 150.452029][ T7493] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 150.460020][ T7493] R13: 000000000000000b R14: 00007f193b103f60 R15: 00007ffcd03e0a38 [ 150.468049][ T7493] [ 150.888301][ T7512] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 150.895619][ T7512] IPv6: NLM_F_CREATE should be set when creating new route [ 150.902968][ T7512] IPv6: NLM_F_CREATE should be set when creating new route [ 151.510238][ T7542] __nla_validate_parse: 6 callbacks suppressed [ 151.510260][ T7542] netlink: 8 bytes leftover after parsing attributes in process `syz.4.755'. [ 151.585086][ C1] TCP: MD5 Hash mismatch for [::1].2->[::1].2 [.]L3 index 0 [ 151.592816][ C1] TCP: MD5 Hash mismatch for [::1].2->[::1].2 [P.]L3 index 0 [ 151.717928][ T7554] FAULT_INJECTION: forcing a failure. [ 151.717928][ T7554] name failslab, interval 1, probability 0, space 0, times 0 [ 151.736714][ T7555] netlink: 332 bytes leftover after parsing attributes in process `syz.3.761'. [ 151.740501][ T7554] CPU: 0 PID: 7554 Comm: syz.0.760 Not tainted 6.10.0-rc6-syzkaller-00165-g0ec986ed7bab #0 [ 151.746276][ T7555] netlink: 'syz.3.761': attribute type 9 has an invalid length. [ 151.755621][ T7554] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 [ 151.755636][ T7554] Call Trace: [ 151.755646][ T7554] [ 151.755655][ T7554] dump_stack_lvl+0x241/0x360 [ 151.755694][ T7554] ? __pfx_dump_stack_lvl+0x10/0x10 [ 151.765077][ T7555] netlink: 108 bytes leftover after parsing attributes in process `syz.3.761'. [ 151.773440][ T7554] ? __pfx__printk+0x10/0x10 [ 151.773475][ T7554] ? _copy_from_iter+0x26b/0x1960 [ 151.773524][ T7554] should_fail_ex+0x3b0/0x4e0 [ 151.777665][ T7555] netlink: 32 bytes leftover after parsing attributes in process `syz.3.761'. [ 151.779753][ T7554] ? build_skb+0x52/0x2a0 [ 151.779780][ T7554] should_failslab+0x9/0x20 [ 151.786022][ T7555] unsupported nlmsg_type 40 [ 151.789623][ T7554] kmem_cache_alloc_noprof+0x6c/0x2a0 [ 151.789662][ T7554] ? __pfx_alloc_pages_mpol_noprof+0x10/0x10 [ 151.789701][ T7554] build_skb+0x52/0x2a0 [ 151.789725][ T7554] ? __tun_build_skb+0x25/0x2f0 [ 151.855635][ T7554] __tun_build_skb+0x33/0x2f0 [ 151.860328][ T7554] tun_get_user+0x2084/0x4560 [ 151.865014][ T7554] ? tun_get_user+0x84c/0x4560 [ 151.869790][ T7554] ? __pfx_tun_get_user+0x10/0x10 [ 151.874825][ T7554] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 151.880299][ T7554] ? tun_get+0x1e/0x2f0 [ 151.884647][ T7554] ? tun_get+0x1e/0x2f0 [ 151.888834][ T7554] ? tun_get+0x27d/0x2f0 [ 151.893100][ T7554] tun_chr_write_iter+0x113/0x1f0 [ 151.898148][ T7554] vfs_write+0xa72/0xc90 [ 151.902407][ T7554] ? __pfx_tun_chr_write_iter+0x10/0x10 [ 151.907983][ T7554] ? __pfx_vfs_write+0x10/0x10 [ 151.912773][ T7554] ksys_write+0x1a0/0x2c0 [ 151.917123][ T7554] ? __pfx_ksys_write+0x10/0x10 [ 151.922016][ T7554] ? do_syscall_64+0x100/0x230 [ 151.926815][ T7554] ? do_syscall_64+0xb6/0x230 [ 151.931508][ T7554] do_syscall_64+0xf3/0x230 [ 151.936030][ T7554] ? clear_bhb_loop+0x35/0x90 [ 151.940722][ T7554] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 151.946623][ T7554] RIP: 0033:0x7f669f97475f [ 151.951065][ T7554] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 29 8c 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 7c 8c 02 00 48 [ 151.970679][ T7554] RSP: 002b:00007f66a0711010 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 151.979110][ T7554] RAX: ffffffffffffffda RBX: 00007f669fb03f60 RCX: 00007f669f97475f [ 151.987094][ T7554] RDX: 000000000000004e RSI: 0000000020001fc0 RDI: 00000000000000c8 [ 151.995088][ T7554] RBP: 00007f66a07110a0 R08: 0000000000000000 R09: 0000000000000000 [ 152.003058][ T7554] R10: 000000000000004e R11: 0000000000000293 R12: 0000000000000001 [ 152.011047][ T7554] R13: 000000000000000b R14: 00007f669fb03f60 R15: 00007ffcffd3d8a8 [ 152.019120][ T7554] [ 152.197838][ T7563] FAULT_INJECTION: forcing a failure. [ 152.197838][ T7563] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 152.231753][ T7563] CPU: 0 PID: 7563 Comm: syz.1.764 Not tainted 6.10.0-rc6-syzkaller-00165-g0ec986ed7bab #0 [ 152.241817][ T7563] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 [ 152.251898][ T7563] Call Trace: [ 152.255207][ T7563] [ 152.258168][ T7563] dump_stack_lvl+0x241/0x360 [ 152.262912][ T7563] ? __pfx_dump_stack_lvl+0x10/0x10 [ 152.268153][ T7563] ? __pfx__printk+0x10/0x10 [ 152.272782][ T7563] ? __pfx_lock_release+0x10/0x10 [ 152.277833][ T7563] ? __alloc_skb+0x28f/0x440 [ 152.282463][ T7563] should_fail_ex+0x3b0/0x4e0 [ 152.287182][ T7563] _copy_from_user+0x2f/0xe0 [ 152.291821][ T7563] ppp_write+0x161/0x2a0 [ 152.296099][ T7563] ? __pfx_ppp_write+0x10/0x10 [ 152.300899][ T7563] vfs_write+0x2a2/0xc90 [ 152.305198][ T7563] ? __pfx_vfs_write+0x10/0x10 [ 152.310004][ T7563] ? __fget_files+0x29/0x470 [ 152.314635][ T7563] ? __fget_files+0x3f6/0x470 [ 152.319355][ T7563] ? __fget_files+0x29/0x470 [ 152.323992][ T7563] ksys_write+0x1a0/0x2c0 [ 152.328361][ T7563] ? __pfx_ksys_write+0x10/0x10 [ 152.333264][ T7563] ? do_syscall_64+0x100/0x230 [ 152.338073][ T7563] ? do_syscall_64+0xb6/0x230 [ 152.342790][ T7563] do_syscall_64+0xf3/0x230 [ 152.347333][ T7563] ? clear_bhb_loop+0x35/0x90 [ 152.352059][ T7563] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 152.357994][ T7563] RIP: 0033:0x7f63ca575bd9 [ 152.362449][ T7563] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 152.382077][ T7563] RSP: 002b:00007f63cb321048 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 152.390518][ T7563] RAX: ffffffffffffffda RBX: 00007f63ca703f60 RCX: 00007f63ca575bd9 [ 152.398499][ T7563] RDX: 0000000000000078 RSI: 0000000020000240 RDI: 0000000000000003 [ 152.406476][ T7563] RBP: 00007f63cb3210a0 R08: 0000000000000000 R09: 0000000000000000 [ 152.414450][ T7563] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 152.422443][ T7563] R13: 000000000000000b R14: 00007f63ca703f60 R15: 00007fffdb88e898 [ 152.430433][ T7563] [ 152.633197][ T7580] netlink: 8 bytes leftover after parsing attributes in process `syz.2.768'. [ 152.730832][ T7583] FAULT_INJECTION: forcing a failure. [ 152.730832][ T7583] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 152.775382][ T7583] CPU: 0 PID: 7583 Comm: syz.0.772 Not tainted 6.10.0-rc6-syzkaller-00165-g0ec986ed7bab #0 [ 152.785419][ T7583] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 [ 152.795512][ T7583] Call Trace: [ 152.798820][ T7583] [ 152.801789][ T7583] dump_stack_lvl+0x241/0x360 [ 152.806552][ T7583] ? __pfx_dump_stack_lvl+0x10/0x10 [ 152.811793][ T7583] ? __pfx__printk+0x10/0x10 [ 152.816426][ T7583] ? __pfx_lock_release+0x10/0x10 [ 152.821507][ T7583] should_fail_ex+0x3b0/0x4e0 [ 152.826240][ T7583] _copy_from_user+0x2f/0xe0 [ 152.830868][ T7583] get_user_ifreq+0xc3/0x200 [ 152.835510][ T7583] sock_ioctl+0x796/0x8e0 [ 152.839885][ T7583] ? __pfx_sock_ioctl+0x10/0x10 [ 152.844774][ T7583] ? __fget_files+0x3f6/0x470 [ 152.849488][ T7583] ? __fget_files+0x29/0x470 [ 152.854123][ T7583] ? bpf_lsm_file_ioctl+0x9/0x10 [ 152.859098][ T7583] ? security_file_ioctl+0x87/0xb0 [ 152.864246][ T7583] ? __pfx_sock_ioctl+0x10/0x10 [ 152.869140][ T7583] __se_sys_ioctl+0xfc/0x170 [ 152.873770][ T7583] do_syscall_64+0xf3/0x230 [ 152.878315][ T7583] ? clear_bhb_loop+0x35/0x90 [ 152.883039][ T7583] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 152.888977][ T7583] RIP: 0033:0x7f669f975bd9 [ 152.893422][ T7583] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 152.913061][ T7583] RSP: 002b:00007f66a0711048 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 152.921514][ T7583] RAX: ffffffffffffffda RBX: 00007f669fb03f60 RCX: 00007f669f975bd9 [ 152.929525][ T7583] RDX: 0000000020000900 RSI: 00000000000089f1 RDI: 0000000000000004 [ 152.929688][ T7589] netlink: 864 bytes leftover after parsing attributes in process `syz.2.773'. [ 152.937518][ T7583] RBP: 00007f66a07110a0 R08: 0000000000000000 R09: 0000000000000000 [ 152.937538][ T7583] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 152.937553][ T7583] R13: 000000000000000b R14: 00007f669fb03f60 R15: 00007ffcffd3d8a8 [ 152.937587][ T7583] [ 153.419753][ T7610] netlink: 8 bytes leftover after parsing attributes in process `syz.1.780'. [ 153.500883][ T7613] netlink: 'syz.0.783': attribute type 2 has an invalid length. [ 153.526095][ T7617] netlink: 'syz.4.785': attribute type 1 has an invalid length. [ 153.534163][ T7613] netlink: 24 bytes leftover after parsing attributes in process `syz.0.783'. [ 153.569453][ T7616] netlink: 'syz.4.785': attribute type 1 has an invalid length. [ 153.590770][ T7616] netdevsim netdevsim4 netdevsim0: entered promiscuous mode [ 153.762531][ T7623] pim6reg1: entered promiscuous mode [ 153.767991][ T7623] pim6reg1: entered allmulticast mode [ 153.815342][ T7629] FAULT_INJECTION: forcing a failure. [ 153.815342][ T7629] name failslab, interval 1, probability 0, space 0, times 0 [ 153.823251][ T7619] netdevsim netdevsim4 netdevsim0: left promiscuous mode [ 153.828389][ T7629] CPU: 0 PID: 7629 Comm: syz.2.788 Not tainted 6.10.0-rc6-syzkaller-00165-g0ec986ed7bab #0 [ 153.845358][ T7629] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 [ 153.855448][ T7629] Call Trace: [ 153.858757][ T7629] [ 153.861718][ T7629] dump_stack_lvl+0x241/0x360 [ 153.866508][ T7629] ? __pfx_dump_stack_lvl+0x10/0x10 [ 153.871760][ T7629] ? __pfx__printk+0x10/0x10 [ 153.876402][ T7629] ? __pfx_lock_acquire+0x10/0x10 [ 153.881469][ T7629] should_fail_ex+0x3b0/0x4e0 [ 153.886181][ T7629] ? tipc_nametbl_lookup_group+0x7a9/0xc20 [ 153.892025][ T7629] should_failslab+0x9/0x20 [ 153.896548][ T7629] kmalloc_trace_noprof+0x6c/0x2c0 [ 153.901725][ T7629] tipc_nametbl_lookup_group+0x7a9/0xc20 [ 153.907375][ T7629] ? tipc_nametbl_lookup_group+0xb4/0xc20 [ 153.913126][ T7629] __tipc_sendmsg+0x1a38/0x35f0 [ 153.918007][ T7629] ? __pfx___tipc_sendmsg+0x10/0x10 [ 153.923214][ T7629] ? validate_chain+0x11e/0x5900 [ 153.928166][ T7629] ? validate_chain+0x11e/0x5900 [ 153.933507][ T7629] ? __pfx_lock_acquire+0x10/0x10 [ 153.938540][ T7629] ? __pfx_validate_chain+0x10/0x10 [ 153.943761][ T7629] ? __pfx_validate_chain+0x10/0x10 [ 153.948969][ T7629] ? aa_label_sk_perm+0x4f0/0x6d0 [ 153.954009][ T7629] ? mark_lock+0x9a/0x350 [ 153.958353][ T7629] ? __lock_acquire+0x1346/0x1fd0 [ 153.963416][ T7629] ? mark_lock+0x9a/0x350 [ 153.967848][ T7629] ? lockdep_hardirqs_on_prepare+0x43d/0x780 [ 153.973838][ T7629] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 153.980180][ T7629] ? __local_bh_enable_ip+0x168/0x200 [ 153.985575][ T7629] ? tipc_sendmsg+0x47/0x70 [ 153.990086][ T7629] ? __pfx___local_bh_enable_ip+0x10/0x10 [ 153.995807][ T7629] ? do_raw_spin_unlock+0x13c/0x8b0 [ 154.001025][ T7629] ? __pfx_tipc_sendmsg+0x10/0x10 [ 154.006079][ T7629] tipc_sendmsg+0x55/0x70 [ 154.010425][ T7629] __sock_sendmsg+0x221/0x270 [ 154.015124][ T7629] ____sys_sendmsg+0x525/0x7d0 [ 154.019919][ T7629] ? __pfx_____sys_sendmsg+0x10/0x10 [ 154.025226][ T7629] __sys_sendmsg+0x2b0/0x3a0 [ 154.029824][ T7629] ? __pfx___sys_sendmsg+0x10/0x10 [ 154.034952][ T7629] ? vfs_write+0x7c4/0xc90 [ 154.039417][ T7629] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 154.045753][ T7629] ? do_syscall_64+0x100/0x230 [ 154.050573][ T7629] ? do_syscall_64+0xb6/0x230 [ 154.055269][ T7629] do_syscall_64+0xf3/0x230 [ 154.059822][ T7629] ? clear_bhb_loop+0x35/0x90 [ 154.064523][ T7629] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 154.070432][ T7629] RIP: 0033:0x7f26ab775bd9 [ 154.074857][ T7629] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 154.094497][ T7629] RSP: 002b:00007f26ac4bb048 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 154.102924][ T7629] RAX: ffffffffffffffda RBX: 00007f26ab903f60 RCX: 00007f26ab775bd9 [ 154.110901][ T7629] RDX: 0000000000000000 RSI: 0000000020000240 RDI: 0000000000000006 [ 154.118892][ T7629] RBP: 00007f26ac4bb0a0 R08: 0000000000000000 R09: 0000000000000000 [ 154.126865][ T7629] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 154.134842][ T7629] R13: 000000000000000b R14: 00007f26ab903f60 R15: 00007ffe3ee03ea8 [ 154.142831][ T7629] [ 154.240769][ T7633] netlink: 'syz.3.790': attribute type 3 has an invalid length. [ 154.282275][ T7633] netlink: 8 bytes leftover after parsing attributes in process `syz.3.790'. [ 154.522956][ T7648] netlink: 104 bytes leftover after parsing attributes in process `syz.4.795'. [ 154.890987][ T7652] syzkaller0: entered promiscuous mode [ 154.911434][ C1] TCP: MD5 Hash mismatch for [::1].2->[::1].2 [.]L3 index 0 [ 154.914941][ T7652] syzkaller0: entered allmulticast mode [ 154.919161][ C1] TCP: MD5 Hash mismatch for [::1].2->[::1].2 [P.]L3 index 0 [ 156.669994][ T7677] __nla_validate_parse: 3 callbacks suppressed [ 156.670009][ T7677] netlink: 40 bytes leftover after parsing attributes in process `syz.0.804'. [ 157.336497][ T7718] netlink: 8 bytes leftover after parsing attributes in process `syz.3.819'. [ 157.403792][ C0] TCP: MD5 Hash mismatch for [::1].2->[::1].2 [.]L3 index 0 [ 157.411529][ C0] TCP: MD5 Hash mismatch for [::1].2->[::1].2 [P.]L3 index 0 [ 157.553761][ T7728] netlink: 16 bytes leftover after parsing attributes in process `syz.1.823'. [ 158.013794][ T7731] syzkaller0: entered promiscuous mode [ 158.023735][ T7731] syzkaller0: entered allmulticast mode [ 158.472395][ T7758] netlink: 4 bytes leftover after parsing attributes in process `syz.4.830'. [ 159.714510][ T7762] TCP: request_sock_TCPv6: Possible SYN flooding on port [::]:20002. Sending cookies. [ 159.839356][ T5154] IPVS: starting estimator thread 0... [ 159.904421][ T7769] netlink: 'syz.0.834': attribute type 1 has an invalid length. [ 159.940159][ T7773] netlink: 12 bytes leftover after parsing attributes in process `syz.1.836'. [ 159.964961][ T7771] IPVS: using max 17 ests per chain, 40800 per kthread [ 159.998566][ T7777] netlink: 8 bytes leftover after parsing attributes in process `syz.1.836'. [ 160.019176][ T7776] netlink: 8 bytes leftover after parsing attributes in process `syz.3.837'. [ 160.059517][ T7779] tipc: Enabled bearer , priority 10 [ 160.103281][ T7779] FAULT_INJECTION: forcing a failure. [ 160.103281][ T7779] name failslab, interval 1, probability 0, space 0, times 0 [ 160.178488][ T7779] CPU: 0 PID: 7779 Comm: syz.4.838 Not tainted 6.10.0-rc6-syzkaller-00165-g0ec986ed7bab #0 [ 160.188537][ T7779] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 [ 160.198621][ T7779] Call Trace: [ 160.201928][ T7779] [ 160.204910][ T7779] dump_stack_lvl+0x241/0x360 [ 160.209635][ T7779] ? __pfx_dump_stack_lvl+0x10/0x10 [ 160.214880][ T7779] ? __pfx__printk+0x10/0x10 [ 160.219515][ T7779] ? ref_tracker_alloc+0x332/0x490 [ 160.224675][ T7779] should_fail_ex+0x3b0/0x4e0 [ 160.229382][ T7779] ? skb_clone+0x20c/0x390 [ 160.233815][ T7779] should_failslab+0x9/0x20 [ 160.238362][ T7779] kmem_cache_alloc_noprof+0x6c/0x2a0 [ 160.243777][ T7779] skb_clone+0x20c/0x390 [ 160.248054][ T7779] __netlink_deliver_tap+0x3cc/0x7c0 [ 160.253353][ T7779] ? netlink_deliver_tap+0x2e/0x1b0 [ 160.258557][ T7779] netlink_deliver_tap+0x19d/0x1b0 [ 160.263697][ T7779] netlink_unicast+0x7b8/0x980 [ 160.268494][ T7779] ? __pfx_netlink_unicast+0x10/0x10 [ 160.273779][ T7779] ? __virt_addr_valid+0x183/0x520 [ 160.278919][ T7779] ? __check_object_size+0x49c/0x900 [ 160.284236][ T7779] ? bpf_lsm_netlink_send+0x9/0x10 [ 160.289367][ T7779] netlink_sendmsg+0x8db/0xcb0 [ 160.294158][ T7779] ? __pfx_netlink_sendmsg+0x10/0x10 [ 160.299465][ T7779] ? __import_iovec+0x536/0x820 [ 160.304339][ T7779] ? aa_sock_msg_perm+0x91/0x160 [ 160.309289][ T7779] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 160.314579][ T7779] ? security_socket_sendmsg+0x87/0xb0 [ 160.320047][ T7779] ? __pfx_netlink_sendmsg+0x10/0x10 [ 160.325366][ T7779] __sock_sendmsg+0x221/0x270 [ 160.330063][ T7779] ____sys_sendmsg+0x525/0x7d0 [ 160.334863][ T7779] ? __pfx_____sys_sendmsg+0x10/0x10 [ 160.340167][ T7779] __sys_sendmsg+0x2b0/0x3a0 [ 160.344768][ T7779] ? __pfx___sys_sendmsg+0x10/0x10 [ 160.349888][ T7779] ? vfs_write+0x7c4/0xc90 [ 160.354351][ T7779] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 160.360688][ T7779] ? do_syscall_64+0x100/0x230 [ 160.365477][ T7779] ? do_syscall_64+0xb6/0x230 [ 160.370166][ T7779] do_syscall_64+0xf3/0x230 [ 160.374677][ T7779] ? clear_bhb_loop+0x35/0x90 [ 160.379373][ T7779] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 160.385277][ T7779] RIP: 0033:0x7f193af75bd9 [ 160.389692][ T7779] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 160.409298][ T7779] RSP: 002b:00007f193bd11048 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 160.417721][ T7779] RAX: ffffffffffffffda RBX: 00007f193b103f60 RCX: 00007f193af75bd9 [ 160.426129][ T7779] RDX: 0000000000000000 RSI: 00000000200009c0 RDI: 0000000000000003 [ 160.434105][ T7779] RBP: 00007f193bd110a0 R08: 0000000000000000 R09: 0000000000000000 [ 160.442092][ T7779] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 160.450079][ T7779] R13: 000000000000000b R14: 00007f193b103f60 R15: 00007ffcd03e0a38 [ 160.458064][ T7779] [ 160.474714][ T7781] netlink: 8 bytes leftover after parsing attributes in process `syz.2.839'. [ 160.479271][ T7795] xt_ecn: cannot match TCP bits for non-tcp packets [ 160.491604][ T7779] tipc: Disabling bearer [ 160.528720][ T7794] netlink: 4 bytes leftover after parsing attributes in process `syz.1.842'. [ 160.594413][ T7795] netlink: 2 bytes leftover after parsing attributes in process `syz.0.841'. [ 160.677893][ T7800] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 160.783687][ T7804] TCP: request_sock_TCPv6: Possible SYN flooding on port [::]:20002. Sending cookies. [ 161.361399][ C1] TCP: MD5 Hash mismatch for [::1].2->[::1].2 [.]L3 index 0 [ 161.369220][ C1] TCP: MD5 Hash mismatch for [::1].2->[::1].2 [P.]L3 index 0 [ 161.523363][ T7833] TCP: request_sock_TCPv6: Possible SYN flooding on port [::]:20002. Sending cookies. [ 161.857321][ T7842] __nla_validate_parse: 3 callbacks suppressed [ 161.857342][ T7842] netlink: 32 bytes leftover after parsing attributes in process `syz.2.862'. [ 162.052711][ T7854] xt_ecn: cannot match TCP bits for non-tcp packets [ 162.061446][ T7851] netlink: 8 bytes leftover after parsing attributes in process `syz.0.861'. [ 162.134297][ T7854] netlink: 2 bytes leftover after parsing attributes in process `syz.4.864'. [ 162.147193][ T7851] IPVS: Unknown mcast interface: [ 162.203457][ T7857] netlink: 4 bytes leftover after parsing attributes in process `syz.2.865'. [ 163.132319][ T7884] netlink: 8 bytes leftover after parsing attributes in process `syz.2.876'. [ 163.207888][ T7890] netlink: 4 bytes leftover after parsing attributes in process `syz.0.879'. [ 163.353375][ T7895] A link change request failed with some changes committed already. Interface vxcan1 may have been left with an inconsistent configuration, please check. [ 163.440241][ T7895] netlink: 4 bytes leftover after parsing attributes in process `syz.1.881'. [ 163.535033][ T7902] xt_ecn: cannot match TCP bits for non-tcp packets [ 163.746801][ T7911] netlink: 4 bytes leftover after parsing attributes in process `syz.2.886'. [ 164.072570][ T7925] smc: net device ip6tnl0 applied user defined pnetid SYZ2 [ 164.247848][ T7933] hsr0: entered promiscuous mode [ 164.387354][ T7938] ɶƣ0G3w: entered promiscuous mode [ 164.630918][ T7943] xt_ecn: cannot match TCP bits for non-tcp packets [ 165.191538][ T7958] smc: net device ip6tnl0 erased user defined pnetid SYZ2 [ 165.823461][ T7980] ɶƣ0G4w: entered promiscuous mode [ 165.936154][ T7994] netlink: 4 bytes leftover after parsing attributes in process `syz.2.912'. [ 166.357106][ T8008] xt_ecn: cannot match TCP bits for non-tcp packets [ 167.339818][ T8032] FAULT_INJECTION: forcing a failure. [ 167.339818][ T8032] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 167.364183][ T8032] CPU: 1 PID: 8032 Comm: syz.2.930 Not tainted 6.10.0-rc6-syzkaller-00165-g0ec986ed7bab #0 [ 167.374256][ T8032] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 [ 167.384369][ T8032] Call Trace: [ 167.387689][ T8032] [ 167.390748][ T8032] dump_stack_lvl+0x241/0x360 [ 167.395493][ T8032] ? __pfx_dump_stack_lvl+0x10/0x10 [ 167.400764][ T8032] ? __pfx__printk+0x10/0x10 [ 167.405436][ T8032] ? snprintf+0xda/0x120 [ 167.409747][ T8032] should_fail_ex+0x3b0/0x4e0 [ 167.414523][ T8032] _copy_to_user+0x2f/0xb0 [ 167.419145][ T8032] simple_read_from_buffer+0xca/0x150 [ 167.424602][ T8032] proc_fail_nth_read+0x1e9/0x250 [ 167.429711][ T8032] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 167.435339][ T8032] ? rw_verify_area+0x520/0x6b0 [ 167.440266][ T8032] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 167.445888][ T8032] vfs_read+0x204/0xbc0 [ 167.450102][ T8032] ? __pfx_lock_release+0x10/0x10 [ 167.455229][ T8032] ? __pfx_vfs_read+0x10/0x10 [ 167.459991][ T8032] ? __fget_files+0x29/0x470 [ 167.464674][ T8032] ? __fget_files+0x3f6/0x470 [ 167.469454][ T8032] ksys_read+0x1a0/0x2c0 [ 167.473783][ T8032] ? __pfx_ksys_read+0x10/0x10 [ 167.478625][ T8032] ? do_syscall_64+0x100/0x230 [ 167.483471][ T8032] ? do_syscall_64+0xb6/0x230 [ 167.488244][ T8032] do_syscall_64+0xf3/0x230 [ 167.492841][ T8032] ? clear_bhb_loop+0x35/0x90 [ 167.497607][ T8032] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 167.503575][ T8032] RIP: 0033:0x7f26ab7746bc [ 167.508059][ T8032] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 c9 8c 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 1f 8d 02 00 48 [ 167.527827][ T8032] RSP: 002b:00007f26ac4bb040 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 167.536342][ T8032] RAX: ffffffffffffffda RBX: 00007f26ab903f60 RCX: 00007f26ab7746bc [ 167.544391][ T8032] RDX: 000000000000000f RSI: 00007f26ac4bb0b0 RDI: 0000000000000004 [ 167.552429][ T8032] RBP: 00007f26ac4bb0a0 R08: 0000000000000000 R09: 0000000000000014 [ 167.560450][ T8032] R10: 0000000074cb0000 R11: 0000000000000246 R12: 0000000000000002 [ 167.568502][ T8032] R13: 000000000000000b R14: 00007f26ab903f60 R15: 00007ffe3ee03ea8 [ 167.576559][ T8032] [ 167.686415][ T8044] xt_ecn: cannot match TCP bits for non-tcp packets [ 167.769969][ T8046] x_tables: duplicate underflow at hook 2 [ 168.010484][ T8054] netlink: 4 bytes leftover after parsing attributes in process `syz.3.935'. [ 168.412558][ T8067] ɶƣ0G2w: entered promiscuous mode [ 168.905451][ T8088] netlink: 40 bytes leftover after parsing attributes in process `syz.2.950'. [ 168.936831][ T8088] netlink: 40 bytes leftover after parsing attributes in process `syz.2.950'. [ 169.271158][ T8096] netlink: 12 bytes leftover after parsing attributes in process `syz.4.953'. [ 169.301432][ T8096] netlink: 'syz.4.953': attribute type 18 has an invalid length. [ 169.373122][ T8096] xt_bpf: check failed: parse error [ 169.525459][ T8110] xt_ecn: cannot match TCP bits for non-tcp packets [ 169.698453][ T8118] netlink: 'syz.1.960': attribute type 10 has an invalid length. [ 169.732725][ T8118] netlink: 2 bytes leftover after parsing attributes in process `syz.1.960'. [ 169.741581][ T8118] team0: entered promiscuous mode [ 169.771995][ T8118] team_slave_0: entered promiscuous mode [ 169.778175][ T8118] team_slave_1: entered promiscuous mode [ 169.788040][ T8118] batadv1: entered promiscuous mode [ 169.798724][ T8118] bridge0: port 3(team0) entered blocking state [ 169.811595][ T8118] bridge0: port 3(team0) entered disabled state [ 169.814759][ T8122] netlink: 'syz.2.963': attribute type 3 has an invalid length. [ 169.822812][ T8118] team0: entered allmulticast mode [ 169.842226][ T8118] team_slave_0: entered allmulticast mode [ 169.848163][ T8118] team_slave_1: entered allmulticast mode [ 169.856868][ T8118] batadv1: entered allmulticast mode [ 169.944533][ T34] batman_adv: batadv1: No IGMP Querier present - multicast optimizations disabled [ 169.954534][ T34] batman_adv: batadv1: No MLD Querier present - multicast optimizations disabled [ 170.064716][ T8131] netlink: 'syz.2.965': attribute type 21 has an invalid length. [ 170.083625][ T8131] netlink: 'syz.2.965': attribute type 1 has an invalid length. [ 170.760756][ T8152] netlink: 12 bytes leftover after parsing attributes in process `syz.1.974'. [ 170.802157][ T8152] netlink: 12 bytes leftover after parsing attributes in process `syz.1.974'. [ 170.822202][ T8152] netlink: 40 bytes leftover after parsing attributes in process `syz.1.974'. [ 170.831345][ T8156] netlink: 40 bytes leftover after parsing attributes in process `syz.4.975'. [ 171.090371][ T8171] xt_ecn: cannot match TCP bits for non-tcp packets [ 171.529980][ T8178] FAULT_INJECTION: forcing a failure. [ 171.529980][ T8178] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 171.545230][ T8178] CPU: 0 PID: 8178 Comm: syz.1.983 Not tainted 6.10.0-rc6-syzkaller-00165-g0ec986ed7bab #0 [ 171.555258][ T8178] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 [ 171.565334][ T8178] Call Trace: [ 171.568630][ T8178] [ 171.571577][ T8178] dump_stack_lvl+0x241/0x360 [ 171.576293][ T8178] ? __pfx_dump_stack_lvl+0x10/0x10 [ 171.581510][ T8178] ? __pfx__printk+0x10/0x10 [ 171.586135][ T8178] ? __pfx_lock_release+0x10/0x10 [ 171.591171][ T8178] should_fail_ex+0x3b0/0x4e0 [ 171.595872][ T8178] _copy_from_user+0x2f/0xe0 [ 171.600500][ T8178] copy_msghdr_from_user+0xae/0x680 [ 171.605722][ T8178] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 171.611583][ T8178] do_recvmmsg+0x40f/0xae0 [ 171.616048][ T8178] ? __pfx_lock_release+0x10/0x10 [ 171.621108][ T8178] ? __pfx_do_recvmmsg+0x10/0x10 [ 171.626197][ T8178] ? __pfx_rcu_read_lock_any_held+0x10/0x10 [ 171.632131][ T8178] ? ksys_write+0x23e/0x2c0 [ 171.636663][ T8178] ? __pfx_lock_release+0x10/0x10 [ 171.641717][ T8178] ? vfs_write+0x7c4/0xc90 [ 171.646167][ T8178] ? __mutex_unlock_slowpath+0x21d/0x750 [ 171.651828][ T8178] ? __fget_files+0x3f6/0x470 [ 171.656653][ T8178] __x64_sys_recvmmsg+0x199/0x250 [ 171.661728][ T8178] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 171.667312][ T8178] ? do_syscall_64+0x100/0x230 [ 171.672114][ T8178] ? do_syscall_64+0xb6/0x230 [ 171.676833][ T8178] do_syscall_64+0xf3/0x230 [ 171.681818][ T8178] ? clear_bhb_loop+0x35/0x90 [ 171.686591][ T8178] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 171.692527][ T8178] RIP: 0033:0x7f63ca575bd9 [ 171.696978][ T8178] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 171.716634][ T8178] RSP: 002b:00007f63cb321048 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 171.724630][ T8182] netlink: 8 bytes leftover after parsing attributes in process `syz.0.984'. [ 171.725068][ T8178] RAX: ffffffffffffffda RBX: 00007f63ca703f60 RCX: 00007f63ca575bd9 [ 171.725090][ T8178] RDX: 0000000000000001 RSI: 0000000020000fc0 RDI: 0000000000000003 [ 171.725106][ T8178] RBP: 00007f63cb3210a0 R08: 0000000000000000 R09: 0000000000000000 [ 171.725121][ T8178] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 171.725135][ T8178] R13: 000000000000000b R14: 00007f63ca703f60 R15: 00007fffdb88e898 [ 171.725169][ T8178] [ 172.523786][ T8205] ɶƣ0G1w: entered promiscuous mode [ 172.583819][ T8207] (unnamed net_device) (uninitialized): option ad_actor_sys_prio: mode dependency failed, not supported in mode balance-rr(0) [ 172.737910][ T8211] FAULT_INJECTION: forcing a failure. [ 172.737910][ T8211] name failslab, interval 1, probability 0, space 0, times 0 [ 172.781700][ T8211] CPU: 1 PID: 8211 Comm: syz.4.994 Not tainted 6.10.0-rc6-syzkaller-00165-g0ec986ed7bab #0 [ 172.791746][ T8211] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 [ 172.801831][ T8211] Call Trace: [ 172.805126][ T8211] [ 172.808094][ T8211] dump_stack_lvl+0x241/0x360 [ 172.812794][ T8211] ? __pfx_dump_stack_lvl+0x10/0x10 [ 172.818011][ T8211] ? __pfx__printk+0x10/0x10 [ 172.822619][ T8211] ? netlink_insert+0x10b7/0x14b0 [ 172.827655][ T8211] should_fail_ex+0x3b0/0x4e0 [ 172.832346][ T8211] ? __alloc_skb+0x1c3/0x440 [ 172.836950][ T8211] should_failslab+0x9/0x20 [ 172.841472][ T8211] kmem_cache_alloc_node_noprof+0x71/0x320 [ 172.847308][ T8211] __alloc_skb+0x1c3/0x440 [ 172.851740][ T8211] ? __pfx___alloc_skb+0x10/0x10 [ 172.856687][ T8211] ? netlink_autobind+0xd6/0x2f0 [ 172.861644][ T8211] ? netlink_autobind+0x2b0/0x2f0 [ 172.866689][ T8211] netlink_sendmsg+0x631/0xcb0 [ 172.871476][ T8211] ? __pfx_netlink_sendmsg+0x10/0x10 [ 172.876771][ T8211] ? __import_iovec+0x536/0x820 [ 172.881621][ T8211] ? aa_sock_msg_perm+0x91/0x160 [ 172.886579][ T8211] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 172.891868][ T8211] ? security_socket_sendmsg+0x87/0xb0 [ 172.897352][ T8211] ? __pfx_netlink_sendmsg+0x10/0x10 [ 172.902648][ T8211] __sock_sendmsg+0x221/0x270 [ 172.907344][ T8211] ____sys_sendmsg+0x525/0x7d0 [ 172.912125][ T8211] ? __pfx_____sys_sendmsg+0x10/0x10 [ 172.917433][ T8211] __sys_sendmsg+0x2b0/0x3a0 [ 172.922039][ T8211] ? __pfx___sys_sendmsg+0x10/0x10 [ 172.927157][ T8211] ? vfs_write+0x7c4/0xc90 [ 172.931613][ T8211] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 172.937953][ T8211] ? do_syscall_64+0x100/0x230 [ 172.942736][ T8211] ? do_syscall_64+0xb6/0x230 [ 172.947426][ T8211] do_syscall_64+0xf3/0x230 [ 172.951940][ T8211] ? clear_bhb_loop+0x35/0x90 [ 172.956633][ T8211] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 172.962552][ T8211] RIP: 0033:0x7f193af75bd9 [ 172.966975][ T8211] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 172.986604][ T8211] RSP: 002b:00007f193bd11048 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 172.995034][ T8211] RAX: ffffffffffffffda RBX: 00007f193b103f60 RCX: 00007f193af75bd9 [ 173.003019][ T8211] RDX: 0000000000000000 RSI: 0000000020000140 RDI: 0000000000000003 [ 173.010997][ T8211] RBP: 00007f193bd110a0 R08: 0000000000000000 R09: 0000000000000000 [ 173.018995][ T8211] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 173.026970][ T8211] R13: 000000000000000b R14: 00007f193b103f60 R15: 00007ffcd03e0a38 [ 173.034960][ T8211] [ 173.178182][ C1] vxcan0: j1939_tp_rxtimer: 0xffff88802d510400: rx timeout, send abort [ 173.187051][ C1] vxcan0: j1939_tp_rxtimer: 0xffff88802d513000: rx timeout, send abort [ 173.196157][ C1] vxcan0: j1939_xtp_rx_abort_one: 0xffff88802d510400: 0x00000: (3) A timeout occurred and this is the connection abort to close the session. [ 173.211892][ C1] vxcan0: j1939_xtp_rx_abort_one: 0xffff88802d513000: 0x00000: (3) A timeout occurred and this is the connection abort to close the session. [ 173.310567][ T8223] xt_ecn: cannot match TCP bits for non-tcp packets [ 173.384196][ T8224] batadv0: entered promiscuous mode [ 173.448157][ T8224] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 173.556150][ T8239] netlink: 'syz.0.1002': attribute type 10 has an invalid length. [ 173.575528][ T8239] __nla_validate_parse: 1 callbacks suppressed [ 173.575547][ T8239] netlink: 2 bytes leftover after parsing attributes in process `syz.0.1002'. [ 173.612529][ T8239] team0: entered promiscuous mode [ 173.622705][ T8239] team_slave_0: entered promiscuous mode [ 173.660712][ T8239] team_slave_1: entered promiscuous mode [ 173.679853][ T8243] netlink: 'syz.2.1005': attribute type 75 has an invalid length. [ 173.691522][ T8239] bridge0: port 2(team0) entered blocking state [ 173.701269][ T8239] bridge0: port 2(team0) entered disabled state [ 173.713312][ T8239] team0: entered allmulticast mode [ 173.746928][ T8239] team_slave_0: entered allmulticast mode [ 173.756118][ T8239] team_slave_1: entered allmulticast mode [ 173.791162][ T8239] bridge0: port 2(team0) entered blocking state [ 173.797684][ T8239] bridge0: port 2(team0) entered forwarding state [ 173.988375][ T8262] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1012'. [ 174.054081][ T8262] bridge0: port 2(bridge_slave_1) entered disabled state [ 174.229831][ T8267] netlink: 180 bytes leftover after parsing attributes in process `syz.4.1016'. [ 174.264076][ T8268] netlink: 180 bytes leftover after parsing attributes in process `syz.1.1015'. [ 174.294076][ T8268] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 174.302895][ T8267] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 174.362369][ T8276] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 174.387438][ T8278] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1018'. [ 174.408683][ T8267] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 174.439866][ T8276] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 174.515284][ T8267] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 174.682206][ T8288] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 174.809894][ T8295] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1026'. [ 175.236254][ T8306] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1030'. [ 175.286841][ T8307] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1028'. [ 175.326647][ T8309] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1031'. [ 175.340824][ T8309] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1031'. [ 175.659769][ T8316] veth6: entered allmulticast mode [ 175.768185][ T8316] syzkaller0: entered promiscuous mode [ 175.774019][ T8316] syzkaller0: entered allmulticast mode [ 178.548982][ T8336] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 178.656621][ T8336] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 178.748967][ T8336] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 178.946529][ T8354] __nla_validate_parse: 7 callbacks suppressed [ 178.946549][ T8354] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1044'. [ 179.176495][ T8365] xt_CT: You must specify a L4 protocol and not use inversions on it [ 179.244780][ T8367] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1050'. [ 179.384487][ T8369] sctp: [Deprecated]: syz.1.1051 (pid 8369) Use of int in maxseg socket option. [ 179.384487][ T8369] Use struct sctp_assoc_value instead [ 179.770824][ T8387] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1057'. [ 179.894045][ T8392] netlink: 'syz.0.1059': attribute type 10 has an invalid length. [ 180.012801][ T8392] team0: Device veth1_macvtap failed to register rx_handler [ 180.137912][ T8399] netlink: 40 bytes leftover after parsing attributes in process `syz.4.1062'. [ 180.180304][ T8401] netlink: 180 bytes leftover after parsing attributes in process `syz.1.1063'. [ 180.219870][ T8401] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 180.339032][ T8401] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 180.399072][ T8405] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 180.450388][ T8405] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 180.486783][ T8401] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 180.996144][ T8425] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1067'. [ 181.061413][ T8427] netlink: 'syz.1.1068': attribute type 3 has an invalid length. [ 181.085733][ T8427] netlink: 132 bytes leftover after parsing attributes in process `syz.1.1068'. [ 181.108323][ T8427] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1068'. [ 181.119201][ T8427] netlink: 14601 bytes leftover after parsing attributes in process `syz.1.1068'. [ 181.458697][ T8430] veth0_vlan: left promiscuous mode [ 181.797069][ T8448] netlink: 40 bytes leftover after parsing attributes in process `syz.4.1076'. [ 182.002963][ T8455] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 182.106070][ T8455] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 182.212244][ T8455] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 182.357589][ T8472] sctp: [Deprecated]: syz.4.1086 (pid 8472) Use of int in maxseg socket option. [ 182.357589][ T8472] Use struct sctp_assoc_value instead [ 183.313421][ T8519] xt_ecn: cannot match TCP bits for non-tcp packets [ 183.347953][ C1] TCP: MD5 Hash mismatch for [::1].2->[::1].2 [.]L3 index 0 [ 183.355919][ C1] TCP: MD5 Hash mismatch for [::1].2->[::1].2 [P.]L3 index 0 [ 183.644646][ T8529] bond1: entered promiscuous mode [ 183.696876][ T8529] bond1: (slave vxcan3): The slave device specified does not support setting the MAC address [ 183.713639][ T8529] bond1: (slave vxcan3): Error -95 calling set_mac_address [ 183.748227][ T8532] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 183.834879][ T8532] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 183.898663][ T8532] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 183.913671][ C1] TCP: MD5 Hash mismatch for [::1].2->[::1].2 [.]L3 index 0 [ 183.921279][ C1] TCP: MD5 Hash mismatch for [::1].2->[::1].2 [P.]L3 index 0 [ 184.136255][ T8537] __nla_validate_parse: 8 callbacks suppressed [ 184.136279][ T8537] netlink: 830 bytes leftover after parsing attributes in process `syz.3.1107'. [ 184.411354][ T8548] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1112'. [ 184.435891][ T8548] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1112'. [ 184.461329][ T8549] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1111'. [ 184.467542][ T8548] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1112'. [ 184.862875][ T8562] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1117'. [ 184.937376][ C0] TCP: MD5 Hash mismatch for [::1].2->[::1].2 [.]L3 index 0 [ 184.945407][ C0] TCP: MD5 Hash mismatch for [::1].2->[::1].2 [P.]L3 index 0 [ 185.059604][ T8569] xt_ecn: cannot match TCP bits for non-tcp packets [ 185.712933][ T8587] netlink: 180 bytes leftover after parsing attributes in process `syz.0.1123'. [ 185.750033][ T8587] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 185.845870][ T8587] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 185.945847][ T8590] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 186.318541][ T8600] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1129'. [ 187.335378][ C0] TCP: MD5 Hash mismatch for [::1].2->[::1].2 [.]L3 index 0 [ 187.343279][ C0] TCP: MD5 Hash mismatch for [::1].2->[::1].2 [P.]L3 index 0 [ 188.250798][ T8597] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 188.359632][ T8597] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 189.011966][ T8597] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 189.031704][ T8597] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 189.051787][ T8597] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 189.060723][ T8597] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 189.269094][ T8611] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1132'. [ 189.281753][ T8611] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1132'. [ 189.290868][ T8611] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1132'. [ 189.330132][ T8623] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1134'. [ 189.507484][ T8645] FAULT_INJECTION: forcing a failure. [ 189.507484][ T8645] name failslab, interval 1, probability 0, space 0, times 0 [ 189.562997][ T8645] CPU: 1 PID: 8645 Comm: syz.4.1137 Not tainted 6.10.0-rc6-syzkaller-00165-g0ec986ed7bab #0 [ 189.573132][ T8645] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 [ 189.583232][ T8645] Call Trace: [ 189.586520][ T8645] [ 189.589459][ T8645] dump_stack_lvl+0x241/0x360 [ 189.594175][ T8645] ? __pfx_dump_stack_lvl+0x10/0x10 [ 189.599402][ T8645] ? __pfx__printk+0x10/0x10 [ 189.604014][ T8645] ? __pfx___might_resched+0x10/0x10 [ 189.609315][ T8645] ? __asan_memset+0x23/0x50 [ 189.613923][ T8645] ? lockdep_init_map_type+0xa1/0x910 [ 189.619320][ T8645] should_fail_ex+0x3b0/0x4e0 [ 189.624035][ T8645] should_failslab+0x9/0x20 [ 189.628556][ T8645] __kmalloc_node_noprof+0xdf/0x440 [ 189.633769][ T8645] ? kvmalloc_node_noprof+0x72/0x190 [ 189.639075][ T8645] kvmalloc_node_noprof+0x72/0x190 [ 189.644216][ T8645] alloc_netdev_mqs+0xa21/0xf80 [ 189.649097][ T8645] rtnl_create_link+0x2f9/0xc20 [ 189.653967][ T8645] rtnl_newlink+0x1421/0x20a0 [ 189.658662][ T8645] ? __kernel_text_address+0xd/0x40 [ 189.663884][ T8645] ? rtnl_newlink+0xab1/0x20a0 [ 189.668683][ T8645] ? __pfx_rtnl_newlink+0x10/0x10 [ 189.673723][ T8645] ? __pfx___mutex_trylock_common+0x10/0x10 [ 189.679643][ T8645] ? rcu_is_watching+0x15/0xb0 [ 189.684433][ T8645] ? trace_contention_end+0x3c/0x120 [ 189.689743][ T8645] ? __mutex_lock+0x2ef/0xd70 [ 189.694443][ T8645] ? __pfx_lock_release+0x10/0x10 [ 189.699490][ T8645] ? __pfx_rtnl_newlink+0x10/0x10 [ 189.704531][ T8645] rtnetlink_rcv_msg+0x89b/0x1180 [ 189.709574][ T8645] ? rtnetlink_rcv_msg+0x208/0x1180 [ 189.714788][ T8645] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 189.720266][ T8645] ? lockdep_hardirqs_on_prepare+0x43d/0x780 [ 189.726274][ T8645] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 189.732616][ T8645] ? __local_bh_enable_ip+0x168/0x200 [ 189.737990][ T8645] ? lockdep_hardirqs_on+0x99/0x150 [ 189.743216][ T8645] ? __local_bh_enable_ip+0x168/0x200 [ 189.748593][ T8645] ? dev_hard_start_xmit+0x773/0x7e0 [ 189.753885][ T8645] ? __dev_queue_xmit+0x2d2/0x3d30 [ 189.759003][ T8645] ? __pfx___local_bh_enable_ip+0x10/0x10 [ 189.764728][ T8645] ? __dev_queue_xmit+0x2d2/0x3d30 [ 189.769843][ T8645] ? __dev_queue_xmit+0x16c9/0x3d30 [ 189.775061][ T8645] ? __dev_queue_xmit+0x2d2/0x3d30 [ 189.780191][ T8645] ? ref_tracker_free+0x643/0x7e0 [ 189.785248][ T8645] netlink_rcv_skb+0x1e3/0x430 [ 189.790037][ T8645] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 189.795528][ T8645] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 189.800880][ T8645] ? netlink_deliver_tap+0x2e/0x1b0 [ 189.806101][ T8645] netlink_unicast+0x7ea/0x980 [ 189.810893][ T8645] ? __pfx_netlink_unicast+0x10/0x10 [ 189.816275][ T8645] ? __virt_addr_valid+0x183/0x520 [ 189.821424][ T8645] ? __check_object_size+0x49c/0x900 [ 189.826735][ T8645] ? bpf_lsm_netlink_send+0x9/0x10 [ 189.831872][ T8645] netlink_sendmsg+0x8db/0xcb0 [ 189.836662][ T8645] ? __pfx_netlink_sendmsg+0x10/0x10 [ 189.841968][ T8645] ? __import_iovec+0x536/0x820 [ 189.846828][ T8645] ? aa_sock_msg_perm+0x91/0x160 [ 189.851788][ T8645] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 189.857079][ T8645] ? security_socket_sendmsg+0x87/0xb0 [ 189.862548][ T8645] ? __pfx_netlink_sendmsg+0x10/0x10 [ 189.867845][ T8645] __sock_sendmsg+0x221/0x270 [ 189.872551][ T8645] ____sys_sendmsg+0x525/0x7d0 [ 189.877357][ T8645] ? __pfx_____sys_sendmsg+0x10/0x10 [ 189.882689][ T8645] __sys_sendmsg+0x2b0/0x3a0 [ 189.887387][ T8645] ? __pfx___sys_sendmsg+0x10/0x10 [ 189.892569][ T8645] ? vfs_write+0x7c4/0xc90 [ 189.897059][ T8645] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 189.903406][ T8645] ? do_syscall_64+0x100/0x230 [ 189.908204][ T8645] ? do_syscall_64+0xb6/0x230 [ 189.912908][ T8645] do_syscall_64+0xf3/0x230 [ 189.917439][ T8645] ? clear_bhb_loop+0x35/0x90 [ 189.922151][ T8645] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 189.928163][ T8645] RIP: 0033:0x7f193af75bd9 [ 189.932585][ T8645] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 189.952201][ T8645] RSP: 002b:00007f193bd11048 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 189.960652][ T8645] RAX: ffffffffffffffda RBX: 00007f193b103f60 RCX: 00007f193af75bd9 [ 189.968628][ T8645] RDX: 0000000000000000 RSI: 0000000020000280 RDI: 0000000000000008 [ 189.976631][ T8645] RBP: 00007f193bd110a0 R08: 0000000000000000 R09: 0000000000000000 [ 189.984612][ T8645] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 189.992596][ T8645] R13: 000000000000000b R14: 00007f193b103f60 R15: 00007ffcd03e0a38 [ 190.000595][ T8645] [ 190.039173][ T8651] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1139'. [ 190.229384][ T8651] veth0: entered promiscuous mode [ 190.307792][ T8651] veth0: left promiscuous mode [ 190.389439][ T8654] netlink: 180 bytes leftover after parsing attributes in process `syz.0.1141'. [ 190.416518][ T8654] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 190.458275][ T8662] netlink: 'syz.4.1140': attribute type 10 has an invalid length. [ 190.467656][ T8662] netlink: 2 bytes leftover after parsing attributes in process `syz.4.1140'. [ 190.485529][ T8662] team0: entered promiscuous mode [ 190.490666][ T8662] team_slave_0: entered promiscuous mode [ 190.504109][ T8662] team_slave_1: entered promiscuous mode [ 190.516841][ T8662] bridge0: port 4(team0) entered blocking state [ 190.521769][ T8654] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 190.528486][ T8662] bridge0: port 4(team0) entered disabled state [ 190.549202][ T8662] team0: entered allmulticast mode [ 190.557118][ T8662] team_slave_0: entered allmulticast mode [ 190.571565][ T8662] team_slave_1: entered allmulticast mode [ 190.585662][ T8662] bridge0: port 4(team0) entered blocking state [ 190.592175][ T8662] bridge0: port 4(team0) entered forwarding state [ 190.607595][ T8660] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 191.427330][ T8676] 0XD: left allmulticast mode [ 191.518367][ C0] TCP: MD5 Hash mismatch for [::1].2->[::1].2 [.]L3 index 0 [ 191.526189][ C0] TCP: MD5 Hash mismatch for [::1].2->[::1].2 [P.]L3 index 0 [ 192.084617][ C1] TCP: MD5 Hash mismatch for [::1].2->[::1].2 [.]L3 index 0 [ 192.092188][ C1] TCP: MD5 Hash mismatch for [::1].2->[::1].2 [P.]L3 index 0 [ 192.492677][ T8676] bridge0: port 4(team0) entered disabled state [ 192.499270][ T8676] bridge0: port 1(bridge_slave_0) entered disabled state [ 193.003304][ T8700] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1154'. [ 193.338508][ T8676] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 193.412129][ T8676] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 193.447411][ T8676] batman_adv: batadv0: Interface deactivated: veth0_to_hsr [ 193.894522][ T8676] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 193.904304][ T8676] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 193.921834][ T8676] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 193.930921][ T8676] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 194.013858][ T8676] netdevsim netdevsim4 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 194.024728][ T8676] netdevsim netdevsim4 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 194.033847][ T8676] netdevsim netdevsim4 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 194.042835][ T8676] netdevsim netdevsim4 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 194.060254][ T8676] vxlan0: left promiscuous mode [ 194.070734][ T8676] bridge0: left promiscuous mode [ 194.078537][ T8676] macvlan2: left promiscuous mode [ 194.086994][ T8676] vlan2: left promiscuous mode [ 194.103247][ T8676] veth6: left allmulticast mode [ 194.110433][ T8678] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1148'. [ 194.171910][ T8696] ɶƣ0G2w: entered promiscuous mode [ 194.202852][ T8705] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1156'. [ 194.642527][ T8727] __nla_validate_parse: 2 callbacks suppressed [ 194.642547][ T8727] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1163'. [ 194.719716][ T8727] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1163'. [ 194.885860][ T8735] FAULT_INJECTION: forcing a failure. [ 194.885860][ T8735] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 194.907633][ T8730] @: renamed from veth0_vlan (while UP) [ 194.940911][ T8735] CPU: 1 PID: 8735 Comm: syz.3.1166 Not tainted 6.10.0-rc6-syzkaller-00165-g0ec986ed7bab #0 [ 194.951130][ T8735] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 [ 194.961308][ T8735] Call Trace: [ 194.964620][ T8735] [ 194.967592][ T8735] dump_stack_lvl+0x241/0x360 [ 194.972334][ T8735] ? __pfx_dump_stack_lvl+0x10/0x10 [ 194.978105][ T8735] ? __pfx__printk+0x10/0x10 [ 194.982740][ T8735] ? bpf_cgroup_storage_free+0x8f/0xb0 [ 194.988260][ T8735] ? __pfx_lock_release+0x10/0x10 [ 194.993317][ T8735] ? bpf_test_run+0x840/0x910 [ 194.998053][ T8735] should_fail_ex+0x3b0/0x4e0 [ 195.002794][ T8735] _copy_to_user+0x2f/0xb0 [ 195.007254][ T8735] bpf_test_finish+0x22c/0x8b0 [ 195.012088][ T8735] ? __might_fault+0xaa/0x120 [ 195.016811][ T8735] ? __pfx_bpf_test_finish+0x10/0x10 [ 195.022143][ T8735] ? _copy_from_user+0xa6/0xe0 [ 195.026962][ T8735] ? bpf_test_init+0x15a/0x180 [ 195.031771][ T8735] bpf_prog_test_run_xdp+0x905/0x11b0 [ 195.037209][ T8735] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 195.043065][ T8735] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 195.048935][ T8735] ? fput+0x45/0x210 [ 195.052867][ T8735] ? bpf_prog_test_run+0x32b/0x3b0 [ 195.058042][ T8735] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 195.063903][ T8735] bpf_prog_test_run+0x33a/0x3b0 [ 195.068894][ T8735] __sys_bpf+0x48d/0x810 [ 195.073206][ T8735] ? __pfx___sys_bpf+0x10/0x10 [ 195.078053][ T8735] ? lockdep_hardirqs_on_prepare+0x43d/0x780 [ 195.084154][ T8735] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 195.090524][ T8735] ? do_syscall_64+0x100/0x230 [ 195.095340][ T8735] __x64_sys_bpf+0x7c/0x90 [ 195.099810][ T8735] do_syscall_64+0xf3/0x230 [ 195.104374][ T8735] ? clear_bhb_loop+0x35/0x90 [ 195.109106][ T8735] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 195.115058][ T8735] RIP: 0033:0x7f0243175bd9 [ 195.119518][ T8735] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 195.139169][ T8735] RSP: 002b:00007f0244005048 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 195.147612][ T8735] RAX: ffffffffffffffda RBX: 00007f0243303f60 RCX: 00007f0243175bd9 [ 195.155594][ T8735] RDX: 0000000000000010 RSI: 0000000020000740 RDI: 000000000000000a [ 195.163746][ T8735] RBP: 00007f02440050a0 R08: 0000000000000000 R09: 0000000000000000 [ 195.171817][ T8735] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 195.179804][ T8735] R13: 000000000000000b R14: 00007f0243303f60 R15: 00007ffef664d278 [ 195.187807][ T8735] [ 195.228401][ T1249] ieee802154 phy0 wpan0: encryption failed: -22 [ 195.242030][ T1249] ieee802154 phy1 wpan1: encryption failed: -22 [ 195.609806][ C0] TCP: MD5 Hash mismatch for [::1].2->[::1].2 [.]L3 index 0 [ 195.617629][ C0] TCP: MD5 Hash mismatch for [::1].2->[::1].2 [P.]L3 index 0 [ 197.071094][ T8738] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1167'. [ 197.293943][ T8753] macvlan2: entered allmulticast mode [ 197.330482][ T8753] mac80211_hwsim hwsim15 wlan0: entered promiscuous mode [ 197.375708][ T8753] mac80211_hwsim hwsim15 wlan0: entered allmulticast mode [ 197.416564][ T8753] bond0: (slave macvlan2): Enslaving as an active interface with an up link [ 197.456633][ T8762] bond0: entered promiscuous mode [ 197.505897][ T8762] bond_slave_0: entered promiscuous mode [ 197.517211][ T8762] bond_slave_1: entered promiscuous mode [ 197.525002][ T8762] macvlan2: entered promiscuous mode [ 197.544584][ T8764] bridge0: port 4(batadv0) entered blocking state [ 197.554813][ T8774] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 197.556801][ T8764] bridge0: port 4(batadv0) entered disabled state [ 197.590208][ T8764] batadv0: entered allmulticast mode [ 197.605122][ T8764] bridge0: port 4(batadv0) entered blocking state [ 197.611789][ T8764] bridge0: port 4(batadv0) entered forwarding state [ 197.696595][ T8778] netlink: 'syz.3.1181': attribute type 15 has an invalid length. [ 197.731556][ T8778] netlink: 25 bytes leftover after parsing attributes in process `syz.3.1181'. [ 197.862567][ T8782] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1183'. [ 197.936542][ T62] batman_adv: batadv0: No IGMP Querier present - multicast optimizations disabled [ 197.946174][ T62] batman_adv: batadv0: No MLD Querier present - multicast optimizations disabled [ 198.104051][ T8799] netlink: 'syz.2.1186': attribute type 1 has an invalid length. [ 198.124673][ T8799] netlink: 9372 bytes leftover after parsing attributes in process `syz.2.1186'. [ 198.146554][ T8799] netlink: 'syz.2.1186': attribute type 1 has an invalid length. [ 198.275243][ T8804] netlink: 'syz.0.1190': attribute type 3 has an invalid length. [ 198.334233][ T8804] netlink: 130984 bytes leftover after parsing attributes in process `syz.0.1190'. [ 198.358128][ T8808] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1192'. [ 198.364539][ T8807] netlink: 292 bytes leftover after parsing attributes in process `syz.1.1191'. [ 198.376075][ T8808] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1192'. [ 198.455553][ T8808] netlink: 'syz.4.1192': attribute type 10 has an invalid length. [ 198.852577][ T8827] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 198.941992][ T8827] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 198.957339][ T8833] FAULT_INJECTION: forcing a failure. [ 198.957339][ T8833] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 198.974614][ T8833] CPU: 0 PID: 8833 Comm: syz.4.1201 Not tainted 6.10.0-rc6-syzkaller-00165-g0ec986ed7bab #0 [ 198.984885][ T8833] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 [ 198.995091][ T8833] Call Trace: [ 198.998440][ T8833] [ 199.001444][ T8833] dump_stack_lvl+0x241/0x360 [ 199.006230][ T8833] ? __pfx_dump_stack_lvl+0x10/0x10 [ 199.011575][ T8833] ? __pfx__printk+0x10/0x10 [ 199.016265][ T8833] ? __pfx_lock_release+0x10/0x10 [ 199.021369][ T8833] ? __lock_acquire+0x1346/0x1fd0 [ 199.024852][ T8827] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 199.026450][ T8833] should_fail_ex+0x3b0/0x4e0 [ 199.040964][ T8833] _copy_from_user+0x2f/0xe0 [ 199.045617][ T8833] kstrtouint_from_user+0xc6/0x190 [ 199.050827][ T8833] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 199.056726][ T8833] ? __pfx_lock_acquire+0x10/0x10 [ 199.061833][ T8833] proc_fail_nth_write+0xaa/0x2d0 [ 199.066905][ T8833] ? __pfx_rcu_read_lock_any_held+0x10/0x10 [ 199.072858][ T8833] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 199.078528][ T8833] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 199.084286][ T8833] vfs_write+0x2a2/0xc90 [ 199.088649][ T8833] ? __pfx_vfs_write+0x10/0x10 [ 199.093446][ T8833] ? __fget_files+0x29/0x470 [ 199.098086][ T8833] ? __fget_files+0x3f6/0x470 [ 199.102896][ T8833] ksys_write+0x1a0/0x2c0 [ 199.107302][ T8833] ? __pfx_ksys_write+0x10/0x10 [ 199.112182][ T8833] ? do_syscall_64+0x100/0x230 [ 199.116988][ T8833] ? do_syscall_64+0xb6/0x230 [ 199.121701][ T8833] do_syscall_64+0xf3/0x230 [ 199.126247][ T8833] ? clear_bhb_loop+0x35/0x90 [ 199.130966][ T8833] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 199.136901][ T8833] RIP: 0033:0x7f193af7475f [ 199.141344][ T8833] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 29 8c 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 7c 8c 02 00 48 [ 199.160974][ T8833] RSP: 002b:00007f193bd11040 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 199.169417][ T8833] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f193af7475f [ 199.177414][ T8833] RDX: 0000000000000001 RSI: 00007f193bd110b0 RDI: 0000000000000004 [ 199.185414][ T8833] RBP: 00007f193bd110a0 R08: 0000000000000000 R09: 0000000000000000 [ 199.193406][ T8833] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000001 [ 199.201413][ T8833] R13: 000000000000000b R14: 00007f193b103f60 R15: 00007ffcd03e0a38 [ 199.209439][ T8833] [ 199.340807][ T8840] xt_ecn: cannot match TCP bits for non-tcp packets [ 199.712680][ T8852] __nla_validate_parse: 4 callbacks suppressed [ 199.712708][ T8852] netlink: 1028 bytes leftover after parsing attributes in process `syz.4.1208'. [ 199.762198][ T8852] sch_tbf: burst 0 is lower than device bridge_slave_0 mtu (1514) ! [ 199.877152][ T8859] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1208'. [ 199.907069][ T8859] netlink: 'syz.4.1208': attribute type 14 has an invalid length. [ 200.018142][ T8862] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1212'. [ 200.058493][ T8865] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1213'. [ 200.107133][ T8866] @: renamed from veth0_vlan (while UP) [ 200.155806][ C0] TCP: MD5 Hash mismatch for [::1].2->[::1].2 [.]L3 index 0 [ 200.163721][ C0] TCP: MD5 Hash mismatch for [::1].2->[::1].2 [P.]L3 index 0 [ 200.201043][ T8871] netlink: 'syz.4.1214': attribute type 1 has an invalid length. [ 200.229779][ T8871] netlink: 9372 bytes leftover after parsing attributes in process `syz.4.1214'. [ 200.308913][ T8871] netlink: 'syz.4.1214': attribute type 1 has an invalid length. [ 200.326135][ T8873] xt_ecn: cannot match TCP bits for non-tcp packets [ 200.636982][ T8879] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1217'. [ 200.705463][ C0] TCP: MD5 Hash mismatch for [::1].2->[::1].2 [.]L3 index 0 [ 200.713288][ C0] TCP: MD5 Hash mismatch for [::1].2->[::1].2 [P.]L3 index 0 [ 200.999378][ T8886] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1220'. [ 201.161566][ T8892] FAULT_INJECTION: forcing a failure. [ 201.161566][ T8892] name failslab, interval 1, probability 0, space 0, times 0 [ 201.174529][ T8892] CPU: 1 PID: 8892 Comm: syz.2.1222 Not tainted 6.10.0-rc6-syzkaller-00165-g0ec986ed7bab #0 [ 201.184674][ T8892] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 [ 201.194796][ T8892] Call Trace: [ 201.198142][ T8892] [ 201.201133][ T8892] dump_stack_lvl+0x241/0x360 [ 201.205907][ T8892] ? __pfx_dump_stack_lvl+0x10/0x10 [ 201.211296][ T8892] ? __pfx__printk+0x10/0x10 [ 201.216016][ T8892] should_fail_ex+0x3b0/0x4e0 [ 201.220787][ T8892] ? skb_clone+0x20c/0x390 [ 201.225289][ T8892] should_failslab+0x9/0x20 [ 201.229873][ T8892] kmem_cache_alloc_noprof+0x6c/0x2a0 [ 201.235338][ T8892] skb_clone+0x20c/0x390 [ 201.239668][ T8892] ? dev_queue_xmit_nit+0x220/0xc10 [ 201.244951][ T8892] dev_queue_xmit_nit+0x419/0xc10 [ 201.250055][ T8892] ? dev_queue_xmit_nit+0x2b/0xc10 [ 201.255256][ T8892] ? validate_xmit_skb+0xa04/0x1120 [ 201.260555][ T8892] dev_hard_start_xmit+0x15f/0x7e0 [ 201.265757][ T8892] ? __pfx_validate_xmit_skb+0x10/0x10 [ 201.271315][ T8892] __dev_queue_xmit+0x1b0e/0x3d30 [ 201.276883][ T8892] ? __dev_queue_xmit+0x2d2/0x3d30 [ 201.282091][ T8892] ? __pfx___dev_queue_xmit+0x10/0x10 [ 201.287556][ T8892] ? __copy_skb_header+0x437/0x5b0 [ 201.292747][ T8892] ? __asan_memcpy+0x40/0x70 [ 201.297444][ T8892] ? __copy_skb_header+0x437/0x5b0 [ 201.302655][ T8892] ? __skb_clone+0x454/0x6c0 [ 201.307520][ T8892] ? skb_clone+0x240/0x390 [ 201.312074][ T8892] __netlink_deliver_tap+0x54d/0x7c0 [ 201.317491][ T8892] ? netlink_deliver_tap+0x2e/0x1b0 [ 201.322793][ T8892] netlink_deliver_tap+0x19d/0x1b0 [ 201.327989][ T8892] netlink_unicast+0x7b8/0x980 [ 201.332857][ T8892] ? __pfx_netlink_unicast+0x10/0x10 [ 201.338225][ T8892] ? __virt_addr_valid+0x183/0x520 [ 201.343429][ T8892] ? __check_object_size+0x49c/0x900 [ 201.348796][ T8892] ? bpf_lsm_netlink_send+0x9/0x10 [ 201.354090][ T8892] netlink_sendmsg+0x8db/0xcb0 [ 201.358947][ T8892] ? __pfx_netlink_sendmsg+0x10/0x10 [ 201.364317][ T8892] ? __import_iovec+0x536/0x820 [ 201.369259][ T8892] ? aa_sock_msg_perm+0x91/0x160 [ 201.374270][ T8892] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 201.379612][ T8892] ? security_socket_sendmsg+0x87/0xb0 [ 201.385127][ T8892] ? __pfx_netlink_sendmsg+0x10/0x10 [ 201.390565][ T8892] __sock_sendmsg+0x221/0x270 [ 201.395501][ T8892] ____sys_sendmsg+0x525/0x7d0 [ 201.400371][ T8892] ? __pfx_____sys_sendmsg+0x10/0x10 [ 201.405841][ T8892] __sys_sendmsg+0x2b0/0x3a0 [ 201.410523][ T8892] ? __pfx___sys_sendmsg+0x10/0x10 [ 201.415719][ T8892] ? vfs_write+0x7c4/0xc90 [ 201.420262][ T8892] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 201.426666][ T8892] ? do_syscall_64+0x100/0x230 [ 201.431514][ T8892] ? do_syscall_64+0xb6/0x230 [ 201.436267][ T8892] do_syscall_64+0xf3/0x230 [ 201.440853][ T8892] ? clear_bhb_loop+0x35/0x90 [ 201.445610][ T8892] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 201.451590][ T8892] RIP: 0033:0x7f26ab775bd9 [ 201.456049][ T8892] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 201.475801][ T8892] RSP: 002b:00007f26ac4bb048 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 201.484546][ T8892] RAX: ffffffffffffffda RBX: 00007f26ab903f60 RCX: 00007f26ab775bd9 [ 201.492583][ T8892] RDX: 0000000000000000 RSI: 0000000020000040 RDI: 0000000000000003 [ 201.500619][ T8892] RBP: 00007f26ac4bb0a0 R08: 0000000000000000 R09: 0000000000000000 [ 201.508660][ T8892] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 201.516698][ T8892] R13: 000000000000000b R14: 00007f26ab903f60 R15: 00007ffe3ee03ea8 [ 201.524758][ T8892] [ 201.605250][ T8902] xt_ecn: cannot match TCP bits for non-tcp packets [ 201.631957][ T8900] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1225'. [ 201.874847][ T8906] netlink: 'syz.4.1228': attribute type 9 has an invalid length. [ 201.988229][ T8914] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1229'. [ 202.223350][ T8928] netlink: 'syz.2.1236': attribute type 4 has an invalid length. [ 202.240464][ T8927] netlink: 9336 bytes leftover after parsing attributes in process `syz.3.1235'. [ 202.358539][ T8933] 0: renamed from hsr_slave_1 [ 202.389328][ T8933] 0: entered allmulticast mode [ 202.416100][ T8933] A link change request failed with some changes committed already. Interface c0 may have been left with an inconsistent configuration, please check. [ 202.444091][ T4489] Bluetooth: hci1: command 0x0406 tx timeout [ 202.444140][ T5112] Bluetooth: hci4: command 0x0405 tx timeout [ 202.452342][ T4489] Bluetooth: hci3: command 0x0406 tx timeout [ 202.735985][ T8950] vlan2: entered promiscuous mode [ 203.123689][ C0] TCP: MD5 Hash mismatch for [::1].2->[::1].2 [.]L3 index 0 [ 203.131530][ C0] TCP: MD5 Hash mismatch for [::1].2->[::1].2 [P.]L3 index 0 [ 203.659430][ T8983] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 203.921558][ T8991] validate_nla: 3 callbacks suppressed [ 203.921581][ T8991] netlink: 'syz.2.1260': attribute type 5 has an invalid length. [ 204.006028][ T8992] netlink: 'syz.3.1261': attribute type 4 has an invalid length. [ 204.052206][ T8992] netlink: 'syz.3.1261': attribute type 4 has an invalid length. [ 204.073370][ T8999] tipc: Failed to remove unknown binding: 66,1,1/5:4038672983/4038672985 [ 204.097574][ T8999] tipc: Failed to remove unknown binding: 66,1,1/5:4038672983/4038672985 [ 204.791303][ T9028] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 204.883209][ T9037] __nla_validate_parse: 16 callbacks suppressed [ 204.883232][ T9037] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1272'. [ 204.931272][ T9035] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1273'. [ 205.056028][ C1] TCP: MD5 Hash mismatch for [::1].2->[::1].2 [.]L3 index 0 [ 205.146147][ T9051] pim6reg1: entered promiscuous mode [ 205.153053][ T9051] pim6reg1: entered allmulticast mode [ 205.161862][ T9051] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1276'. [ 205.237778][ T9053] team0: Device is already in use. [ 205.358813][ T9057] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1280'. [ 205.885312][ T9067] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1284'. [ 205.922053][ T9067] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1284'. [ 205.940253][ T9067] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1284'. [ 206.390035][ T9091] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1291'. [ 206.615202][ T9098] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1293'. [ 206.819013][ T9102] ɶƣ0G2w: entered promiscuous mode [ 206.991358][ T9114] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1299'. [ 207.182434][ T9121] FAULT_INJECTION: forcing a failure. [ 207.182434][ T9121] name failslab, interval 1, probability 0, space 0, times 0 [ 207.218193][ T9121] CPU: 1 PID: 9121 Comm: syz.4.1301 Not tainted 6.10.0-rc6-syzkaller-00165-g0ec986ed7bab #0 [ 207.228406][ T9121] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 [ 207.238486][ T9121] Call Trace: [ 207.241789][ T9121] [ 207.244736][ T9121] dump_stack_lvl+0x241/0x360 [ 207.249460][ T9121] ? __pfx_dump_stack_lvl+0x10/0x10 [ 207.254678][ T9121] ? __pfx__printk+0x10/0x10 [ 207.259314][ T9121] ? netlink_insert+0x10b7/0x14b0 [ 207.264383][ T9121] should_fail_ex+0x3b0/0x4e0 [ 207.269070][ T9121] ? __alloc_skb+0x1c3/0x440 [ 207.273682][ T9121] should_failslab+0x9/0x20 [ 207.278221][ T9121] kmem_cache_alloc_node_noprof+0x71/0x320 [ 207.284051][ T9121] __alloc_skb+0x1c3/0x440 [ 207.288477][ T9121] ? __pfx___alloc_skb+0x10/0x10 [ 207.293421][ T9121] ? netlink_autobind+0xd6/0x2f0 [ 207.298373][ T9121] ? netlink_autobind+0x2b0/0x2f0 [ 207.303407][ T9121] netlink_sendmsg+0x631/0xcb0 [ 207.308190][ T9121] ? __pfx_netlink_sendmsg+0x10/0x10 [ 207.313502][ T9121] ? __import_iovec+0x536/0x820 [ 207.318385][ T9121] ? aa_sock_msg_perm+0x91/0x160 [ 207.323353][ T9121] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 207.328640][ T9121] ? security_socket_sendmsg+0x87/0xb0 [ 207.334105][ T9121] ? __pfx_netlink_sendmsg+0x10/0x10 [ 207.339396][ T9121] __sock_sendmsg+0x221/0x270 [ 207.344099][ T9121] ____sys_sendmsg+0x525/0x7d0 [ 207.348912][ T9121] ? __pfx_____sys_sendmsg+0x10/0x10 [ 207.354247][ T9121] __sys_sendmsg+0x2b0/0x3a0 [ 207.358887][ T9121] ? __pfx___sys_sendmsg+0x10/0x10 [ 207.364033][ T9121] ? vfs_write+0x7c4/0xc90 [ 207.368480][ T9121] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 207.374816][ T9121] ? do_syscall_64+0x100/0x230 [ 207.379589][ T9121] ? do_syscall_64+0xb6/0x230 [ 207.384287][ T9121] do_syscall_64+0xf3/0x230 [ 207.388802][ T9121] ? clear_bhb_loop+0x35/0x90 [ 207.393505][ T9121] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 207.399436][ T9121] RIP: 0033:0x7f193af75bd9 [ 207.403854][ T9121] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 207.423465][ T9121] RSP: 002b:00007f193bcf0048 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 207.431887][ T9121] RAX: ffffffffffffffda RBX: 00007f193b104038 RCX: 00007f193af75bd9 [ 207.439857][ T9121] RDX: 0000000000000000 RSI: 00000000200002c0 RDI: 000000000000000a [ 207.447825][ T9121] RBP: 00007f193bcf00a0 R08: 0000000000000000 R09: 0000000000000000 [ 207.455837][ T9121] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 207.463843][ T9121] R13: 000000000000006e R14: 00007f193b104038 R15: 00007ffcd03e0a38 [ 207.471845][ T9121] [ 208.690201][ C0] net_ratelimit: 1 callbacks suppressed [ 208.690225][ C0] TCP: MD5 Hash mismatch for [::1].2->[::1].2 [.]L3 index 0 [ 208.703673][ C0] TCP: MD5 Hash mismatch for [::1].2->[::1].2 [P.]L3 index 0 [ 209.926445][ T9229] trusted_key: syz.2.1335 sent an empty control message without MSG_MORE. [ 209.985984][ T9232] __nla_validate_parse: 16 callbacks suppressed [ 209.986005][ T9232] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1339'. [ 210.118353][ T9240] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1340'. [ 210.134737][ T9243] netlink: 'syz.0.1342': attribute type 8 has an invalid length. [ 210.335871][ T9251] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1346'. [ 210.346072][ T9251] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1346'. [ 210.363921][ T9251] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1346'. [ 210.580033][ T9259] netlink: 'syz.3.1349': attribute type 29 has an invalid length. [ 210.600489][ T9259] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1349'. [ 210.611364][ T9259] netlink: 'syz.3.1349': attribute type 29 has an invalid length. [ 210.621400][ T9259] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1349'. [ 210.787753][ T9265] IPVS: length: 131 != 8 [ 210.903330][ T9267] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1351'. [ 211.119551][ T9279] Bluetooth: hci3: unsupported parameter 64512 [ 211.158802][ T9279] Bluetooth: hci3: invalid length 0, exp 2 for type 15 [ 211.296780][ T9286] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1357'. [ 211.362846][ T9288] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1359'. [ 211.382585][ T9288] team0: left allmulticast mode [ 211.399486][ T9288] team_slave_0: left allmulticast mode [ 211.430848][ T9288] team_slave_1: left allmulticast mode [ 211.473187][ T9288] bridge0: port 2(team0) entered disabled state [ 211.499349][ T9288] bridge_slave_0: left allmulticast mode [ 211.518683][ T9288] bridge_slave_0: left promiscuous mode [ 211.529606][ T9288] bridge0: port 1(bridge_slave_0) entered disabled state [ 211.567114][ T9288] bond0: (slave bridge0): Releasing backup interface [ 211.812825][ T9305] ieee802154 phy0 wpan0: encryption failed: -90 [ 211.849370][ C1] TCP: MD5 Hash mismatch for [::1].2->[::1].2 [.]L3 index 0 [ 211.857149][ C1] TCP: MD5 Hash mismatch for [::1].2->[::1].2 [P.]L3 index 0 [ 212.250938][ T9320] ieee802154 phy0 wpan0: encryption failed: -22 [ 212.438656][ T9330] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 213.655416][ T9373] ɶƣ0G3w: entered promiscuous mode [ 213.945883][ T9390] netlink: 'syz.2.1394': attribute type 10 has an invalid length. [ 213.989723][ T9390] netlink: 'syz.2.1394': attribute type 3 has an invalid length. [ 215.433089][ T9444] __nla_validate_parse: 18 callbacks suppressed [ 215.433109][ T9444] netlink: 224 bytes leftover after parsing attributes in process `syz.3.1407'. [ 215.484705][ T9446] netlink: 'syz.3.1407': attribute type 3 has an invalid length. [ 215.899732][ T9459] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1412'. [ 216.090086][ T9463] ɶƣ0G5w: entered promiscuous mode [ 216.150458][ T9468] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1416'. [ 216.390527][ T9476] netlink: 224 bytes leftover after parsing attributes in process `syz.0.1420'. [ 216.452902][ T9476] netlink: 'syz.0.1420': attribute type 3 has an invalid length. [ 216.658697][ T9487] netlink: 40 bytes leftover after parsing attributes in process `syz.4.1423'. [ 216.977610][ T9499] netlink: zone id is out of range [ 216.986823][ T9501] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1430'. [ 217.007453][ T9501] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1430'. [ 217.020775][ T9501] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1430'. [ 217.041204][ T9499] netlink: 132 bytes leftover after parsing attributes in process `syz.4.1428'. [ 217.532324][ T9520] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1435'. [ 217.928587][ T9535] FAULT_INJECTION: forcing a failure. [ 217.928587][ T9535] name failslab, interval 1, probability 0, space 0, times 0 [ 217.972707][ T9535] CPU: 1 PID: 9535 Comm: syz.2.1442 Not tainted 6.10.0-rc6-syzkaller-00165-g0ec986ed7bab #0 [ 217.982954][ T9535] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 [ 217.993055][ T9535] Call Trace: [ 217.996369][ T9535] [ 217.999333][ T9535] dump_stack_lvl+0x241/0x360 [ 218.002508][ T9539] FAULT_INJECTION: forcing a failure. [ 218.002508][ T9539] name failslab, interval 1, probability 0, space 0, times 0 [ 218.004040][ T9535] ? __pfx_dump_stack_lvl+0x10/0x10 [ 218.004081][ T9535] ? __pfx__printk+0x10/0x10 [ 218.026735][ T9535] should_fail_ex+0x3b0/0x4e0 [ 218.031464][ T9535] ? __alloc_skb+0x1c3/0x440 [ 218.036092][ T9535] should_failslab+0x9/0x20 [ 218.040648][ T9535] kmem_cache_alloc_node_noprof+0x71/0x320 [ 218.046523][ T9535] __alloc_skb+0x1c3/0x440 [ 218.050985][ T9535] ? __pfx___alloc_skb+0x10/0x10 [ 218.055980][ T9535] ? netlink_ack_tlv_len+0x6e/0x200 [ 218.061217][ T9535] netlink_ack+0x13f/0xa30 [ 218.065669][ T9535] ? kasan_save_track+0x51/0x80 [ 218.070535][ T9535] ? kasan_save_free_info+0x40/0x50 [ 218.075757][ T9535] ? __dev_queue_xmit+0x1b0e/0x3d30 [ 218.080971][ T9535] ? __netlink_deliver_tap+0x54d/0x7c0 [ 218.086449][ T9535] ? netlink_unicast+0x7b8/0x980 [ 218.091398][ T9535] ? ____sys_sendmsg+0x525/0x7d0 [ 218.096358][ T9535] netlink_rcv_skb+0x262/0x430 [ 218.101143][ T9535] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 218.106620][ T9535] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 218.111938][ T9535] ? apparmor_capable+0x138/0x1b0 [ 218.116978][ T9535] ? bpf_lsm_capable+0x9/0x10 [ 218.121679][ T9535] ? security_capable+0x90/0xb0 [ 218.126553][ T9535] nfnetlink_rcv+0x297/0x2a80 [ 218.131241][ T9535] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 218.137579][ T9535] ? __local_bh_enable_ip+0x168/0x200 [ 218.142960][ T9535] ? lockdep_hardirqs_on+0x99/0x150 [ 218.148171][ T9535] ? __local_bh_enable_ip+0x168/0x200 [ 218.153554][ T9535] ? dev_hard_start_xmit+0x773/0x7e0 [ 218.158851][ T9535] ? __dev_queue_xmit+0x2d2/0x3d30 [ 218.163973][ T9535] ? __pfx___local_bh_enable_ip+0x10/0x10 [ 218.169709][ T9535] ? __dev_queue_xmit+0x2d2/0x3d30 [ 218.174835][ T9535] ? __dev_queue_xmit+0x16c9/0x3d30 [ 218.180044][ T9535] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 218.185186][ T9535] ? __dev_queue_xmit+0x2d2/0x3d30 [ 218.190318][ T9535] ? ref_tracker_free+0x643/0x7e0 [ 218.195360][ T9535] ? __asan_memcpy+0x40/0x70 [ 218.199972][ T9535] ? __pfx_ref_tracker_free+0x10/0x10 [ 218.205375][ T9535] ? netlink_deliver_tap+0x2e/0x1b0 [ 218.210602][ T9535] ? skb_clone+0x240/0x390 [ 218.215035][ T9535] ? __pfx_lock_release+0x10/0x10 [ 218.220075][ T9535] ? __netlink_deliver_tap+0x77e/0x7c0 [ 218.225560][ T9535] ? netlink_deliver_tap+0x2e/0x1b0 [ 218.230774][ T9535] netlink_unicast+0x7ea/0x980 [ 218.235555][ T9535] ? __pfx_netlink_unicast+0x10/0x10 [ 218.240848][ T9535] ? __virt_addr_valid+0x183/0x520 [ 218.245977][ T9535] ? __check_object_size+0x49c/0x900 [ 218.251281][ T9535] ? bpf_lsm_netlink_send+0x9/0x10 [ 218.256415][ T9535] netlink_sendmsg+0x8db/0xcb0 [ 218.261202][ T9535] ? __pfx_netlink_sendmsg+0x10/0x10 [ 218.266503][ T9535] ? __import_iovec+0x536/0x820 [ 218.271358][ T9535] ? aa_sock_msg_perm+0x91/0x160 [ 218.276319][ T9535] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 218.281627][ T9535] ? security_socket_sendmsg+0x87/0xb0 [ 218.287104][ T9535] ? __pfx_netlink_sendmsg+0x10/0x10 [ 218.292403][ T9535] __sock_sendmsg+0x221/0x270 [ 218.297102][ T9535] ____sys_sendmsg+0x525/0x7d0 [ 218.301886][ T9535] ? __pfx_____sys_sendmsg+0x10/0x10 [ 218.307196][ T9535] __sys_sendmsg+0x2b0/0x3a0 [ 218.311801][ T9535] ? __pfx___sys_sendmsg+0x10/0x10 [ 218.316944][ T9535] ? vfs_write+0x7c4/0xc90 [ 218.321403][ T9535] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 218.327740][ T9535] ? do_syscall_64+0x100/0x230 [ 218.332612][ T9535] ? do_syscall_64+0xb6/0x230 [ 218.337311][ T9535] do_syscall_64+0xf3/0x230 [ 218.341843][ T9535] ? clear_bhb_loop+0x35/0x90 [ 218.346543][ T9535] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 218.352452][ T9535] RIP: 0033:0x7f26ab775bd9 [ 218.356922][ T9535] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 218.376537][ T9535] RSP: 002b:00007f26ac4bb048 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 218.384961][ T9535] RAX: ffffffffffffffda RBX: 00007f26ab903f60 RCX: 00007f26ab775bd9 [ 218.392942][ T9535] RDX: 0000000000000000 RSI: 0000000020000380 RDI: 0000000000000003 [ 218.400916][ T9535] RBP: 00007f26ac4bb0a0 R08: 0000000000000000 R09: 0000000000000000 [ 218.408889][ T9535] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 218.416872][ T9535] R13: 000000000000000b R14: 00007f26ab903f60 R15: 00007ffe3ee03ea8 [ 218.424863][ T9535] [ 218.444494][ T9539] CPU: 1 PID: 9539 Comm: syz.0.1444 Not tainted 6.10.0-rc6-syzkaller-00165-g0ec986ed7bab #0 [ 218.454612][ T9539] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 [ 218.464698][ T9539] Call Trace: [ 218.468007][ T9539] [ 218.470970][ T9539] dump_stack_lvl+0x241/0x360 [ 218.475697][ T9539] ? __pfx_dump_stack_lvl+0x10/0x10 [ 218.480938][ T9539] ? __pfx__printk+0x10/0x10 [ 218.485572][ T9539] ? __pfx___might_resched+0x10/0x10 [ 218.490898][ T9539] ? lockdep_hardirqs_on_prepare+0x43d/0x780 [ 218.496918][ T9539] should_fail_ex+0x3b0/0x4e0 [ 218.501642][ T9539] ? dccp_feat_entry_new+0x173/0x3a0 [ 218.506969][ T9539] should_failslab+0x9/0x20 [ 218.507977][ C0] TCP: MD5 Hash mismatch for [::1].2->[::1].2 [.]L3 index 0 [ 218.511491][ T9539] kmalloc_trace_noprof+0x6c/0x2c0 [ 218.511538][ T9539] dccp_feat_entry_new+0x173/0x3a0 [ 218.511569][ T9539] dccp_feat_parse_options+0xeac/0x2c30 [ 218.519225][ C0] TCP: MD5 Hash mismatch for [::1].2->[::1].2 [P.]L3 index 0 [ 218.523946][ T9539] ? __pfx_dccp_feat_parse_options+0x10/0x10 [ 218.523986][ T9539] ? kmalloc_trace_noprof+0x19c/0x2c0 [ 218.553416][ T9539] dccp_parse_options+0x13bd/0x2670 [ 218.558670][ T9539] dccp_rcv_established+0x55/0x320 [ 218.563811][ T9539] dccp_v6_do_rcv+0x28c/0xb10 [ 218.568507][ T9539] ? __pfx_dccp_v6_do_rcv+0x10/0x10 [ 218.573726][ T9539] __release_sock+0x243/0x350 [ 218.578540][ T9539] release_sock+0x61/0x1f0 [ 218.582988][ T9539] dccp_sendmsg+0x4ee/0xba0 [ 218.587518][ T9539] ? __pfx_dccp_sendmsg+0x10/0x10 [ 218.592561][ T9539] ? sock_rps_record_flow+0x1a/0x400 [ 218.597873][ T9539] ? inet_sendmsg+0x330/0x390 [ 218.602553][ T9539] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 218.607842][ T9539] ? security_socket_sendmsg+0x87/0xb0 [ 218.613314][ T9539] __sock_sendmsg+0x1a6/0x270 [ 218.618039][ T9539] __sys_sendto+0x3a4/0x4f0 [ 218.622572][ T9539] ? __pfx___sys_sendto+0x10/0x10 [ 218.627631][ T9539] ? lockdep_hardirqs_on_prepare+0x43d/0x780 [ 218.633630][ T9539] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 218.639968][ T9539] ? exc_page_fault+0x590/0x8c0 [ 218.644834][ T9539] __x64_sys_sendto+0xde/0x100 [ 218.649632][ T9539] do_syscall_64+0xf3/0x230 [ 218.654156][ T9539] ? clear_bhb_loop+0x35/0x90 [ 218.658854][ T9539] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 218.664765][ T9539] RIP: 0033:0x7f669f97796c [ 218.669468][ T9539] Code: 2a 5a 02 00 44 8b 4c 24 2c 4c 8b 44 24 20 89 c5 44 8b 54 24 28 48 8b 54 24 18 b8 2c 00 00 00 48 8b 74 24 10 8b 7c 24 08 0f 05 <48> 3d 00 f0 ff ff 77 34 89 ef 48 89 44 24 08 e8 70 5a 02 00 48 8b [ 218.689170][ T9539] RSP: 002b:00007f66a070fed0 EFLAGS: 00000293 ORIG_RAX: 000000000000002c [ 218.697597][ T9539] RAX: ffffffffffffffda RBX: 00007f66a070ffd0 RCX: 00007f669f97796c [ 218.705573][ T9539] RDX: 0000000000000020 RSI: 00007f66a0710020 RDI: 0000000000000005 [ 218.713566][ T9539] RBP: 0000000000000000 R08: 00007f66a070ff24 R09: 000000000000000c [ 218.721542][ T9539] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000005 [ 218.729519][ T9539] R13: 00007f66a070ff78 R14: 00007f66a0710020 R15: 0000000000000000 [ 218.737534][ T9539] [ 218.792358][ T9536] dccp_close: ABORT with 32 bytes unread [ 218.818915][ T9539] dccp_parse_options: DCCP(ffff888061fb0ac0): Option 32 (len=7) error=9 [ 218.858760][ T9539] ================================================================== [ 218.866876][ T9539] BUG: KASAN: slab-use-after-free in ccid2_hc_tx_packet_recv+0x1902/0x2070 [ 218.875514][ T9539] Read of size 1 at addr ffff88802d10b494 by task syz.0.1444/9539 [ 218.883346][ T9539] [ 218.885703][ T9539] CPU: 1 PID: 9539 Comm: syz.0.1444 Not tainted 6.10.0-rc6-syzkaller-00165-g0ec986ed7bab #0 [ 218.895825][ T9539] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 [ 218.905908][ T9539] Call Trace: [ 218.909214][ T9539] [ 218.912172][ T9539] dump_stack_lvl+0x241/0x360 [ 218.916902][ T9539] ? __pfx_dump_stack_lvl+0x10/0x10 [ 218.922147][ T9539] ? __pfx__printk+0x10/0x10 [ 218.926780][ T9539] ? _printk+0xd5/0x120 [ 218.930972][ T9539] ? __virt_addr_valid+0x183/0x520 [ 218.936124][ T9539] ? __virt_addr_valid+0x183/0x520 [ 218.941274][ T9539] print_report+0x169/0x550 [ 218.945831][ T9539] ? __virt_addr_valid+0x183/0x520 [ 218.950981][ T9539] ? __virt_addr_valid+0x183/0x520 [ 218.956130][ T9539] ? __virt_addr_valid+0x44e/0x520 [ 218.961274][ T9539] ? __phys_addr+0xba/0x170 [ 218.965825][ T9539] ? ccid2_hc_tx_packet_recv+0x1902/0x2070 [ 218.971678][ T9539] kasan_report+0x143/0x180 [ 218.976249][ T9539] ? ccid2_hc_tx_packet_recv+0x1902/0x2070 [ 218.982102][ T9539] ccid2_hc_tx_packet_recv+0x1902/0x2070 [ 218.987785][ T9539] ? lockdep_hardirqs_on+0x99/0x150 [ 218.993027][ T9539] ? dccp_ackvec_clear_state+0x5dd/0x8b0 [ 218.998703][ T9539] ? dccp_ackvec_input+0x1d5/0xf60 [ 219.003853][ T9539] ? ccid2_hc_rx_packet_recv+0xfd/0x1c0 [ 219.009437][ T9539] ? __pfx_ccid2_hc_tx_packet_recv+0x10/0x10 [ 219.015462][ T9539] dccp_rcv_established+0x295/0x320 [ 219.020700][ T9539] dccp_v6_do_rcv+0x28c/0xb10 [ 219.025427][ T9539] ? __pfx_dccp_v6_do_rcv+0x10/0x10 [ 219.030657][ T9539] __release_sock+0x243/0x350 [ 219.035377][ T9539] release_sock+0x61/0x1f0 [ 219.039832][ T9539] dccp_sendmsg+0x4ee/0xba0 [ 219.044385][ T9539] ? __pfx_dccp_sendmsg+0x10/0x10 [ 219.049626][ T9539] ? sock_rps_record_flow+0x1a/0x400 [ 219.055032][ T9539] ? inet_sendmsg+0x330/0x390 [ 219.059827][ T9539] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 219.065139][ T9539] ? security_socket_sendmsg+0x87/0xb0 [ 219.070657][ T9539] __sock_sendmsg+0x1a6/0x270 [ 219.075474][ T9539] __sys_sendto+0x3a4/0x4f0 [ 219.080034][ T9539] ? __pfx___sys_sendto+0x10/0x10 [ 219.080276][ T9556] netlink: 'syz.4.1446': attribute type 3 has an invalid length. [ 219.085281][ T9539] ? lockdep_hardirqs_on_prepare+0x43d/0x780 [ 219.085313][ T9539] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 219.085339][ T9539] ? exc_page_fault+0x590/0x8c0 [ 219.085370][ T9539] __x64_sys_sendto+0xde/0x100 [ 219.085399][ T9539] do_syscall_64+0xf3/0x230 [ 219.085431][ T9539] ? clear_bhb_loop+0x35/0x90 [ 219.085467][ T9539] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 219.085499][ T9539] RIP: 0033:0x7f669f97796c [ 219.085519][ T9539] Code: 2a 5a 02 00 44 8b 4c 24 2c 4c 8b 44 24 20 89 c5 44 8b 54 24 28 48 8b 54 24 18 b8 2c 00 00 00 48 8b 74 24 10 8b 7c 24 08 0f 05 <48> 3d 00 f0 ff ff 77 34 89 ef 48 89 44 24 08 e8 70 5a 02 00 48 8b [ 219.154458][ T9539] RSP: 002b:00007f66a070fed0 EFLAGS: 00000293 ORIG_RAX: 000000000000002c [ 219.162908][ T9539] RAX: ffffffffffffffda RBX: 00007f66a070ffd0 RCX: 00007f669f97796c [ 219.170912][ T9539] RDX: 0000000000000020 RSI: 00007f66a0710020 RDI: 0000000000000005 [ 219.178927][ T9539] RBP: 0000000000000000 R08: 00007f66a070ff24 R09: 000000000000000c [ 219.186946][ T9539] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000005 [ 219.194958][ T9539] R13: 00007f66a070ff78 R14: 00007f66a0710020 R15: 0000000000000000 [ 219.202984][ T9539] [ 219.206041][ T9539] [ 219.208390][ T9539] Allocated by task 9539: [ 219.212735][ T9539] kasan_save_track+0x3f/0x80 [ 219.217453][ T9539] __kasan_kmalloc+0x98/0xb0 [ 219.222092][ T9539] kmalloc_node_track_caller_noprof+0x225/0x440 [ 219.228575][ T9539] kmalloc_reserve+0x111/0x2a0 [ 219.233432][ T9539] __alloc_skb+0x1f3/0x440 [ 219.237888][ T9539] dccp_send_ack+0xaa/0x310 [ 219.242436][ T9539] ccid2_hc_rx_packet_recv+0x10c/0x1c0 [ 219.247950][ T9539] dccp_rcv_established+0x1bb/0x320 [ 219.253188][ T9539] dccp_v6_do_rcv+0x28c/0xb10 [ 219.257903][ T9539] __sk_receive_skb+0x823/0x8a0 [ 219.262786][ T9539] dccp_v6_rcv+0x123b/0x1710 [ 219.267408][ T9539] ip6_protocol_deliver_rcu+0x1058/0x1570 [ 219.273162][ T9539] ip6_input_finish+0x186/0x2d0 [ 219.278046][ T9539] NF_HOOK+0x3a4/0x450 [ 219.282152][ T9539] NF_HOOK+0x3a4/0x450 [ 219.286254][ T9539] __netif_receive_skb+0x1ea/0x650 [ 219.291395][ T9539] process_backlog+0x391/0x7d0 [ 219.296189][ T9539] __napi_poll+0xcb/0x490 [ 219.300562][ T9539] net_rx_action+0x7bb/0x10a0 [ 219.305275][ T9539] handle_softirqs+0x2c4/0x970 [ 219.310130][ T9539] do_softirq+0x11b/0x1e0 [ 219.314599][ T9539] __local_bh_enable_ip+0x1bb/0x200 [ 219.319971][ T9539] __dev_queue_xmit+0x16c9/0x3d30 [ 219.325057][ T9539] ip6_finish_output2+0xfc0/0x1670 [ 219.330232][ T9539] ip6_finish_output+0x41e/0x810 [ 219.335245][ T9539] ip6_xmit+0xefe/0x17f0 [ 219.339563][ T9539] inet6_csk_xmit+0x466/0x700 [ 219.344327][ T9539] dccp_transmit_skb+0xf3f/0x16a0 [ 219.349434][ T9539] dccp_xmit_packet+0x376/0x610 [ 219.354355][ T9539] dccp_write_xmit+0x138/0x220 [ 219.359187][ T9539] dccp_sendmsg+0x76d/0xba0 [ 219.363828][ T9539] __sock_sendmsg+0x1a6/0x270 [ 219.368595][ T9539] __sys_sendto+0x3a4/0x4f0 [ 219.373170][ T9539] __x64_sys_sendto+0xde/0x100 [ 219.377997][ T9539] do_syscall_64+0xf3/0x230 [ 219.382572][ T9539] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 219.388539][ T9539] [ 219.390909][ T9539] Freed by task 9539: [ 219.394936][ T9539] kasan_save_track+0x3f/0x80 [ 219.399688][ T9539] kasan_save_free_info+0x40/0x50 [ 219.404816][ T9539] poison_slab_object+0xe0/0x150 [ 219.410099][ T9539] __kasan_slab_free+0x37/0x60 [ 219.414942][ T9539] kfree+0x149/0x360 [ 219.418914][ T9539] skb_release_data+0x676/0x880 [ 219.423937][ T9539] kfree_skb_reason+0x1a3/0x3b0 [ 219.428879][ T9539] dccp_v6_do_rcv+0x131/0xb10 [ 219.433644][ T9539] __release_sock+0x243/0x350 [ 219.438408][ T9539] release_sock+0x61/0x1f0 [ 219.442979][ T9539] dccp_sendmsg+0x4ee/0xba0 [ 219.447574][ T9539] __sock_sendmsg+0x1a6/0x270 [ 219.452319][ T9539] __sys_sendto+0x3a4/0x4f0 [ 219.456895][ T9539] __x64_sys_sendto+0xde/0x100 [ 219.461729][ T9539] do_syscall_64+0xf3/0x230 [ 219.466318][ T9539] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 219.472295][ T9539] [ 219.474665][ T9539] The buggy address belongs to the object at ffff88802d10b000 [ 219.474665][ T9539] which belongs to the cache kmalloc-2k of size 2048 [ 219.488787][ T9539] The buggy address is located 1172 bytes inside of [ 219.488787][ T9539] freed 2048-byte region [ffff88802d10b000, ffff88802d10b800) [ 219.502823][ T9539] [ 219.505191][ T9539] The buggy address belongs to the physical page: [ 219.511671][ T9539] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2d108 [ 219.520522][ T9539] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 219.529070][ T9539] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 219.536738][ T9539] page_type: 0xffffefff(slab) [ 219.541543][ T9539] raw: 00fff00000000040 ffff888015042000 ffffea00019a0e00 dead000000000002 [ 219.550185][ T9539] raw: 0000000000000000 0000000000080008 00000001ffffefff 0000000000000000 [ 219.558835][ T9539] head: 00fff00000000040 ffff888015042000 ffffea00019a0e00 dead000000000002 [ 219.567574][ T9539] head: 0000000000000000 0000000000080008 00000001ffffefff 0000000000000000 [ 219.576315][ T9539] head: 00fff00000000003 ffffea0000b44201 ffffffffffffffff 0000000000000000 [ 219.585058][ T9539] head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000 [ 219.593797][ T9539] page dumped because: kasan: bad access detected [ 219.600510][ T9539] page_owner tracks the page as allocated [ 219.606262][ T9539] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5096, tgid 5096 (syz-executor), ts 81743814485, free_ts 81712467362 [ 219.627858][ T9539] post_alloc_hook+0x1f3/0x230 [ 219.632702][ T9539] get_page_from_freelist+0x2e4c/0x2f10 [ 219.638321][ T9539] __alloc_pages_noprof+0x256/0x6c0 [ 219.643593][ T9539] alloc_slab_page+0x5f/0x120 [ 219.648391][ T9539] allocate_slab+0x5a/0x2f0 [ 219.652963][ T9539] ___slab_alloc+0xcd1/0x14b0 [ 219.657714][ T9539] __slab_alloc+0x58/0xa0 [ 219.662097][ T9539] kmalloc_trace_noprof+0x1d5/0x2c0 [ 219.667375][ T9539] rtnl_newlink+0xf2/0x20a0 [ 219.669383][ T9545] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 219.671922][ T9539] rtnetlink_rcv_msg+0x89b/0x1180 [ 219.671974][ T9539] netlink_rcv_skb+0x1e3/0x430 [ 219.672003][ T9539] netlink_unicast+0x7ea/0x980 [ 219.672024][ T9539] netlink_sendmsg+0x8db/0xcb0 [ 219.672051][ T9539] __sock_sendmsg+0x221/0x270 [ 219.672081][ T9539] __sys_sendto+0x3a4/0x4f0 [ 219.672100][ T9539] __x64_sys_sendto+0xde/0x100 [ 219.672122][ T9539] page last free pid 5160 tgid 5160 stack trace: [ 219.672137][ T9539] free_unref_page+0xd22/0xea0 [ 219.672168][ T9539] __put_partials+0xeb/0x130 [ 219.672189][ T9539] put_cpu_partial+0x17c/0x250 [ 219.672212][ T9539] __slab_free+0x2ea/0x3d0 [ 219.672234][ T9539] qlist_free_all+0x9e/0x140 [ 219.672258][ T9539] kasan_quarantine_reduce+0x14f/0x170 [ 219.672279][ T9539] __kasan_slab_alloc+0x23/0x80 [ 219.672304][ T9539] kmem_cache_alloc_noprof+0x135/0x2a0 [ 219.672337][ T9539] __anon_vma_prepare+0xc4/0x4a0 [ 219.672359][ T9539] handle_pte_fault+0x59b1/0x7090 [ 219.672381][ T9539] handle_mm_fault+0x10df/0x1ba0 [ 219.672412][ T9539] exc_page_fault+0x459/0x8c0 [ 219.672440][ T9539] asm_exc_page_fault+0x26/0x30 [ 219.672473][ T9539] [ 219.672479][ T9539] Memory state around the buggy address: [ 219.672493][ T9539] ffff88802d10b380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 219.672510][ T9539] ffff88802d10b400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 219.672524][ T9539] >ffff88802d10b480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 219.672536][ T9539] ^ [ 219.672548][ T9539] ffff88802d10b500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 219.672563][ T9539] ffff88802d10b580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 219.672575][ T9539] ================================================================== [ 219.864321][ T9539] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 219.871632][ T9539] CPU: 0 PID: 9539 Comm: syz.0.1444 Not tainted 6.10.0-rc6-syzkaller-00165-g0ec986ed7bab #0 [ 219.881773][ T9539] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 [ 219.891904][ T9539] Call Trace: [ 219.895232][ T9539] [ 219.898200][ T9539] dump_stack_lvl+0x241/0x360 [ 219.902950][ T9539] ? __pfx_dump_stack_lvl+0x10/0x10 [ 219.908220][ T9539] ? __pfx__printk+0x10/0x10 [ 219.912908][ T9539] ? preempt_schedule+0xe1/0xf0 [ 219.917829][ T9539] ? vscnprintf+0x5d/0x90 [ 219.923098][ T9539] panic+0x349/0x860 [ 219.927040][ T9539] ? check_panic_on_warn+0x21/0xb0 [ 219.932175][ T9539] ? __pfx_panic+0x10/0x10 [ 219.936647][ T9539] ? _raw_spin_unlock_irqrestore+0x130/0x140 [ 219.942644][ T9539] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 219.948989][ T9539] ? print_report+0x502/0x550 [ 219.953690][ T9539] check_panic_on_warn+0x86/0xb0 [ 219.958655][ T9539] ? ccid2_hc_tx_packet_recv+0x1902/0x2070 [ 219.964486][ T9539] end_report+0x77/0x160 [ 219.968781][ T9539] kasan_report+0x154/0x180 [ 219.973314][ T9539] ? ccid2_hc_tx_packet_recv+0x1902/0x2070 [ 219.979154][ T9539] ccid2_hc_tx_packet_recv+0x1902/0x2070 [ 219.984907][ T9539] ? lockdep_hardirqs_on+0x99/0x150 [ 219.990224][ T9539] ? dccp_ackvec_clear_state+0x5dd/0x8b0 [ 219.995887][ T9539] ? dccp_ackvec_input+0x1d5/0xf60 [ 220.001032][ T9539] ? ccid2_hc_rx_packet_recv+0xfd/0x1c0 [ 220.006604][ T9539] ? __pfx_ccid2_hc_tx_packet_recv+0x10/0x10 [ 220.012618][ T9539] dccp_rcv_established+0x295/0x320 [ 220.017840][ T9539] dccp_v6_do_rcv+0x28c/0xb10 [ 220.022546][ T9539] ? __pfx_dccp_v6_do_rcv+0x10/0x10 [ 220.027767][ T9539] __release_sock+0x243/0x350 [ 220.032491][ T9539] release_sock+0x61/0x1f0 [ 220.037054][ T9539] dccp_sendmsg+0x4ee/0xba0 [ 220.041805][ T9539] ? __pfx_dccp_sendmsg+0x10/0x10 [ 220.046864][ T9539] ? sock_rps_record_flow+0x1a/0x400 [ 220.052174][ T9539] ? inet_sendmsg+0x330/0x390 [ 220.056868][ T9539] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 220.062173][ T9539] ? security_socket_sendmsg+0x87/0xb0 [ 220.067651][ T9539] __sock_sendmsg+0x1a6/0x270 [ 220.072365][ T9539] __sys_sendto+0x3a4/0x4f0 [ 220.076892][ T9539] ? __pfx___sys_sendto+0x10/0x10 [ 220.081954][ T9539] ? lockdep_hardirqs_on_prepare+0x43d/0x780 [ 220.087964][ T9539] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 220.094323][ T9539] ? exc_page_fault+0x590/0x8c0 [ 220.099205][ T9539] __x64_sys_sendto+0xde/0x100 [ 220.104005][ T9539] do_syscall_64+0xf3/0x230 [ 220.108628][ T9539] ? clear_bhb_loop+0x35/0x90 [ 220.113331][ T9539] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 220.119276][ T9539] RIP: 0033:0x7f669f97796c [ 220.123728][ T9539] Code: 2a 5a 02 00 44 8b 4c 24 2c 4c 8b 44 24 20 89 c5 44 8b 54 24 28 48 8b 54 24 18 b8 2c 00 00 00 48 8b 74 24 10 8b 7c 24 08 0f 05 <48> 3d 00 f0 ff ff 77 34 89 ef 48 89 44 24 08 e8 70 5a 02 00 48 8b [ 220.143509][ T9539] RSP: 002b:00007f66a070fed0 EFLAGS: 00000293 ORIG_RAX: 000000000000002c [ 220.152156][ T9539] RAX: ffffffffffffffda RBX: 00007f66a070ffd0 RCX: 00007f669f97796c [ 220.160149][ T9539] RDX: 0000000000000020 RSI: 00007f66a0710020 RDI: 0000000000000005 [ 220.168171][ T9539] RBP: 0000000000000000 R08: 00007f66a070ff24 R09: 000000000000000c [ 220.176297][ T9539] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000005 [ 220.184303][ T9539] R13: 00007f66a070ff78 R14: 00007f66a0710020 R15: 0000000000000000 [ 220.192401][ T9539] [ 220.195811][ T9539] Kernel Offset: disabled [ 220.200225][ T9539] Rebooting in 86400 seconds..