last executing test programs: 15.027839304s ago: executing program 4 (id=9374): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x7}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x2, 0x4}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000640)=@newtfilter={0x4c, 0x2c, 0xd27, 0x70bd24, 0x5dfdbff, {0x0, 0x0, 0x0, r3, {0x4, 0xa}, {}, {0xb}}, [@filter_kind_options=@f_bpf={{0x8}, {0x20, 0x2, [@TCA_BPF_FLAGS_GEN={0x8, 0x9, 0x2}, @TCA_BPF_OPS={{0x6, 0x4, 0x1}, {0xc, 0x5, [{0x6, 0xd, 0x5, 0x4}]}}]}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8858}, 0x20004804) (fail_nth: 4) 14.007342337s ago: executing program 4 (id=9380): bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004", @ANYRES32=0x0], 0x50) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240), 0x50) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000040)={0xffffffffffffffff, 0xe0, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x59, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffca, 0x0, 0x0, 0x0, 0x0, 0xf, 0x0, 0x0, 0x0}}, 0x10) r1 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(r1) r2 = socket$tipc(0x1e, 0x2, 0x0) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$IPT_SO_SET_REPLACE(r3, 0x0, 0x40, &(0x7f0000000140)=@raw={'raw\x00', 0x8, 0x3, 0x448, 0x0, 0xa, 0x148, 0x0, 0x60, 0x3b0, 0x2a8, 0x2a8, 0x3b0, 0x2a8, 0x7fffffe, 0x0, {[{{@ip={@multicast2, @multicast2, 0x0, 0x0, 'caif0\x00', 'rose0\x00'}, 0x0, 0x2f8, 0x318, 0x0, {0x200003ae, 0x7f00}, [@common=@inet=@hashlimit1={{0x58}, {'veth0_to_hsr\x00', {0x0, 0x0, 0x2, 0x0, 0x0, 0xcced, 0x7}}}, @common=@unspec=@bpf1={{0x230, 'bpf\x00', 0x0}, @bytecode={0x0, 0x17, 0x0, [{0x3, 0xe, 0x8d, 0x8}, {0x1, 0xe, 0x6, 0x4}, {0x800, 0x9, 0x2, 0x100}, {0xb, 0x49, 0xfb, 0xfffff001}, {0x9, 0x9, 0xfd, 0x2}, {0x1000, 0x1, 0x9, 0xfffff801}, {0x6, 0x4, 0x3}, {0x1, 0x13, 0x1, 0x3}, {0xcec, 0x3, 0xaa, 0x80000001}, {0x6, 0xf6, 0xb6, 0xfffffffc}, {0x8, 0x57, 0x8e, 0xc}, {0x4, 0xad, 0x8}, {0x5, 0x0, 0xfb, 0x3}, {0xacde, 0x2, 0xfd, 0xd4db}, {0x87, 0x10, 0x6, 0x3ff}, {0x2820, 0x5, 0x6}, {0x3, 0x2, 0x89, 0x80000001}, {0x4, 0x8, 0x3, 0x10001}, {0x101, 0x80, 0x6, 0x7}, {0x2, 0x7, 0xc, 0x40000000}, {0x9, 0x23, 0x71, 0x1}, {0x4, 0x7f, 0xa, 0x1ff}, {0x80, 0xa9, 0x7, 0x5}, {0x5, 0x3c, 0x9, 0x9}, {0x5, 0x7, 0x6, 0x8}, {0x9, 0xfe, 0xb, 0xd7}, {0x4, 0x81, 0x0, 0xf78000}, {0x4, 0x3, 0x6, 0x1000}, {0x56d, 0x7, 0x1, 0x2}, {0x5, 0x7, 0x0, 0x7}, {0x5, 0x43, 0x8a, 0x16c}, {0x0, 0x81, 0x2, 0x4}, {0x8, 0x1, 0x2, 0x2}, {0x9, 0x6, 0x4, 0x5}, {0x6, 0x12, 0x1, 0x7}, {0x4, 0x3, 0xfd, 0x7}, {0x4, 0xb, 0x6, 0x5}, {0x400, 0x6, 0xae, 0x80002}, {0x1a, 0x6, 0x8, 0x80}, {0x5, 0x8e, 0xe, 0x7fffffff}, {0x6, 0x5, 0x8, 0x8000}, {0x5e, 0x7, 0x4, 0x401}, {0xf, 0x5, 0x0, 0x1}, {0x2, 0x2, 0x3, 0x7}, {0x10, 0x3, 0x7, 0x1}, {0x5, 0xc, 0x3, 0x8}, {0x4, 0xd8, 0x6, 0x3}, {0x0, 0x6b, 0x3, 0x7}, {0x5, 0x6, 0xfd, 0x7fffffff}, {0x8, 0x8, 0x6, 0x7}, {0x95, 0x6, 0xb9, 0xd6cd}, {0x401, 0x3, 0xfc, 0x8}, {0x9, 0xfb, 0x5, 0x9}, {0x4, 0x8, 0x7, 0x5}, {0x0, 0x9, 0x47, 0x4}, {0x5, 0x4, 0x7, 0x7fff}, {0x8, 0xff, 0x1d, 0x2}, {0x81, 0x5, 0x2, 0x2}, {0x1, 0x4, 0x8, 0x5}, {0x1f1c, 0xc, 0x3, 0x6}, {0x3830, 0x3, 0x40, 0x7}, {0x9, 0x8, 0x4, 0x8}, {0x200, 0x2, 0x1, 0xa23}, {0x2, 0xe2, 0x5, 0xffffffff}], {0x400}}}]}, @unspec=@NOTRACK={0x20}}, {{@ip={@empty, @empty, 0x0, 0xffffffff, 'syzkaller0\x00', 'veth0_to_team\x00', {}, {}, 0x1d, 0x0, 0x2a}, 0x0, 0x70, 0x98}, @common=@unspec=@NFQUEUE2={0x28, 'NFQUEUE\x00', 0x2, {0x4, 0x9a, 0x2}}}], {{'\x00', 0xc8, 0x70, 0x98}, {0x28}}}}, 0x4a8) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, 0x0, 0x0) bind$tipc(r2, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x6, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x2c, '\x00', r0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_MAX_BURST(r4, 0x84, 0x83, 0x0, &(0x7f0000000300)) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000003c0)=ANY=[], 0x50) socket$netlink(0x10, 0x3, 0x0) socket(0x10, 0x803, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) r5 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x275a, 0x0) write$cgroup_int(r5, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r6 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r6, 0x107, 0x14, 0x0, 0x0) getpeername$packet(0xffffffffffffffff, 0x0, 0x0) 13.754846374s ago: executing program 4 (id=9381): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r3, 0x0, 0xf3a, 0x0) close(r2) write(r0, 0x0, 0x0) mmap(&(0x7f00009fd000/0x600000)=nil, 0x600000, 0x100000d, 0x6031, 0xffffffffffffffff, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_GET_BYNAME(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)={0x28, 0xe, 0x6, 0x401, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x20000000}, 0x40000) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r5 = socket$rds(0x15, 0x5, 0x0) bind$rds(r5, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10) sendmsg$rds(r5, &(0x7f0000000080)={&(0x7f0000000040)={0x2, 0x4, @dev={0xac, 0x14, 0x14, 0x12}}, 0x10, 0x0, 0x0, &(0x7f0000001880)=[@rdma_args={0x48, 0x114, 0x1, {{0x5, 0x1a2}, {0x0}, &(0x7f0000000400)=[{&(0x7f0000000880)=""/4096, 0x1000}], 0x1, 0xff05, 0xc}}, @rdma_args={0x48, 0x114, 0x1, {{0xbbb9, 0x3}, {&(0x7f0000001940)=""/221, 0xdd}, &(0x7f0000000780)=[{&(0x7f0000000440)=""/96, 0x60}, {&(0x7f00000004c0)=""/127, 0x7f}, {&(0x7f00000001c0)=""/147, 0x93}, {&(0x7f0000000600)=""/23, 0x17}, {&(0x7f0000000640)=""/41, 0x29}, {&(0x7f0000000680)=""/213, 0xd5}], 0x6, 0x0, 0x7}}], 0x90}, 0x0) r6 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x11, 0x10, &(0x7f0000000540)=ANY=[@ANYBLOB="1800000009000000000000afff80000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b702000014000040b7030000000000008500000083000000bf0900000000000055090100000000009500ebff00000000850000000f000000bf91000000000000b7020000010000008500000085000000b70000000000000095"], &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x8, '\x00', 0x0, @fallback=0x1e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r7 = socket$inet6(0xa, 0x2, 0x0) r8 = socket(0x10, 0x803, 0x0) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r9, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x8, 0x3, 0x478, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x3a8, 0xffffffff, 0xffffffff, 0x3a8, 0xffffffff, 0x3, 0x0, {[{{@uncond, 0x0, 0x1a0, 0x1c0, 0x60030000, {0x0, 0xff000000}, [@common=@inet=@recent0={{0xf8}, {0x9, 0x0, 0x24, 0x0, 'syz0\x00', 0x1}}]}, @unspec=@TRACE={0x20}}, {{@ipv6={@ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x37}}, @mcast2, [0x0, 0xff000000, 0xffffffff, 0xff], [0xff, 0x47066fef753f41fe, 0xff000000, 0xff], 'veth1_to_hsr\x00', 'bond0\x00', {0xff}, {}, 0x87, 0x2, 0x0, 0xa}, 0x0, 0x1c8, 0x1e8, 0x0, {}, [@common=@inet=@recent0={{0xf8}, {0x0, 0x400, 0x1, 0x1, 'syz0\x00', 0xda}}, @inet=@rpfilter={{0x28}, {0x5}}]}, @unspec=@NOTRACK={0x20}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x4d8) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000540), r8) getsockname$packet(r8, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) r12 = socket$nl_route(0x10, 0x3, 0x0) r13 = socket$nl_generic(0x10, 0x3, 0x10) r14 = syz_genetlink_get_family_id$wireguard(&(0x7f00000003c0), 0xffffffffffffffff) sendmsg$WG_CMD_SET_DEVICE(r13, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001bc0)={0x158, r14, 0x1, 0x0, 0x0, {}, [@WGDEVICE_A_LISTEN_PORT={0x6, 0x6, 0x4e23}, @WGDEVICE_A_PRIVATE_KEY={0x24, 0x3, @b}, @WGDEVICE_A_IFNAME={0x14, 0x2, 'wg0\x00'}, @WGDEVICE_A_PEERS={0x104, 0x8, 0x0, 0x1, [{0x100, 0x0, 0x0, 0x1, [@WGPEER_A_PUBLIC_KEY={0x24, 0x1, @neg}, @WGPEER_A_ENDPOINT4={0x14, 0x4, {0x2, 0x4e1f, @broadcast}}, @WGPEER_A_PROTOCOL_VERSION={0x8}, @WGPEER_A_FLAGS={0x8, 0x3, 0x1}, @WGPEER_A_PUBLIC_KEY={0x24, 0x1, @neg}, @WGPEER_A_ALLOWEDIPS={0x88, 0x9, 0x0, 0x1, [{0x28, 0x0, 0x0, 0x1, [@ipv6={{0x6}, {0x14, 0x2, @private0}, {0x5, 0x3, 0x3}}]}, {0x40, 0x0, 0x0, 0x1, [@ipv4={{0x6}, {0x8, 0x2, @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x5}}, @ipv6={{0x6}, {0x14, 0x2, @empty}, {0x5, 0x3, 0x2}}]}, {0x1c, 0x0, 0x0, 0x1, [@ipv4={{0x6}, {0x8, 0x2, @remote}, {0x5, 0x3, 0x1}}]}]}, @WGPEER_A_FLAGS={0x8}]}]}]}, 0x158}, 0x1, 0x0, 0x0, 0x4004840}, 0x40082) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000100)=ANY=[@ANYRES32=r10, @ANYBLOB="aaed565c856342f4f38a1b12875b6963a19be7491e85c8abeba02dda2d69bcfce8c48105953ca3901b7961e59699c573fdddbca7e7f91121ff", @ANYRESDEC=0x0, @ANYRES16=r11, @ANYRES64=r14, @ANYRESHEX=r14, @ANYRES32=r7], 0x50) setsockopt$sock_attach_bpf(r4, 0x1, 0x32, &(0x7f0000001b80)=r2, 0x4) sendmsg$nl_route(r12, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="500000001000370400000000ffdbdf040000", @ANYRESOCT=r11, @ANYBLOB="01f5050000000000300012800b00010067656e6576650000200002800500040001000000140007"], 0x50}, 0x1, 0x0, 0x0, 0x11}, 0x0) sendmmsg$inet(r7, &(0x7f0000000880)=[{{&(0x7f0000000040)={0x2, 0x4e1c, @multicast1}, 0x10, 0x0, 0x0, &(0x7f0000000000)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r11, @empty, @multicast1}}}], 0x20}}], 0x1, 0x4880) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001ac0)={0x18, 0x18, &(0x7f0000000280)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9}, {{0x18, 0x1, 0x1, 0x0, r6}}, {}, [@printk={@i, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x6}}, @func={0x85, 0x0, 0x1, 0x0, 0x4}], {{}, {}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000340)='syzkaller\x00', 0xffffff5d, 0x94, &(0x7f0000000540)=""/148, 0x0, 0x1e, '\x00', r11, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000800)={0x3, 0x1}, 0x8, 0x10, &(0x7f0000001a40)={0x1, 0x1, 0x101, 0x3}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000001a80)=[r3, r3, r3, r2, r3, r3, r3], 0x0, 0x10, 0x200}, 0x94) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) 11.739670059s ago: executing program 4 (id=9390): r0 = socket(0x10, 0x80002, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f0000000040)={{0x2, 0x4e24, @local}, {0x306}, 0x8, {0x2, 0x4e23, @initdev={0xac, 0x1e, 0x1, 0x0}}, 'ip6gre0\x00'}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff0000", @ANYRES32=0x0, @ANYBLOB="c30c424700000000280012800a00010076786c616e00000018000280140010", @ANYRES8=0x0, @ANYRES8], 0x48}}, 0x0) sendmmsg$alg(r0, &(0x7f00000000c0), 0x492492492492627, 0x0) socket$inet(0x2, 0x2, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x2b, 0x1804, 0x10) r3 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000002580)=[{&(0x7f0000000180)={0x14, 0x13, 0x1, 0x0, 0x0, "", [@typed={0x6}]}, 0x14}], 0x1}, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r4, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x320, 0x0, 0x5c, 0x160, 0x140, 0x3e0, 0x250, 0x228, 0x25a, 0x250, 0x228, 0x4, 0x0, {[{{@ipv6={@remote, @dev, [], [], 'veth0_to_batadv\x00', 'pim6reg\x00', {0xff}, {}, 0x3a}, 0x5002, 0xf8, 0x140, 0x52020000, {0x0, 0x6802000000000000}, [@common=@icmp6={{0x28}, {0x12, "d176", 0x1}}, @common=@unspec=@state={{0x28}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x1}}}, {{@ipv6={@local, @empty, [0xffffffff], [], 'veth1_to_hsr\x00', 'dummy0\x00', {}, {}, 0x24}, 0x0, 0xa8, 0x110}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x10, 0x0, 0x0, 0x0, 'snmp\x00', 'syz0\x00', {0x2}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x380) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000580)=@newsa={0x138, 0x10, 0x633, 0x70bd2a, 0x0, {{@in6=@local, @in6=@mcast1, 0x0, 0xfffd, 0x4e24, 0x0, 0x2, 0x20, 0x20, 0x4}, {@in=@multicast1, 0x0, 0x32}, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', {0xfffffffffffffffd, 0x40000000000, 0x0, 0x2dcd, 0x3}, {0x0, 0x0, 0x0, 0x8000000}, {0x0, 0x4, 0x3}, 0x70bd25, 0x0, 0xa, 0x4}, [@algo_crypt={0x48, 0x2, {{'ecb(cipher_null)\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x24000084}, 0x0) listen(r2, 0x5) setsockopt$inet_tcp_int(r2, 0x6, 0x3, &(0x7f0000000080)=0xa, 0x4) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000480)=@ipv6_newnexthop={0x1c, 0x68, 0x5fb9a818fb7378e9, 0x0, 0x0, {}, [@NHA_FDB={0x4}]}, 0x1c}}, 0x0) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=@newnexthop={0x18, 0x68, 0x200, 0x2, 0x7ffffffc}, 0x18}, 0x1, 0x0, 0x0, 0x24008000}, 0x4000) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r7 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r8 = openat$cgroup_freezer_state(r7, &(0x7f0000000140), 0x2, 0x0) ioctl$F2FS_IOC_DECOMPRESS_FILE(r8, 0xf517, 0x0) mkdirat$cgroup(r7, &(0x7f00000000c0)='syz1\x00', 0x1ff) write$cgroup_freezer_state(r8, &(0x7f0000000040)='FROZEN\x00', 0x7) sendfile(r8, r8, 0x0, 0x9) ioctl$EXT4_IOC_GET_ES_CACHE(r1, 0xc020662a, &(0x7f0000000300)={0x3, 0x1, 0x6, 0x87f}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000880)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r10, 0x1, 0x1a, &(0x7f0000000040)={0x3, &(0x7f0000000140)=[{0x20, 0x0, 0xb, 0xfffff038}, {0x20, 0x81, 0x0, 0x6e0f}, {0x6, 0x0, 0xff, 0x2000000}]}, 0x10) sendmmsg(r9, &(0x7f0000000800)=[{{0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000000380)="cb4e863ba8c01bad07c16d83873105a598bda81c458febc87db972a08a968ca997e1dc6edc16ddace1221e998d09cede30f31322c9e8c2ea64", 0x39}, {&(0x7f00000003c0)="ef192ef27c0c4af908a7825b59c9", 0xe}, {&(0x7f0000000400)="08307a92ab668f12d1c12a82b7cbcb5a68b37697abace2225bbe0829b4cd61c316c37bf28a1d080c515110618a56e8323f7f447181fd1061f4cf4c67679fab6217", 0x41}, {&(0x7f00000004c0)="290f85ff0ea6be14e37d7d59a786144f6054573f9a515e2c7bdb551afb48dd11157c898536278dc6d1012209a328120e390506e352c703fd15357a6afec61f558474aafc9b8c1b41a5efba294d8c62ea450a7670f49a59bcd27c5d1f7297e5106b95459cf53b980f30b6c011", 0x6c}], 0x4, &(0x7f00000006c0)=[{0xe0, 0x11, 0x4, "8cd9c1003074d05f08e12893975846dc88e26084522bfd6738a44e8c7d8c9dc73a8e4df5913d896bff0b7c322fade4f32a1b083fb38b6b7e4dc3b2d946870d28e148913160d5a81683fdfe575b04ef6c655e52c28c25bb42bb04841d428d66b80fce0543a5e4d2f2bf8f7dd965f21dc5c469e3f0ad75aedf0ff48a20977303fb96d48c540dd9fdb2e543d4a52fdb2cc73335a878caa1272a303ffe250a5ddfcef5b221fbd0bfcfebf11d7e3a02ea2011d32aec971f4d14ec278cf419c019b1928f7d3857a6e2bf373cb807"}, {0x58, 0x110, 0x9, "dc417d1c07bc29a494f1eb144ac564bf593e37f154a295baa85c3b64f90d3e708fbd581c71207cb0cfd4fb701e72e399cacdcc70e431912bbe5bbf993fe52a869f0ebd"}], 0x138}}], 0x1, 0x48840) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000200)=@newtaction={0x5c, 0x30, 0xb, 0x70bd2c, 0x0, {}, [{0x48, 0x1, [@m_ct={0x44, 0x1, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x80000002, 0x0, 0x20000000, 0x0, 0x400}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc}}}]}]}, 0x5c}, 0x1, 0x0, 0x0, 0x8890}, 0x40) 10.838778169s ago: executing program 4 (id=9394): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x7}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x2, 0x4}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000640)=@newtfilter={0x4c, 0x2c, 0xd27, 0x70bd24, 0x5dfdbff, {0x0, 0x0, 0x0, r3, {0x4, 0xa}, {}, {0xb}}, [@filter_kind_options=@f_bpf={{0x8}, {0x20, 0x2, [@TCA_BPF_FLAGS_GEN={0x8, 0x9, 0x2}, @TCA_BPF_OPS={{0x6, 0x4, 0x1}, {0xc, 0x5, [{0x6, 0xd, 0x5, 0x4}]}}]}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8858}, 0x20004804) (fail_nth: 5) 10.175347724s ago: executing program 4 (id=9396): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000640)=ANY=[@ANYBLOB="5c00005a1500010000000000fbdbdf250a010100000000000000000000000000fc010000000000000000000000000001000107ff000300000a00a00000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000010000000c0015005a"], 0x5c}, 0x1, 0x0, 0x0, 0x80000}, 0x44800) 4.254649971s ago: executing program 0 (id=9436): bpf$MAP_CREATE(0x0, &(0x7f0000001000)=@base={0xa, 0x4, 0x8, 0xa, 0x0, 0xffffffffffffffff, 0xfffffffd}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000070000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000a500850000002d00000095"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x4, '\x00', 0x0, @fallback=0x34, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) r0 = socket$netlink(0x10, 0x3, 0xc) r1 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$IP_VS_SO_SET_STARTDAEMON(r1, 0x0, 0x48b, &(0x7f0000000000)={0x1, 'veth1_to_bridge\x00', 0x20}, 0x18) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="140000001000010000000000000000000200000a20000000000a01040000000000000000020000000900010073797a30000000002c000000030a01040000000000000000020000000900010073797a30000000000900030073797a3000000000a8000000060a01040000000000000000020000000900010073797a30000000000900020073797a30000000007c000480680001800a0001006d61746368000000580002800e000100686173686c696d697400000008000240000000013c0003002e6f37000000000000000000000000002000000010270000050000001100000010000000e8030000e80300002020000000000000000000001000018008000100647570"], 0x11c}}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18010000000000000000000000000000850000007b"], 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x7, &(0x7f0000000180)=ANY=[@ANYRESDEC=r0, @ANYRESOCT, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x37, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f03, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r2}, 0xc) r3 = socket$rxrpc(0x21, 0x2, 0x2) setsockopt$RXRPC_UPGRADEABLE_SERVICE(r3, 0x110, 0x5, &(0x7f0000000040)=[0x1, 0x4], 0x2) 3.560520377s ago: executing program 0 (id=9438): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r2, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="6c0000000001010400000000141a000002000000240001801400018008000100e000000108000200e00000010c00028005000100000000002c00028014000180080001000800ffee08000200ac1e00010c00028005000100000000000600034000010000080007"], 0x6c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000f00000000000000000a20000000000a05000000000000000000070000000900010073797a3000000000c8000000090a010400000000000000000700000108000a40000000000900020073797a31000000000900010073797a300000000008000540000000041c000980100002800c0001800800014000000002080001400000ff"], 0x110}, 0x1, 0x0, 0x0, 0x8840}, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000080)=ANY=[@ANYRES64=r0, @ANYRES32=0x0, @ANYRES16=r0, @ANYRES64=r0, @ANYBLOB="20802762f131a34febdd1c660707c60535e1b2368bfcb17ab9d65b3782d2aacbea68a4642d60fac9e6060d58907f3087098e856e0930edd322e22e796d4d07cb932715d2e7d55b707624846e6d73016f04f5c1186f5e1178e94492baabd385fd3c22961be8164682cc281a7504e6564ac4dbbd28f52e567d9d0b1cddf7032f8793f3df"], 0x68}, 0x1, 0x0, 0x0, 0x20004011}, 0x0) 3.052661869s ago: executing program 3 (id=9441): syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) socket$netlink(0x10, 0x3, 0x0) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_route(0x10, 0x3, 0x0) r0 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), r0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r1, @ANYBLOB="01000000000000001c0012000c000100626f6e6400000000"], 0x3c}}, 0x0) socket(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)=ANY=[@ANYBLOB="3c00000010000304000000000020000000000000", @ANYRES32=r2, @ANYBLOB="a4280400000000001400350076657468305f746f5f626f6e6400000008000a00", @ANYRES32=r1], 0x3c}, 0x1, 0x0, 0x0, 0x8800}, 0x8000) 3.052207061s ago: executing program 0 (id=9442): r0 = socket(0x10, 0x80002, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f0000000040)={{0x2, 0x4e24, @local}, {0x306}, 0x8, {0x2, 0x4e23, @initdev={0xac, 0x1e, 0x1, 0x0}}, 'ip6gre0\x00'}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff0000", @ANYRES32=0x0, @ANYBLOB="c30c424700000000280012800a00010076786c616e00000018000280140010", @ANYRES8=0x0, @ANYRES8], 0x48}}, 0x0) sendmmsg$alg(r0, &(0x7f00000000c0), 0x492492492492627, 0x0) socket$inet(0x2, 0x2, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x2b, 0x1804, 0x10) r3 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000002580)=[{&(0x7f0000000180)={0x14, 0x13, 0x1, 0x0, 0x0, "", [@typed={0x6}]}, 0x14}], 0x1}, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r4, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x320, 0x0, 0x5c, 0x160, 0x140, 0x3e0, 0x250, 0x228, 0x25a, 0x250, 0x228, 0x4, 0x0, {[{{@ipv6={@remote, @dev, [], [], 'veth0_to_batadv\x00', 'pim6reg\x00', {0xff}, {}, 0x3a}, 0x5002, 0xf8, 0x140, 0x52020000, {0x0, 0x6802000000000000}, [@common=@icmp6={{0x28}, {0x12, "d176", 0x1}}, @common=@unspec=@state={{0x28}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x1}}}, {{@ipv6={@local, @empty, [0xffffffff], [], 'veth1_to_hsr\x00', 'dummy0\x00', {}, {}, 0x24}, 0x0, 0xa8, 0x110}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x10, 0x0, 0x0, 0x0, 'snmp\x00', 'syz0\x00', {0x2}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x380) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000580)=@newsa={0x138, 0x10, 0x633, 0x70bd2a, 0x0, {{@in6=@local, @in6=@mcast1, 0x0, 0xfffd, 0x4e24, 0x0, 0x2, 0x20, 0x20, 0x4}, {@in=@multicast1, 0x0, 0x32}, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', {0xfffffffffffffffd, 0x40000000000, 0x0, 0x2dcd, 0x3}, {0x0, 0x0, 0x0, 0x14000000}, {0x0, 0x4, 0x3}, 0x70bd25, 0x0, 0xa, 0x4}, [@algo_crypt={0x48, 0x2, {{'ecb(cipher_null)\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x24000084}, 0x0) listen(r2, 0x5) setsockopt$inet_tcp_int(r2, 0x6, 0x3, &(0x7f0000000080)=0xa, 0x4) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000480)=@ipv6_newnexthop={0x1c, 0x68, 0x5fb9a818fb7378e9, 0x0, 0x0, {}, [@NHA_FDB={0x4}]}, 0x1c}}, 0x0) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=@newnexthop={0x18, 0x68, 0x200, 0x2, 0x7ffffffc}, 0x18}, 0x1, 0x0, 0x0, 0x24008000}, 0x4000) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r7 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r8 = openat$cgroup_freezer_state(r7, &(0x7f0000000140), 0x2, 0x0) ioctl$F2FS_IOC_DECOMPRESS_FILE(r8, 0xf517, 0x0) mkdirat$cgroup(r7, &(0x7f00000000c0)='syz1\x00', 0x1ff) write$cgroup_freezer_state(r8, &(0x7f0000000040)='FROZEN\x00', 0x7) sendfile(r8, r8, 0x0, 0x9) ioctl$EXT4_IOC_GET_ES_CACHE(r1, 0xc020662a, &(0x7f0000000300)={0x3, 0x1, 0x6, 0x87f}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000880)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r10, 0x1, 0x1a, &(0x7f0000000040)={0x3, &(0x7f0000000140)=[{0x20, 0x0, 0xb, 0xfffff038}, {0x20, 0x81, 0x0, 0x6e0f}, {0x6, 0x0, 0xff, 0x2000000}]}, 0x10) sendmmsg(r9, &(0x7f0000000800)=[{{0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000000380)="cb4e863ba8c01bad07c16d83873105a598bda81c458febc87db972a08a968ca997e1dc6edc16ddace1221e998d09cede30f31322c9e8c2ea64", 0x39}, {&(0x7f00000003c0)="ef192ef27c0c4af908a7825b59c9", 0xe}, {&(0x7f0000000400)="08307a92ab668f12d1c12a82b7cbcb5a68b37697abace2225bbe0829b4cd61c316c37bf28a1d080c515110618a56e8323f7f447181fd1061f4cf4c67679fab6217", 0x41}, {&(0x7f00000004c0)="290f85ff0ea6be14e37d7d59a786144f6054573f9a515e2c7bdb551afb48dd11157c898536278dc6d1012209a328120e390506e352c703fd15357a6afec61f558474aafc9b8c1b41a5efba294d8c62ea450a7670f49a59bcd27c5d1f7297e5106b95459cf53b980f30b6c011", 0x6c}], 0x4, &(0x7f00000006c0)=[{0xe0, 0x11, 0x4, "8cd9c1003074d05f08e12893975846dc88e26084522bfd6738a44e8c7d8c9dc73a8e4df5913d896bff0b7c322fade4f32a1b083fb38b6b7e4dc3b2d946870d28e148913160d5a81683fdfe575b04ef6c655e52c28c25bb42bb04841d428d66b80fce0543a5e4d2f2bf8f7dd965f21dc5c469e3f0ad75aedf0ff48a20977303fb96d48c540dd9fdb2e543d4a52fdb2cc73335a878caa1272a303ffe250a5ddfcef5b221fbd0bfcfebf11d7e3a02ea2011d32aec971f4d14ec278cf419c019b1928f7d3857a6e2bf373cb807"}, {0x58, 0x110, 0x9, "dc417d1c07bc29a494f1eb144ac564bf593e37f154a295baa85c3b64f90d3e708fbd581c71207cb0cfd4fb701e72e399cacdcc70e431912bbe5bbf993fe52a869f0ebd"}], 0x138}}], 0x1, 0x48840) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000200)=@newtaction={0x5c, 0x30, 0xb, 0x70bd2c, 0x0, {}, [{0x48, 0x1, [@m_ct={0x44, 0x1, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x80000002, 0x0, 0x20000000, 0x0, 0x400}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc}}}]}]}, 0x5c}, 0x1, 0x0, 0x0, 0x8890}, 0x40) 2.587244118s ago: executing program 3 (id=9444): r0 = socket$nl_route(0x10, 0x3, 0x0) (async, rerun: 32) bpf$PROG_LOAD(0x5, 0x0, 0x0) (async, rerun: 32) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=ANY=[@ANYBLOB="380100001000330624c47000000000007f00000100000000000000000000000000000000000000000000000000000000000000050000fffd000000003a000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="e0000002000000000000000000000000fffffffd32000000ac1414aa0000000000000000000000000100000000000000030000000000000009000000000000000900000000000000020000000000000000000000000000000000000000000000fcffffffffffffff000000000000000000000000000000005f000000000000000a00000000000000010000000000000000000000000100000000000002000000230000000000000048000200656362286369706865725f6e756c6c29"], 0x138}, 0x1, 0x0, 0x0, 0x20040}, 0x80) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) (async, rerun: 64) connect$inet(r2, &(0x7f0000000480)={0x2, 0x4e23, @multicast2}, 0x10) (rerun: 64) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000001080)=ANY=[@ANYRES32, @ANYRES32, @ANYBLOB='=\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="d42b07"], 0x20) setsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f00000004c0)={{{@in6=@dev={0xfe, 0x80, '\x00', 0x4}, @in6=@private2={0xfc, 0x2, '\x00', 0x1}, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x4, 0xffff, 0xfffffffffffffffd, 0x2}, {0x1, 0x0, 0x400000000}, 0x0, 0x0, 0x1, 0x0, 0x3, 0x3}, {{@in6=@ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}, 0x0, 0x32}, 0x0, @in=@dev={0xac, 0x14, 0x14, 0x39}, 0x0, 0x0, 0x0, 0xb7, 0x2, 0xfffffffe}}, 0xe8) (async) write(r2, &(0x7f0000000140)="0e0412b60f82bb714a766118ff5aa329fa94da4900", 0x15) (async) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@newlink={0x4c, 0x10, 0x609, 0x70bd28, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x88abdd8f, 0x10008}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @gtp={{0x8}, {0x20, 0x2, 0x0, 0x1, [@IFLA_GTP_PDP_HASHSIZE={0x8, 0x3, 0x1}, @IFLA_GTP_LOCAL6={0x14, 0x8, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}}]}}}]}, 0x4c}}, 0x20000054) (async) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)=@newlink={0x88, 0x10, 0x401, 0x70bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, 0xb00, 0x46951}, [@IFLA_VF_PORTS={0x60, 0x18, 0x0, 0x1, [{0x5c, 0x1, 0x0, 0x1, [@IFLA_PORT_INSTANCE_UUID={0x14, 0x4, "bfdd4c2eeefc6de7e3c0985b429b0886"}, @IFLA_PORT_REQUEST={0x5, 0x6, 0x8}, @IFLA_PORT_HOST_UUID={0x14, 0x5, "afa66b75ddfc99d0b243f25ed8c30a93"}, @IFLA_PORT_HOST_UUID={0x14, 0x5, "9c6bfcf593388712a536bdb77d9abb43"}, @IFLA_PORT_PROFILE={0xb, 0x2, 'geneve\x00'}, @IFLA_PORT_REQUEST={0x5, 0x6, 0x9}]}]}, @IFLA_NUM_TX_QUEUES={0x8, 0x1f, 0x4}]}, 0x88}}, 0x2000000) 2.370206607s ago: executing program 0 (id=9446): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=@newlink={0x48, 0x10, 0x401, 0x0, 0x1, {0x0, 0x0, 0x0, 0x0, 0x42000, 0x2}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @geneve={{0xb}, {0x18, 0x2, 0x0, 0x1, [@IFLA_GENEVE_REMOTE6={0x14, 0x12, @mcast2}]}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x40680c5}, 0x0) (async) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=@newlink={0x48, 0x10, 0x401, 0x0, 0x1, {0x0, 0x0, 0x0, 0x0, 0x42000, 0x2}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @geneve={{0xb}, {0x18, 0x2, 0x0, 0x1, [@IFLA_GENEVE_REMOTE6={0x14, 0x12, @mcast2}]}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x40680c5}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_xfrm(0x10, 0x3, 0x6) (async) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000080)={0x0, 0x0}, &(0x7f00000000c0)=0xc) sendmsg$nl_xfrm(r2, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000200)={&(0x7f0000000440)=@getsadinfo={0xdc, 0x23, 0x200, 0x70bd27, 0x25dfdbff, 0x0, [@encap={0x1c, 0x4, {0x2, 0x4e20, 0x4e1e, @in6=@dev={0xfe, 0x80, '\x00', 0x25}}}, @policy={0xac, 0x7, {{@in=@rand_addr=0x64010102, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x4e21, 0x8001, 0x4e21, 0x914, 0x2, 0x80, 0x20, 0x4, 0x0, r3}, {0x1, 0x1, 0x56b000000, 0x9, 0x4, 0xff, 0x7, 0x80000001}, {0x7ff, 0x800, 0x1, 0x1}, 0x50be, 0x6e6bc0, 0x1, 0x0, 0x3, 0x3}}]}, 0xdc}, 0x1, 0x0, 0x0, 0x4000091}, 0x20008011) sendmsg$NFT_BATCH(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a00)=ANY=[@ANYBLOB="140000001000010000000000000000000200000a20000000000a01080000000000000000020000000900010073797a300000000064000000090a010400000000000000020200000008000a40000000010900020073797a31000000000900010073797a300000000008000540000000080800034000000084200009801c0002800c00018008000140000000030c0001800800014000000004440000000e0a01010000000000000000020000000900020073797a31000000000900010073797a30000000001800038014000080100001800c0001"], 0xf0}}, 0x0) socket$l2tp6(0xa, 0x2, 0x73) (async) r4 = socket$l2tp6(0xa, 0x2, 0x73) connect$inet6(r4, &(0x7f0000000280)={0xa, 0x4e20, 0xc6, @empty, 0xb51}, 0x1c) 2.311934723s ago: executing program 2 (id=9447): sendmsg$NFT_MSG_GETRULE(0xffffffffffffffff, 0x0, 0x200450c0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) r1 = socket$inet6(0xa, 0x5, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000e40)=@raw={'raw\x00', 0x3c1, 0x3, 0x5a0, 0x0, 0xffffff80, 0x178, 0xd0040000, 0x178, 0x4d0, 0x22b, 0x258, 0x4d0, 0x258, 0x2034, 0x0, {[{{@uncond, 0x1d, 0x300, 0x368, 0x340, {0x1e0002a8, 0x7203000000000000}, [@common=@unspec=@bpf1={{0x230}, @bytecode={0x0, 0x1a, 0x64, [{}, {0x25, 0x0, 0x1}, {0x0, 0x40}, {}, {0x0, 0x7, 0x8}, {}, {0x0, 0x0, 0xfd}, {}, {}, {0x20}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {}, {}, {0x0, 0x0, 0x0, 0x2}, {}, {0x0, 0x0, 0x4}, {}, {0x6}, {}, {0x9}, {}, {}, {}, {0x0, 0x8}, {}, {0x0, 0x0, 0x0, 0x80000000}, {0x870}, {}, {}, {}, {0x2, 0xfe}, {0x0, 0x0, 0x0, 0x2}, {}, {0x0, 0x3, 0x10}, {}, {}, {0xfffe, 0x7, 0x4}, {0x0, 0x0, 0x1}, {0x0, 0x1}, {0x8, 0x8, 0x0, 0xfffffffc}, {}, {0x0, 0xfc, 0xe4}, {0x0, 0x0, 0xff}, {}, {0x3}, {}, {0x0, 0x0, 0x0, 0x10}, {}, {}, {0x0, 0x0, 0x0, 0xffffffff}, {}, {0x4, 0x8a}, {}, {}, {}, {0x0, 0x4}]}}, @common=@inet=@socket1={{0x28}}]}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x1c, 0x7, 0x279, 0x2, 'netbios-ns\x00', 'syz1\x00', {0x170}}}}, {{@ipv6={@private2, @empty, [0xff, 0x0, 0xffffff00, 0xff000000], [0xff000000, 0xff000000, 0xffffff00], 'vlan1\x00', 'pim6reg1\x00', {}, {0xff}, 0x0, 0x9, 0x1, 0x12}, 0x0, 0x100, 0x168, 0x0, {}, [@common=@ah={{0x30}}, @inet=@rpfilter={{0x28}, {0x4}}]}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x11, 0x0, 0x0, 0x0, 'syz1\x00', 'syz0\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x600) listen(r0, 0x0) recvmmsg(r0, &(0x7f0000002bc0)=[{{0x0, 0x0, &(0x7f00000004c0)=[{0x0}, {0x0}], 0x2, &(0x7f0000000500)=""/4096, 0x1000}, 0x2}, {{&(0x7f0000001500)=@phonet, 0x80, &(0x7f0000001840)=[{&(0x7f0000001580)=""/208, 0xd0}, {&(0x7f0000001680)=""/88, 0x58}, {0x0}, {&(0x7f0000001780)=""/192, 0xc0}], 0x4, &(0x7f0000001880)=""/189, 0xbd}, 0xfffffff8}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000002ac0)=""/193, 0xc1}, 0x8}], 0x3, 0x41, 0x0) connect$inet(0xffffffffffffffff, 0x0, 0x0) r2 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) setsockopt$llc_int(r2, 0x10c, 0x5, &(0x7f0000000040), 0x4) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)={{0x14, 0x10, 0x4}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x201, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0x48}}, 0x0) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r4, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, 0x0, &(0x7f0000000440)) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(r4, 0x84, 0x6c, &(0x7f0000000080), &(0x7f0000000180)=0x8) sendmsg$nl_generic(r3, 0x0, 0xc000) 2.110580253s ago: executing program 3 (id=9448): r0 = socket$pppoe(0x18, 0x1, 0x0) r1 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_MFC_PROXY(r1, 0x0, 0xd2, &(0x7f0000000040)={@broadcast, @multicast1, 0x1, "0d5011f02b7fab96e0aa834d3a9e7cfc12178ac0ab1e6227c2b6ddaa5effda90", 0x5, 0x16, 0xfffffffe, 0x1}, 0x3c) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r2, 0x11, 0x68, &(0x7f0000000080)=0xa40, 0x4) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000180)={0x1f, 0xffff, 0x3}, 0x6) write(r3, &(0x7f0000000000)="38000000010001", 0x7) setsockopt$inet6_udp_encap(r2, 0x11, 0x64, &(0x7f0000000000)=0x2, 0x4) setsockopt$inet6_udp_encap(r2, 0x11, 0x64, &(0x7f0000000040)=0x2, 0x4) r4 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_MFC_PROXY(r4, 0x0, 0xd2, &(0x7f0000000000)={@broadcast, @multicast1, 0x0, "12ceaac82ab7d944e84b6fbd6178697e3b10c9b81bede26c85ee73daab4158e8", 0x2, 0x6, 0x4, 0x4}, 0x3c) setsockopt$MRT_FLUSH(r4, 0x0, 0xd4, &(0x7f0000000100)=0xe, 0x4) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x4001, @remote, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000002340)=[{{0x0, 0x0, 0x0}}], 0x3e8, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x200040d8, &(0x7f0000000080)={0xa, 0x4e21, 0x80000, @local, 0x4000004}, 0x1c) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000100)="580000001400192340834b80040d8c560a067fbc45ff810500000000000058000b480400945f6400947e570028925a01000000000000008000f0fffeffe809000000fff5dd0000001000010005081000418e00030004fcff", 0x58}], 0x1) 2.110288816s ago: executing program 0 (id=9449): r0 = socket(0x40000000015, 0x5, 0x0) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @loopback}, 0x10) bind$inet(r0, &(0x7f0000000340)={0x2, 0x0, @loopback}, 0x57) r1 = socket$tipc(0x1e, 0x5, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000300)=ANY=[@ANYBLOB="9feb01001800000000000000280000002800000006000000040000000000000e0300000000000000010000000000009200000000000000000000000202000000002e000061"], 0x0, 0x46}, 0x28) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005800000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x30}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x94) bind$tipc(r1, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x0, {0x42}}, 0x10) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000000)={0x42, 0x1}, 0x10) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0x4, 0x4, &(0x7f0000000040)=@framed={{0x66, 0xa, 0x0, 0x0, 0x0, 0x61, 0x11, 0x8c}, [@call={0x85, 0x0, 0x0, 0xce}]}, &(0x7f0000000000)='GPL\x00'}, 0x94) r3 = socket$tipc(0x1e, 0x2, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0x6, 0x5, &(0x7f0000000100)=@framed={{0x18, 0x2, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x3}, [@call={0x85, 0x0, 0x0, 0x2c}, @call={0x85, 0x0, 0x0, 0x11}]}, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x359}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000380)={r4, 0x0, 0xe, 0x0, &(0x7f0000000140)="410c49bc3c388e38d0da5a20564e", 0x0, 0x1008, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) bind$tipc(r3, &(0x7f0000000180)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x1, 0x5}}, 0x10) setsockopt$TIPC_GROUP_JOIN(r3, 0x10f, 0x87, &(0x7f0000000240)={0x42, 0x1}, 0x10) close(0x3) sendmsg$alg(r0, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1800000880000000170100000200000000000000000000001800000000000000170100000400000001000000000000"], 0x30}, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r6, 0x107, 0x7, &(0x7f0000000100)=0x40001fc, 0x4) setsockopt$packet_tx_ring(r6, 0x107, 0x5, &(0x7f0000000080)=@req3={0x8000, 0x6, 0x300, 0xfc}, 0x1c) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f05ebbee1, 0x8031, 0xffffffffffffffff, 0x0) sendmsg$RDMA_NLDEV_CMD_SYS_SET(r0, &(0x7f00000002c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000280)={&(0x7f00000001c0)={0x18, 0x1407, 0x400, 0x70bd2b, 0x25dfdbfc, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}]}, 0x18}, 0x1, 0x0, 0x0, 0x8010}, 0x840) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x1032, 0xffffffffffffffff, 0x21d67000) sendmsg$TIPC_CMD_GET_NODES(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000480)={0x1c, 0x0, 0x1, 0x0, 0xfffffd, {{}, {0x0, 0x6}}}, 0x1c}, 0x1, 0x0, 0x0, 0x44043}, 0x0) 2.012874356s ago: executing program 2 (id=9451): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r0, &(0x7f0000000200)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x200000d, 0x12, r0, 0x0) unshare(0xa020480) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f00000000c0)=0x0) syz_open_procfs$namespace(r1, &(0x7f0000000000)='ns/uts\x00') r2 = syz_open_procfs$namespace(0x0, &(0x7f0000000240)='ns/mnt\x00') unshare(0x6020400) unshare(0x22020600) r3 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000900)=ANY=[@ANYBLOB="02000000040000000400000001"], 0x48) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0xd, 0x6, 0x4, 0x1, 0x0, r3, 0x5}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000440)={{r4}, &(0x7f0000000840), &(0x7f0000000340)}, 0x20) close(r2) 1.809079225s ago: executing program 1 (id=9452): r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$inet_opts(r0, 0x0, 0x4, &(0x7f0000000000)="8907040400", 0x5) setsockopt$inet_mreqn(r0, 0x0, 0x24, &(0x7f0000000100)={@multicast1, @dev={0xac, 0x14, 0x14, 0xd}}, 0xc) socket$packet(0x11, 0x3, 0x300) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(serpent)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, 0x0, 0x0) r2 = accept4(r1, 0x0, 0x0, 0x80800) sendmmsg$alg(r2, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000280)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb09587304856755200db549e13d64a3489bfc1961cc504fc1175ce7e3335c86d231c5d64829c1ebfac649a1787882b454975a71a18ece31ee6f69e99707e2a13f4f826a57837744a810058f73e25119f8e0b8787ed2f318a1df960df58a7c091b9a7a60e5a2f546d0fe807dab278a08cb2056295185213037adcec5da72763d52734d7dfd51c27", 0xcf}, {&(0x7f00000003c0)="e8700e444d50a969ff67247cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece98ad3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11", 0xfe67}], 0x3, &(0x7f0000000380)}], 0x1, 0x40800) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000dc0)={0x6, 0x6, &(0x7f0000000640)=ANY=[@ANYBLOB="1800000000000000000000000000000018200000", @ANYRES32, @ANYBLOB="0000000000000000890000000000000095"], &(0x7f0000000d40)='syzkaller\x00'}, 0x94) r3 = socket$netlink(0x10, 0x3, 0x4) write(r3, &(0x7f00000000c0)="270000001400070f030e0000120f0a001100b1128a151f75080039000500"/39, 0x27) sendmsg$inet(r0, &(0x7f0000000080)={&(0x7f0000000a40)={0x2, 0x4e23, @empty}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x60000000}, 0x800) 1.655202888s ago: executing program 2 (id=9453): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_UNLABEL_C_STATICADD(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x8, 0x3000000000002, 0x0, 0x80}, 0x0) 1.456352321s ago: executing program 1 (id=9454): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000200), r0) sendmsg$NLBL_CIPSOV4_C_ADD(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000000)=ANY=[@ANYBLOB="84010000", @ANYRES16=r1, @ANYBLOB="010000000000ffdbdf250100000004000480080002000100000008000100000000000400088058010c8054000b8008000a008fee0000080009000000000008000a00afc3000008000a000000000008000a0000000000080009003b3e"], 0x184}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x6, 0x6, &(0x7f00000001c0)=ANY=[@ANYBLOB="1802000001000000000000000300000085000000410000001800000003d81b15e7d238cc"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(0xffffffffffffffff, 0x84, 0x72, &(0x7f0000000000)={0x0, 0x8, 0x30}, &(0x7f0000000040)=0xc) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000100)={r2, @in={{0x2, 0x4e22, @local}}, 0x74d6, 0x2, 0x5, 0x4, 0x62, 0x3, 0x76}, &(0x7f00000001c0)=0x9c) r3 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r3, 0x0, 0x482, &(0x7f0000000080)={0x84, @rand_addr=0x64010100, 0x4e21, 0x3, 'wrr\x00', 0x1, 0xa8a, 0x30}, 0x2c) setsockopt$IP_VS_SO_SET_ADDDEST(r3, 0x0, 0x487, &(0x7f0000000000)={{0x84, @rand_addr=0x64010100, 0x4e24, 0x3, 'lblcr\x00', 0x8, 0x7, 0x55}, {@remote, 0x4e24, 0x2000, 0x0, 0x12d5c, 0x12d4c}}, 0x44) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f00000002c0)=@mangle={'mangle\x00', 0x1f, 0x6, 0x390, 0x0, 0x130, 0x1c8, 0x260, 0x2f8, 0x98, 0x130, 0x1c8, 0x260, 0x2f8, 0x6, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @ECN={0x28, 'ECN\x00', 0x0, {0x1, 0x1}}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x3f0) r4 = socket(0x1a, 0x2, 0x0) setsockopt(r4, 0x107, 0x1, &(0x7f0000000000), 0x0) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f00000006c0)=ANY=[@ANYRES64=r0, @ANYRES32=0x0, @ANYRESDEC=r0], 0x48) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r5, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x200000d0}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=ANY=[@ANYBLOB="38010000100033062cbd7000000000007f00000100000000000000000000000000000000000000000000000000000000000000050000fffd000000003a000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="e0000002000000000000000000000000fffffffd32000000ac1414aa0000000000230300000000000000000000000000030000000000000009000000000000000900000000000000020000000000000000000000000000000000000000000000fcffffffffffffff000000000000000000000000000000005f000000000000000a000000000000000100000000000000000000000001000000000000020000e6230000000000000048000200656362286369706865725f6e756c6c29"], 0x138}, 0x1, 0x0, 0x0, 0x20040}, 0x80) getsockopt$bt_l2cap_L2CAP_LM(0xffffffffffffffff, 0x6, 0x3, 0x0, 0x0) r7 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r7, &(0x7f0000000280)={0x2, 0x4e22, @multicast1}, 0x10) connect$inet(r7, &(0x7f0000000480)={0x2, 0x4e23, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r7, 0x0, 0x11, &(0x7f00000004c0)={{{@in6=@dev={0xfe, 0x80, '\x00', 0x4}, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x4, 0x10002, 0xfffffffffffffffd, 0x2}, {0x1, 0x0, 0x400000000}, 0x0, 0x0, 0x1, 0x0, 0x3, 0x3}, {{@in6=@ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}, 0x1000, 0xff}, 0x0, @in=@dev={0xac, 0x14, 0x14, 0x39}, 0x0, 0x0, 0x0, 0xb7, 0x2, 0xfffffffe}}, 0xe8) write(r7, 0x0, 0x0) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r4, 0x89f2, &(0x7f0000000740)={'ip_vti0\x00', 0x0}) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x1, 0x4, &(0x7f0000000700)=ANY=[@ANYBLOB="180000000000000000000000000000009111870000000000"], 0x0, 0x4, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xfffffff8}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={0xffffffffffffffff, 0x2000000, 0x3, 0x0, &(0x7f0000000040)='c\v\x00', 0x0, 0xcf25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x80}, 0x50) bpf$TOKEN_CREATE(0x24, &(0x7f0000000000), 0x4e) socket$nl_netfilter(0x10, 0x3, 0xc) 1.428096035s ago: executing program 3 (id=9455): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000900)={0x10, 0x4, 0x0, 0x0, 0x1}, 0x94) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nfc(&(0x7f0000000500), r1) sendmsg$NFC_CMD_SE_IO(r1, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000a00)={0x14, r2, 0x1, 0x70bd28, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), r3) r4 = socket$kcm(0x29, 0x2, 0x0) close(r4) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r5, 0x0) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000023c0)=@base={0x12, 0x4, 0x8, 0xb}, 0x48) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000500)={r6, &(0x7f0000000240), &(0x7f00000004c0)=@tcp6=r5}, 0x20) setsockopt$sock_attach_bpf(r4, 0x1, 0xd, &(0x7f00000000c0), 0xfe11) close(r4) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000004c0)={'wlan1\x00'}) sendmsg$NL80211_CMD_SET_CQM(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000580)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="010025bd7000fcdbdf253f00000008000300", @ANYRESOCT=r0, @ANYBLOB="30005e8004000100080002", @ANYRESHEX=r3], 0x4c}, 0x1, 0x0, 0x0, 0x4080}, 0x24004000) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000940)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x10000, {{@in=@multicast2, @in=@empty, 0x0, 0xfffc, 0x0, 0x0, 0xa, 0x20}, {0x20008, 0x10, 0x100000002, 0x0, 0x6, 0xffffffffffffb475, 0xffffffffffffffff, 0x4}, {0x1000000003, 0x2000000000000000, 0x2, 0xffffffffffffffff}, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x3}}, 0xb8}}, 0x4004) r8 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r8, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in=@multicast1=0xe0000002, @in, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x87}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffb}, {0x0, 0x0, 0x200000000000000}}}, 0xb8}}, 0x2c000010) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f0000000080)=0x0, &(0x7f00000000c0)=0x4) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x14, &(0x7f0000000100)={@private2={0xfc, 0x2, '\x00', 0x1}, r9}, 0x14) r10 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="b8000000190001000000000000000000e00000020000000000000000000000000000000000000000000000000000000000080000000000000a00000087000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000500000000000000fbffffffffffffff000000000000000000000000000040000000000000000002000000000000000002000000000000000000040000000000"], 0xb8}, 0x1, 0x0, 0x0, 0x4000015}, 0x2c000010) r11 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) setsockopt$bt_l2cap_L2CAP_OPTIONS(r11, 0x6, 0x1, &(0x7f00000000c0)={0x0, 0x747, 0x3, 0x4, 0xfb, 0x8, 0x101}, 0xc) getsockopt$bt_l2cap_L2CAP_OPTIONS(r11, 0x6, 0x1, 0x0, &(0x7f0000000100)) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000340)={@fallback=r0, 0x0, 0x0, 0x7, &(0x7f0000000140)=[0x0, 0x0, 0x0, 0x0], 0x4, 0x0, &(0x7f0000000240)=[0x0, 0x0, 0x0, 0x0], &(0x7f0000000280)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000300)=[0x0, 0x0, 0x0, 0x0, 0x0], 0x0}, 0x40) ioctl$XFS_IOC_START_COMMIT(r10, 0x80585882, &(0x7f00000003c0)={0xffffffffffffffff}) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000380)={@cgroup=r13, r0, 0x1a, 0x0, 0x0, @void, @value=r0, @void, @void, r12}, 0x20) 1.36551374s ago: executing program 2 (id=9456): r0 = socket(0xa, 0x5, 0x0) r1 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000580)=@bpf_lsm={0x1d, 0x19, &(0x7f0000000300)=@framed={{0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9}, [@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x9}}, @alu={0x7, 0x0, 0x7, 0x0, 0x2, 0x10, 0xfffffffffffffffc}, @map_fd={0x18, 0xa, 0x1, 0x0, 0x1}, @jmp={0x5, 0x0, 0x3, 0x2, 0xe, 0xffffffffffffffe0, 0xffffffffffffffff}, @cb_func={0x18, 0x3, 0x4, 0x0, 0xfffffffffffffff8}, @jmp={0x5, 0x1, 0x5, 0x0, 0xb, 0xfffffffffffffff0, 0x4}, @cb_func={0x18, 0x5, 0x4, 0x0, 0x7}]}, &(0x7f0000000400)='GPL\x00', 0x9, 0x6c, &(0x7f0000000440)=""/108, 0x41000, 0x0, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, &(0x7f00000004c0)={0x2, 0x3}, 0x8, 0x10, &(0x7f0000000500)={0x5, 0xf, 0x646b6ce8, 0x1}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000540)=[0x1, 0x1, 0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x5}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000001840)={r1, 0x0, 0x1000, 0x8f, &(0x7f0000000640)="909d9bf61187403a481155f41efe7c23ea76a9eea7fd5522fc9602a03529c370215d3cb1265c6ac4213cf00590fc962a87c4e5ab9a08e24776b0c2529f0da49e01e82f48bef3fc55daebc0903be86211c137774ea02805c6d39483f8dff1a2dc7056b2591f1f043bcbea52307c90edb737ef1cdb7e329bb8e550e79ced4a9051b7627ee0e5c7af25681a4420f26b2f8a8db227f7c0dffba033f6d75f5cf2df45e8236df31681680be061907460818cdad62e8935cfae46c85b13830bfa39db55b6d996a12c9033917199932e333b6403aa07c38f489e031598fda3d186f8c5102c0a5db0ab95a43f9bb1b03b7b47dfc14e2dcdba7154647e2f91649c71410ca2015b05e6c86316baf7da954b2ae7bb31fd6295ac0b93858d1a87bb70359f2ce036ec4ce49dd0d7a7f2008582e9b1898ba4f39e498ef0d2c3943caa36da37137571934220009e8e3a2d71957e8ce5955ebe21ffd76e7ad8d29aa262db3915ae12b5244380e12fadced7d54319d6299119c5e620ae879a8bf1c38051a025688b414855d33d5f24e566c53895b5e602da7495b885a9189b82a262abb8b5dbb1eaa1e4da831e236a7f02e239fa5d9a12aa2deb9b9db33013c15603d37ba89d560db047d05f010486b2fd0b6638bf05df985f69ed72128c94230b2796fc6c70aeea382e14ebc937989ad430b7eccb5390d19c3eab6cbcc2eede161ec45d1cd090fa355c675a753b6878548a8722a1566063be31972bd2693f59798e596b7c8ecb6586c2ce873b444c248f359388403c9222fda30d1213d9267fb5d84a3bf04839d185005724657026c49ae39ffd875bc9d88d148888918e1ef5dcad24f2f93ec0e225fb5917105eaeb520e3f09781d9b53898895f12eb7e3651a964da7679429999b2770298470bf15fac2db386e29cbc9312062d016d45416c5b17878a35c28ba0db5cc500449d15f05d8d223bf49e3dc3acd95b292446283052966632da4f3cee1a839ef5bcd3354e8d415603f8398b0e45a064abde349f3e984df3022609953150c2e7ce57da3bba8b266bb7efd79f3877ea560baca83338cecb071648be33d5b9c0ac9e823e2bfabe78ae38be9e5d6bd063e69c29248131d4670e931dda32b51997c73858629dd1ca1222879fb7f3ce0f8d865dcfda4861bc8cd8640e3902a34f0700bdbea97e651b668985b73827fb20b3cd1296bad4a4f32c473b6fc9676bd9e8196f50f5a5d8ecb642701de0faf1e087910623a3e43ccfa89f60cc2005966f85d544b0bb55de44a9ea5c5f2bcc243da6154c2738deb4f4e9d8ea6019b03104a6484d010bd37c99cdad06161a58e95efd5c9c6fbf76e78b00f0fd75094c5079d11ddc0a54f4f60828da7f0803e056b401a44d7c575e26120e92f72961c4cc579a73a10a03190603d0e2a9e828e409c7084891e7f35ddd1c36df2192a1c1411c526e752f1628351b07c565b05b6861c1555d60cf960081fe91f457d615ac0eb3a1c3e7a0b0d77f3c3aa0cd98fd73921f070adac5ed85a9f9610f8ef84da12bfd2379509567741d917379a4b89e0a9ee2fa73bd80ac879484dfc4a65647325c57870d434dfe33292f7b4fe992cf2c269d7014ecd9904e1e674522bfffe84580b4ae0fcd4b6fc873716230e09d5f4303397c98e91dd63b0ab68ee5dba499fc512595ca7bbc4dfc799894e65f4529f23d458c2fdadc1f01b029bdbfa644d7fd7de5b8156cfb1e7496cb7b9772d72b42e5d9d9e3095a41a69d5be29e54c2a29c92cdb79aec596eb70b53c6947594e5f4d7d3849ce0e74c6f741d8b5b186c74c9c0658c098c2ffce3bb6b3e72d3bfd0646d1b787c93bc58477acc813a9fb5ed4a83e55f4b1a3304e58dc25594ec916124f1ae174ca11c3fee70cc303dc6d72d2fc35506d661b500a711cf6518fe6698861916542f26f9c8a042e89989c262eb73c35f8e99f6fbaba7450c33188244b4b303c03d243768cf2f07913d0e6cc3c58546bd64a96c4f7661183189cdc177f2b7550d3b0cdea793d084004ac73f199f02920b3a3956939b3c56713f149c13cc941d05f3a7603691f2f0a5e0cf5628ac95cb255ffc7fcf81f8ed676c2ddc873ec8dd0576bf3810df5a433f6adc6393ddc1b16aaf1d94c4af1fea47453ffd7f8ec7da38e303c1253723abf42bb0f58f4416f87d1bd19decbbc80841ca917132c45d28bdc128784ba5e46fbb5c3ce7dd0b20de3e395486e7b04e4fa3a70142a29544fe8489adc771922af79b554dbe4d552e7b8b21b957a53546f241afd925efbb36f6cc9d98bd5512dec448af86ab9f27daa36c84c95f3c21fdbb4aaeff3a1dcb4c3419bdef688cfc2ca6d7018bee98f0c266a48325c5e7404e6c42310aa6693758a44dc73f6e59d51f5a7a4017c50f181db479878ca1461bb062f879ee7fde233ee58d7ff7b9031a30c13535e56be44629eca41337f55f69bb216bf5c9622555d3323b3a4cd50f1d9f5f338a2c2dc5ccbf7d8c14430aa7d852cba6704a79c3d6e1fa2e02983b6bffbad5792c21e4977ce0ec6f035ec00f21b1bb3fdb8bf61f81815c85acf5adbded6bf2c60170d648304242e1d32e2396c03cafeb52ce141320f0fab72242afc88d4daa3241fbc3e43f2811b51e760636299e7ebe30cae1a3412d01ff2802a0a314aa637e9cc7469ab87b9c82d52ac7ba38cd4a03ba82457b0495f51be81886b7849cca3c844eb427674e329464d7226d7289effb6bed1c4fbce1717ef0254204d6b01b9d7ff7e1d399faadab2429f46f01e6efbf933f7d5d95323309a8ad856ae65d99fc813b516b52e79e732775f365aa603df44db82a209849ea2ac84a9fc58e714c5e7a618d27aa9b9197e4a69b4b7136d1e8004ba31f7c22cdb998f3ea9d785d53156eaf6419c569ec3467592bd7a8552c158ec934b02b99e6df176394520112579c0f31b4a3b44ca7bc812cc42fb5dbd35ff4def715110d48b9a00b3e03f1037b1ac7b662f2d4d25ba9d5b7075fe77895f0713f7b52ab1961f4b9e09b3e59d592aa6f255a25ba39ab1cd1c5ee5b6c1dec2d100efa0af7e1395eab4e766d9fa889a63fa260519ce2d42f706fff3605d33f713dc6f1496b66d3bc422c49b598692445482a3a717d386d923748ca784bc8f1ca77a5e69d0a8fc64b43e17e074dc52e9e453edfa537389fb8d308eaa768a1a747fbbb591cb886005b639002ef9151373e803c511ae3feee6d508d31df13fbb37d6920cbc5804fe959d65300706bcbb01200c65abc3c319b54453a39064edb55cc04ed8d8758abf66b2c215c4607698b61fbfaae7ada183ef9160cc2fe0d227e4c6672570976e788e209573ce2cf150e5d8b21a3c4d48f995cfdaab31756bcaaeb65417938d3cf005e4110230719bdf2c11155d6f8339889645379efbdef15146e356544dba717be58127f83dcc75ee4ee9ee6572a4d3ac20c8dcfe536a94e93dc7554b58142969af7711f378d84b005816d01ab30727d1bf132486272531728550f2acd7c9f7e379595d8ebdf22ae468e92bd3f9f19a7129c760b9cb7d497c8e9218bb9e43b2d5487d059bf6e4332de2b96afe3c16bea1b653286fd7479814ca32c9c8b0dfc547ddf93929208902f9832744bf464bf2dfa0d82cac201565a8b44517e24f0ee703a4402caa41f64e8d7d6085559df6ef71f1ee1208707a6455ed91a251a46c4c4420744b6d1516f5981f8aef49a01a5077e6c88a4a3ad18a0fe0fa92e411fe7a1483250e7482c74a9d2189bc95b3fa2c00468b76de7cb5d45d2818b450502921977a0c7e7cbf0d047b2249fea08f9274fd44084d7ae38b79bbdd9cc95fc683895f46218cbd2d63a25695b92d7468a539e3f6faf797e1e0619a077c0e853564ad372d5d2ce87bc47e6c1977a6a5087b54a9b085b833458fc0fdb569c8cc836805206bdeaec793b605d3e088b82dc56c6105cc4f6d090c54283a41cf287f94f273ea65d917c3b96de9ec695cd660e08456ae7b4275e0addd081f910d75be8fff486793eef01d10fc785f9d08231245b288d290e4cec720cc10c30d292617212666f5282aee4101858de83de156b40fd45b23293957695e54d22d6ea197ab91a518e6054c089140e79c9b2fed604ea7e5083f68e6c89ee9707c975d6062850b4ea992c318a14b3ef35e8a7cd7b3ac0e01ad0138ead8ae5d9134e931897f7f47fe0b031dd98c1b97d4dc6f948fa6f5ad0f8d1f2f10dcce32892e411ce9d0c101a5954fc8180d28098dbf8dbb2cc97e187eed338c54ec18b77d25c54f7fdbf45f79f74a2ae88de60fcb6e1fd793df3b71571425f938dcf23238af43ab35d41031fec6108cee42e5d14754804111e9db76bcd4330d9a6f4ef8ead06f3d6bf9be2ad877dff7c8d133d2d8c170f8ccd17fa01a60622ef4a8bb9a6a7906e1a5c3c1560897c15f9670c5ab53fa038c6827623ddfc82d48508ab59899aa582af7ba0793c51c292c525287e2514e6554b350edf78484b9ce31f828b6b69040d047dfaf4d9ee8bc8f85910a95280dfa07e2b5f08bfab09b70d51111b5a3493c2c1f3958085a45dd757447fdb55329447420c31f999865e1cba823b6fd21d4bd6a2773c8f4172410342d956f857d165fcac98f94cb2da5dbcb4ef689ddddeae7967f8d29973a1667400ad1ab25bbe8481f4e106b86d4773b526853617179774bac90f395cefaa65a5785f5fa65d48f34fcc8aa3cb57bd2cd1b747634d632e16bfc5f972f4023e3f1802a72eb036746e9e6d400f2298f722865b00c16b3a3d676eac18954e7b54acc40cdcc3c71904e599fa9d3992dc70e5410ccaf7d19d39e3bd2a4d7bc54a1ca3e0650143423827603a4f1689a9bfa63877b92430054ea70ef62da71e0dd3fec1898be5f19253f163d59035a2561c67189915e4cb1d6b5eb0b232df9d726f2efd8c65f2612a7338b872d72c3393c538d6f06ccdda642878097f60bcc64b4a28e7b3dd44974ae89cd04aaca661badfc468cf6fccc7ed0021473b03d4e8ad374b068e47c8a258d3c5857cf4a1b8b2b443b4f5218a93f4c5aa519d18ebd585991d79514de83fb464de90bdb539690a54c09c56b3444288394159c2edd99bbe25abbaae5289c7fb295c0ac88b5ddbf9e3d6760467c333a58293c8669b2c8607c20d99d10e3960bd221b3ae1ab9fd0aabfbeb33f51dcffe6510d3e98f63ca0587f3d78b4263a270c46e53ef4dbc805e6938d4c7d8659f1d1ef3f1a36faeaf936313ca6b404cd615d9265b79ac344a11fb3da21b1d3179e9739e3607d32cc4b02df997c1201213f815c0c967634a9037b6ff1028394114cebc418ba67ed78a570e488ca9c15944b00790ecd55b56e9b3e9395c4cad35fcf02b3edaad4c8a69b3aa86b8c61288076196de0c1c56663dda859410314e058e3fc8c6687476f8a213e56121b0b3aa166e8265af193aa49e46f0cf83a33d3885711d2b0b43334f1c8ab7c95c4df2f093c9a599e3e055ae6254d9983686e9dba27a4dad7d571c05df64e9a4a4a77b282758f630715bd47a1e5f34f35c3c0564450775596d504f0e5fcbf5525632b9eb1825d2f455d0b239a07f816ac0e30fb89888b3b5ca503ee4dbc0825d2a64e24b40a27465edd88770a0d922e54c301b4c6389b9af9d463b359931d73609f2d8d97deb89c1f7c5b1a6b5e2773c5db88dcf9f2dcba3fc9c1c4af6e4d9712d16885d753841324530a7e772264171dff84c0469a99a88805fbfcd37c6f3d551f50b0c4f122f416c33a096bfdb8a1c005a146f39de2781e92f4a504d54cd657cd68074282573544d95f74a21de7772d0288d8", &(0x7f0000001640)=""/143, 0x6, 0x0, 0x95, 0x7e, &(0x7f0000001700)="2e97f3ab17776ad240aea2fb60da95aba86fe56534abf7f73dbba1d942da43945d999f11b0374012fa6a5f53ca13790fab924e3f6c0145763b39b5a42da81d267e11c88610a895f9b556e5548a3d5aef5080f17c166fe139bb9f89074be4be582ca3d05a61b9c385b1e745253060c946a0de9cd70e12585a8dbb0fc479b5fd12cf9fc825d13b15845ab6d5db7f03830352db27a0f0", &(0x7f00000017c0)="30c6dab87397bbc4de65ec7901c3040538c2f833a489ca9501dbe48f58c276a942c32e5b4df577ae53a1bed2045122a32cff6023c8409ef32f495e06f3674e5c2b065494f507546edc511ed306c28574f9ee0f95c69da880443ed9da6279532d476ff0acc7d81a13027041ca181d24167f9e2e858ec1ecaf29c45cbe7e77", 0x2, 0x0, 0x1}, 0x50) sendmsg$inet_sctp(r0, &(0x7f0000000140)={&(0x7f0000000000)=@in6={0xa, 0x4e24, 0xff, @loopback, 0x5}, 0x1c, &(0x7f00000002c0)=[{&(0x7f0000000040)='Z', 0x1}], 0x1, &(0x7f0000000200)=[@dstaddrv4={0x18, 0x84, 0x7, @local}, @sndrcv={0x30, 0x84, 0x1, {0x5, 0x800, 0x2, 0x6, 0x7e15, 0x2a2b, 0xfff, 0x8dc3}}], 0x48, 0x4855}, 0x24000052) 1.151177664s ago: executing program 1 (id=9457): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000380), r0) sendmsg$TIPC_CMD_ENABLE_BEARER(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000d000000000001"], 0x38}, 0x1, 0xffffffffffff800b, 0x0, 0x44081}, 0x0) 1.043036077s ago: executing program 2 (id=9458): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$unix(0x1, 0x2, 0x0) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000c80)=ANY=[@ANYBLOB="98000000", @ANYRES16=r2, @ANYBLOB="010028bd7000fddbdf250700000008000300", @ANYRES32=r3, @ANYBLOB="0c009900ff070000750000001400040073797a6b616c6c65723000000000000008000500070000000a00180003030303030300001c00e7"], 0x98}, 0x1, 0x0, 0x0, 0x91}, 0x24004884) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r5 = socket(0x400000000010, 0x3, 0x0) r6 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, r7, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x7}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x2, 0x4}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000640)=@newtfilter={0x4c, 0x2c, 0xd27, 0x70bd24, 0x5dfdbff, {0x0, 0x0, 0x0, r7, {0x4, 0xa}, {}, {0xb}}, [@filter_kind_options=@f_bpf={{0x8}, {0x20, 0x2, [@TCA_BPF_FLAGS_GEN={0x8, 0x9, 0x2}, @TCA_BPF_OPS={{0x6, 0x4, 0x1}, {0xc, 0x5, [{0x6, 0xd, 0x5, 0x4}]}}]}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8858}, 0x20004804) 946.517964ms ago: executing program 3 (id=9459): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x4001}) r1 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8916, &(0x7f0000000080)={'syzkaller0\x00', {0x2, 0x0, @rand_addr=0xac140001}}) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', 0x1}) r2 = socket$inet_sctp(0x2, 0x1, 0x84) bind(r2, &(0x7f0000000000)=@in={0x2, 0x3210, @rand_addr=0xac140001}, 0x10) write$tun(r0, &(0x7f0000000140)=ANY=[@ANYBLOB="00070800010000000000140008004500003c000000004084ca2502020202ac14000104d2321000000000000000000100001c11223344000800000005000500000000010c0007"], 0x4a) 916.683437ms ago: executing program 1 (id=9460): r0 = socket(0x800000000000026, 0x2, 0x0) setsockopt$inet6_group_source_req(r0, 0x29, 0x2a, &(0x7f0000000080)={0x1, {{0xa, 0x0, 0x4000000, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}}, 0x108) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000340)={0x1, {{0xa, 0x4e24, 0x5, @mcast1={0xff, 0x7}, 0x20000000}}, {{0xa, 0x3, 0xfffffffe, @private1}}}, 0x108) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x4000000) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @empty}, 0x1c) socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000c40)={0x6, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nfc(&(0x7f0000000080), r2) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), r4) r6 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r6, 0x84, 0x1f, &(0x7f0000000100)={0x0, @in6={{0xa, 0x4e21, 0x101, @dev={0xfe, 0x80, '\x00', 0x1c}}}, 0x7, 0x7}, &(0x7f00000001c0)=0x90) sendmsg$ETHTOOL_MSG_CHANNELS_SET(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="340000002fecc4bfbf8eae77", @ANYRES16=r5, @ANYBLOB="010000000000000000001200000018000180140002006e657464657673696d300000000000000800090000000000"], 0x34}, 0x1, 0x0, 0x0, 0x4f67a6733fac6c5c}, 0x0) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r8 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r8, 0x6, 0x210000000013, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r8, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4) connect$inet(r8, &(0x7f0000000180)={0x2, 0x4e21, @loopback}, 0x10) shutdown(r8, 0x1) recvmmsg(r8, &(0x7f00000031c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x22, 0x0) ioctl$TUNSETLINK(r7, 0x400454cd, 0x6) r9 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r9, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) sendmsg$NFC_CMD_START_POLL(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)={0x24, r3, 0x1, 0x123, 0x234, {}, [@NFC_ATTR_DEVICE_INDEX={0x8}, @NFC_ATTR_PROTOCOLS={0x8, 0x3, 0xffffffff}]}, 0x24}}, 0x0) sendmsg$NFC_CMD_DEV_DOWN(r2, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000580)={0x1c, r3, 0x1, 0x123, 0x234, {0x7}, [@NFC_ATTR_DEVICE_INDEX={0x8}]}, 0x1c}}, 0x0) 316.996151ms ago: executing program 3 (id=9461): socket$nl_generic(0x10, 0x3, 0x10) (async) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f00000001c0), r0) (async) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f00000001c0), r0) syz_init_net_socket$bt_rfcomm(0x1f, 0x3, 0x3) (async) r3 = syz_init_net_socket$bt_rfcomm(0x1f, 0x3, 0x3) getsockopt$bt_rfcomm_RFCOMM_LM(r3, 0x12, 0x3, &(0x7f0000000540), &(0x7f0000000580)=0x4) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a00000004000000ff0f000007"], 0x48) sendmsg$NL802154_CMD_NEW_SEC_LEVEL(r1, &(0x7f0000000680)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000640)={&(0x7f0000000600)={0x1c, 0x0, 0x10, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_IFINDEX={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4001}, 0x40011) (async) sendmsg$NL802154_CMD_NEW_SEC_LEVEL(r1, &(0x7f0000000680)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000640)={&(0x7f0000000600)={0x1c, 0x0, 0x10, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_IFINDEX={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4001}, 0x40011) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x15, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb7030000080000002d01000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000080)={{r4}, &(0x7f0000000000), &(0x7f0000000040)=r5}, 0x20) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r5, 0x2000002, 0xe, 0x0, &(0x7f00000004c0)="df034affffffffffff0000000000", 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x4c) sendmsg$TIPC_NL_LINK_GET(r0, &(0x7f0000000400)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x44000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000280)={0x110, r2, 0x8, 0x70bd2a, 0x25dfdbfb, {}, [@TIPC_NLA_BEARER={0x78, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x7}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e22, @broadcast}}, {0x20, 0x2, @in6={0xa, 0x4e21, 0x2, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x4}}}}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e23, @rand_addr=0x64010101}}, {0x14, 0x2, @in={0x2, 0x4e21, @private=0xa010101}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x10}]}, @TIPC_NLA_MON={0xc, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x1}]}, @TIPC_NLA_SOCK={0x38, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x2}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x80}, @TIPC_NLA_SOCK_CON={0xc, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x81}]}, @TIPC_NLA_SOCK_REF={0x8}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x1}]}, @TIPC_NLA_MON={0x1c, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x6}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x1}]}, @TIPC_NLA_MON={0xc, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x2}]}, @TIPC_NLA_PUBL={0xc, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x1}]}, @TIPC_NLA_SOCK={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0x10001}]}]}, 0x110}, 0x1, 0x0, 0x0, 0x8}, 0x1) r6 = syz_genetlink_get_family_id$nbd(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)={0x48, r6, 0x1, 0x70bd2b, 0x25dfdbfc, {}, [@NBD_ATTR_BACKEND_IDENTIFIER={0x9, 0xa, '^^@-['}, @NBD_ATTR_SOCKETS={0x4}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x3}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x1}]}, 0x48}, 0x1, 0x0, 0x0, 0x40040}, 0x8c0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040), r0) (async) syz_genetlink_get_family_id$batadv(&(0x7f0000000040), r0) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)=ANY=[@ANYBLOB="4433000041000701fefffffffeffffff017c0000040042800c00018006000600800a0000203302801c331480040015"], 0x3344}}, 0xc000) (async) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)=ANY=[@ANYBLOB="4433000041000701fefffffffeffffff017c0000040042800c00018006000600800a0000203302801c331480040015"], 0x3344}}, 0xc000) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_CTHELPER_GET(r7, &(0x7f0000000500)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="2c000000010905000000000040000000a50c000480080001407fddffff"], 0x2c}, 0x1, 0x0, 0x0, 0x24000901}, 0x4048080) 214.991357ms ago: executing program 0 (id=9462): r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="9feb010018000000000000004c0000004c0000002a0000000100000000000001040000002000000105000000010000040400000013000000010000000000000017000000020000040800000021000000010000000000000025000000020000002000000000696e74006270665f7370696e5f6c6f636b0076616c006d61705f76616c756500636e74006c"], 0x0, 0x8e}, 0x28) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0200000004000000080000000100000000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=r0, @ANYBLOB="0100000003809c899fb58cdbea0000000000000000000000000002008cfe283bbcefabf71230de72fec769"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x3, 0x10, &(0x7f0000000400)=ANY=[@ANYBLOB="bfa200000000000007020000fcfeffff620200000000000018110000", @ANYRES32=r1, @ANYBLOB="000000000000000085000000010000001500070000000000bf06000000000000bf610000000000000701000004000000850000007b000000bf610000000000000701000004000000850000005d000000b70000000000000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x5ddb343c6bddcfb5, 0x0, '\x00', 0x0, @fallback=0x1b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x94) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x3, 0x10, &(0x7f0000000400)=ANY=[@ANYBLOB="bfa200000000000007020000fcfeffff620200000000000018110000", @ANYRES32=r1, @ANYBLOB="000000000000000085000000010000001500070000000000bf06000000000000bf610000000000000701000004000000850000007b000000bf610000000000000701000004000000850000005d000000b70000000000000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x5ddb343c6bddcfb5, 0x0, '\x00', 0x0, @fallback=0x1b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x94) 151.235729ms ago: executing program 2 (id=9463): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000400), 0xffffffffffffffff) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000180)) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000080)={'vxcan1\x00'}) r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$IP_VS_SO_SET_ADD(r5, 0x0, 0x482, &(0x7f00000001c0)={0x84, @remote, 0x0, 0x0, 'lblc\x00'}, 0x2c) r6 = socket$inet_sctp(0x2, 0x1, 0x84) sendmmsg$inet(r6, &(0x7f0000000680)=[{{&(0x7f0000000080)={0x2, 0x0, @remote}, 0x10, &(0x7f0000000380)}}], 0x1, 0x4040040) bind$can_raw(r4, &(0x7f00000005c0), 0x10) socket$inet_smc(0x2b, 0x1, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPVS_CMD_NEW_SERVICE(r9, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=ANY=[@ANYBLOB="4c001000", @ANYRES16=r8, @ANYBLOB="010000000000000000000100000038000180060001000200000008000500000000000c"], 0x4c}}, 0x0) sendmsg$IPVS_CMD_SET_DEST(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000200)=ANY=[@ANYBLOB="14000000", @ANYRES16=r8, @ANYBLOB="010015be4c385af31d4911"], 0x14}, 0x1, 0x0, 0x0, 0x40084}, 0x40000) r10 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), r10) getsockname$packet(r10, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r10, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001d00)=ANY=[@ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006", @ANYBLOB="94f96b4d58470ab74a8d069d29f7d29b68f7e6da4ddadf77cbf0bb876f76e2a60db4c15d671189087462942b3d4e84a62a2d76fb5ed8324daa5cbe5aef6325ae3ec17ccecb578c4b3469e69adfa4b972128a03aad633a2eee5ed01fab81accdb6f0950a2f29d35745288788cc3aa6d5124a8dfe3b41a25ca3fdd2fee1c8176e08de63cb853d345aa538bcc8a20b24d20ff57a1fb5a8a19027bb01abd8a91477f7d52842245dad66173b15afea5dc534578c559d7c77ac85176a8535ec9c4c67ed6c3d4edbbdc1628908dcd346851a881dbb0faa63b0cff1152c62394fdc1a2771af08b8610db0b4abb26c1732cecceb1055130f2634a085bee13500d0a714f07b2dc760b06ca39377bc84d9a615c2d6b1225348cb31d18794ff6eb779bf4b5b4f720a441eac9b278a71bcdae0a069d6b0f3bac85efbf0d3836863e3ec65ce45a73461996286db0b478596dd5a2c1a3306d6383030606f6540fb54291d431595f09f790fc7588a68f4026a2818e25ea6393d98912e8045a04cd8a3e2fd75535b53e289f0f51c220e3c82a2b30e61d8f3aa226b069e9a24305c6e89c21c1d0e19a8f77eb03afc3e374b5d6d95dcaf53aa2072ac4e9370a6d5ce076d568da2e16f1724f3b9ae55d7d394c852769e2f5242c128bfbfb9bacb1e9865f3a3d1790a12e4c1d25aeabd5b8927c32d96975516b4823aea31d0c304e24b83edfe6cea9a0761075ee776edf2496a80051440b9cba66582bf00c651bc5f5e8104897208b9ed4f8e8299e71a364d0a9512bf2b0745f1e390d122530243ca6ed338df4201abec33fe99e3dd1b597c3bd60aba571c31b7d94c868f350390012c1e90f61829e6b3729d8b0db4b11bd41e215526c88a7ccc256f0d2ddd65400717ffbae11f871cbf7185537f024720cce6661b57b7d5cfb60e3b523fde78410cb3f87841a930bcbcdfc1ef47cc175ed786fac837bc57a43f3259321c13652b1c961b6d0927797d0a9ab58cdb7876d7ebfe559029912487f3b9a5232f0b50a28bc167c7344eb59d5b2124f444fcee156047453e95af065b1a186ed187f39c5d8334397f063fbbdd0e99ba7d0e9f7e292c1d6133c84c221ee193b694db5f137309b3ffc5f1b09d11b912a2d18ace87b435683b545b0e8c80d7984f38f65ab70b4b796cce628b353eb7a0fc59423013b6ff7cdaea7b9e1efccc3156fdc0187da1085d60d6eb517c1cbce590bd36ebe8a717cda0e8471beaf0a7e5c5e6463f8638a0c37cd8ced613d5bc3e2fb31bca788cda78d4da9b81895dcda32c4db26b031aa4355a5a07cd861b66fa6fc4b4c6a98388825ac5c26db363c39317f22fb82b8c9fc2db23e57ad1fda4ceab58f964adce1f2ef04375fb762fa6483346bb6bce2714b492388daef47febe63396184b3d6edf1e641ac59617b9478d9c3b92df112e61ced1075aa2bd100411872f1c8431d398d0a1cf4ba58365fd7135f9108f3643e7237ac7b17b3d9136168770432136f707c20676641102efd2e1d2529b3589964cab6bdf35d408af75997aaa23a3a630331e970365c791e9b0e28b3e2a0534f602735ac9475628265dc3903e64be1ac71b98628527952d12824f94a17398a847f598d22a5a4fd5c84036786fcd6065d34345e62bf3d62c15c95d1f52061e1e32fbadb1a42cad3d6591cc4d001addb47f467a3004a1240f4df4b380ef09c856babf972350ddec4476e6512e15a6d0c40f9ab127f1ec6fe79e1303cbc9366eb4a4e61ee9d1630d0825a12b9bb258f28c9b1d8adff9f0536eba7e17487374908c3a22d786b5c3f652d499097cd3f7ba3df8a56c9718c3a256ec425d43934281bf5e79b43daae6c5229e00a30e1171975712324cc3a468d5f3314adb49b67b93d3c2b87f894ab519be6e0107e6174f895ae9ed91e9f18e3c2f22b7d47af29dbff139746c8dad43219490837b6f99cd982e610373a72315797519ba04687b9d8821148b0b5e5435b4b6e63525112f600b5cdda020fd2d38e6c0ad609f6f6eba846bb14cb00458b72904d3b6c5a6518219d51dafc6882d423b99f9a6e8ba1d28987eccdcb7511b662d30bc239560b7caf26f6e88608f6a7cb8ecfc6cbc4774553d1974c31799e6d80045a3dc42c6e793aeeb8f2dbae98562ec5ac5d8dd695e2d5c0d30c067d4d7c7866ec5a4edec0d4a2e2414bc8dad5913876a1667a10bac8c2336cdcb70807c8395a00bbaedb64d07e05fce8d69f7b3a66ce4c8e643f9b97d3fbe7bd6c48541435d55ef277e7161f1a902b2d12c9a4ee0dcd2f5fb9d3378f660a7ccb8ce9934a44b5c23343ef38786df939a0a163bc952d6879211b964802903dc15948e3b689e530aab304174bb9cc47f38e69171b275489499c81787ac54f9a1a9890c0032f141864646db39831260c49ecfd3b37a105912c5c641f3c066b71fd7810a9fdf837a51f7bd47272ecb336f8a553f4c78b0833fc2fbc836d450733a55075a9ad9ba42813d22d51c04d4cb005cbab9438dbcf4161ef0eb94dd05b1d1e72cef6f16229051ec8225ed842be1cb53bb006c860bc6c4538935ccf5c590e8e3bbefee7b35680e407785c6b27d5022d18ee3727cec7b33c31f76b6ecbbcc9535ed674b6ab0ae8285f471f642abf9cadbf6b6ce7594b217d3f66ff1f6028dd3258a57e25e4543a16c0f78713b2324595d295fe76ce70b279e8087d24609363e0d4e37c1228e757488352fcae61780261e525832a43e9194458679f7e05f709737a86fec26dc23a6a591ae2ec725afe39f3b730d9e7f20644e1ac1ddd74313aa390b4d81069bb4f9963125ebc1588528235b383db548f8841bfc25b2b4b6fc57ea95a393822d677974e80ce7a6dfad50ea85f487c3c08afff1cc8243d699308c4d0ccf020ab6c1c7ccd4a74d16f6dacf81adb50ca141cc8a08d54c33061caaaea81b0c1bd2a33c82f7e8e9ed97e8250f71443b5a5b3422546afcbefa1bef96c4f5e918ca4a7d321f0005d66e5a8b975bc2f0d6ecae570b746b536dd013aeb93a9b33cb8e860c0387ccb1e27d3c2426a29fa327a0f5e5bf5a090d0b150d6e69e214ddb9cc6b028706d28c36d4ea265904bb7745fb678f634e5acc3ed93815c5fbfce2d79986019470cbc407ebf9895223686432beccf3af29a232d5271527dd6c9c6dd4a7b1d9cb53a88d1e5964a6d6bda45f3716d3dd13471b5fa5a604c534aabca18690cc1843a3c46d60d15f8936253e8c076608cab1f1418c6fb94c908146d9e69637891546c146dcf61566476ddf4c20c0392253c9878e0ed867a3de06b2509c3d94801ba3c4474ffc7b0e498c34f3d75774cc65e2ff7ec02fce4e0b228a06cbdf15049dc55f873018c3cee6eff38faf3ca6873e83411ffbaaa3741c6d8e78a25fed1f3ea8f8068130e1fbf57a1ce59ba0518a5cd05700f28ed832dd1d0a5e7f81a2e65de40fd19ec3bd925d813b70f84026b8e6464a1659431380b6cb9ef222c2b0ac0601f932dcc2818531e091f2a3a15d2e381968773bb60dee776c77bdc046910400a50b291ab4105a39713a95ec45318ecd0159d4205f5462aae4e40bec1059954941ab8c3b1a8bbd84fb42fd04e43adf6dbc992a3e555120c0206ddd9e683e322c716792ffbb36eefc7410724cf424a6a98984dc08bacd5889e196da99a1d6d4d74d5fc8b3ea99c039062a0d88c9f2dd88afbfb06d02b1320a9176caa76ae9a233df57e78ba7c6adeb6c0d100b53a2d58f9dc72c1983ef6d0f633d004eb1375d48f65015b748c1aa4edbf1dd52c4470e96a41237e1b772f4c6dfc84feae026c067dc8e5e99d9dce718b24f0c9098efad2922872499c29aa3eb05465ffcc79d9f28028e8fd90f7107b77a6d5c90ace6203e6c7bd5be32276931bfd62a59a8f2220529fc2ad5714c86b36aae18242fc17eb42b96184fb8b04415c3d3e61af5498abbaf905b51d787d90887ac77bb0452a18370e825d4ae6a3c63ee785d321a5eea82f398d2105d3531d15613aa6816d05ecc69107e46f4a5fe620d2201fa521f743f3785f601a085b3e81e58bf6e69ff6f04d3b2db9429960b212c641d214e524a682fcff2c20d73a4642510e44744f4662f2235f3a642dcb82c40d494122eea36cadeaf5dc087d38b26d0845eee2eecafb1013c8b69c23f2cd2a00fe1d9cdc2808acba7f98f6683d8d7c65e987fb92e31f2f1e35a2daede7abc78498f155467c69d1ca236514059c9372c15420aa03baa0ca68b20efb62eafa0af80fe8d8298eb9a5b5217861fcc843998b0c8a931dbcf4f1f787bbc8867aa6ab34c4cebe1c22f0fefac9e687671968a6fea3d292e75f0465aa1b32e02738deb01ca793a3c99948225739bd731dca255dc65a4133008d646faa15928b15135d6ec7f3e5e786119dff6ff0cb3888362ffcbd142615eb4ba59133372165b45cf05939a93c9ea27745a47d0c7bfdef903b7ba56a272727f226ad60d6e5b004f9025cbc8009f8e23e0eb3fa482e7cae97631b12cdd4eef77641861a9490fa75caad88699484987ff25a5db1ec5455cafc7dc92507cf49b0fcd21f1864f547918b7b83fadda304657099df001feadc0745e187394531304c16729ca1cf0e7889da2cf8741dc8acc4a8a85fbc2b8dfe0e50a68528cd3b2d4913f8fac8343cef904935401d8abb8d002439bdd6e1245896f805cb9bfdcd5cb8eeb4187144650f31a6c9bd0cfe704c6cdae02c4da7ac29f0a2b08585e6b26206cd8010e0b21de0e9b0e523bf6cf5d05621df0432586da653804a08504a36e1ff71545661f4ec563cca936d3a1fc47bad97069f97e85499e344e56a20b55a82c9bbaf5427db5662a0b6ce2300788ccd15cf215f3b81dcb903220f6496620176fdcf049fbbdfb778dc95b8353c3173f6e53b6abae57baf9855b44c9313607a238f6f3f958b6b2eeeb67c0e430bf71bb46d567fcf1f4585cc81d7cecc913f52f34ad863bd3e3b8318a88a0aeed07a671fd3b8c35d927ed88bb13c48353d6300b776bfb9bb2773c8b0f1dc7ba784456a175551c0b27a612aa42d1ec69a29a5864d701f5358f279bb124041bf89648d5213d921c07f3cd6586babc4198b112ca873060da448de5ba20e14ebada8946dbedbf0bf72353258141aa82c4971304aff128c4a12d78bed20f420fa2c7ecc1e085203ef704e20477b5370a57092110cb1acdbb1fdb0bbc9c97cd2c1f40212b459231c12dd068ee54e732cc613957e41ac8c5a7a3fcb75cd0cf1cd6091d6577c4a88879bce7490861840af0c91754a62465f428bcc9df106e063f5450d853c50ff1d9ad414bda107681e7ef2f8b4ae331f43a79404dfa605f58ac684348a4d9b373531598c5e066cb832b00ba51cbca5695f96153edef222784d565ec4b1c9c2fb80a9d01d6aa77cc893ac6ea6a1ae538e1a142871d91770a8bc30a8a1c178cda9ebbe0aff5477dd56c35821c9f8cf95be9e2a4bbd624f4a4fe245d8bd8da9dad89d6d1baf6c60746b5ab15fba70d676cf9a07efe8ba3a696e48a464dd6d67fcebd70036c607e9b8b046b7ec26c5c87b9a7bc141b808e1938556adf939627d9081591e86bbde4a5867f3b91e834679e8c4165ff09c23beb9acc5382312e9d301731202ad3a7e7123e37360721769e1218d5d4afadcf230687cdd550a437acc940fdef4f7482a638646a0c4a7dbaf2e3b97d3c8d84a293c98f86909d44d15f92d3b003412c8f43f6182bef9acd5e8cbed4f12350436f8473ebee594c76841e14e309b4e9a00d02459a1bbce02a2f2d81244e58aefe966a8d6d66b7f0fbbb2b199ca08753300cac0f3c422c73d8ffbf6fe4d6210997336b59257eea950e127d6001e8d0dfbf0a9914f2dd46b94d43d1c4c8eda61f51be0e6f059af9b349c941375c32a78960c823848208a1efa6274c286f9abb02a55cead54e3013844b8ebf1027212c574a939f5602b2a03bda6fb7607a4cc2cdbe7a6a0071f63d25516cdc76d656d84191d01859e4cc011d7945a9e96350029e0613a6a2a1277e4cf4dfa7ad58bd946bbb9a6f4f9e62d4fc272869cddc1e394baefdab650b821e76c96cfe8e2933bd9c75baf5294690c6e748b5a3dac404737d79ad0d3ab89ce56fe95a059de8c44948fddda679ec12a3a04b01310282e2811617f5f04a608b03ef5e971087060e4b80daf9075739d95152703aec888c2cf38fff24d50810000000000000000", @ANYRES32=r11], 0x3c}}, 0x0) pwritev(r10, &(0x7f00000007c0)=[{&(0x7f0000000600)="7e907546ea946bf7fa9814c042ababa38bef0e83c9b5b04aee18adedc481e178c694a77742dad0786c251a5d84a536e29e837aba9bc015b41f136585a4715a086c4cf02584694a0c554fa8e1515e674b6abee2f0c83d970cf837ea61b92451ad7dfee030b5cbf95f53da989bcd1ebf31404e675017e82061fb46de385985801e69295e285ab042413d8562118ef05f8be4a9a2acbdc6ec653cf5024f99f5c211840deb32b898cd43adabaea1b13eedd342f1d91736d3fae9fe39184abb94279b12364cbdd1394f9aca59214b67801907d5cfbe89220890685151871cb388b538f3470e", 0xe3}, {&(0x7f0000000700)="e7022b6896d1eb9da36a11eeeed9e82df8de5958507244fc5665f2847215ae3cf5bbd724d4441e3503a352fa3a3ebeec97a229877f105d31e8cb68f1423a09f4f153ff919313390c9fc2dc30af8750f036642442424d8387babd1a644eb485d40596aee8e58269923b366faf882ca07d07888bd178fe78b57015558fdc351ce4aec397b6ef6002b0a845a1d7", 0x8c}], 0x2, 0xb, 0x4) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)=ANY=[], 0x3c}, 0x1, 0x0, 0x0, 0x4008800}, 0x8000) sendmsg$nl_route(r2, &(0x7f0000000c80)={0x0, 0x0, &(0x7f0000000c40)={&(0x7f0000000800)=ANY=[@ANYRES8=r6, @ANYRES8=0x0, @ANYBLOB="12030000000000000a000100aaaaaaaaaabb0000a37a654c471ee0646a1be0d9ae5b94acd51d332502148737c5ca3acbc5086987162a36213d42c958ba83394480fac8d11ce3eecadb66423b3c7bf99d3d7e7b2955976412ad09241e532b1c702c8bbeb776a0f684f4f45954df80605ffb1a84ea8f4a06339321d6eeb27bc4833317dffce0d6e3949bf583ece4df5dd752d910121001da94cea2eb43d55e6cc2cd6acefa2ae931e1222a8589f4584f1301dcaad00db2891ae3268d12469563c0bd95b2acb55a1e0409a219de0ea2e593058743d07ce60bf4"], 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x40042) r12 = socket$nl_route(0x10, 0x3, 0x0) socket(0x1, 0x803, 0x0) sendmsg$nl_route(r12, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="4c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="00030000000000001c0012800c0001006d6163766c616e000c000280080001000800000008000500", @ANYRES32, @ANYBLOB='\b\x00\n\x00', @ANYRES32], 0x4c}}, 0x884) sendmsg$DEVLINK_CMD_RATE_SET(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="3c000000a5ac94b291851f72196d83b8255a7db4a75e709d467c7bda8d4d123ef4fd924917517814965a15fabbb0957f4a852a41a68cd6046ae4f047b72f02340639d86b698416f180ee", @ANYRES16=r1, @ANYBLOB="0100ffffffff000000002f0000000e0001006e657464657673696d0000000f0002006e657464657673696d3000000800030002000000"], 0x3c}, 0x1, 0x0, 0x0, 0x20000041}, 0x0) 94.025981ms ago: executing program 1 (id=9464): r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$inet_opts(r0, 0x0, 0x4, &(0x7f0000000000)="8907040400", 0x5) setsockopt$inet_mreqn(r0, 0x0, 0x24, &(0x7f0000000100)={@multicast1, @dev={0xac, 0x14, 0x14, 0xd}}, 0xc) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000001280)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x17) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(serpent)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, 0x0, 0x0) r3 = accept4(r2, 0x0, 0x0, 0x80800) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000280)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb09587304856755200db549e13d64a3489bfc1961cc504fc1175ce7e3335c86d231c5d64829c1ebfac649a1787882b454975a71a18ece31ee6f69e99707e2a13f4f826a57837744a810058f73e25119f8e0b8787ed2f318a1df960df58a7c091b9a7a60e5a2f546d0fe807dab278a08cb2056295185213037adcec5da72763d52734d7dfd51c27", 0xcf}, {&(0x7f00000003c0)="e8700e444d50a969ff67247cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece98ad3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11", 0xfe67}], 0x3, &(0x7f0000000380)}], 0x1, 0x40800) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000dc0)={0x6, 0x6, &(0x7f0000000640)=ANY=[@ANYBLOB="1800000000000000000000000000000018200000", @ANYRES32=r1, @ANYBLOB="0000000000000000890000000000000095"], &(0x7f0000000d40)='syzkaller\x00'}, 0x94) r4 = socket$netlink(0x10, 0x3, 0x4) write(r4, &(0x7f00000000c0)="270000001400070f030e0000120f0a001100b1128a151f75080039000500"/39, 0x27) sendmsg$inet(r0, &(0x7f0000000080)={&(0x7f0000000a40)={0x2, 0x4e23, @empty}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x60000000}, 0x800) 0s ago: executing program 1 (id=9465): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000940)=@updpolicy={0x1fc, 0x19, 0x1, 0x0, 0x0, {{@in=@empty, @in6=@empty, 0x0, 0xffff, 0x0, 0x0, 0x2, 0x0, 0x20, 0x8}, {0x0, 0x2, 0x800000000, 0x6, 0x0, 0x0, 0x0, 0x80000000000001d}, {0x0, 0x0, 0x0, 0x2dd}, 0x0, 0x0, 0x2}, [@tmpl={0x144, 0x5, [{{@in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0xfffffffd, 0x2b}, 0x0, @in=@loopback, 0x0, 0x0, 0x0, 0xfb, 0x0, 0x510d3f09}, {{@in=@broadcast, 0x0, 0x2b}, 0x2, @in6=@remote}, {{@in6=@loopback, 0x0, 0x3c}, 0x2, @in=@rand_addr=0x64010101, 0x500, 0x1, 0x3, 0x0, 0x7, 0x2cd6, 0x3}, {{@in=@dev={0xac, 0x14, 0x14, 0x2a}, 0x4d6, 0x32}, 0x2, @in=@local, 0x0, 0x4, 0x0, 0x0, 0x0, 0x3}, {{@in=@loopback, 0x0, 0x3c}, 0x2, @in6=@dev={0xfe, 0x80, '\x00', 0x22}, 0xffffffff, 0x0, 0x0, 0x0, 0xfffffffd}]}]}, 0x1fc}, 0x1, 0x0, 0x0, 0x60004000}, 0x10) kernel console output (not intermixed with test programs): 2'. [ 1039.718277][ T1383] SET target dimension over the limit! [ 1039.743784][ T1383] tipc: Enabled bearer , priority 10 [ 1039.912942][ T1391] FAULT_INJECTION: forcing a failure. [ 1039.912942][ T1391] name failslab, interval 1, probability 0, space 0, times 0 [ 1039.912978][ T1391] CPU: 1 UID: 0 PID: 1391 Comm: syz.2.8548 Not tainted syzkaller #0 PREEMPT(full) [ 1039.913008][ T1391] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1039.913022][ T1391] Call Trace: [ 1039.913032][ T1391] [ 1039.913043][ T1391] dump_stack_lvl+0xe8/0x150 [ 1039.913084][ T1391] should_fail_ex+0x410/0x560 [ 1039.913118][ T1391] ? __alloc_skb+0x1db/0x7a0 [ 1039.913148][ T1391] should_failslab+0xa8/0x100 [ 1039.913178][ T1391] ? __alloc_skb+0x1db/0x7a0 [ 1039.913203][ T1391] kmem_cache_alloc_node_noprof+0xa1/0x610 [ 1039.913240][ T1391] ? __alloc_skb+0x18d/0x7a0 [ 1039.913270][ T1391] ? __alloc_skb+0x1db/0x7a0 [ 1039.913307][ T1391] __alloc_skb+0x1db/0x7a0 [ 1039.913342][ T1391] netlink_sendmsg+0x5d4/0xb40 [ 1039.913378][ T1391] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1039.913412][ T1391] ? apparmor_socket_sendmsg+0x98/0x360 [ 1039.913443][ T1391] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1039.913466][ T1391] sock_sendmsg_nosec+0x13a/0x180 [ 1039.913494][ T1391] ____sys_sendmsg+0x54e/0x850 [ 1039.913532][ T1391] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1039.913572][ T1391] ? import_iovec+0x73/0xa0 [ 1039.913605][ T1391] ___sys_sendmsg+0x2a5/0x360 [ 1039.913635][ T1391] ? __lock_acquire+0x747/0x2de0 [ 1039.913662][ T1391] ? __pfx____sys_sendmsg+0x10/0x10 [ 1039.913740][ T1391] ? __fget_files+0x2a/0x420 [ 1039.913772][ T1391] ? __fget_files+0x3a2/0x420 [ 1039.913815][ T1391] __x64_sys_sendmsg+0x1b1/0x290 [ 1039.913852][ T1391] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1039.913911][ T1391] do_syscall_64+0x166/0x520 [ 1039.913943][ T1391] ? trace_irq_disable+0x3b/0x140 [ 1039.913966][ T1391] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1039.913990][ T1391] ? clear_bhb_loop+0x70/0xc0 [ 1039.914018][ T1391] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1039.914041][ T1391] RIP: 0033:0x7f9e4379e159 [ 1039.914063][ T1391] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1039.914083][ T1391] RSP: 002b:00007f9e4466a028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1039.914109][ T1391] RAX: ffffffffffffffda RBX: 00007f9e43a25fa0 RCX: 00007f9e4379e159 [ 1039.914126][ T1391] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000003 [ 1039.914158][ T1391] RBP: 00007f9e4466a090 R08: 0000000000000000 R09: 0000000000000000 [ 1039.914173][ T1391] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1039.914188][ T1391] R13: 00007f9e43a26038 R14: 00007f9e43a25fa0 R15: 00007ffff57d9fe8 [ 1039.914227][ T1391] [ 1040.253890][ T1392] net_ratelimit: 500 callbacks suppressed [ 1040.253914][ T1392] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1040.257109][ T1392] netlink: 40 bytes leftover after parsing attributes in process `syz.1.8547'. [ 1040.968857][T31578] tipc: Node number set to 2710976057 [ 1041.641433][ T1459] netlink: 'syz.1.8572': attribute type 1 has an invalid length. [ 1041.793959][ T1459] bond4: option mode: invalid value (9) [ 1041.851760][ T1459] bond4 (unregistering): Released all slaves [ 1042.035744][ T1449] x_tables: ip6_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 1042.609660][ T1495] netlink: 'syz.2.8586': attribute type 21 has an invalid length. [ 1042.643607][ T1496] syzkaller0: entered promiscuous mode [ 1042.643637][ T1496] syzkaller0: entered allmulticast mode [ 1042.648959][ T1495] __nla_validate_parse: 3 callbacks suppressed [ 1042.648982][ T1495] netlink: 156 bytes leftover after parsing attributes in process `syz.2.8586'. [ 1042.764752][ T1497] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1042.807059][ T1497] netlink: 36 bytes leftover after parsing attributes in process `syz.0.8584'. [ 1042.930592][ T1507] FAULT_INJECTION: forcing a failure. [ 1042.930592][ T1507] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1042.930629][ T1507] CPU: 0 UID: 0 PID: 1507 Comm: syz.2.8588 Not tainted syzkaller #0 PREEMPT(full) [ 1042.930655][ T1507] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1042.930669][ T1507] Call Trace: [ 1042.930679][ T1507] [ 1042.930690][ T1507] dump_stack_lvl+0xe8/0x150 [ 1042.930728][ T1507] should_fail_ex+0x410/0x560 [ 1042.930762][ T1507] _copy_from_user+0x2d/0xb0 [ 1042.930794][ T1507] kstrtouint_from_user+0xd6/0x180 [ 1042.930822][ T1507] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 1042.930859][ T1507] ? lock_acquire+0x115/0x350 [ 1042.930888][ T1507] proc_fail_nth_write+0x8e/0x210 [ 1042.930912][ T1507] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 1042.930945][ T1507] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 1042.930968][ T1507] vfs_write+0x296/0xba0 [ 1042.931013][ T1507] ? __pfx_vfs_write+0x10/0x10 [ 1042.931050][ T1507] ? __fget_files+0x2a/0x420 [ 1042.931087][ T1507] ? __fget_files+0x3a2/0x420 [ 1042.931117][ T1507] ? __fget_files+0x2a/0x420 [ 1042.931158][ T1507] ksys_write+0x150/0x270 [ 1042.931195][ T1507] ? __pfx_ksys_write+0x10/0x10 [ 1042.931243][ T1507] do_syscall_64+0x166/0x520 [ 1042.931273][ T1507] ? trace_irq_disable+0x3b/0x140 [ 1042.931297][ T1507] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1042.931320][ T1507] ? clear_bhb_loop+0x70/0xc0 [ 1042.931349][ T1507] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1042.931373][ T1507] RIP: 0033:0x7f9e4375e98e [ 1042.931394][ T1507] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1042.931414][ T1507] RSP: 002b:00007f9e44648fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1042.931439][ T1507] RAX: ffffffffffffffda RBX: 00007f9e446496c0 RCX: 00007f9e4375e98e [ 1042.931455][ T1507] RDX: 0000000000000001 RSI: 00007f9e446490a0 RDI: 0000000000000004 [ 1042.931471][ T1507] RBP: 00007f9e44649090 R08: 0000000000000000 R09: 0000000000000000 [ 1042.931486][ T1507] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1042.931500][ T1507] R13: 00007f9e43a26128 R14: 00007f9e43a26090 R15: 00007ffff57d9fe8 [ 1042.931544][ T1507] [ 1043.295024][ T1512] netlink: 12 bytes leftover after parsing attributes in process `syz.4.8590'. [ 1043.555695][ T1522] netlink: 12 bytes leftover after parsing attributes in process `syz.4.8593'. [ 1043.615194][ T1526] netlink: 'syz.3.8594': attribute type 1 has an invalid length. [ 1043.637236][ T1522] 8021q: adding VLAN 0 to HW filter on device bond14 [ 1043.681616][ T1526] bond7: option mode: invalid value (9) [ 1043.683597][ T1526] bond7 (unregistering): Released all slaves [ 1043.731348][ T1530] bridge0: port 2(bridge_slave_1) entered disabled state [ 1043.732011][ T1530] bridge0: port 1(bridge_slave_0) entered disabled state [ 1043.759051][ T1530] bond12: (slave bridge0): Releasing backup interface [ 1043.779069][ T1530] bridge0: port 2(bridge_slave_1) entered blocking state [ 1043.779249][ T1530] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1043.779591][ T1530] bridge0: port 1(bridge_slave_0) entered blocking state [ 1043.779730][ T1530] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1043.841640][ T1530] bond14: (slave bridge0): Enslaving as an active interface with an up link [ 1044.279068][ T1551] netlink: 8 bytes leftover after parsing attributes in process `syz.3.8601'. [ 1044.459022][ T1553] netlink: 4140 bytes leftover after parsing attributes in process `syz.3.8602'. [ 1044.474429][T30932] Bluetooth: hci3: unexpected cc 0x1003 length: 0 < 9 [ 1044.474467][T30932] Bluetooth: hci3: unexpected event for opcode 0x1003 [ 1044.534317][ T1557] netlink: 12 bytes leftover after parsing attributes in process `syz.4.8603'. [ 1044.996135][ T1581] FAULT_INJECTION: forcing a failure. [ 1044.996135][ T1581] name failslab, interval 1, probability 0, space 0, times 0 [ 1044.996172][ T1581] CPU: 1 UID: 0 PID: 1581 Comm: syz.0.8612 Not tainted syzkaller #0 PREEMPT(full) [ 1044.996199][ T1581] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1044.996214][ T1581] Call Trace: [ 1044.996224][ T1581] [ 1044.996234][ T1581] dump_stack_lvl+0xe8/0x150 [ 1044.996285][ T1581] should_fail_ex+0x410/0x560 [ 1044.996319][ T1581] ? __alloc_skb+0x1db/0x7a0 [ 1044.996348][ T1581] should_failslab+0xa8/0x100 [ 1044.996380][ T1581] ? __alloc_skb+0x1db/0x7a0 [ 1044.996406][ T1581] kmem_cache_alloc_node_noprof+0xa1/0x610 [ 1044.996444][ T1581] ? __alloc_skb+0x18d/0x7a0 [ 1044.996473][ T1581] ? __alloc_skb+0x1db/0x7a0 [ 1044.996511][ T1581] __alloc_skb+0x1db/0x7a0 [ 1044.996545][ T1581] batadv_netlink_set_mesh+0xb7c/0x1080 [ 1044.996669][ T1581] genl_family_rcv_msg_doit+0x233/0x340 [ 1044.996710][ T1581] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 1044.996755][ T1581] ? bpf_lsm_capable+0x9/0x20 [ 1044.996776][ T1581] ? security_capable+0x7e/0x2c0 [ 1044.996811][ T1581] genl_rcv_msg+0x614/0x7a0 [ 1044.996851][ T1581] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1044.996878][ T1581] ? __pfx_batadv_pre_doit+0x10/0x10 [ 1044.996900][ T1581] ? __pfx_batadv_netlink_set_mesh+0x10/0x10 [ 1044.996924][ T1581] ? __pfx_batadv_post_doit+0x10/0x10 [ 1044.996965][ T1581] netlink_rcv_skb+0x226/0x4a0 [ 1044.996990][ T1581] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1044.997022][ T1581] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1044.997064][ T1581] ? down_read+0x2be/0x330 [ 1044.997104][ T1581] genl_rcv+0x28/0x40 [ 1044.997131][ T1581] netlink_unicast+0x7bd/0x940 [ 1044.997179][ T1581] netlink_sendmsg+0x813/0xb40 [ 1044.997213][ T1581] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1044.997245][ T1581] ? apparmor_socket_sendmsg+0x98/0x360 [ 1044.997284][ T1581] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1044.997306][ T1581] sock_sendmsg_nosec+0x13a/0x180 [ 1044.997333][ T1581] ____sys_sendmsg+0x54e/0x850 [ 1044.997373][ T1581] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1044.997416][ T1581] ? import_iovec+0x73/0xa0 [ 1044.997449][ T1581] ___sys_sendmsg+0x2a5/0x360 [ 1044.997480][ T1581] ? __lock_acquire+0x747/0x2de0 [ 1044.997509][ T1581] ? __pfx____sys_sendmsg+0x10/0x10 [ 1044.997580][ T1581] ? __fget_files+0x2a/0x420 [ 1044.997612][ T1581] ? __fget_files+0x3a2/0x420 [ 1044.997657][ T1581] __x64_sys_sendmsg+0x1b1/0x290 [ 1044.997694][ T1581] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1044.997753][ T1581] do_syscall_64+0x166/0x520 [ 1044.997786][ T1581] ? trace_irq_disable+0x3b/0x140 [ 1044.997810][ T1581] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1044.997834][ T1581] ? clear_bhb_loop+0x70/0xc0 [ 1044.997864][ T1581] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1044.997888][ T1581] RIP: 0033:0x7f29b839e159 [ 1044.997910][ T1581] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1044.997931][ T1581] RSP: 002b:00007f29b9322028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1044.997955][ T1581] RAX: ffffffffffffffda RBX: 00007f29b8625fa0 RCX: 00007f29b839e159 [ 1044.997973][ T1581] RDX: 0000000000000054 RSI: 0000200000000f00 RDI: 0000000000000004 [ 1044.997987][ T1581] RBP: 00007f29b9322090 R08: 0000000000000000 R09: 0000000000000000 [ 1044.998001][ T1581] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1044.998015][ T1581] R13: 00007f29b8626038 R14: 00007f29b8625fa0 R15: 00007ffde1945288 [ 1044.998054][ T1581] [ 1045.404203][ T1584] netlink: 'syz.0.8615': attribute type 1 has an invalid length. [ 1045.449160][ T1587] FAULT_INJECTION: forcing a failure. [ 1045.449160][ T1587] name failslab, interval 1, probability 0, space 0, times 0 [ 1045.449216][ T1587] CPU: 0 UID: 0 PID: 1587 Comm: syz.4.8613 Not tainted syzkaller #0 PREEMPT(full) [ 1045.449241][ T1587] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1045.449256][ T1587] Call Trace: [ 1045.449266][ T1587] [ 1045.449276][ T1587] dump_stack_lvl+0xe8/0x150 [ 1045.449315][ T1587] should_fail_ex+0x410/0x560 [ 1045.449349][ T1587] should_failslab+0xa8/0x100 [ 1045.449377][ T1587] ? skb_clone+0x212/0x3a0 [ 1045.449412][ T1587] kmem_cache_alloc_noprof+0xa1/0x600 [ 1045.449450][ T1587] ? skb_clone+0x212/0x3a0 [ 1045.449491][ T1587] skb_clone+0x212/0x3a0 [ 1045.449529][ T1587] __netlink_deliver_tap+0x355/0x6e0 [ 1045.449565][ T1587] ? netlink_deliver_tap+0x2e/0x1b0 [ 1045.449591][ T1587] netlink_deliver_tap+0x19c/0x1b0 [ 1045.449616][ T1587] netlink_unicast+0x781/0x940 [ 1045.449663][ T1587] netlink_sendmsg+0x813/0xb40 [ 1045.449697][ T1587] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1045.449737][ T1587] ? apparmor_socket_sendmsg+0x98/0x360 [ 1045.449768][ T1587] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1045.449791][ T1587] sock_sendmsg_nosec+0x13a/0x180 [ 1045.449820][ T1587] ____sys_sendmsg+0x54e/0x850 [ 1045.449859][ T1587] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1045.449903][ T1587] ? import_iovec+0x73/0xa0 [ 1045.449938][ T1587] ___sys_sendmsg+0x2a5/0x360 [ 1045.449969][ T1587] ? __lock_acquire+0x747/0x2de0 [ 1045.449998][ T1587] ? __pfx____sys_sendmsg+0x10/0x10 [ 1045.450076][ T1587] ? __fget_files+0x2a/0x420 [ 1045.450107][ T1587] ? __fget_files+0x3a2/0x420 [ 1045.450151][ T1587] __x64_sys_sendmsg+0x1b1/0x290 [ 1045.450186][ T1587] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1045.450244][ T1587] do_syscall_64+0x166/0x520 [ 1045.450276][ T1587] ? trace_irq_disable+0x3b/0x140 [ 1045.450299][ T1587] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1045.450323][ T1587] ? clear_bhb_loop+0x70/0xc0 [ 1045.450352][ T1587] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1045.450375][ T1587] RIP: 0033:0x7fb4eb19e159 [ 1045.450395][ T1587] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1045.450415][ T1587] RSP: 002b:00007fb4ec0ba028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1045.450440][ T1587] RAX: ffffffffffffffda RBX: 00007fb4eb425fa0 RCX: 00007fb4eb19e159 [ 1045.450458][ T1587] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 1045.450473][ T1587] RBP: 00007fb4ec0ba090 R08: 0000000000000000 R09: 0000000000000000 [ 1045.450488][ T1587] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1045.450504][ T1587] R13: 00007fb4eb426038 R14: 00007fb4eb425fa0 R15: 00007fffedf00888 [ 1045.450542][ T1587] [ 1045.503229][ T1589] netlink: 12 bytes leftover after parsing attributes in process `syz.2.8614'. [ 1045.745708][ T1584] 8021q: adding VLAN 0 to HW filter on device bond10 [ 1045.822937][ T1590] bond10: (slave geneve8): making interface the new active one [ 1045.839973][ T1590] bond10: (slave geneve8): Enslaving as an active interface with an up link [ 1045.939203][ T1587] netlink: 48 bytes leftover after parsing attributes in process `syz.4.8613'. [ 1046.002057][ T1599] : option downdelay: invalid value (18446744073709547007) [ 1046.002088][ T1599] : option downdelay: allowed values 0 - 2147483647 [ 1046.031838][ T1601] netlink: 48 bytes leftover after parsing attributes in process `syz.1.8618'. [ 1046.058144][ T1599]  (unregistering): Released all slaves [ 1046.207613][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1046.421273][ T1620] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1047.227642][ T1657] netlink: 'syz.1.8638': attribute type 10 has an invalid length. [ 1047.228184][ T1657] v: left promiscuous mode [ 1047.229628][ T1657] team0: Device v failed to register rx_handler [ 1047.454046][ T1671] FAULT_INJECTION: forcing a failure. [ 1047.454046][ T1671] name failslab, interval 1, probability 0, space 0, times 0 [ 1047.454083][ T1671] CPU: 0 UID: 0 PID: 1671 Comm: syz.3.8643 Not tainted syzkaller #0 PREEMPT(full) [ 1047.454112][ T1671] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1047.454127][ T1671] Call Trace: [ 1047.454136][ T1671] [ 1047.454147][ T1671] dump_stack_lvl+0xe8/0x150 [ 1047.454186][ T1671] should_fail_ex+0x410/0x560 [ 1047.454225][ T1671] ? __alloc_skb+0x1db/0x7a0 [ 1047.454255][ T1671] should_failslab+0xa8/0x100 [ 1047.454285][ T1671] ? __alloc_skb+0x1db/0x7a0 [ 1047.454311][ T1671] kmem_cache_alloc_node_noprof+0xa1/0x610 [ 1047.454348][ T1671] ? __alloc_skb+0x18d/0x7a0 [ 1047.454376][ T1671] ? __alloc_skb+0x1db/0x7a0 [ 1047.454413][ T1671] __alloc_skb+0x1db/0x7a0 [ 1047.454446][ T1671] pfkey_sendmsg+0x20c/0x11d0 [ 1047.454486][ T1671] ? lock_acquire+0x115/0x350 [ 1047.454512][ T1671] ? __lock_acquire+0x747/0x2de0 [ 1047.454540][ T1671] ? __pfx_pfkey_sendmsg+0x10/0x10 [ 1047.454580][ T1671] ? aa_sk_perm+0x713/0x900 [ 1047.454608][ T1671] ? __lock_acquire+0x747/0x2de0 [ 1047.454635][ T1671] ? __lock_acquire+0x747/0x2de0 [ 1047.454658][ T1671] ? __pfx_aa_sk_perm+0x10/0x10 [ 1047.454690][ T1671] ? aa_sock_msg_perm+0x144/0x210 [ 1047.454727][ T1671] ? apparmor_socket_sendmsg+0x98/0x360 [ 1047.454756][ T1671] ? __pfx_pfkey_sendmsg+0x10/0x10 [ 1047.454790][ T1671] sock_sendmsg_nosec+0x13a/0x180 [ 1047.454819][ T1671] ____sys_sendmsg+0x54e/0x850 [ 1047.454858][ T1671] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1047.454902][ T1671] ? import_iovec+0x73/0xa0 [ 1047.454936][ T1671] ___sys_sendmsg+0x2a5/0x360 [ 1047.454967][ T1671] ? __lock_acquire+0x747/0x2de0 [ 1047.454996][ T1671] ? __pfx____sys_sendmsg+0x10/0x10 [ 1047.455068][ T1671] ? __fget_files+0x2a/0x420 [ 1047.455101][ T1671] ? __fget_files+0x3a2/0x420 [ 1047.455144][ T1671] __x64_sys_sendmsg+0x1b1/0x290 [ 1047.455180][ T1671] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1047.455246][ T1671] do_syscall_64+0x166/0x520 [ 1047.455279][ T1671] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1047.455302][ T1671] ? clear_bhb_loop+0x70/0xc0 [ 1047.455331][ T1671] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1047.455354][ T1671] RIP: 0033:0x7fca67d9e159 [ 1047.455375][ T1671] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1047.455394][ T1671] RSP: 002b:00007fca68ba8028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1047.455419][ T1671] RAX: ffffffffffffffda RBX: 00007fca68025fa0 RCX: 00007fca67d9e159 [ 1047.455437][ T1671] RDX: 0000000000000000 RSI: 0000200000000180 RDI: 0000000000000004 [ 1047.455452][ T1671] RBP: 00007fca68ba8090 R08: 0000000000000000 R09: 0000000000000000 [ 1047.455467][ T1671] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1047.455482][ T1671] R13: 00007fca68026038 R14: 00007fca68025fa0 R15: 00007fff7dfedfc8 [ 1047.455519][ T1671] [ 1047.782714][ T1673] __nla_validate_parse: 6 callbacks suppressed [ 1047.782738][ T1673] netlink: 12 bytes leftover after parsing attributes in process `syz.0.8644'. [ 1047.827035][ T1676] netlink: 'syz.1.8645': attribute type 3 has an invalid length. [ 1047.928103][ T1673] 8021q: adding VLAN 0 to HW filter on device bond11 [ 1047.992791][ T1673] bond11: (slave geneve9): Enslaving as an active interface with an up link [ 1048.378492][ T1699] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1048.486088][ T1710] netlink: 12 bytes leftover after parsing attributes in process `syz.3.8654'. [ 1048.534317][ T1708] syzkaller0: entered promiscuous mode [ 1048.534344][ T1708] syzkaller0: entered allmulticast mode [ 1048.556385][ T1714] netlink: 28 bytes leftover after parsing attributes in process `syz.0.8657'. [ 1048.636144][ T1718] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1048.930885][ T1727] tipc: Enabled bearer , priority 20 [ 1049.156703][ T1739] netlink: 'syz.4.8663': attribute type 1 has an invalid length. [ 1049.291571][ T1740] veth7: entered allmulticast mode [ 1049.295696][ T1740] bond15: (slave veth7): Enslaving as an active interface with a down link [ 1049.297475][ T1746] netlink: 24 bytes leftover after parsing attributes in process `syz.0.8665'. [ 1049.363226][ T1740] bond15: (slave veth0_to_bond): making interface the new active one [ 1049.364047][ T1740] bond15: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 1049.441510][ T1748] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1049.483122][ T1739] veth9: entered allmulticast mode [ 1049.504428][ T1739] bond15: (slave veth9): Enslaving as an active interface with a down link [ 1049.609375][ T1757] netlink: 12 bytes leftover after parsing attributes in process `syz.1.8669'. [ 1049.623211][ T1740] macvlan2: entered promiscuous mode [ 1049.623235][ T1740] macvlan2: entered allmulticast mode [ 1049.623914][ T1740] bond15: entered promiscuous mode [ 1049.623933][ T1740] veth0_to_bond: entered promiscuous mode [ 1049.632231][ T1740] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 1049.634582][ T1740] bond15: (slave macvlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 1049.634957][ T1740] bond15: left promiscuous mode [ 1049.635006][ T1740] veth0_to_bond: left promiscuous mode [ 1049.936708][ T1767] netlink: 28 bytes leftover after parsing attributes in process `syz.3.8674'. [ 1049.988645][ T1770] netlink: 4 bytes leftover after parsing attributes in process `syz.0.8668'. [ 1050.163827][ T1779] syzkaller0: entered promiscuous mode [ 1050.163855][ T1779] syzkaller0: entered allmulticast mode [ 1050.193232][ T1779] tipc: Enabled bearer , priority 0 [ 1050.209994][ T1777] tipc: Resetting bearer [ 1050.289219][ T1789] netlink: 'syz.4.8679': attribute type 3 has an invalid length. [ 1050.342724][ T1777] tipc: Disabling bearer [ 1050.567790][ T1792] x_tables: ip6_tables: cgroup match: used from hooks PREROUTING, but only valid from INPUT/OUTPUT/POSTROUTING [ 1050.934055][ T1819] netlink: 388 bytes leftover after parsing attributes in process `syz.3.8688'. [ 1050.993942][ T1821] netlink: 4 bytes leftover after parsing attributes in process `syz.0.8687'. [ 1050.996590][ T1821] netlink: 4 bytes leftover after parsing attributes in process `syz.0.8687'. [ 1051.052282][ T1822] tc_dump_action: action bad kind [ 1051.055721][ T1824] syzkaller0: entered promiscuous mode [ 1051.055745][ T1824] syzkaller0: entered allmulticast mode [ 1051.143077][T30932] Bluetooth: hci2: unexpected event for opcode 0x1003 [ 1051.143204][T30932] Bluetooth: hci2: unexpected event for opcode 0x2003 [ 1051.143307][T30932] Bluetooth: hci2: unexpected event for opcode 0x2060 [ 1051.185578][ T1821] IPVS: set_ctl: invalid protocol: 43 172.20.20.187:20001 [ 1051.213773][ T1830] xt_bpf: check failed: parse error [ 1051.537416][ T1844] IPVS: set_ctl: invalid protocol: 137 100.1.1.1:20004 [ 1051.653195][ T1847] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1051.845216][ T1849] xt_CT: No such helper "snmp" [ 1051.957445][ T1862] syzkaller0: entered promiscuous mode [ 1051.957489][ T1862] syzkaller0: entered allmulticast mode [ 1051.996717][ T1866] netlink: 'syz.2.8704': attribute type 1 has an invalid length. [ 1052.097432][ T1866] 8021q: adding VLAN 0 to HW filter on device bond5 [ 1052.178319][ T1870] bond5: (slave gretap1): making interface the new active one [ 1052.193369][ T1870] bond5: (slave gretap1): Enslaving as an active interface with an up link [ 1052.421550][ T1886] veth0_to_batadv: entered promiscuous mode [ 1052.421578][ T1886] veth0_to_batadv: entered allmulticast mode [ 1052.553221][ T1894] ip_tables: iptables: counters copy to user failed while replacing table [ 1052.635375][ T1894] bridge_slave_0: Caught tx_queue_len zero misconfig [ 1052.672719][ T1900] FAULT_INJECTION: forcing a failure. [ 1052.672719][ T1900] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1052.672756][ T1900] CPU: 0 UID: 0 PID: 1900 Comm: syz.0.8714 Not tainted syzkaller #0 PREEMPT(full) [ 1052.672782][ T1900] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1052.672797][ T1900] Call Trace: [ 1052.672806][ T1900] [ 1052.672817][ T1900] dump_stack_lvl+0xe8/0x150 [ 1052.672856][ T1900] should_fail_ex+0x410/0x560 [ 1052.672890][ T1900] _copy_from_user+0x2d/0xb0 [ 1052.672923][ T1900] kstrtouint_from_user+0xd6/0x180 [ 1052.672952][ T1900] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 1052.672988][ T1900] ? lock_acquire+0x115/0x350 [ 1052.673018][ T1900] proc_fail_nth_write+0x8e/0x210 [ 1052.673043][ T1900] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 1052.673076][ T1900] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 1052.673099][ T1900] vfs_write+0x296/0xba0 [ 1052.673145][ T1900] ? __pfx_vfs_write+0x10/0x10 [ 1052.673197][ T1900] ? __fget_files+0x2a/0x420 [ 1052.673242][ T1900] ? __fget_files+0x3a2/0x420 [ 1052.673273][ T1900] ? __fget_files+0x2a/0x420 [ 1052.673315][ T1900] ksys_write+0x150/0x270 [ 1052.673353][ T1900] ? __pfx_ksys_write+0x10/0x10 [ 1052.673402][ T1900] do_syscall_64+0x166/0x520 [ 1052.673434][ T1900] ? trace_irq_disable+0x3b/0x140 [ 1052.673458][ T1900] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1052.673482][ T1900] ? clear_bhb_loop+0x70/0xc0 [ 1052.673511][ T1900] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1052.673534][ T1900] RIP: 0033:0x7f29b835e98e [ 1052.673556][ T1900] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1052.673576][ T1900] RSP: 002b:00007f29b9321fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1052.673601][ T1900] RAX: ffffffffffffffda RBX: 00007f29b93226c0 RCX: 00007f29b835e98e [ 1052.673619][ T1900] RDX: 0000000000000001 RSI: 00007f29b93220a0 RDI: 0000000000000004 [ 1052.673635][ T1900] RBP: 00007f29b9322090 R08: 0000000000000000 R09: 0000000000000000 [ 1052.673650][ T1900] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1052.673664][ T1900] R13: 00007f29b8626038 R14: 00007f29b8625fa0 R15: 00007ffde1945288 [ 1052.673703][ T1900] [ 1053.078846][ T1896] syzkaller0: entered promiscuous mode [ 1053.078875][ T1896] syzkaller0: entered allmulticast mode [ 1053.218508][ T1910] __nla_validate_parse: 7 callbacks suppressed [ 1053.218533][ T1910] netlink: 24 bytes leftover after parsing attributes in process `syz.0.8718'. [ 1053.443207][ T1916] netlink: 'syz.0.8720': attribute type 1 has an invalid length. [ 1053.747644][ T1927] xt_nfacct: accounting object `' does not exist [ 1056.453939][ T1912] syzkaller0: entered promiscuous mode [ 1056.453966][ T1912] syzkaller0: entered allmulticast mode [ 1056.482697][ T1916] workqueue: Failed to create a rescuer kthread for wq "bond12": -EINTR [ 1056.647172][ T1939] netlink: 28 bytes leftover after parsing attributes in process `syz.0.8726'. [ 1056.851396][ T1943] tipc: Enabled bearer , priority 0 [ 1056.854699][ T1943] syzkaller0: entered promiscuous mode [ 1056.854724][ T1943] syzkaller0: entered allmulticast mode [ 1056.886418][ T1943] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 1056.975068][ T1955] netlink: 28 bytes leftover after parsing attributes in process `syz.2.8734'. [ 1057.049698][ T1959] netlink: 12 bytes leftover after parsing attributes in process `syz.4.8732'. [ 1057.073328][ T1961] netlink: 'syz.2.8736': attribute type 1 has an invalid length. [ 1057.110909][ T1961] bond6: option mode: invalid value (9) [ 1057.116107][ T1961] bond6 (unregistering): Released all slaves [ 1057.155200][ T1953] netlink: 36 bytes leftover after parsing attributes in process `syz.0.8730'. [ 1057.177030][ T1943] tipc: Resetting bearer [ 1057.297781][ T1942] tipc: Resetting bearer [ 1057.358037][ T1942] tipc: Disabling bearer [ 1057.431001][ T1978] netlink: 'syz.3.8740': attribute type 1 has an invalid length. [ 1057.500885][ T1978] 8021q: adding VLAN 0 to HW filter on device bond7 [ 1057.530953][ T1982] bond7: (slave geneve4): making interface the new active one [ 1057.533371][ T1982] bond7: (slave geneve4): Enslaving as an active interface with an up link [ 1058.099460][ T2007] RDS: rds_bind could not find a transport for ::ffff:172.20.20.187, load rds_tcp or rds_rdma? [ 1058.495282][ T2032] netlink: 12 bytes leftover after parsing attributes in process `syz.2.8760'. [ 1058.538432][ T2032] 8021q: adding VLAN 0 to HW filter on device bond6 [ 1058.568725][ T2036] netlink: 68 bytes leftover after parsing attributes in process `syz.3.8759'. [ 1058.624657][ T2035] netlink: 'syz.0.8761': attribute type 4 has an invalid length. [ 1058.755960][ T2045] netlink: 8 bytes leftover after parsing attributes in process `syz.2.8762'. [ 1058.822650][ T2048] netlink: 'syz.1.8765': attribute type 3 has an invalid length. [ 1058.856926][ T2049] netlink: 4 bytes leftover after parsing attributes in process `syz.0.8764'. [ 1058.869613][ T2049] xt_TCPMSS: Only works on TCP SYN packets [ 1058.957199][ T2054] xt_hl: Unknown TTL match mode: 237 [ 1059.066889][ T2049] syz_tun: left allmulticast mode [ 1059.066919][ T2049] syz_tun: left promiscuous mode [ 1059.067268][ T2049] bridge0: port 3(syz_tun) entered disabled state [ 1059.094722][ T2049] bridge_slave_1: left promiscuous mode [ 1059.095020][ T2049] bridge0: port 2(bridge_slave_1) entered disabled state [ 1059.111871][ T2049] bridge_slave_0: left allmulticast mode [ 1059.111945][ T2049] bridge_slave_0: left promiscuous mode [ 1059.112550][ T2049] bridge0: port 1(bridge_slave_0) entered disabled state [ 1059.139108][ T2052] netlink: 'syz.0.8764': attribute type 11 has an invalid length. [ 1059.139394][ T2058] netlink: 'syz.1.8769': attribute type 1 has an invalid length. [ 1059.183152][ T2049] bond8: (slave bridge0): Releasing backup interface [ 1059.368754][ T2058] 8021q: adding VLAN 0 to HW filter on device bond4 [ 1059.390149][ T2067] netlink: 32 bytes leftover after parsing attributes in process `syz.2.8772'. [ 1059.445870][ T2061] bond4: (slave geneve3): making interface the new active one [ 1059.484130][ T2061] bond4: (slave geneve3): Enslaving as an active interface with an up link [ 1059.767284][ T2080] tipc: Failed to remove unknown binding: 66,0,0/2779053068:58574434/58574436 [ 1059.767323][ T2080] tipc: Failed to remove unknown binding: 66,0,0/2779053068:58574434/58574435 [ 1059.852394][ T2086] tipc: Failed to remove unknown binding: 66,0,0/2779053068:58574434/58574436 [ 1059.852433][ T2086] tipc: Failed to remove unknown binding: 66,0,0/2779053068:58574434/58574435 [ 1060.038980][ T2097] netlink: 28 bytes leftover after parsing attributes in process `syz.0.8784'. [ 1060.330298][ T2105] netlink: 19 bytes leftover after parsing attributes in process `syz.1.8788'. [ 1060.848813][ T2121] netlink: 12 bytes leftover after parsing attributes in process `syz.2.8791'. [ 1061.233884][ T2128] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8793'. [ 1061.595813][ T2138] netlink: 12 bytes leftover after parsing attributes in process `syz.4.8798'. [ 1062.141401][ T1283] netdevsim netdevsim0 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1062.141442][ T1283] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1062.141471][ T1283] netdevsim netdevsim0 netdevsim0: unset [1, 1] type 2 family 0 port 20000 - 0 [ 1062.141809][ T1283] netdevsim netdevsim0 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1062.141839][ T1283] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1062.141867][ T1283] netdevsim netdevsim0 netdevsim1: unset [1, 1] type 2 family 0 port 20000 - 0 [ 1062.141997][ T1283] netdevsim netdevsim0 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1062.142026][ T1283] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1062.142054][ T1283] netdevsim netdevsim0 netdevsim2: unset [1, 1] type 2 family 0 port 20000 - 0 [ 1062.142092][ T1283] netdevsim netdevsim0 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1062.142120][ T1283] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1062.142147][ T1283] netdevsim netdevsim0 netdevsim3: unset [1, 1] type 2 family 0 port 20000 - 0 [ 1062.898062][ T2168] 8021q: adding VLAN 0 to HW filter on device bond17 [ 1062.916073][ T2168] bridge0: port 2(bridge_slave_1) entered disabled state [ 1062.916292][ T2168] bridge0: port 1(bridge_slave_0) entered disabled state [ 1062.920703][ T2168] bond14: (slave bridge0): Releasing backup interface [ 1062.946535][ T2168] bridge0: port 2(bridge_slave_1) entered blocking state [ 1062.946686][ T2168] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1062.946989][ T2168] bridge0: port 1(bridge_slave_0) entered blocking state [ 1062.947127][ T2168] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1062.985801][ T2168] bond17: (slave bridge0): Enslaving as an active interface with an up link [ 1063.138358][ T2174] syzkaller0: entered promiscuous mode [ 1063.138383][ T2174] syzkaller0: entered allmulticast mode [ 1063.371072][ T2190] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1063.608681][ T2199] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1063.665085][ T2196] netlink: 'syz.3.8820': attribute type 16 has an invalid length. [ 1063.665113][ T2196] netlink: 'syz.3.8820': attribute type 17 has an invalid length. [ 1063.796686][ T2204] __nla_validate_parse: 4 callbacks suppressed [ 1063.796711][ T2204] netlink: 24 bytes leftover after parsing attributes in process `syz.3.8820'. [ 1063.869450][ T2196] bridge_slave_1: left allmulticast mode [ 1063.888240][ T2196] veth0_to_batadv: left promiscuous mode [ 1063.888269][ T2196] veth0_to_batadv: left allmulticast mode [ 1063.917951][ T2196] v: left promiscuous mode [ 1063.926545][ T2196] v: entered promiscuous mode [ 1063.959761][ T2196] 8021q: adding VLAN 0 to HW filter on device bond3 [ 1063.977001][ T2196] veth0_to_bridge: entered promiscuous mode [ 1064.001234][ T2196] ip6gretap1: left allmulticast mode [ 1064.007385][ T2196] hsr1: Slave A (wlan0) is not up; please bring it up to get a fully working HSR network [ 1064.007414][ T2196] hsr1: Slave B (team0) is not up; please bring it up to get a fully working HSR network [ 1064.009687][ T2196] A link change request failed with some changes committed already. Interface veth1_to_bod may have been left with an inconsistent configuration, please check. [ 1064.333915][ T1283] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1064.333965][ T1283] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1064.334003][ T1283] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1064.334059][ T1283] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1064.438711][T23724] tipc: Subscription rejected, illegal request [ 1064.508652][ T2235] netlink: 4 bytes leftover after parsing attributes in process `syz.3.8831'. [ 1064.524869][ T1283] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 1064.525128][ T1283] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 1064.553281][T31564] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 1064.650720][T31564] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 1064.783839][ T2249] netlink: 'syz.2.8835': attribute type 1 has an invalid length. [ 1064.928931][ T2258] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8840'. [ 1065.000269][ T2263] netlink: 'syz.4.8841': attribute type 3 has an invalid length. [ 1065.027970][ T2249] 8021q: adding VLAN 0 to HW filter on device bond7 [ 1065.081218][ T2254] bond7: (slave geneve5): making interface the new active one [ 1065.083320][ T2254] bond7: (slave geneve5): Enslaving as an active interface with an up link [ 1065.237693][ T2268] netlink: 404 bytes leftover after parsing attributes in process `syz.2.8844'. [ 1065.467522][T23724] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1065.467547][T23724] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1065.532400][ T2273] netlink: 12 bytes leftover after parsing attributes in process `syz.2.8844'. [ 1065.537483][ T2289] netlink: 20 bytes leftover after parsing attributes in process `syz.4.8849'. [ 1065.553080][T31577] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 1065.647550][ T2273] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1065.988144][T30932] Bluetooth: hci4: link tx timeout [ 1065.988309][T30932] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 1066.028134][ T2299] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1066.129693][T30932] Bluetooth: hci4: link tx timeout [ 1066.129717][T30932] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 1066.217806][T30932] Bluetooth: hci4: link tx timeout [ 1066.217829][T30932] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 1066.301151][T30932] Bluetooth: hci4: link tx timeout [ 1066.301174][T30932] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 1066.414961][T30932] Bluetooth: hci4: link tx timeout [ 1066.414986][T30932] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 1066.554057][ T2316] netlink: 20 bytes leftover after parsing attributes in process `syz.4.8855'. [ 1067.118472][ T2344] netlink: 4 bytes leftover after parsing attributes in process `syz.4.8865'. [ 1067.475152][T30932] Bluetooth: hci4: link tx timeout [ 1067.475175][T30932] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 1067.624062][T30932] Bluetooth: hci4: link tx timeout [ 1067.624095][T30932] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 1067.979924][T30932] Bluetooth: hci4: link tx timeout [ 1067.979948][T30932] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 1068.035507][T30932] Bluetooth: hci4: command 0x0406 tx timeout [ 1068.118368][ T2377] xt_CT: No such helper "snmp" [ 1068.270761][ C1] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 1068.436544][ T2400] xt_bpf: check failed: parse error [ 1069.222749][ T2442] netlink: 28 bytes leftover after parsing attributes in process `syz.4.8895'. [ 1069.522746][ T2456] netlink: 19 bytes leftover after parsing attributes in process `syz.3.8897'. [ 1069.534463][ T2456] netlink: 19 bytes leftover after parsing attributes in process `syz.3.8897'. [ 1069.774827][ T2471] xt_bpf: check failed: parse error [ 1069.875343][ T2477] xt_IDLETIMER: label is empty or not nul-terminated [ 1070.821542][ T2513] xt_CT: No such helper "snmp" [ 1071.124524][ T1380] netdevsim netdevsim3 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1071.124576][ T1380] netdevsim netdevsim3 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1071.124614][ T1380] netdevsim netdevsim3 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1071.124651][ T1380] netdevsim netdevsim3 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1071.356362][ T2558] netlink: 36 bytes leftover after parsing attributes in process `syz.0.8930'. [ 1071.768445][ T2588] netlink: 28 bytes leftover after parsing attributes in process `syz.0.8936'. [ 1071.851432][ T2597] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input9 [ 1071.880699][ T2597] netlink: 4 bytes leftover after parsing attributes in process `syz.4.8938'. [ 1072.155698][ T2609] netlink: 16 bytes leftover after parsing attributes in process `syz.0.8943'. [ 1072.159869][ T2609] IPVS: set_ctl: invalid protocol: 2 172.20.20.170:20004 [ 1072.249882][ T2617] netlink: 300 bytes leftover after parsing attributes in process `syz.2.8944'. [ 1072.292711][ T2620] netlink: 36 bytes leftover after parsing attributes in process `syz.4.8945'. [ 1072.512979][ T2631] xt_bpf: check failed: parse error [ 1072.557471][ T2633] tipc: Enabling of bearer rejected, already enabled [ 1072.609772][ T2639] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8950'. [ 1072.646573][ T2639] netlink: zone id is out of range [ 1072.646593][ T2639] netlink: zone id is out of range [ 1072.646603][ T2639] netlink: zone id is out of range [ 1072.646614][ T2639] netlink: zone id is out of range [ 1072.646624][ T2639] netlink: zone id is out of range [ 1072.646634][ T2639] netlink: zone id is out of range [ 1072.646648][ T2639] netlink: zone id is out of range [ 1072.646658][ T2639] netlink: zone id is out of range [ 1072.646668][ T2639] netlink: zone id is out of range [ 1072.646678][ T2639] netlink: zone id is out of range [ 1073.210114][ T2673] xt_CT: No such helper "netbios-ns" [ 1074.267897][ T2753] __nla_validate_parse: 4 callbacks suppressed [ 1074.267923][ T2753] netlink: 32 bytes leftover after parsing attributes in process `syz.1.8982'. [ 1074.293380][ T2753] netlink: 32 bytes leftover after parsing attributes in process `syz.1.8982'. [ 1074.303579][ T2753] netlink: 32 bytes leftover after parsing attributes in process `syz.1.8982'. [ 1074.312601][ T2753] netlink: 32 bytes leftover after parsing attributes in process `syz.1.8982'. [ 1074.330600][ T2753] netlink: 32 bytes leftover after parsing attributes in process `syz.1.8982'. [ 1074.335627][ T2753] netlink: 32 bytes leftover after parsing attributes in process `syz.1.8982'. [ 1074.359280][ T2753] netlink: 32 bytes leftover after parsing attributes in process `syz.1.8982'. [ 1074.379008][ T2753] netlink: 32 bytes leftover after parsing attributes in process `syz.1.8982'. [ 1074.392326][ T2753] netlink: 32 bytes leftover after parsing attributes in process `syz.1.8982'. [ 1074.415132][ T2753] netlink: 32 bytes leftover after parsing attributes in process `syz.1.8982'. [ 1074.628089][ T2764] xt_bpf: check failed: parse error [ 1074.898176][ T2776] syzkaller0: entered promiscuous mode [ 1074.898203][ T2776] syzkaller0: entered allmulticast mode [ 1075.150731][ T2784] netlink: 'syz.3.8990': attribute type 1 has an invalid length. [ 1075.191671][ T2784] 8021q: adding VLAN 0 to HW filter on device bond8 [ 1075.334873][ T2784] bond8: (slave geneve5): making interface the new active one [ 1075.370319][ T2784] bond8: (slave geneve5): Enslaving as an active interface with an up link [ 1075.428013][ T2797] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1075.630613][ C1] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 1075.646233][ T2803] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 1076.155252][ T2846] bond3: (slave bridge0): Releasing backup interface [ 1076.252672][ T2857] netlink: 'syz.2.9007': attribute type 1 has an invalid length. [ 1076.296796][ T2856] xt_bpf: check failed: parse error [ 1076.462478][ T2853] sysfs: cannot create duplicate filename '/class/ieee80211/!ù' [ 1076.462539][ T2853] CPU: 1 UID: 0 PID: 2853 Comm: syz.4.9006 Not tainted syzkaller #0 PREEMPT(full) [ 1076.462566][ T2853] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1076.462580][ T2853] Call Trace: [ 1076.462590][ T2853] [ 1076.462601][ T2853] dump_stack_lvl+0xe8/0x150 [ 1076.462644][ T2853] sysfs_warn_dup+0x8e/0xa0 [ 1076.462682][ T2853] sysfs_do_create_link_sd+0xc0/0x110 [ 1076.462721][ T2853] device_add_class_symlinks+0x1cf/0x240 [ 1076.462816][ T2853] device_add+0x467/0xb80 [ 1076.462854][ T2853] wiphy_register+0x1fc8/0x2ff0 [ 1076.462957][ T2853] ? __pfx_wiphy_register+0x10/0x10 [ 1076.462983][ T2853] ? __pfx_netdev_run_todo+0x10/0x10 [ 1076.463024][ T2853] ? minstrel_ht_alloc+0x6e0/0x7e0 [ 1076.463098][ T2853] ? ieee80211_init_rate_ctrl_alg+0x55d/0x5d0 [ 1076.463162][ T2853] ieee80211_register_hw+0x3d7c/0x4b40 [ 1076.463256][ T2853] ? ieee80211_register_hw+0x1951/0x4b40 [ 1076.463317][ T2853] ? __pfx_ieee80211_register_hw+0x10/0x10 [ 1076.463353][ T2853] ? __asan_memset+0x22/0x50 [ 1076.463378][ T2853] ? __hrtimer_setup+0x1b7/0x260 [ 1076.463411][ T2853] ? __pfx_mac80211_hwsim_beacon+0x10/0x10 [ 1076.463504][ T2853] mac80211_hwsim_new_radio+0x3264/0x5720 [ 1076.463568][ T2853] ? __pfx_mac80211_hwsim_new_radio+0x10/0x10 [ 1076.463596][ T2853] ? kstrndup+0xbd/0x160 [ 1076.463627][ T2853] ? kstrndup+0xbd/0x160 [ 1076.463654][ T2853] hwsim_new_radio_nl+0xd8b/0xf90 [ 1076.463701][ T2853] genl_family_rcv_msg_doit+0x233/0x340 [ 1076.463741][ T2853] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 1076.463789][ T2853] ? bpf_lsm_capable+0x9/0x20 [ 1076.463811][ T2853] ? security_capable+0x7e/0x2c0 [ 1076.463859][ T2853] genl_rcv_msg+0x614/0x7a0 [ 1076.463898][ T2853] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1076.463927][ T2853] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 1076.463972][ T2853] netlink_rcv_skb+0x226/0x4a0 [ 1076.463998][ T2853] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1076.464031][ T2853] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1076.464073][ T2853] ? down_read+0x2be/0x330 [ 1076.464112][ T2853] genl_rcv+0x28/0x40 [ 1076.464139][ T2853] netlink_unicast+0x7bd/0x940 [ 1076.464186][ T2853] netlink_sendmsg+0x813/0xb40 [ 1076.464220][ T2853] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1076.464255][ T2853] ? apparmor_socket_sendmsg+0x98/0x360 [ 1076.464286][ T2853] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1076.464308][ T2853] sock_sendmsg_nosec+0x13a/0x180 [ 1076.464337][ T2853] ____sys_sendmsg+0x54e/0x850 [ 1076.464377][ T2853] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1076.464423][ T2853] ? import_iovec+0x73/0xa0 [ 1076.464459][ T2853] ___sys_sendmsg+0x2a5/0x360 [ 1076.464491][ T2853] ? __lock_acquire+0x747/0x2de0 [ 1076.464523][ T2853] ? __pfx____sys_sendmsg+0x10/0x10 [ 1076.464561][ T2853] ? futex_wait+0x2a2/0x390 [ 1076.464632][ T2853] ? __fget_files+0x2a/0x420 [ 1076.464665][ T2853] ? __fget_files+0x3a2/0x420 [ 1076.464709][ T2853] __x64_sys_sendmsg+0x1b1/0x290 [ 1076.464745][ T2853] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1076.464802][ T2853] do_syscall_64+0x166/0x520 [ 1076.464833][ T2853] ? trace_irq_disable+0x3b/0x140 [ 1076.464862][ T2853] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1076.464885][ T2853] ? clear_bhb_loop+0x70/0xc0 [ 1076.464913][ T2853] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1076.464936][ T2853] RIP: 0033:0x7fb4eb19e159 [ 1076.464959][ T2853] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1076.464978][ T2853] RSP: 002b:00007fb4ec057028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1076.465003][ T2853] RAX: ffffffffffffffda RBX: 00007fb4eb426270 RCX: 00007fb4eb19e159 [ 1076.465021][ T2853] RDX: 0000000000000084 RSI: 0000200000000100 RDI: 0000000000000008 [ 1076.465037][ T2853] RBP: 00007fb4eb23506b R08: 0000000000000000 R09: 0000000000000000 [ 1076.465052][ T2853] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1076.465066][ T2853] R13: 00007fb4eb426308 R14: 00007fb4eb426270 R15: 00007fffedf00888 [ 1076.465106][ T2853] [ 1076.934531][T30932] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 1076.948364][T30932] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 1076.954929][T30932] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 1076.982383][T30932] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 1077.028263][T30932] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 1077.230144][ T2865] 8021q: adding VLAN 0 to HW filter on device bond12 [ 1077.843387][ T2917] FAULT_INJECTION: forcing a failure. [ 1077.843387][ T2917] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1077.843425][ T2917] CPU: 0 UID: 0 PID: 2917 Comm: syz.2.9025 Not tainted syzkaller #0 PREEMPT(full) [ 1077.843453][ T2917] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1077.843468][ T2917] Call Trace: [ 1077.843479][ T2917] [ 1077.843490][ T2917] dump_stack_lvl+0xe8/0x150 [ 1077.843530][ T2917] should_fail_ex+0x410/0x560 [ 1077.843566][ T2917] _copy_from_user+0x2d/0xb0 [ 1077.843599][ T2917] kstrtouint_from_user+0xd6/0x180 [ 1077.843630][ T2917] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 1077.843667][ T2917] ? lock_acquire+0x115/0x350 [ 1077.843699][ T2917] proc_fail_nth_write+0x8e/0x210 [ 1077.843729][ T2917] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 1077.843762][ T2917] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 1077.843786][ T2917] vfs_write+0x296/0xba0 [ 1077.843832][ T2917] ? __pfx_vfs_write+0x10/0x10 [ 1077.843878][ T2917] ? __fget_files+0x2a/0x420 [ 1077.843915][ T2917] ? __fget_files+0x3a2/0x420 [ 1077.843946][ T2917] ? __fget_files+0x2a/0x420 [ 1077.843988][ T2917] ksys_write+0x150/0x270 [ 1077.844026][ T2917] ? __pfx_ksys_write+0x10/0x10 [ 1077.844076][ T2917] do_syscall_64+0x166/0x520 [ 1077.844108][ T2917] ? trace_irq_disable+0x3b/0x140 [ 1077.844132][ T2917] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1077.844156][ T2917] ? clear_bhb_loop+0x70/0xc0 [ 1077.844183][ T2917] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1077.844206][ T2917] RIP: 0033:0x7f9e4375e98e [ 1077.844228][ T2917] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1077.844247][ T2917] RSP: 002b:00007f9e44669fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1077.844272][ T2917] RAX: ffffffffffffffda RBX: 00007f9e4466a6c0 RCX: 00007f9e4375e98e [ 1077.844290][ T2917] RDX: 0000000000000001 RSI: 00007f9e4466a0a0 RDI: 0000000000000004 [ 1077.844305][ T2917] RBP: 00007f9e4466a090 R08: 0000000000000000 R09: 0000000000000000 [ 1077.844320][ T2917] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1077.844334][ T2917] R13: 00007f9e43a26038 R14: 00007f9e43a25fa0 R15: 00007ffff57d9fe8 [ 1077.844372][ T2917] [ 1078.133389][ T2916] bond18: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 1078.138347][ T2916] bond18 (unregistering): Released all slaves [ 1078.212829][ T2924] xt_bpf: check failed: parse error [ 1079.151867][ T5623] Bluetooth: hci0: command tx timeout [ 1079.897193][ T2999] __nla_validate_parse: 60 callbacks suppressed [ 1079.897217][ T2999] netlink: 188 bytes leftover after parsing attributes in process `syz.1.9046'. [ 1080.015266][ T3001] Bluetooth: MGMT ver 1.23 [ 1080.258043][ T3017] xt_bpf: check failed: parse error [ 1080.292140][ T2858] bridge0: port 1(bridge_slave_0) entered blocking state [ 1080.293376][ T2858] bridge0: port 1(bridge_slave_0) entered disabled state [ 1080.293569][ T2858] bridge_slave_0: entered allmulticast mode [ 1080.299081][ T2858] bridge_slave_0: entered promiscuous mode [ 1080.334112][ T2858] bridge0: port 2(bridge_slave_1) entered blocking state [ 1080.334232][ T2858] bridge0: port 2(bridge_slave_1) entered disabled state [ 1080.334408][ T2858] bridge_slave_1: entered allmulticast mode [ 1080.338033][ T2858] bridge_slave_1: entered promiscuous mode [ 1080.486604][ T3026] netlink: 12 bytes leftover after parsing attributes in process `syz.1.9053'. [ 1080.573632][ T3026] 8021q: adding VLAN 0 to HW filter on device bond5 [ 1080.578661][ T2858] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1080.584840][ T2858] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1080.647518][ T3022] bond5: (slave bridge0): Enslaving as an active interface with an up link [ 1080.766426][ T3023] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 1080.817835][ T2858] team0: Port device team_slave_0 added [ 1080.843892][ T2858] team0: Port device team_slave_1 added [ 1080.887914][ T3043] net_ratelimit: 498 callbacks suppressed [ 1080.887939][ T3043] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1081.021280][ T2858] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1081.021300][ T2858] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1081.021330][ T2858] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1081.046884][ T2858] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1081.046930][ T2858] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1081.047018][ T2858] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1081.230593][T30932] Bluetooth: hci0: command tx timeout [ 1081.269179][ T2858] hsr_slave_0: entered promiscuous mode [ 1081.276359][ T2858] hsr_slave_1: entered promiscuous mode [ 1081.283259][ T2858] debugfs: 'hsr0' already exists in 'hsr' [ 1081.283283][ T2858] Cannot create hsr debugfs directory [ 1081.290016][ T3056] xt_TPROXY: Can be used only with -p tcp or -p udp [ 1081.308568][ T3056] netlink: 100 bytes leftover after parsing attributes in process `syz.0.9058'. [ 1081.517627][ T3063] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1081.645733][ T3065] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1081.701695][ T2858] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1081.955759][ T2858] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1082.198062][ T3096] netlink: 4 bytes leftover after parsing attributes in process `syz.0.9068'. [ 1082.424133][ T2858] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1082.664113][ T2858] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1083.117949][ T3132] netlink: 19 bytes leftover after parsing attributes in process `syz.2.9082'. [ 1083.130309][ T3135] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1083.181249][ T3136] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1083.182736][ T2858] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 1083.217366][ T2858] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1083.218440][ T2858] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 1083.277080][ T2858] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1083.278060][ T2858] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 1083.312556][T30932] Bluetooth: hci0: command tx timeout [ 1083.327738][ T2858] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1083.338773][ T2858] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 1083.370697][ T2858] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1083.574820][ T2858] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1083.632797][ T2858] 8021q: adding VLAN 0 to HW filter on device team0 [ 1083.663117][T23717] bridge0: port 1(bridge_slave_0) entered blocking state [ 1083.663232][T23717] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1083.702166][T23724] bridge0: port 2(bridge_slave_1) entered blocking state [ 1083.702280][T23724] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1084.468304][ T3194] netlink: 12 bytes leftover after parsing attributes in process `syz.1.9100'. [ 1084.579293][ T3203] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1084.696503][ T3205] xt_CT: No such helper "snmp" [ 1084.824254][ T2858] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1084.922311][ T2858] veth0_vlan: entered promiscuous mode [ 1084.951883][ T2858] veth1_vlan: entered promiscuous mode [ 1085.027217][ T2858] veth0_macvtap: entered promiscuous mode [ 1085.048969][ T2858] veth1_macvtap: entered promiscuous mode [ 1085.104351][ T2858] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1085.134989][ T2858] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1085.261527][ T1380] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1085.261578][ T1380] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1085.261615][ T1380] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1085.261662][ T1380] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1085.391356][T30932] Bluetooth: hci0: command tx timeout [ 1085.648570][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1085.648594][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1085.828315][ T8950] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1085.828340][ T8950] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1085.991763][ T3255] netlink: 'syz.4.9112': attribute type 12 has an invalid length. [ 1085.991791][ T3255] netlink: 8 bytes leftover after parsing attributes in process `syz.4.9112'. [ 1085.991820][ T3255] bond0: option primary_reselect: invalid value (22) [ 1086.223734][ T3274] netlink: 'syz.3.9120': attribute type 1 has an invalid length. [ 1086.247777][ T3274] netlink: 'syz.3.9120': attribute type 32 has an invalid length. [ 1086.247808][ T3274] netlink: 8 bytes leftover after parsing attributes in process `syz.3.9120'. [ 1086.301503][ T3277] netlink: 4 bytes leftover after parsing attributes in process `syz.0.9121'. [ 1086.337050][ T3274] bond1: option coupled_control: invalid value (64) [ 1086.365661][ T3274] bond1 (unregistering): Released all slaves [ 1086.458797][ T3290] lo: entered promiscuous mode [ 1086.481752][ T3290] tunl0: entered promiscuous mode [ 1086.484314][ T3290] gre0: entered promiscuous mode [ 1086.759114][ T3290] gretap0: entered promiscuous mode [ 1086.819473][ T3290] erspan0: entered promiscuous mode [ 1086.836607][ T3290] ip_vti0: entered promiscuous mode [ 1086.839706][ T3290] ip6_vti0: entered promiscuous mode [ 1086.855693][ T3290] sit0: entered promiscuous mode [ 1086.883748][ T3290] ip6tnl0: entered promiscuous mode [ 1086.888850][ T3290] ip6gre0: entered promiscuous mode [ 1086.916648][ T3290] syz_tun: entered promiscuous mode [ 1086.939848][ T3290] ip6gretap0: entered promiscuous mode [ 1086.949944][ T3290] bridge0: port 2(bridge_slave_1) entered disabled state [ 1086.950673][ T3290] bridge0: port 1(bridge_slave_0) entered disabled state [ 1086.966450][ T3290] bridge0: entered promiscuous mode [ 1087.094820][ T3300] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 1087.229047][ T3312] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1087.332836][ T3312] netlink: 12 bytes leftover after parsing attributes in process `syz.4.9131'. [ 1087.332868][ T3312] netlink: 12 bytes leftover after parsing attributes in process `syz.4.9131'. [ 1087.502876][ T3328] netlink: 8 bytes leftover after parsing attributes in process `syz.0.9134'. [ 1087.502911][ T3328] netlink: 8 bytes leftover after parsing attributes in process `syz.0.9134'. [ 1087.721788][ T3339] netlink: 28 bytes leftover after parsing attributes in process `syz.3.9136'. [ 1087.742510][ T3339] netlink: 48 bytes leftover after parsing attributes in process `syz.3.9136'. [ 1087.815247][ T5623] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1087.833743][ T5623] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1087.834120][ T3331] xt_CT: No such helper "snmp" [ 1087.856839][ T5623] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1087.874438][ T5623] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1087.875204][ T5623] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1088.130803][ T3349] netlink: 4 bytes leftover after parsing attributes in process `syz.0.9138'. [ 1088.557429][ T3357] bond0: option lacp_strict: mode dependency failed, not supported in mode balance-rr(0) [ 1088.975128][ T1380] netdevsim netdevsim2 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1088.975171][ T1380] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1089.197870][ T1380] netdevsim netdevsim2 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1089.197911][ T1380] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1089.368317][ T1380] netdevsim netdevsim2 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1089.368357][ T1380] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1089.425663][ T3406] netlink: 'syz.4.9154': attribute type 3 has an invalid length. [ 1089.539271][ T1380] netdevsim netdevsim2 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1089.539314][ T1380] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1089.619179][ T3406] gre1: entered allmulticast mode [ 1089.955264][ T5623] Bluetooth: hci3: command tx timeout [ 1090.193458][ T1380] bond5 (unregistering): (slave gretap1): Releasing active interface [ 1090.243701][ T1380] bond7 (unregistering): (slave geneve5): Releasing active interface [ 1090.248808][ T1380] bond4 (unregistering): (slave geneve4): Releasing active interface [ 1090.277625][ T1380] bond1 (unregistering): (slave geneve2): Releasing active interface [ 1090.300335][ T1380] batman_adv: batadv0: Interface deactivated: macvlan2 [ 1090.310330][ T1380] batman_adv: batadv0: Removing interface: macvlan2 [ 1090.336387][ T1380] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1090.338768][ T1380] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1090.340344][ T1380] bond0 (unregistering): Released all slaves [ 1090.368668][ C1] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 1090.373205][ T1380] bond1 (unregistering): Released all slaves [ 1090.396503][ T1380] bond2 (unregistering): Released all slaves [ 1090.415564][ T1380] bond3 (unregistering): Released all slaves [ 1090.435107][ T1380] bond4 (unregistering): Released all slaves [ 1090.453671][ T1380] bond5 (unregistering): Released all slaves [ 1090.472411][ T1380] bond6 (unregistering): Released all slaves [ 1090.491021][ T1380] bond7 (unregistering): Released all slaves [ 1090.660567][ T1380] ovs-dp0: left promiscuous mode [ 1090.732743][ T1380] tipc: Disabling bearer [ 1090.736094][ T1380] tipc: Left network mode [ 1090.778873][ T3344] bridge0: port 1(bridge_slave_0) entered blocking state [ 1090.779055][ T3344] bridge0: port 1(bridge_slave_0) entered disabled state [ 1090.779215][ T3344] bridge_slave_0: entered allmulticast mode [ 1090.802120][ T3344] bridge_slave_0: entered promiscuous mode [ 1090.811534][ T3344] bridge0: port 2(bridge_slave_1) entered blocking state [ 1090.811709][ T3344] bridge0: port 2(bridge_slave_1) entered disabled state [ 1090.811872][ T3344] bridge_slave_1: entered allmulticast mode [ 1090.814486][ T3344] bridge_slave_1: entered promiscuous mode [ 1090.893569][ T3344] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1090.897680][ T3344] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1091.044223][ T3344] team0: Port device team_slave_0 added [ 1091.057537][ T3344] team0: Port device team_slave_1 added [ 1091.111478][ T3344] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1091.111497][ T3344] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1091.111523][ T3344] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1091.115029][ T3344] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1091.115045][ T3344] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1091.116860][ T3344] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1091.330081][ T3344] hsr_slave_0: entered promiscuous mode [ 1091.337054][ T3344] hsr_slave_1: entered promiscuous mode [ 1091.337879][ T3344] debugfs: 'hsr0' already exists in 'hsr' [ 1091.337900][ T3344] Cannot create hsr debugfs directory [ 1091.588921][ T3370] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1091.869099][ T3442] __nla_validate_parse: 5 callbacks suppressed [ 1091.869125][ T3442] netlink: 12 bytes leftover after parsing attributes in process `syz.4.9163'. [ 1092.030547][ T5623] Bluetooth: hci3: command tx timeout [ 1094.110783][ T5623] Bluetooth: hci3: command tx timeout [ 1094.852701][ T1380] hsr_slave_0: left promiscuous mode [ 1094.924040][ T1380] hsr_slave_1: left promiscuous mode [ 1094.949713][ T1380] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1094.949741][ T1380] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1095.014300][ T1380] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1095.014329][ T1380] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1095.088200][ T1380] veth1_macvtap: left promiscuous mode [ 1095.088241][ T1380] veth0_macvtap: left promiscuous mode [ 1095.088359][ T1380] veth1_vlan: left promiscuous mode [ 1095.503639][ T1380] team0 (unregistering): Port device team_slave_1 removed [ 1095.523135][ T1380] team0 (unregistering): Port device team_slave_0 removed [ 1095.524423][ T8950] smc: removing ib device syz2 [ 1095.780019][ T5283] 8021q: adding VLAN 0 to HW filter on device eth1 [ 1095.923520][ T8950] smbdirect: ib_dev[syz2] removed [ 1095.932762][ T3483] bridge0: port 1(bridge_slave_0) entered disabled state [ 1095.946873][ T3483] bridge0: port 2(bridge_slave_1) entered disabled state [ 1096.076610][ T3492] netlink: 12 bytes leftover after parsing attributes in process `syz.0.9173'. [ 1096.167525][ T3483] bond4: left promiscuous mode [ 1096.190800][ T5623] Bluetooth: hci3: command tx timeout [ 1096.194187][ T3483] bond7: left promiscuous mode [ 1096.219966][ T3483] bond9: left promiscuous mode [ 1096.261713][ T3483] vti0: left promiscuous mode [ 1096.334024][ T3502] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1096.382906][ T3504] netlink: 12 bytes leftover after parsing attributes in process `syz.1.9174'. [ 1096.855769][ T3513] gretap1: entered promiscuous mode [ 1097.035387][ T3524] netlink: 'syz.3.9182': attribute type 1 has an invalid length. [ 1097.489975][ T3535] netlink: 'syz.1.9185': attribute type 1 has an invalid length. [ 1097.525816][ T3538] FAULT_INJECTION: forcing a failure. [ 1097.525816][ T3538] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1097.525853][ T3538] CPU: 1 UID: 0 PID: 3538 Comm: syz.0.9186 Not tainted syzkaller #0 PREEMPT(full) [ 1097.525881][ T3538] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1097.525895][ T3538] Call Trace: [ 1097.525905][ T3538] [ 1097.525916][ T3538] dump_stack_lvl+0xe8/0x150 [ 1097.525955][ T3538] should_fail_ex+0x410/0x560 [ 1097.525989][ T3538] _copy_from_user+0x2d/0xb0 [ 1097.526020][ T3538] ___sys_sendmsg+0x1c6/0x360 [ 1097.526054][ T3538] ? __lock_acquire+0x747/0x2de0 [ 1097.526083][ T3538] ? __pfx____sys_sendmsg+0x10/0x10 [ 1097.526157][ T3538] ? __fget_files+0x2a/0x420 [ 1097.526189][ T3538] ? __fget_files+0x3a2/0x420 [ 1097.526234][ T3538] __x64_sys_sendmsg+0x1b1/0x290 [ 1097.526270][ T3538] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1097.526328][ T3538] do_syscall_64+0x166/0x520 [ 1097.526360][ T3538] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1097.526384][ T3538] ? clear_bhb_loop+0x70/0xc0 [ 1097.526413][ T3538] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1097.526437][ T3538] RIP: 0033:0x7f29b839e159 [ 1097.526458][ T3538] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1097.526478][ T3538] RSP: 002b:00007f29b9322028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1097.526503][ T3538] RAX: ffffffffffffffda RBX: 00007f29b8625fa0 RCX: 00007f29b839e159 [ 1097.526521][ T3538] RDX: 0000000000000054 RSI: 0000200000000f00 RDI: 0000000000000003 [ 1097.526536][ T3538] RBP: 00007f29b9322090 R08: 0000000000000000 R09: 0000000000000000 [ 1097.526551][ T3538] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1097.526566][ T3538] R13: 00007f29b8626038 R14: 00007f29b8625fa0 R15: 00007ffde1945288 [ 1097.526604][ T3538] [ 1097.728110][ T3540] netlink: 28 bytes leftover after parsing attributes in process `syz.1.9185'. [ 1098.025003][ T3543] netlink: 60 bytes leftover after parsing attributes in process `syz.3.9188'. [ 1098.208201][ T3559] netlink: 4 bytes leftover after parsing attributes in process `syz.3.9188'. [ 1098.343330][ T3539] bond6: (slave geneve4): making interface the new active one [ 1098.344599][ T3539] bond6: (slave geneve4): Enslaving as an active interface with an up link [ 1098.345811][ T3540] bond6: entered promiscuous mode [ 1098.345830][ T3540] geneve4: entered promiscuous mode [ 1098.367089][ T3540] 8021q: adding VLAN 0 to HW filter on device bond6 [ 1098.543793][ T3542] tipc: Resetting bearer [ 1098.569335][ T3542] tipc: Resetting bearer [ 1098.768949][ T3543] netlink: 12 bytes leftover after parsing attributes in process `syz.3.9188'. [ 1098.768980][ T3543] netlink: 8 bytes leftover after parsing attributes in process `syz.3.9188'. [ 1098.828792][ T3559] bridge_slave_1: left allmulticast mode [ 1098.828824][ T3559] bridge_slave_1: left promiscuous mode [ 1098.829067][ T3559] bridge0: port 2(bridge_slave_1) entered disabled state [ 1098.879833][ T3559] bridge_slave_0: left allmulticast mode [ 1098.879865][ T3559] bridge_slave_0: left promiscuous mode [ 1098.880106][ T3559] bridge0: port 1(bridge_slave_0) entered disabled state [ 1099.521113][ T12] netdevsim netdevsim1 netdevsim2: set [1, 1] type 2 family 0 port 20000 - 0 [ 1099.521169][ T12] netdevsim netdevsim1 netdevsim0: set [1, 1] type 2 family 0 port 20000 - 0 [ 1099.521211][ T12] netdevsim netdevsim1 netdevsim1: set [1, 1] type 2 family 0 port 20000 - 0 [ 1099.521252][ T12] netdevsim netdevsim1 netdevsim3: set [1, 1] type 2 family 0 port 20000 - 0 [ 1100.005592][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1100.005616][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1100.045671][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1100.045695][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1100.111848][ T3599] netlink: 'syz.0.9196': attribute type 30 has an invalid length. [ 1100.188695][ T3606] netlink: 12 bytes leftover after parsing attributes in process `syz.1.9198'. [ 1100.277509][ T3606] veth1_to_bond: entered allmulticast mode [ 1100.432030][ T3612] netlink: 4 bytes leftover after parsing attributes in process `syz.1.9198'. [ 1100.445477][ T1380] IPVS: stop unused estimator thread 0... [ 1100.504635][ T3612] veth1_to_bond (unregistering): left allmulticast mode [ 1100.790301][ T3615] netlink: 20 bytes leftover after parsing attributes in process `syz.1.9198'. [ 1100.799310][ T3615] bridge_slave_1: Caught tx_queue_len zero misconfig [ 1100.958485][ T3344] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 1100.987149][ T3344] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1100.989811][ T3344] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 1101.014998][ T3344] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1101.017663][ T3344] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 1101.041881][ T3344] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1101.042901][ T3344] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 1101.069246][ T3344] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1101.201173][ T3637] xt_bpf: check failed: parse error [ 1101.464327][ T3344] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1101.587253][ T3344] 8021q: adding VLAN 0 to HW filter on device team0 [ 1101.737831][ T8950] bridge0: port 1(bridge_slave_0) entered blocking state [ 1101.737980][ T8950] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1101.812997][ T8933] bridge0: port 2(bridge_slave_1) entered blocking state [ 1101.813113][ T8933] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1101.852276][ T3673] netlink: 'syz.0.9216': attribute type 30 has an invalid length. [ 1101.948360][ T3679] netlink: 'syz.3.9220': attribute type 3 has an invalid length. [ 1102.029811][ T3673] bond13: option arp_missed_max: invalid value (0) [ 1102.029854][ T3673] bond13: option arp_missed_max: allowed values 1 - 255 [ 1102.050561][ T3673] bond13 (unregistering): Released all slaves [ 1102.611614][ T3672] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 1103.028341][ T3725] xt_nfacct: accounting object `' does not exist [ 1103.109138][ T3729] netlink: 24 bytes leftover after parsing attributes in process `syz.0.9229'. [ 1103.497305][ T3741] netlink: 'syz.0.9232': attribute type 1 has an invalid length. [ 1103.560033][ T3741] 8021q: adding VLAN 0 to HW filter on device bond13 [ 1103.645182][ T3746] bond13: (slave veth3): Enslaving as an active interface with a down link [ 1103.753640][ T3344] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1103.957155][ T3741] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1103.959293][ T3741] 8021q: adding VLAN 0 to HW filter on device team0 [ 1103.983265][ T3741] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1104.021661][ T3741] bridge_slave_1: left allmulticast mode [ 1104.046860][ T3741] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 1104.046889][ T3741] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1104.078466][ T3741] veth1_macvtap: left promiscuous mode [ 1104.080264][ T3741] veth0_macvtap: left promiscuous mode [ 1104.088270][ T3741] veth0_macvtap: entered promiscuous mode [ 1104.092913][ T3741] veth1_macvtap: entered promiscuous mode [ 1104.118762][ T3741] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1104.119791][ T3741] netdevsim netdevsim0 netdevsim0: left promiscuous mode [ 1104.136504][ T3741] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1104.137897][ T3741] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1104.139888][ T3741] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1104.165408][ T3741] 8021q: adding VLAN 0 to HW filter on device macsec1 [ 1104.169044][ T3741] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1104.204081][ T3741] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1104.205175][ T3741] hsr1: Slave B (team0) is not up; please bring it up to get a fully working HSR network [ 1104.209002][ T3741] 8021q: adding VLAN 0 to HW filter on device bond3 [ 1104.234851][ T3741] 8021q: adding VLAN 0 to HW filter on device bond4 [ 1104.247002][ T3741] 8021q: adding VLAN 0 to HW filter on device bond5 [ 1104.249742][ T3741] 8021q: adding VLAN 0 to HW filter on device bond6 [ 1104.266463][ T3741] 8021q: adding VLAN 0 to HW filter on device bond7 [ 1104.269612][ T3741] 8021q: adding VLAN 0 to HW filter on device bond8 [ 1104.286419][ T3741] 8021q: adding VLAN 0 to HW filter on device bond9 [ 1104.349275][ T3741] A link change request failed with some changes committed already. Interface geneve7 may have been left with an inconsistent configuration, please check. [ 1104.378245][ T3746] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 1104.391213][ T3746] bond13: (slave batadv1): making interface the new active one [ 1104.392553][ T3746] batadv1: entered promiscuous mode [ 1104.392910][ T3746] bond13: (slave batadv1): Enslaving as an active interface with an up link [ 1104.393117][T20126] netdevsim netdevsim0 netdevsim0: entered promiscuous mode [ 1104.481141][ T8950] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1104.481182][ T8950] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1104.481210][ T8950] netdevsim netdevsim0 netdevsim0: set [1, 1] type 2 family 0 port 20000 - 0 [ 1104.484017][T23717] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1104.484055][T23717] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1104.484083][T23717] netdevsim netdevsim0 netdevsim2: set [1, 1] type 2 family 0 port 20000 - 0 [ 1104.484127][T23717] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1104.484155][T23717] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1104.484183][T23717] netdevsim netdevsim0 netdevsim1: set [1, 1] type 2 family 0 port 20000 - 0 [ 1104.562928][T23717] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1104.563044][T23717] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1104.563110][T23717] netdevsim netdevsim0 netdevsim3: set [1, 1] type 2 family 0 port 20000 - 0 [ 1104.709146][ T3769] syzkaller0: entered promiscuous mode [ 1104.709199][ T3769] syzkaller0: entered allmulticast mode [ 1104.764369][ T1380] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1104.764701][ T1380] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1104.795084][T31570] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1104.796638][T31570] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 1104.818461][ T3344] veth0_vlan: entered promiscuous mode [ 1105.024096][T31570] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1105.120893][T31570] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 1105.167680][ T3780] x_tables: ip6_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 1105.402775][ T3777] netlink: 48 bytes leftover after parsing attributes in process `syz.4.9241'. [ 1105.734508][T31577] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1108.389921][ T3344] veth1_vlan: entered promiscuous mode [ 1108.455573][ T1283] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 1108.469014][ T3788] xt_bpf: check failed: parse error [ 1108.567458][ T3344] veth0_macvtap: entered promiscuous mode [ 1108.597552][ T3344] veth1_macvtap: entered promiscuous mode [ 1108.632684][ T3791] netlink: 12 bytes leftover after parsing attributes in process `syz.1.9245'. [ 1108.712166][ T3791] 8021q: adding VLAN 0 to HW filter on device bond7 [ 1108.750656][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1108.755198][ T3798] gretap0: entered allmulticast mode [ 1108.805931][ T3797] bond5: (slave bridge0): Releasing backup interface [ 1108.925756][ T3797] bond7: (slave bridge0): Enslaving as an active interface with an up link [ 1109.148142][ T3344] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1109.187929][ T3813] netlink: 36 bytes leftover after parsing attributes in process `syz.0.9251'. [ 1109.202855][ T3344] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1109.346207][ T1283] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1109.347695][ T1283] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1109.349106][ T1283] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1109.424998][ T1283] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1109.542251][ T3822] netlink: 'syz.4.9255': attribute type 1 has an invalid length. [ 1109.694480][ T3822] 8021q: adding VLAN 0 to HW filter on device bond18 [ 1109.771387][ T3823] bond18: (slave geneve0): making interface the new active one [ 1109.774914][ T3823] bond18: (slave geneve0): Enslaving as an active interface with an up link [ 1109.805939][ T3830] netlink: 28 bytes leftover after parsing attributes in process `syz.1.9256'. [ 1109.805967][ T3830] netlink: 28 bytes leftover after parsing attributes in process `syz.1.9256'. [ 1109.825097][ T8933] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1109.825158][ T8933] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1109.876542][ T8950] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 1109.876810][ T8950] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 1110.156575][ T8950] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1110.156598][ T8950] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1110.235324][ T3834] syzkaller0: entered promiscuous mode [ 1110.235351][ T3834] syzkaller0: entered allmulticast mode [ 1110.266229][ T3834] FAULT_INJECTION: forcing a failure. [ 1110.266229][ T3834] name failslab, interval 1, probability 0, space 0, times 0 [ 1110.266272][ T3834] CPU: 0 UID: 0 PID: 3834 Comm: syz.0.9260 Not tainted syzkaller #0 PREEMPT(full) [ 1110.266297][ T3834] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1110.266312][ T3834] Call Trace: [ 1110.266322][ T3834] [ 1110.266332][ T3834] dump_stack_lvl+0xe8/0x150 [ 1110.266371][ T3834] should_fail_ex+0x410/0x560 [ 1110.266403][ T3834] ? __alloc_skb+0x1db/0x7a0 [ 1110.266433][ T3834] should_failslab+0xa8/0x100 [ 1110.266465][ T3834] ? __alloc_skb+0x1db/0x7a0 [ 1110.266490][ T3834] kmem_cache_alloc_node_noprof+0xa1/0x610 [ 1110.266531][ T3834] ? __alloc_skb+0x18d/0x7a0 [ 1110.266559][ T3834] ? __alloc_skb+0x1db/0x7a0 [ 1110.266595][ T3834] __alloc_skb+0x1db/0x7a0 [ 1110.266630][ T3834] netlink_sendmsg+0x5d4/0xb40 [ 1110.266665][ T3834] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1110.266698][ T3834] ? apparmor_socket_sendmsg+0x98/0x360 [ 1110.266728][ T3834] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1110.266750][ T3834] sock_sendmsg_nosec+0x13a/0x180 [ 1110.266779][ T3834] ____sys_sendmsg+0x54e/0x850 [ 1110.266818][ T3834] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1110.266861][ T3834] ? import_iovec+0x73/0xa0 [ 1110.266895][ T3834] ___sys_sendmsg+0x2a5/0x360 [ 1110.266927][ T3834] ? __lock_acquire+0x747/0x2de0 [ 1110.266956][ T3834] ? __pfx____sys_sendmsg+0x10/0x10 [ 1110.267029][ T3834] ? __fget_files+0x2a/0x420 [ 1110.267060][ T3834] ? __fget_files+0x3a2/0x420 [ 1110.267104][ T3834] __x64_sys_sendmsg+0x1b1/0x290 [ 1110.267141][ T3834] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1110.267199][ T3834] do_syscall_64+0x166/0x520 [ 1110.267231][ T3834] ? trace_irq_disable+0x3b/0x140 [ 1110.267255][ T3834] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1110.267286][ T3834] ? clear_bhb_loop+0x70/0xc0 [ 1110.267315][ T3834] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1110.267339][ T3834] RIP: 0033:0x7f29b839e159 [ 1110.267360][ T3834] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1110.267380][ T3834] RSP: 002b:00007f29b9322028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1110.267405][ T3834] RAX: ffffffffffffffda RBX: 00007f29b8625fa0 RCX: 00007f29b839e159 [ 1110.267422][ T3834] RDX: 0000000000000000 RSI: 00002000000002c0 RDI: 0000000000000008 [ 1110.267438][ T3834] RBP: 00007f29b9322090 R08: 0000000000000000 R09: 0000000000000000 [ 1110.267453][ T3834] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1110.267467][ T3834] R13: 00007f29b8626038 R14: 00007f29b8625fa0 R15: 00007ffde1945288 [ 1110.267504][ T3834] [ 1110.897193][ T3855] xt_LOG: level 115 >= 8 [ 1110.911452][T17504] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 1111.247282][T30932] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 1111.264602][T30932] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 1111.267954][T30932] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 1111.272280][T30932] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 1111.294518][T30932] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 1111.410090][ T3865] netlink: 4 bytes leftover after parsing attributes in process `syz.1.9271'. [ 1111.496768][ T3871] syzkaller0: entered promiscuous mode [ 1111.496797][ T3871] syzkaller0: entered allmulticast mode [ 1111.538969][ T3865] tipc: Enabled bearer , priority 0 [ 1111.564373][ T3878] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1111.581126][ T3863] tipc: Resetting bearer [ 1111.703409][ T3863] tipc: Disabling bearer [ 1111.933753][ T3883] xt_CT: No such helper "snmp" [ 1112.048830][ T3899] FAULT_INJECTION: forcing a failure. [ 1112.048830][ T3899] name failslab, interval 1, probability 0, space 0, times 0 [ 1112.048869][ T3899] CPU: 0 UID: 0 PID: 3899 Comm: syz.1.9279 Not tainted syzkaller #0 PREEMPT(full) [ 1112.048893][ T3899] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1112.048907][ T3899] Call Trace: [ 1112.048919][ T3899] [ 1112.048930][ T3899] dump_stack_lvl+0xe8/0x150 [ 1112.048969][ T3899] should_fail_ex+0x410/0x560 [ 1112.049001][ T3899] should_failslab+0xa8/0x100 [ 1112.049032][ T3899] __kvmalloc_node_noprof+0x176/0x820 [ 1112.049063][ T3899] ? xt_alloc_table_info+0x40/0xb0 [ 1112.049176][ T3899] ? xt_alloc_table_info+0x40/0xb0 [ 1112.049217][ T3899] xt_alloc_table_info+0x40/0xb0 [ 1112.049250][ T3899] do_ipt_set_ctl+0x962/0xe20 [ 1112.049322][ T3899] ? rcu_is_watching+0x16/0xb0 [ 1112.049353][ T3899] ? __pfx_do_ipt_set_ctl+0x10/0x10 [ 1112.049402][ T3899] ? __mutex_unlock_slowpath+0x731/0x900 [ 1112.049444][ T3899] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1112.049492][ T3899] nf_setsockopt+0x26f/0x290 [ 1112.049528][ T3899] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 1112.049558][ T3899] do_sock_setsockopt+0x17c/0x1b0 [ 1112.049596][ T3899] __x64_sys_setsockopt+0x13d/0x1b0 [ 1112.049632][ T3899] do_syscall_64+0x166/0x520 [ 1112.049663][ T3899] ? trace_irq_disable+0x3b/0x140 [ 1112.049687][ T3899] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1112.049720][ T3899] ? clear_bhb_loop+0x70/0xc0 [ 1112.049747][ T3899] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1112.049770][ T3899] RIP: 0033:0x7fea6d99e159 [ 1112.049791][ T3899] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1112.049812][ T3899] RSP: 002b:00007fea6e953028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 1112.049837][ T3899] RAX: ffffffffffffffda RBX: 00007fea6dc25fa0 RCX: 00007fea6d99e159 [ 1112.049856][ T3899] RDX: 0000000000000040 RSI: 0000000000000000 RDI: 0000000000000004 [ 1112.049870][ T3899] RBP: 00007fea6e953090 R08: 0000000000000408 R09: 0000000000000000 [ 1112.049886][ T3899] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1112.049902][ T3899] R13: 00007fea6dc26038 R14: 00007fea6dc25fa0 R15: 00007ffeea33daf8 [ 1112.049938][ T3899] [ 1112.501617][T23724] netdevsim netdevsim0 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1112.501655][T23724] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1112.501681][T23724] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 1112.771580][T23724] netdevsim netdevsim0 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1112.771622][T23724] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1112.771652][T23724] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 1113.230234][ T3945] netlink: 19 bytes leftover after parsing attributes in process `syz.2.9286'. [ 1113.245142][ T3945] netlink: 19 bytes leftover after parsing attributes in process `syz.2.9286'. [ 1113.266950][ T3949] IPVS: sync thread started: state = BACKUP, mcast_ifn = macsec0, syncid = 3, id = 0 [ 1113.415082][T30932] Bluetooth: hci5: command tx timeout [ 1113.492551][T23724] netdevsim netdevsim0 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1113.492591][T23724] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1113.544540][T23724] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 1113.834322][ T3966] netlink: 20 bytes leftover after parsing attributes in process `syz.2.9291'. [ 1113.870530][ C0] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 1114.001071][ T3962] netlink: 260 bytes leftover after parsing attributes in process `syz.3.9290'. [ 1114.118860][T23724] netdevsim netdevsim0 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1114.118901][T23724] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1114.118933][T23724] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 1114.210250][ T3977] netlink: 4 bytes leftover after parsing attributes in process `syz.4.9294'. [ 1114.940636][ T3995] syzkaller0: entered promiscuous mode [ 1114.940663][ T3995] syzkaller0: entered allmulticast mode [ 1115.245631][ T4013] netlink: 12 bytes leftover after parsing attributes in process `syz.2.9302'. [ 1115.275640][ T3868] bridge0: port 1(bridge_slave_0) entered blocking state [ 1115.275831][ T3868] bridge0: port 1(bridge_slave_0) entered disabled state [ 1115.276015][ T3868] bridge_slave_0: entered allmulticast mode [ 1115.279463][ T3868] bridge_slave_0: entered promiscuous mode [ 1115.308977][ T3868] bridge0: port 2(bridge_slave_1) entered blocking state [ 1115.309614][ T3868] bridge0: port 2(bridge_slave_1) entered disabled state [ 1115.317190][ T3868] bridge_slave_1: entered allmulticast mode [ 1115.335194][ T3868] bridge_slave_1: entered promiscuous mode [ 1115.420042][ T4013] bridge0: port 2(bridge_slave_1) entered disabled state [ 1115.421602][ T4013] bridge0: port 1(bridge_slave_0) entered disabled state [ 1115.470487][ T5623] Bluetooth: hci5: command tx timeout [ 1115.629319][ T4029] netlink: 'syz.2.9304': attribute type 8 has an invalid length. [ 1115.634525][ T4029] netlink: 32 bytes leftover after parsing attributes in process `syz.2.9304'. [ 1115.951160][ C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1116.415106][T23724] bond11 (unregistering): (slave geneve9): Releasing backup interface [ 1116.430235][T23724] bond10 (unregistering): (slave geneve8): Releasing active interface [ 1116.457568][T23724] bond9 (unregistering): (slave geneve6): Releasing active interface [ 1116.471960][T23724] bond7 (unregistering): (slave geneve5): Releasing active interface [ 1116.477593][T23724] bond6 (unregistering): (slave geneve4): Releasing active interface [ 1116.506646][T23724] bond4 (unregistering): (slave geneve3): Releasing active interface [ 1116.573474][T23724] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1116.577252][T23724] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1116.578999][T23724] bond0 (unregistering): Released all slaves [ 1116.617883][T23724] bond1 (unregistering): Released all slaves [ 1116.635515][T23724] bond2 (unregistering): Released all slaves [ 1116.653897][T23724] bond3 (unregistering): Released all slaves [ 1116.681407][T23724] bond4 (unregistering): Released all slaves [ 1116.697929][T23724] bond5 (unregistering): Released all slaves [ 1116.717979][T23724] bond6 (unregistering): Released all slaves [ 1116.745910][T23724] bond7 (unregistering): Released all slaves [ 1116.764996][T23724] bond8 (unregistering): Released all slaves [ 1116.783535][T23724] bond9 (unregistering): Released all slaves [ 1116.808427][T23724] bond10 (unregistering): Released all slaves [ 1116.827522][T23724] bond11 (unregistering): Released all slaves [ 1116.845420][T23724] bond12 (unregistering): Released all slaves [ 1116.874563][T23724] bond13 (unregistering): (slave veth3): Releasing active interface [ 1116.877102][T23724] bond13 (unregistering): (slave batadv1): Releasing active interface [ 1116.877140][T23724] batadv1: left promiscuous mode [ 1116.878758][T23724] bond13 (unregistering): Released all slaves [ 1116.925271][ T3868] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1116.929696][ T3868] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1116.996428][ T5283] 8021q: adding VLAN 0 to HW filter on device eth1 [ 1117.009224][ T4038] team0: entered allmulticast mode [ 1117.009248][ T4038] team_slave_0: entered allmulticast mode [ 1117.009267][ T4038] team_slave_1: entered allmulticast mode [ 1117.143016][ T4056] netlink: 8 bytes leftover after parsing attributes in process `syz.2.9309'. [ 1117.143043][ T4056] netlink: 4 bytes leftover after parsing attributes in process `syz.2.9309'. [ 1117.183718][ T3868] team0: Port device team_slave_0 added [ 1117.186728][ T3868] team0: Port device team_slave_1 added [ 1117.385506][ T3868] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1117.385528][ T3868] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1117.385558][ T3868] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1117.406758][T23724] tipc: Left network mode [ 1117.428621][ T3868] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1117.428685][ T3868] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1117.428768][ T3868] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1117.559255][ T5623] Bluetooth: hci5: command tx timeout [ 1117.720039][ T4065] netlink: 12 bytes leftover after parsing attributes in process `syz.3.9312'. [ 1117.795397][T23724] IPVS: stopping backup sync thread 31147 ... [ 1117.911094][ T4065] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1117.938547][ T3868] hsr_slave_0: entered promiscuous mode [ 1117.948500][ T3868] hsr_slave_1: entered promiscuous mode [ 1117.962597][ T3868] debugfs: 'hsr0' already exists in 'hsr' [ 1117.962624][ T3868] Cannot create hsr debugfs directory [ 1118.619183][ T4096] xt_nfacct: accounting object `' does not exist [ 1118.781617][ T5283] 8021q: adding VLAN 0 to HW filter on device eth2 [ 1119.115604][ T4105] syzkaller0: entered promiscuous mode [ 1119.115630][ T4105] syzkaller0: entered allmulticast mode [ 1119.135167][ T4103] FAULT_INJECTION: forcing a failure. [ 1119.135167][ T4103] name failslab, interval 1, probability 0, space 0, times 0 [ 1119.135204][ T4103] CPU: 0 UID: 0 PID: 4103 Comm: syz.3.9320 Not tainted syzkaller #0 PREEMPT(full) [ 1119.135230][ T4103] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1119.135245][ T4103] Call Trace: [ 1119.135255][ T4103] [ 1119.135265][ T4103] dump_stack_lvl+0xe8/0x150 [ 1119.135305][ T4103] should_fail_ex+0x410/0x560 [ 1119.135337][ T4103] should_failslab+0xa8/0x100 [ 1119.135366][ T4103] ? skb_clone+0x212/0x3a0 [ 1119.135400][ T4103] kmem_cache_alloc_noprof+0xa1/0x600 [ 1119.135440][ T4103] ? skb_clone+0x212/0x3a0 [ 1119.135482][ T4103] skb_clone+0x212/0x3a0 [ 1119.135520][ T4103] __netlink_deliver_tap+0x355/0x6e0 [ 1119.135557][ T4103] ? netlink_deliver_tap+0x2e/0x1b0 [ 1119.135582][ T4103] netlink_deliver_tap+0x19c/0x1b0 [ 1119.135608][ T4103] netlink_unicast+0x781/0x940 [ 1119.135657][ T4103] netlink_sendmsg+0x813/0xb40 [ 1119.135692][ T4103] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1119.135726][ T4103] ? apparmor_socket_sendmsg+0x98/0x360 [ 1119.135756][ T4103] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1119.135779][ T4103] sock_sendmsg_nosec+0x13a/0x180 [ 1119.135809][ T4103] ____sys_sendmsg+0x54e/0x850 [ 1119.135849][ T4103] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1119.135893][ T4103] ? import_iovec+0x73/0xa0 [ 1119.135929][ T4103] ___sys_sendmsg+0x2a5/0x360 [ 1119.135961][ T4103] ? __lock_acquire+0x747/0x2de0 [ 1119.135990][ T4103] ? __pfx____sys_sendmsg+0x10/0x10 [ 1119.136070][ T4103] ? __fget_files+0x2a/0x420 [ 1119.136108][ T4103] ? __fget_files+0x3a2/0x420 [ 1119.136151][ T4103] __x64_sys_sendmsg+0x1b1/0x290 [ 1119.136186][ T4103] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1119.136241][ T4103] do_syscall_64+0x166/0x520 [ 1119.136272][ T4103] ? trace_irq_disable+0x3b/0x140 [ 1119.136295][ T4103] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1119.136319][ T4103] ? clear_bhb_loop+0x70/0xc0 [ 1119.136347][ T4103] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1119.136369][ T4103] RIP: 0033:0x7fc76879e159 [ 1119.136390][ T4103] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1119.136409][ T4103] RSP: 002b:00007fc7696df028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1119.136432][ T4103] RAX: ffffffffffffffda RBX: 00007fc768a25fa0 RCX: 00007fc76879e159 [ 1119.136449][ T4103] RDX: 0000000000000000 RSI: 00002000000002c0 RDI: 0000000000000008 [ 1119.136463][ T4103] RBP: 00007fc7696df090 R08: 0000000000000000 R09: 0000000000000000 [ 1119.136477][ T4103] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1119.136490][ T4103] R13: 00007fc768a26038 R14: 00007fc768a25fa0 R15: 00007fffae1dfbb8 [ 1119.136525][ T4103] [ 1119.424751][ T4103] tipc: Started in network mode [ 1119.424783][ T4103] tipc: Node identity 12dfdf422174, cluster identity 4711 [ 1119.424966][ T4103] tipc: Enabled bearer , priority 0 [ 1119.518906][ T4102] tipc: Resetting bearer [ 1119.584603][ T4102] tipc: Disabling bearer [ 1119.631288][ T5623] Bluetooth: hci5: command tx timeout [ 1119.715664][T23724] team0: left promiscuous mode [ 1119.715691][T23724] team_slave_0: left promiscuous mode [ 1119.715901][T23724] team_slave_1: left promiscuous mode [ 1119.764701][T23724] hsr_slave_0: left promiscuous mode [ 1119.775975][T23724] hsr_slave_1: left promiscuous mode [ 1119.790623][ C1] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 1119.840934][T23724] veth1_macvtap: left promiscuous mode [ 1119.840973][T23724] veth0_macvtap: left promiscuous mode [ 1120.068354][ T4139] netlink: 36 bytes leftover after parsing attributes in process `syz.3.9329'. [ 1120.597986][T23724] team0 (unregistering): Port device team_slave_1 removed [ 1120.620952][T23724] team0 (unregistering): Port device team_slave_0 removed [ 1120.841975][ T5283] 8021q: adding VLAN 0 to HW filter on device eth3 [ 1121.039494][ T4163] netlink: 12 bytes leftover after parsing attributes in process `syz.3.9333'. [ 1121.106203][ T4166] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1121.137512][ T4163] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1121.242326][ T4173] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1121.627274][ T4182] v: renamed from veth0_vlan (while UP) [ 1121.852409][T23724] IPVS: stop unused estimator thread 0... [ 1125.253955][ T4252] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1125.286242][T23724] batman_adv: batadv0: Interface deactivated: ip6gretap1 [ 1125.359362][ T4255] netlink: 4 bytes leftover after parsing attributes in process `syz.4.9349'. [ 1125.501801][T23724] batman_adv: batadv0: Removing interface: ip6gretap1 [ 1125.652542][ T4267] xt_CT: No such helper "snmp" [ 1125.794512][T23724] bond8 (unregistering): (slave geneve5): Releasing active interface [ 1125.814363][T23724] bond7 (unregistering): (slave geneve4): Releasing active interface [ 1125.834892][T23724] bond4 (unregistering): (slave geneve3): Releasing active interface [ 1125.853271][T23724] bond2 (unregistering): (slave geneve2): Releasing active interface [ 1125.876897][T23724] batman_adv: batadv0: Interface deactivated: macvlan4 [ 1125.880098][T23724] batman_adv: batadv0: Removing interface: macvlan4 [ 1125.955967][T23724] bond0 (unregistering): Released all slaves [ 1125.970749][T23724] bond1 (unregistering): Released all slaves [ 1125.995005][T23724] bond3 (unregistering): Released all slaves [ 1126.020212][T23724] bond2 (unregistering): Released all slaves [ 1126.046093][T23724] bond4 (unregistering): Released all slaves [ 1126.079419][T23724] bond5 (unregistering): left promiscuous mode [ 1126.087465][T23724] team0: Port device bond5 removed [ 1126.088871][T23724] bond5 (unregistering): Released all slaves [ 1126.112605][T23724] bond6 (unregistering): Released all slaves [ 1126.129429][T23724] bond7 (unregistering): Released all slaves [ 1126.153233][T23724] bond8 (unregistering): Released all slaves [ 1126.172691][ T4250] ¾x9ÿ: renamed from bridge_slave_0 (while UP) [ 1126.372903][T23724] tipc: Left network mode [ 1126.527082][ T4284] FAULT_INJECTION: forcing a failure. [ 1126.527082][ T4284] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1126.527119][ T4284] CPU: 0 UID: 0 PID: 4284 Comm: syz.4.9356 Not tainted syzkaller #0 PREEMPT(full) [ 1126.527144][ T4284] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1126.527158][ T4284] Call Trace: [ 1126.527168][ T4284] [ 1126.527178][ T4284] dump_stack_lvl+0xe8/0x150 [ 1126.527217][ T4284] should_fail_ex+0x410/0x560 [ 1126.527250][ T4284] _copy_from_iter+0x1d3/0x1660 [ 1126.527276][ T4284] ? __alloc_skb+0x27a/0x7a0 [ 1126.527304][ T4284] ? trace_kmem_cache_alloc+0x29/0xe0 [ 1126.527346][ T4284] ? kmem_cache_alloc_node_noprof+0x1f9/0x610 [ 1126.527381][ T4284] ? __alloc_skb+0x27a/0x7a0 [ 1126.527407][ T4284] ? __alloc_skb+0x27a/0x7a0 [ 1126.527435][ T4284] ? __pfx__copy_from_iter+0x10/0x10 [ 1126.527468][ T4284] ? skb_set_owner_w+0x263/0x3d0 [ 1126.527522][ T4284] ? skb_put+0x112/0x210 [ 1126.527554][ T4284] pppoe_sendmsg+0x49c/0x830 [ 1126.527682][ T4284] ? __pfx_pppoe_sendmsg+0x10/0x10 [ 1126.527712][ T4284] ? apparmor_socket_sendmsg+0x98/0x360 [ 1126.527737][ T4284] ? __pfx_pppoe_sendmsg+0x10/0x10 [ 1126.527762][ T4284] sock_sendmsg_nosec+0x13a/0x180 [ 1126.527787][ T4284] __sys_sendto+0x408/0x5a0 [ 1126.527817][ T4284] ? __pfx___sys_sendto+0x10/0x10 [ 1126.527872][ T4284] ? do_user_addr_fault+0xc4c/0x1340 [ 1126.527899][ T4284] __x64_sys_sendto+0xde/0x100 [ 1126.527929][ T4284] do_syscall_64+0x166/0x520 [ 1126.527956][ T4284] ? trace_irq_disable+0x3b/0x140 [ 1126.527978][ T4284] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1126.528000][ T4284] ? clear_bhb_loop+0x70/0xc0 [ 1126.528024][ T4284] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1126.528044][ T4284] RIP: 0033:0x7fb4eb15e98e [ 1126.528063][ T4284] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1126.528081][ T4284] RSP: 002b:00007fb4ec0b8e88 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 1126.528105][ T4284] RAX: ffffffffffffffda RBX: 00007fb4ec0ba6c0 RCX: 00007fb4eb15e98e [ 1126.528121][ T4284] RDX: 0000000000000020 RSI: 00007fb4ec0b9000 RDI: 0000000000000003 [ 1126.528136][ T4284] RBP: 0000000000000000 R08: 00007fb4ec0b8f04 R09: 000000000000000c [ 1126.528148][ T4284] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 [ 1126.528159][ T4284] R13: 00007fb4ec0b8f58 R14: 00007fb4ec0b9000 R15: 0000000000000000 [ 1126.528188][ T4284] [ 1126.854832][ T3868] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 1126.887242][ T3868] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1126.888603][ T3868] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 1126.946787][ T3868] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1126.951442][ T3868] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 1126.980155][ T3868] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1126.998966][ T3868] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 1127.102788][ T4296] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1127.153185][ T3868] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1127.288089][ T4306] FAULT_INJECTION: forcing a failure. [ 1127.288089][ T4306] name failslab, interval 1, probability 0, space 0, times 0 [ 1127.288126][ T4306] CPU: 0 UID: 0 PID: 4306 Comm: syz.3.9363 Not tainted syzkaller #0 PREEMPT(full) [ 1127.288152][ T4306] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1127.288167][ T4306] Call Trace: [ 1127.288177][ T4306] [ 1127.288187][ T4306] dump_stack_lvl+0xe8/0x150 [ 1127.288226][ T4306] should_fail_ex+0x410/0x560 [ 1127.288258][ T4306] ? __alloc_skb+0x1db/0x7a0 [ 1127.288286][ T4306] should_failslab+0xa8/0x100 [ 1127.288316][ T4306] ? __alloc_skb+0x1db/0x7a0 [ 1127.288342][ T4306] kmem_cache_alloc_node_noprof+0xa1/0x610 [ 1127.288377][ T4306] ? __alloc_skb+0x18d/0x7a0 [ 1127.288405][ T4306] ? __alloc_skb+0x1db/0x7a0 [ 1127.288440][ T4306] __alloc_skb+0x1db/0x7a0 [ 1127.288473][ T4306] alloc_skb_with_frags+0xc6/0x760 [ 1127.288504][ T4306] ? __lock_acquire+0x747/0x2de0 [ 1127.288538][ T4306] sock_alloc_send_pskb+0x878/0x990 [ 1127.288579][ T4306] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 1127.288619][ T4306] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 1127.288657][ T4306] ? dev_get_by_index+0x22/0x2d0 [ 1127.288680][ T4306] ? dev_get_by_index+0x22/0x2d0 [ 1127.288709][ T4306] packet_sendmsg+0x33a6/0x5150 [ 1127.288751][ T4306] ? __pfx_aa_label_sk_perm+0x10/0x10 [ 1127.288786][ T4306] ? __lock_acquire+0x747/0x2de0 [ 1127.288821][ T4306] ? __lock_acquire+0x747/0x2de0 [ 1127.288848][ T4306] ? kstrtouint+0x6e/0xe0 [ 1127.288876][ T4306] ? __pfx_packet_sendmsg+0x10/0x10 [ 1127.288899][ T4306] ? aa_sk_perm+0x713/0x900 [ 1127.288932][ T4306] ? percpu_is_read_locked+0x130/0x190 [ 1127.288964][ T4306] ? __pfx_aa_sk_perm+0x10/0x10 [ 1127.288999][ T4306] ? aa_sock_msg_perm+0x144/0x210 [ 1127.289033][ T4306] ? apparmor_socket_sendmsg+0x98/0x360 [ 1127.289071][ T4306] ? __pfx_packet_sendmsg+0x10/0x10 [ 1127.289097][ T4306] sock_sendmsg_nosec+0x13a/0x180 [ 1127.289125][ T4306] __sys_sendto+0x408/0x5a0 [ 1127.289153][ T4306] ? ksys_write+0x1e6/0x270 [ 1127.289191][ T4306] ? __pfx___sys_sendto+0x10/0x10 [ 1127.289218][ T4306] ? __mutex_unlock_slowpath+0x731/0x900 [ 1127.289280][ T4306] ? __pfx_ksys_write+0x10/0x10 [ 1127.289321][ T4306] __x64_sys_sendto+0xde/0x100 [ 1127.289355][ T4306] do_syscall_64+0x166/0x520 [ 1127.289386][ T4306] ? trace_irq_disable+0x3b/0x140 [ 1127.289410][ T4306] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1127.289434][ T4306] ? clear_bhb_loop+0x70/0xc0 [ 1127.289463][ T4306] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1127.289486][ T4306] RIP: 0033:0x7fc76879e159 [ 1127.289509][ T4306] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1127.289530][ T4306] RSP: 002b:00007fc7696df028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 1127.289556][ T4306] RAX: ffffffffffffffda RBX: 00007fc768a25fa0 RCX: 00007fc76879e159 [ 1127.289574][ T4306] RDX: 000000000000000e RSI: 0000200000000140 RDI: 0000000000000003 [ 1127.289588][ T4306] RBP: 00007fc7696df090 R08: 0000200000000040 R09: 0000000000000014 [ 1127.289604][ T4306] R10: 0000000000044011 R11: 0000000000000246 R12: 0000000000000001 [ 1127.289618][ T4306] R13: 00007fc768a26038 R14: 00007fc768a25fa0 R15: 00007fffae1dfbb8 [ 1127.289654][ T4306] [ 1127.925429][ T4324] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1128.240119][ T4336] netlink: 4 bytes leftover after parsing attributes in process `syz.1.9371'. [ 1128.258837][ T4329] netlink: 120 bytes leftover after parsing attributes in process `syz.4.9370'. [ 1128.290153][ T4336] netlink: 60 bytes leftover after parsing attributes in process `syz.1.9371'. [ 1128.297079][T23724] mac80211_hwsim hwsim48 wlan0 (unregistering): left promiscuous mode [ 1128.378051][ T4338] netlink: 20 bytes leftover after parsing attributes in process `syz.1.9371'. [ 1128.378091][ T4338] openvswitch: netlink: Missing key (keys=c0, expected=10000000) [ 1128.480994][ T4343] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1128.552445][ T3868] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1128.625363][ T4334] netlink: 'syz.1.9371': attribute type 7 has an invalid length. [ 1128.625390][ T4334] netlink: 4 bytes leftover after parsing attributes in process `syz.1.9371'. [ 1128.711424][ T3868] 8021q: adding VLAN 0 to HW filter on device team0 [ 1128.734436][ T4348] FAULT_INJECTION: forcing a failure. [ 1128.734436][ T4348] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1128.734473][ T4348] CPU: 0 UID: 0 PID: 4348 Comm: syz.4.9374 Not tainted syzkaller #0 PREEMPT(full) [ 1128.734499][ T4348] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1128.734513][ T4348] Call Trace: [ 1128.734523][ T4348] [ 1128.734534][ T4348] dump_stack_lvl+0xe8/0x150 [ 1128.734574][ T4348] should_fail_ex+0x410/0x560 [ 1128.734607][ T4348] _copy_from_iter+0x1d3/0x1660 [ 1128.734635][ T4348] ? __alloc_skb+0x27a/0x7a0 [ 1128.734668][ T4348] ? __alloc_skb+0x27a/0x7a0 [ 1128.734699][ T4348] ? __alloc_skb+0x27a/0x7a0 [ 1128.734728][ T4348] ? __pfx__copy_from_iter+0x10/0x10 [ 1128.734758][ T4348] ? kmem_cache_alloc_node_noprof+0x1f9/0x610 [ 1128.734794][ T4348] ? __alloc_skb+0x27a/0x7a0 [ 1128.734820][ T4348] ? __alloc_skb+0x27a/0x7a0 [ 1128.734854][ T4348] ? netlink_sendmsg+0x650/0xb40 [ 1128.734878][ T4348] ? skb_put+0x112/0x210 [ 1128.734911][ T4348] netlink_sendmsg+0x6c0/0xb40 [ 1128.734945][ T4348] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1128.734978][ T4348] ? apparmor_socket_sendmsg+0x18b/0x360 [ 1128.735009][ T4348] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1128.735031][ T4348] sock_sendmsg_nosec+0x13a/0x180 [ 1128.735061][ T4348] ____sys_sendmsg+0x54e/0x850 [ 1128.735100][ T4348] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1128.735144][ T4348] ? import_iovec+0x73/0xa0 [ 1128.735178][ T4348] ___sys_sendmsg+0x2a5/0x360 [ 1128.735209][ T4348] ? __lock_acquire+0x747/0x2de0 [ 1128.735238][ T4348] ? __pfx____sys_sendmsg+0x10/0x10 [ 1128.735320][ T4348] ? __fget_files+0x2a/0x420 [ 1128.735352][ T4348] ? __fget_files+0x3a2/0x420 [ 1128.735395][ T4348] __x64_sys_sendmsg+0x1b1/0x290 [ 1128.735432][ T4348] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1128.735490][ T4348] do_syscall_64+0x166/0x520 [ 1128.735521][ T4348] ? trace_irq_disable+0x3b/0x140 [ 1128.735545][ T4348] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1128.735569][ T4348] ? clear_bhb_loop+0x70/0xc0 [ 1128.735598][ T4348] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1128.735621][ T4348] RIP: 0033:0x7fb4eb19e159 [ 1128.735650][ T4348] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1128.735671][ T4348] RSP: 002b:00007fb4ec0ba028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1128.735696][ T4348] RAX: ffffffffffffffda RBX: 00007fb4eb425fa0 RCX: 00007fb4eb19e159 [ 1128.735714][ T4348] RDX: 0000000020004804 RSI: 0000200000000000 RDI: 0000000000000004 [ 1128.735730][ T4348] RBP: 00007fb4ec0ba090 R08: 0000000000000000 R09: 0000000000000000 [ 1128.735745][ T4348] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1128.735759][ T4348] R13: 00007fb4eb426038 R14: 00007fb4eb425fa0 R15: 00007fffedf00888 [ 1128.735796][ T4348] [ 1128.813784][ T142] bridge0: port 1(bridge_slave_0) entered blocking state [ 1128.814098][ T142] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1129.056755][T23721] bridge0: port 2(bridge_slave_1) entered blocking state [ 1129.056881][T23721] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1129.316964][ T4366] netlink: 'syz.1.9379': attribute type 14 has an invalid length. [ 1129.328357][ T4366] netlink: 12 bytes leftover after parsing attributes in process `syz.1.9379'. [ 1129.414745][ T4366] syzkaller1: entered promiscuous mode [ 1129.414782][ T4366] syzkaller1: entered allmulticast mode [ 1129.547192][ T4379] xt_bpf: check failed: parse error [ 1130.007019][ T4388] x_tables: ip6_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 1130.025682][T23724] team0: left promiscuous mode [ 1130.086306][T23724] hsr_slave_0: left promiscuous mode [ 1130.097397][T23724] hsr_slave_1: left promiscuous mode [ 1130.153067][T23724] veth0_to_bridge: left promiscuous mode [ 1130.153111][T23724] veth0_macvtap: left promiscuous mode [ 1130.153291][T23724] veth1_vlan: left promiscuous mode [ 1130.153374][T23724] v: left promiscuous mode [ 1130.450060][ T4386] netlink: 48 bytes leftover after parsing attributes in process `syz.4.9381'. [ 1130.787484][T23724] smc: removing net device ipvlan1 with user defined pnetid SYZ2 [ 1131.621492][ T4430] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1131.623884][ T3868] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1131.757416][ T5623] Bluetooth: hci4: link tx timeout [ 1131.759312][ T5623] Bluetooth: hci4: killing stalled connection 10:aa:aa:aa:aa:aa [ 1131.778180][ T3868] veth0_vlan: entered promiscuous mode [ 1131.796896][ T3868] veth1_vlan: entered promiscuous mode [ 1131.862827][ T3868] veth0_macvtap: entered promiscuous mode [ 1131.872038][ T3868] veth1_macvtap: entered promiscuous mode [ 1131.924779][ T3868] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1131.995511][ T3868] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1132.019822][ T8950] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1132.020038][ T8950] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1132.044264][ T8937] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1132.044345][ T8937] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1132.127903][T23724] IPVS: stop unused estimator thread 0... [ 1132.241312][ T4441] Cannot find add_set index 0 as target [ 1132.307439][ T4442] xt_CT: No such helper "snmp" [ 1132.322202][ T4441] netlink: 8 bytes leftover after parsing attributes in process `syz.3.9391'. [ 1132.322614][ T4441] netlink: 8 bytes leftover after parsing attributes in process `syz.3.9391'. [ 1132.323013][ T4441] netlink: 8 bytes leftover after parsing attributes in process `syz.3.9391'. [ 1132.368976][ T4441] netlink: 8 bytes leftover after parsing attributes in process `syz.3.9391'. [ 1132.369353][ T4441] netlink: 8 bytes leftover after parsing attributes in process `syz.3.9391'. [ 1132.369620][ T4441] netlink: 8 bytes leftover after parsing attributes in process `syz.3.9391'. [ 1132.369870][ T4441] netlink: 8 bytes leftover after parsing attributes in process `syz.3.9391'. [ 1132.370144][ T4441] netlink: 8 bytes leftover after parsing attributes in process `syz.3.9391'. [ 1132.458050][ T4441] netlink: 8 bytes leftover after parsing attributes in process `syz.3.9391'. [ 1132.474315][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1132.474340][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1132.505747][ T4443] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 1132.653669][ T4438] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 1132.653931][ T4438] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 1132.654151][ T4438] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 1132.654372][ T4438] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 1132.654595][ T4438] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 1132.654815][ T4438] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 1132.659183][ T4457] FAULT_INJECTION: forcing a failure. [ 1132.659183][ T4457] name failslab, interval 1, probability 0, space 0, times 0 [ 1132.659217][ T4457] CPU: 1 UID: 0 PID: 4457 Comm: syz.4.9394 Not tainted syzkaller #0 PREEMPT(full) [ 1132.659241][ T4457] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1132.659256][ T4457] Call Trace: [ 1132.659265][ T4457] [ 1132.659276][ T4457] dump_stack_lvl+0xe8/0x150 [ 1132.659316][ T4457] should_fail_ex+0x410/0x560 [ 1132.659349][ T4457] should_failslab+0xa8/0x100 [ 1132.659379][ T4457] ? skb_clone+0x212/0x3a0 [ 1132.659413][ T4457] kmem_cache_alloc_noprof+0xa1/0x600 [ 1132.659451][ T4457] ? skb_clone+0x212/0x3a0 [ 1132.659492][ T4457] skb_clone+0x212/0x3a0 [ 1132.659529][ T4457] __netlink_deliver_tap+0x355/0x6e0 [ 1132.659566][ T4457] ? netlink_deliver_tap+0x2e/0x1b0 [ 1132.659591][ T4457] netlink_deliver_tap+0x19c/0x1b0 [ 1132.659617][ T4457] netlink_unicast+0x781/0x940 [ 1132.659668][ T4457] netlink_sendmsg+0x813/0xb40 [ 1132.659702][ T4457] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1132.659736][ T4457] ? apparmor_socket_sendmsg+0x18b/0x360 [ 1132.659765][ T4457] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1132.659787][ T4457] sock_sendmsg_nosec+0x13a/0x180 [ 1132.659816][ T4457] ____sys_sendmsg+0x54e/0x850 [ 1132.659855][ T4457] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1132.659899][ T4457] ? import_iovec+0x73/0xa0 [ 1132.659932][ T4457] ___sys_sendmsg+0x2a5/0x360 [ 1132.659963][ T4457] ? __lock_acquire+0x747/0x2de0 [ 1132.659993][ T4457] ? __pfx____sys_sendmsg+0x10/0x10 [ 1132.660066][ T4457] ? __fget_files+0x2a/0x420 [ 1132.660097][ T4457] ? __fget_files+0x3a2/0x420 [ 1132.660147][ T4457] __x64_sys_sendmsg+0x1b1/0x290 [ 1132.660183][ T4457] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1132.660240][ T4457] do_syscall_64+0x166/0x520 [ 1132.660272][ T4457] ? trace_irq_disable+0x3b/0x140 [ 1132.660296][ T4457] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1132.660319][ T4457] ? clear_bhb_loop+0x70/0xc0 [ 1132.660347][ T4457] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1132.660369][ T4457] RIP: 0033:0x7fb4eb19e159 [ 1132.660391][ T4457] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1132.660410][ T4457] RSP: 002b:00007fb4ec0ba028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1132.660434][ T4457] RAX: ffffffffffffffda RBX: 00007fb4eb425fa0 RCX: 00007fb4eb19e159 [ 1132.660451][ T4457] RDX: 0000000020004804 RSI: 0000200000000000 RDI: 0000000000000004 [ 1132.660466][ T4457] RBP: 00007fb4ec0ba090 R08: 0000000000000000 R09: 0000000000000000 [ 1132.660480][ T4457] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1132.660494][ T4457] R13: 00007fb4eb426038 R14: 00007fb4eb425fa0 R15: 00007fffedf00888 [ 1132.660531][ T4457] [ 1133.014614][T23717] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1133.014639][T23717] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1133.745111][T19534] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 1133.748375][T19534] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 1133.757690][T19534] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 1133.776989][T19534] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 1133.778003][T19534] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 1133.804159][ T5628] Bluetooth: hci4: command 0x0406 tx timeout [ 1133.828715][ T4484] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1134.593520][ T5623] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 1134.612332][ T4499] bond1: option active_slave: mode dependency failed, not supported in mode balance-xor(2) [ 1134.627226][ T4499] bond1 (unregistering): Released all slaves [ 1134.796399][ T4509] vlan2: entered allmulticast mode [ 1134.796429][ T4509] netdevsim netdevsim2 netdevsim0: entered allmulticast mode [ 1135.332872][ T8950] netdevsim netdevsim4 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1135.332914][ T8950] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1135.746461][ T4555] xt_hashlimit: size too large, truncated to 1048576 [ 1135.781373][ T8950] netdevsim netdevsim4 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1135.786651][ T4560] xt_hashlimit: size too large, truncated to 1048576 [ 1135.806571][ T8950] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1135.899961][ T4559] netlink: 'syz.1.9417': attribute type 1 has an invalid length. [ 1135.899988][ T4559] __nla_validate_parse: 46 callbacks suppressed [ 1135.900002][ T4559] netlink: 224 bytes leftover after parsing attributes in process `syz.1.9417'. [ 1135.951725][ T5623] Bluetooth: hci1: command tx timeout [ 1136.090734][ T8950] netdevsim netdevsim4 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1136.090777][ T8950] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1136.393560][ T8950] netdevsim netdevsim4 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1136.393603][ T8950] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1136.426458][ T4583] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1137.028385][ T4480] bridge0: port 1(bridge_slave_0) entered blocking state [ 1137.028667][ T4480] bridge0: port 1(bridge_slave_0) entered disabled state [ 1137.028842][ T4480] bridge_slave_0: entered allmulticast mode [ 1137.048005][ T4480] bridge_slave_0: entered promiscuous mode [ 1137.180953][ T4480] bridge0: port 2(bridge_slave_1) entered blocking state [ 1137.181309][ T4480] bridge0: port 2(bridge_slave_1) entered disabled state [ 1137.181479][ T4480] bridge_slave_1: entered allmulticast mode [ 1137.218135][ T4480] bridge_slave_1: entered promiscuous mode [ 1137.386522][ T8950] bridge_slave_1: left promiscuous mode [ 1137.386779][ T8950] bridge0: port 2(bridge_slave_1) entered disabled state [ 1137.422216][ T8950] ¾x9ÿ: left allmulticast mode [ 1137.422249][ T8950] ¾x9ÿ: left promiscuous mode [ 1137.423270][ T8950] bridge0: port 1(1¾x9ÿ) entered disabled state [ 1137.740269][ T4626] netlink: 'syz.3.9431': attribute type 15 has an invalid length. [ 1138.030712][ T5623] Bluetooth: hci1: command tx timeout [ 1138.186693][ T4638] xt_TPROXY: Can be used only with -p tcp or -p udp [ 1138.426927][ T8950] bond18 (unregistering): (slave geneve0): Releasing active interface [ 1138.459883][ T8950] bond13 (unregistering): (slave geneve5): Releasing active interface [ 1138.488344][ T8950] bond10 (unregistering): (slave geneve4): Releasing active interface [ 1138.530205][ T8950] bond8 (unregistering): (slave geneve3): Releasing active interface [ 1138.602443][ T8950] bond5 (unregistering): (slave geneve2): Releasing active interface [ 1138.694012][ T8950] bond17 (unregistering): (slave bridge0): Releasing backup interface [ 1138.736093][ T8950] .` (unregistering): (slave bond_slave_0): Releasing backup interface [ 1138.755240][ T8950] .` (unregistering): (slave bond_slave_1): Releasing backup interface [ 1138.758700][ T8950] .` (unregistering): Released all slaves [ 1138.783063][ T8950] bond1 (unregistering): Released all slaves [ 1138.823908][ T8950] bond2 (unregistering): Released all slaves [ 1138.849404][ T8950] bond3 (unregistering): Released all slaves [ 1138.878394][ T8950] bond4 (unregistering): Released all slaves [ 1138.907663][ T8950] bond5 (unregistering): Released all slaves [ 1138.941128][ T8950] bond6 (unregistering): Released all slaves [ 1138.967571][ T8950] bond7 (unregistering): Released all slaves [ 1138.994064][ T8950] bond8 (unregistering): Released all slaves [ 1139.026373][ T8950] bond9 (unregistering): Released all slaves [ 1139.056502][ T8950] bond10 (unregistering): Released all slaves [ 1139.079736][ T8950] bond0 (unregistering): Released all slaves [ 1139.095950][ T4658] xt_bpf: check failed: parse error [ 1139.118898][ T8950] bond11 (unregistering): Released all slaves [ 1139.139679][ T8950] bond12 (unregistering): Released all slaves [ 1139.182158][ T8950] bond13 (unregistering): Released all slaves [ 1139.216876][ T8950] bond14 (unregistering): Released all slaves [ 1139.244802][ T8950] bond15 (unregistering): (slave veth7): Releasing active interface [ 1139.247725][ T8950] bond15 (unregistering): (slave veth0_to_bond): Releasing active interface [ 1139.275479][ T8950] bond15 (unregistering): (slave veth9): Releasing active interface [ 1139.279577][ T8950] bond15 (unregistering): Released all slaves [ 1139.298674][ T4662] netlink: 4 bytes leftover after parsing attributes in process `syz.0.9436'. [ 1139.298780][ T4662] netlink: 4 bytes leftover after parsing attributes in process `syz.0.9436'. [ 1139.334406][ T8950] bond16 (unregistering): Released all slaves [ 1139.357367][ T8950] bond17 (unregistering): Released all slaves [ 1139.386535][ T8950] bond18 (unregistering): Released all slaves [ 1139.419328][ T4480] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1139.434211][ T4480] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1139.676855][ T4638] mac80211_hwsim hwsim58 wlan0 (unregistering): left promiscuous mode [ 1139.721441][ T4664] IPVS: sync thread started: state = MASTER, mcast_ifn = veth1_to_bridge, syncid = 32, id = 0 [ 1139.769278][ T4480] team0: Port device team_slave_0 added [ 1139.778522][ T4480] team0: Port device team_slave_1 added [ 1139.899191][ T4480] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1139.899211][ T4480] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1139.899239][ T4480] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1139.939399][ T4480] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1139.939450][ T4480] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1139.939543][ T4480] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1140.124009][ T5623] Bluetooth: hci1: command tx timeout [ 1140.171856][ T4674] netlink: 112 bytes leftover after parsing attributes in process `syz.0.9438'. [ 1140.176621][ T4480] hsr_slave_0: entered promiscuous mode [ 1140.177722][ T4480] hsr_slave_1: entered promiscuous mode [ 1140.178467][ T4480] debugfs: 'hsr0' already exists in 'hsr' [ 1140.178490][ T4480] Cannot create hsr debugfs directory [ 1140.499202][ T4681] netlink: 12 bytes leftover after parsing attributes in process `syz.3.9441'. [ 1140.652316][ T4681] 8021q: adding VLAN 0 to HW filter on device bond3 [ 1140.716520][ T8950] tipc: Disabling bearer [ 1140.716681][ T8950] tipc: Left network mode [ 1140.783630][ T4689] xt_CT: No such helper "snmp" [ 1140.955009][ T4697] xt_nfacct: accounting object `' does not exist [ 1141.209355][ T8950] IPVS: stopping backup sync thread 3949 ... [ 1142.150963][ T4734] netlink: 256 bytes leftover after parsing attributes in process `syz.1.9454'. [ 1142.150993][ T4734] netlink: 32 bytes leftover after parsing attributes in process `syz.1.9454'. [ 1142.193067][ T5623] Bluetooth: hci1: command tx timeout [ 1142.565126][ T4745] netlink: 44 bytes leftover after parsing attributes in process `syz.2.9458'. [ 1142.585916][ T8950] mac80211_hwsim hwsim56 wlan0 (unregistering): left promiscuous mode [ 1143.136934][ T4480] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 1143.171855][ T4480] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1143.174717][ T4480] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 1143.248249][ T4480] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1143.249224][ T4480] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 1143.264632][ T4768] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1143.267344][ T4769] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1143.295478][ T4768] netlink: 24 bytes leftover after parsing attributes in process `syz.3.9461'. [ 1143.326323][ T4480] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1143.351045][ T4480] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 1143.376621][ T4480] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1143.428482][T23724] ------------[ cut here ]------------ [ 1143.428500][T23724] timer_delete_sync(&sdp->delay_work) && rcu_segcblist_n_cbs(&sdp->srcu_cblist) [ 1143.428519][T23724] WARNING: kernel/rcu/srcutree.c:707 at cleanup_srcu_struct+0x3d6/0x8b0, CPU#0: kworker/u8:37/23724 [ 1143.456155][T23724] Modules linked in: [ 1143.460811][T23724] CPU: 0 UID: 0 PID: 23724 Comm: kworker/u8:37 Not tainted syzkaller #0 PREEMPT(full) SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 1143.472357][T23724] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1143.483268][T23724] Workqueue: nbd-del nbd_dev_remove_work [ 1143.489114][T23724] RIP: 0010:cleanup_srcu_struct+0x3d6/0x8b0 [ 1143.495224][T23724] Code: 05 8c 00 48 83 7d 00 00 4c 8b 74 24 10 0f 85 dd 03 00 00 41 ff c5 41 83 e5 0f 41 83 fd 07 0f 86 e2 fe ff ff e9 ab 00 00 00 90 <0f> 0b 90 4c 8d b5 00 02 00 00 4c 89 f3 48 c1 eb 03 48 b8 00 00 00 [ 1143.515454][T23724] RSP: 0018:ffffc900073679d0 EFLAGS: 00010206 [ 1143.522017][T23724] RAX: 1ffffd1ffff8243d RBX: 0000607edaf4c100 RCX: dffffc0000000000 [ 1143.530557][T23724] RDX: 0000000000000001 RSI: ffffffff8e417513 RDI: 00000000ffffffff [ 1143.538585][T23724] RBP: ffffe8ffffc12100 R08: ffffffff907a687f R09: 1ffffffff20f4d0f [ 1143.548588][T23724] R10: dffffc0000000000 R11: fffffbfff20f4d10 R12: ffff88802696f000 [ 1143.557819][T23724] R13: 0000000000000000 R14: ffffe8ffffc121e8 R15: 1ffffffff1cdd3de [ 1143.566752][T23724] FS: 0000000000000000(0000) GS:ffff888124cc6000(0000) knlGS:0000000000000000 [ 1143.575828][T23724] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1143.582511][T23724] CR2: 00007f3359b357d0 CR3: 000000004a882000 CR4: 00000000003526f0 [ 1143.590588][T23724] Call Trace: [ 1143.593912][T23724] [ 1143.596895][T23724] blk_mq_free_tag_set+0x617/0x790 [ 1143.602278][T23724] ? process_scheduled_works+0x97a/0x1630 [ 1143.608059][T23724] nbd_dev_remove_work+0x4f/0xe0 [ 1143.613129][T23724] process_scheduled_works+0xc3d/0x1630 [ 1143.618769][T23724] ? __pfx_process_scheduled_works+0x10/0x10 [ 1143.624918][T23724] ? assign_work+0x3cf/0x5d0 [ 1143.629574][T23724] worker_thread+0xa47/0xfb0 [ 1143.634396][T23724] ? __kthread_parkme+0x71/0x1f0 [ 1143.641372][T23724] kthread+0x38b/0x480 [ 1143.645605][T23724] ? __pfx_worker_thread+0x10/0x10 [ 1143.650868][T23724] ? __pfx_kthread+0x10/0x10 [ 1143.656419][T23724] ret_from_fork+0x514/0xb70 [ 1143.661841][T23724] ? __pfx_ret_from_fork+0x10/0x10 [ 1143.667019][T23724] ? __switch_to+0xc89/0x1420 [ 1143.671884][T23724] ? __pfx_kthread+0x10/0x10 [ 1143.676521][T23724] ret_from_fork_asm+0x1a/0x30 [ 1143.681478][T23724] [ 1143.684570][T23724] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 1143.691900][T23724] CPU: 0 UID: 0 PID: 23724 Comm: kworker/u8:37 Not tainted syzkaller #0 PREEMPT(full) [ 1143.701573][T23724] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1143.711674][T23724] Workqueue: nbd-del nbd_dev_remove_work [ 1143.717414][T23724] Call Trace: [ 1143.720730][T23724] [ 1143.723696][T23724] vpanic+0x56d/0xa60 [ 1143.727771][T23724] ? __pfx__printk+0x10/0x10 [ 1143.732401][T23724] ? __pfx_vpanic+0x10/0x10 [ 1143.736952][T23724] ? is_bpf_text_address+0x292/0x2b0 [ 1143.742328][T23724] ? is_bpf_text_address+0x26/0x2b0 [ 1143.747589][T23724] panic+0xc5/0xd0 [ 1143.751364][T23724] ? __pfx_panic+0x10/0x10 [ 1143.755844][T23724] ? ret_from_fork_asm+0x1a/0x30 [ 1143.760849][T23724] __warn+0x315/0x4c0 [ 1143.764890][T23724] ? cleanup_srcu_struct+0x3d6/0x8b0 [ 1143.770236][T23724] ? cleanup_srcu_struct+0x3d6/0x8b0 [ 1143.775575][T23724] __report_bug+0x276/0x570 [ 1143.780222][T23724] ? cleanup_srcu_struct+0x3d6/0x8b0 [ 1143.785559][T23724] ? __pfx___report_bug+0x10/0x10 [ 1143.790645][T23724] ? irqentry_exit+0x218/0x910 [ 1143.795458][T23724] ? lockdep_hardirqs_on+0x7b/0x110 [ 1143.800710][T23724] ? irqentry_exit+0x218/0x910 [ 1143.805524][T23724] ? trace_irq_disable+0x3b/0x140 [ 1143.810592][T23724] ? cleanup_srcu_struct+0x3d6/0x8b0 [ 1143.815911][T23724] report_bug+0x16b/0x220 [ 1143.820640][T23724] ? cleanup_srcu_struct+0x3d6/0x8b0 [ 1143.825964][T23724] ? cleanup_srcu_struct+0x3d8/0x8b0 [ 1143.831284][T23724] handle_bug+0x9c/0x200 [ 1143.835583][T23724] exc_invalid_op+0x1a/0x50 [ 1143.840131][T23724] asm_exc_invalid_op+0x1a/0x20 [ 1143.845029][T23724] RIP: 0010:cleanup_srcu_struct+0x3d6/0x8b0 [ 1143.850968][T23724] Code: 05 8c 00 48 83 7d 00 00 4c 8b 74 24 10 0f 85 dd 03 00 00 41 ff c5 41 83 e5 0f 41 83 fd 07 0f 86 e2 fe ff ff e9 ab 00 00 00 90 <0f> 0b 90 4c 8d b5 00 02 00 00 4c 89 f3 48 c1 eb 03 48 b8 00 00 00 [ 1143.870610][T23724] RSP: 0018:ffffc900073679d0 EFLAGS: 00010206 [ 1143.876720][T23724] RAX: 1ffffd1ffff8243d RBX: 0000607edaf4c100 RCX: dffffc0000000000 [ 1143.884731][T23724] RDX: 0000000000000001 RSI: ffffffff8e417513 RDI: 00000000ffffffff [ 1143.892751][T23724] RBP: ffffe8ffffc12100 R08: ffffffff907a687f R09: 1ffffffff20f4d0f [ 1143.900775][T23724] R10: dffffc0000000000 R11: fffffbfff20f4d10 R12: ffff88802696f000 [ 1143.908792][T23724] R13: 0000000000000000 R14: ffffe8ffffc121e8 R15: 1ffffffff1cdd3de [ 1143.916882][T23724] blk_mq_free_tag_set+0x617/0x790 [ 1143.922099][T23724] ? process_scheduled_works+0x97a/0x1630 [ 1143.927868][T23724] nbd_dev_remove_work+0x4f/0xe0 [ 1143.932860][T23724] process_scheduled_works+0xc3d/0x1630 [ 1143.938840][T23724] ? __pfx_process_scheduled_works+0x10/0x10 [ 1143.944873][T23724] ? assign_work+0x3cf/0x5d0 [ 1143.949519][T23724] worker_thread+0xa47/0xfb0 [ 1143.954175][T23724] ? __kthread_parkme+0x71/0x1f0 [ 1143.959213][T23724] kthread+0x38b/0x480 [ 1143.963317][T23724] ? __pfx_worker_thread+0x10/0x10 [ 1143.968468][T23724] ? __pfx_kthread+0x10/0x10 [ 1143.973100][T23724] ret_from_fork+0x514/0xb70 [ 1143.977735][T23724] ? __pfx_ret_from_fork+0x10/0x10 [ 1143.982886][T23724] ? __switch_to+0xc89/0x1420 [ 1143.987788][T23724] ? __pfx_kthread+0x10/0x10 [ 1143.992419][T23724] ret_from_fork_asm+0x1a/0x30 [ 1143.997256][T23724] [ 1144.000567][T23724] Kernel Offset: disabled [ 1144.004932][T23724] Rebooting in 86400 seconds..