last executing test programs: 4.649742991s ago: executing program 1 (id=12783): bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000600)=ANY=[@ANYBLOB="9feb0100180000000000000040000000400000000200000000000000000000060400000000000000000000010500000008000000000000000000000300000000010000000200000004000000000000000000000b"], 0x0, 0x5a}, 0x28) sendmsg$NFNL_MSG_CTHELPER_NEW(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)={0x34, 0x0, 0x9, 0x801, 0x0, 0x0, {0x0, 0x0, 0x5}, [@NFCTH_PRIV_DATA_LEN={0x8, 0x5, 0x1, 0x0, 0x1c}, @NFCTH_NAME={0x9, 0x1, 'syz1\x00'}, @NFCTH_POLICY={0xc, 0x4, 0x0, 0x1, {0x7, 0x1, 0x1, 0x0, 0x3}}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x2000000) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="3400000040000701fcffffff00000100017c0000040042800c00018006000600800e0000100002800c0017"], 0x34}, 0x1, 0x0, 0x0, 0x4048011}, 0x8800) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000040)={0x0, @in={{0x2, 0x4e22, @remote}}, 0x9, 0xfff8, 0x81, 0x3, 0x40, 0x4, 0x3}, &(0x7f0000000100)=0x9c) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000180)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000040)={{r5}, &(0x7f0000000280), &(0x7f0000000240)=r2}, 0x20) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x10, &(0x7f0000000bc0)=ANY=[@ANYBLOB="1808000000000000000000000000000018120000", @ANYRES32=r5, @ANYBLOB="0000000000000000b703000000000000850000000c000000b7000000000000001801000000082c2500000000002120207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000700000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r3, 0x1, 0x32, &(0x7f00000000c0)=r6, 0x4) sendmsg$inet(r4, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f00000001c0)={0x2, [0x0, 0x0]}, &(0x7f0000000200)=0xc) getsockopt$inet_sctp_SCTP_STATUS(0xffffffffffffffff, 0x84, 0xe, &(0x7f0000000300)={r1, 0x5, 0x2, 0x0, 0x5724, 0x575a, 0x1, 0xfffffff4, {r7, @in={{0x2, 0x4e20, @multicast2}}, 0x3, 0x5, 0x200, 0x6bd1, 0x5}}, &(0x7f0000000240)=0xb0) 4.589302633s ago: executing program 0 (id=12786): syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) listen(0xffffffffffffffff, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r0, 0x10e, 0x1, &(0x7f0000000a80)=0x1, 0x4) r1 = socket$inet6(0xa, 0x3, 0x88) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) 4.474421027s ago: executing program 1 (id=12787): ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x0) sendmsg$IPVS_CMD_DEL_DEST(0xffffffffffffffff, &(0x7f0000000a00)={&(0x7f0000000840)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000009c0)={&(0x7f00000008c0)={0xe0, 0x0, 0x20, 0x70bd2d, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x401}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0xfffffffc}, @IPVS_CMD_ATTR_DAEMON={0x48, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0xc7}, @IPVS_DAEMON_ATTR_STATE={0x8}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @private2}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x7}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x6}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x34, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x3}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x85}, @IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0x2}, @IPVS_DEST_ATTR_INACT_CONNS={0x8}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x6, 0xb, 0xa}, @IPVS_DEST_ATTR_INACT_CONNS={0x8}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e22}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x6}]}, @IPVS_CMD_ATTR_DAEMON={0x24, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e23}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e23}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x2}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @local}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x3}]}, 0xe0}, 0x1, 0x0, 0x0, 0x8010}, 0x0) r0 = socket$kcm(0xa, 0x5, 0x0) sendmsg$kcm(r0, &(0x7f0000002dc0)={&(0x7f0000001640)=@l2tp6={0xa, 0x0, 0x7fff, @local, 0x8}, 0xbd, &(0x7f0000000340)=[{&(0x7f00000003c0)='`', 0x1}], 0x1}, 0x41) ioctl$sock_kcm_SIOCKCMUNATTACH(r0, 0x89e1, &(0x7f0000000b40)={r0}) recvmsg(r0, &(0x7f0000000800)={&(0x7f0000000100)=@nl=@proc, 0x80, &(0x7f0000000740)=[{&(0x7f0000000080)=""/39, 0x27}, {&(0x7f00000016c0)=""/4096, 0x1000}, {&(0x7f0000000280)=""/175, 0xaf}, {&(0x7f0000000200)=""/55, 0x37}, {&(0x7f0000000400)=""/208, 0xd0}, {&(0x7f0000000380)=""/40, 0x28}, {&(0x7f0000002e00)=""/4096, 0x1000}, {&(0x7f0000000500)=""/237, 0xed}, {&(0x7f0000000600)=""/148, 0x94}], 0x9, &(0x7f00000006c0)=""/45, 0x2d}, 0x0) setsockopt$sock_attach_bpf(r0, 0x84, 0x1e, &(0x7f0000000000), 0x4) socket$inet(0x2, 0x3, 0x100) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=@newlink={0x28, 0x10, 0x1, 0x70bd25, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, 0x6293a, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x40845}, 0x4000000) socket$tipc(0x1e, 0x5, 0x0) socket$xdp(0x2c, 0x3, 0x0) unshare(0x22020400) pselect6(0x40, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x800, 0x0, 0x100000, 0x20000000000000}, 0x0, &(0x7f0000000240)={0x1f, 0xfffffffffffffffd, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x6a9}, &(0x7f0000000280), 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000700)=ANY=[@ANYBLOB="9feb0100180000000000000040000000400000000200000000000000000000090400000000000000000000010500000008000000000000"], 0x0, 0x5a}, 0x28) r2 = socket$kcm(0x2, 0x3, 0x2) sendmsg$IPCTNL_MSG_TIMEOUT_NEW(0xffffffffffffffff, &(0x7f0000000b00)={&(0x7f0000000a40)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000ac0)={&(0x7f0000000a80)={0x38, 0x0, 0x8, 0x101, 0x0, 0x0, {0x9dbf829ad0ced961, 0x0, 0xa}, [@CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x88}, @CTA_TIMEOUT_NAME={0x9, 0x1, 'syz1\x00'}, @CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x84}, @CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x3a}]}, 0x38}, 0x1, 0x0, 0x0, 0x8400}, 0x24000091) ioctl$SIOCSIFHWADDR(r2, 0x8916, &(0x7f0000000040)={'veth0_to_batadv\x00', @random="0200073bcd1e"}) 4.386981673s ago: executing program 0 (id=12789): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000ac0)=ANY=[@ANYBLOB="3c020000130001002bbd7000bebdf1db4ee58027000000000000000000000001fc010000000000000000000000e5ff0100020000000000000a0040002b000000", @ANYRES32=0x0, @ANYRES32=0xee01, @ANYBLOB="000000000000000000000000000000000600000000000000000000000000000300000000000000000000000000000000000000000000000000000000000000000000000000000000fcffffffffffffff070000000000000000000000000000000000000000000000000000030000000084010500e0000001000000000000000000000000000004d6330000000a000000ffffffff0000000000000000000000000135000003030200040000000900000009000000fc010000000000000000000000000001000004d4320000000a000000e00000020000000000000000000000000335000004015b0005000000080000000000000000000000000000000000000000000000000004d62b00000002000000ac1e000100000000000000000000000003350000010201000a0000000008000082fb000000000000000000000000000000000001000004d6320000000a000000ac1e0101000000000000000000000000000000000102070008000000020000000100000000000000000000000000000000000001000004d4330000000a000000000000000000000000000000000000010735000000020900598600000800000001000000fc020000000000000000000000000000000004d36c0000000a00"], 0x23c}, 0x1, 0x0, 0x0, 0x4010}, 0x4000) 4.306391237s ago: executing program 0 (id=12790): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYBLOB="1c00000046000701fe"], 0x1c}}, 0xc000) sendmsg$nl_route(r0, 0x0, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000000)=ANY=[@ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000ffffffffffffff7ffcffffffffffffff04000000000000000000000000000000fdffffffffffffff00"/62], 0xd8}, 0x1, 0x0, 0x0, 0x40044}, 0x20008004) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000200)={'bond0\x00', 0x0}) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup.cpu/syz1\x00', 0x1ff) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000140)={'gretap0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="500000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="400d0000000040003000128008000100687372002400028008000200", @ANYRES32=r4, @ANYBLOB="08000100", @ANYRES32=r3], 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) 3.394602538s ago: executing program 1 (id=12791): r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000002c0)='blkio.throttle.io_serviced\x00', 0x275a, 0x0) close(0x3) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x275a, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="3000000040000701feffffff00000000047c000004004280140001800600", @ANYRES32=0x0, @ANYBLOB="040008"], 0x30}, 0x1, 0x0, 0x0, 0x48815}, 0xc000) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000540)=ANY=[@ANYBLOB="140000001000040000000000000000000000000a58000000090a01040000000000000000070000000900020073797a31000000000900010073797a3000000000080005400000001c08000a4000000000080003400000005008000f40000000060c000b400200000000000000140000001000010000000000000000000084000a8658c654f734405e935f2d21485dd46483e4d41afddec3e084e38166e8a4bc696c1fc0018f5778f7fd16ed1cae85cbc8f944959058934b0c34bec02b68fd2e0432414ffd3ee1ebbb73b14f4b814d90116dd0af0c2d831c2eefb41b045d3897fc92226ef2217a6f0000000000000000"], 0x80}}, 0x4000000) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r4, &(0x7f0000000280)={&(0x7f0000000400)=@hci, 0x80, &(0x7f0000000500)=[{&(0x7f00000007c0)=""/223, 0xfffffc9b}, {&(0x7f0000000640)=""/114, 0xfe03}], 0x17, 0x0, 0xffffffffffffffa3}, 0x1f00) sendmsg$tipc(r5, &(0x7f0000000240)={0x0, 0xfffffff5, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0xfffffdef}], 0x1}, 0x0) r6 = openat$cgroup_ro(r0, &(0x7f00000003c0)='cpuset.memory_pressure\x00', 0x7a05, 0x1700) write$cgroup_int(r6, &(0x7f0000000200), 0x806000) ioctl$FS_IOC_RESVSP(r6, 0x40305829, &(0x7f0000000380)={0x0, 0x0, 0x4000, 0x9ffffc}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x22052, r0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x200000a, 0xc3072, r1, 0x2fd15000) r7 = socket$inet6(0xa, 0x5, 0x0) setsockopt$sock_int(r7, 0x1, 0x4000000000000002, &(0x7f0000fee000)=0x3fa, 0x4) r8 = socket$unix(0x1, 0x2, 0x0) bind$unix(r8, &(0x7f0000000100)=@abs={0x1, 0x0, 0x4e20}, 0x6e) r9 = socket$unix(0x1, 0x2, 0x0) bind$unix(r9, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r10, &(0x7f0000000300)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) sendmmsg$unix(r10, &(0x7f00000bd000), 0x2d, 0x20040040) connect$unix(r9, &(0x7f0000000180)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) connect$unix(r9, &(0x7f0000000100)=@abs={0x1, 0x0, 0x4e20}, 0x6e) bind$inet6(r7, &(0x7f0000000140)={0xa, 0x4e20, 0x0, @empty}, 0x1c) r11 = socket$inet6(0xa, 0x5, 0x8001) bind$inet6(r11, &(0x7f0000000080)={0xa, 0x4e20, 0x9, @ipv4={'\x00', '\xff\xff', @empty}, 0x1000d}, 0x1c) listen(r7, 0x5) 3.016686411s ago: executing program 2 (id=12798): r0 = socket$inet6(0xa, 0x2, 0x0) clock_gettime(0x3, &(0x7f0000002000)={0x0, 0x0}) setsockopt$sock_timeval(r0, 0x1, 0x42, &(0x7f0000002040)={r1, r2/1000+60000}, 0x10) recvmmsg(r0, &(0x7f0000000040), 0x400000000000284, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x13, &(0x7f0000000080)=ANY=[@ANYBLOB="180800001bc81a000000000000000001851000000600000018000000", @ANYRES32, @ANYBLOB="00000000000000006608000000000101180000000000000000000000000000009500000000000000360a000000000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000e500010000000000850000000600000095"], &(0x7f0000000000)='GPL\x00', 0x2}, 0x94) 2.89929275s ago: executing program 2 (id=12801): r0 = socket$inet6(0xa, 0x2, 0x0) close(0x3) bpf$ENABLE_STATS(0x20, 0x0, 0x0) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x1f, 0x10, &(0x7f0000000280)=ANY=[@ANYBLOB="18000000000000000000000004000000b7080000000000007baaf8ff00000000b5080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb738565be1e90200000800000018230000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70500000800000085000000a70000009500000000000000"], &(0x7f0000000240)='syzkaller\x00', 0x8, 0x0, 0x0, 0x40f00, 0x73, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000200)={r2}, 0xc) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000080)={'wlan1\x00', 0x0}) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001380)={0x10, 0x3, &(0x7f0000000080)=@framed, &(0x7f00000000c0)='GPL\x00', 0x3}, 0x94) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000001800)={@cgroup, r5, 0x7}, 0x14) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_CQM(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000140)={0x34, r6, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_CQM={0x18, 0x5e, 0x0, 0x1, [@NL80211_ATTR_CQM_RSSI_THOLD={0x4}, @NL80211_ATTR_CQM_TXE_RATE={0x8, 0x5, 0x2a}, @NL80211_ATTR_CQM_TXE_PKTS={0x8}]}]}, 0x34}, 0x1, 0x0, 0x0, 0x8001}, 0x0) r7 = socket$l2tp6(0xa, 0x2, 0x73) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r8, &(0x7f0000000000)=[{&(0x7f00000001c0)="087e19", 0x3}], 0x1, 0x0) close(0x3) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x3, 0x20000000ec071, 0xffffffffffffffff, 0x0) close(0x4) r9 = socket$netlink(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB="3800000002011d040000000000000000020000002400018014000180080001"], 0x38}}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x8, &(0x7f0000000500)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3}, [@jmp={0x5, 0x0, 0x0, 0x0, 0x0, 0x2}, @alu={0x7}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x2}, @jmp={0x5, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc}]}, &(0x7f00000004c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r7, 0x29, 0x20, &(0x7f0000000080)={@remote, 0x800, 0x0, 0x3, 0x1, 0x8}, 0x20) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f0000000040)=0x2005, 0x4) r10 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000000)={'veth0\x00', 0x0}) r12 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r12, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@ipv4_deladdr={0x2c, 0x15, 0x1, 0xfffffffd, 0x25dfdbfc, {0x2, 0x18, 0x0, 0x7e, r11}, [@IFA_LABEL={0x14, 0x3, 'macsec0\x00'}]}, 0x2c}}, 0x0) r13 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000180)=0xffffffffffffffff, 0x4) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB="02000000043419000800000001000000800000003532665a7da0eafec41b081455d466c20d2780df43f5ebf0a4bd7754f367fa3cabb422729817f81f89b13074e76fc176a3e9b00a", @ANYRES32=0x1, @ANYBLOB="01feffff00"/20, @ANYRES32=r11, @ANYRES32=r13, @ANYBLOB="00000000040000000500"/28], 0x50) 2.483511289s ago: executing program 1 (id=12802): socket$nl_xfrm(0x10, 0x3, 0x6) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_FEATURES_SET(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={0x0, 0x434}, 0x1, 0x0, 0x0, 0x4040800}, 0x0) socket$netlink(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = syz_genetlink_get_family_id$tipc2(0x0, 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_LINK_GET(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000700)=ANY=[@ANYRES16=r2, @ANYBLOB="030700000000000000000800000068000480040007"], 0x7c}}, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=@bridge_delneigh={0x28, 0x1c, 0x1, 0x4, 0x0, {0x7, 0x0, 0x0, r4, 0x80, 0xf2, 0x4}, [@NDA_LLADDR={0xa, 0x2, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1b}}]}, 0x28}, 0x1, 0x1000000}, 0x0) syz_init_net_socket$netrom(0x6, 0x5, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0x7, 0x0, 0x0) 2.481646647s ago: executing program 1 (id=12803): syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NLBL_CALIPSO_C_REMOVE(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x3c, r1, 0x300, 0x70bd28, 0x25dfdbff, {}, [@NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_DOI={0x8}]}, 0x3c}}, 0x40000) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000140), r0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000640)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000600)={&(0x7f00000001c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x7}}, [@NFT_MSG_DELSETELEM={0x3ec, 0xe, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_SET_ID={0x8, 0x4, 0x1, 0x0, 0x1}, @NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x3ac, 0x3, 0x0, 0x1, [{0x26c, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_EXPIRATION={0xc, 0x5, 0x1, 0x0, 0x7}, @NFTA_SET_ELEM_FLAGS={0x8}, @NFTA_SET_ELEM_EXPIRATION={0xc, 0x5, 0x1, 0x0, 0x6}, @NFTA_SET_ELEM_EXPIRATION={0xc, 0x5, 0x1, 0x0, 0x7}, @NFTA_SET_ELEM_EXPR={0x94, 0x7, 0x0, 0x1, @bitwise={{0xc}, @val={0x84, 0x2, 0x0, 0x1, [@NFTA_BITWISE_XOR={0x80, 0x5, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x30, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}]}, @NFTA_DATA_VALUE={0x3c, 0x1, "b5ca93239c077239fb6d6d8ecac74737611bb16780b78936182e9a95b90367cf050fcd1561ea1cb04d6e0d9e6440662afb3bf4b16a92f194"}, @NFTA_DATA_VERDICT={0x10, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}]}]}]}}}, @NFTA_SET_ELEM_DATA={0x1a8, 0x2, 0x0, 0x1, [@NFTA_DATA_VALUE={0xe5, 0x1, "5976506aaaa469f9a6d57fca5f79446031e0ccb4fe7e751699ff4b475fea4d5d6c1a140028be8516e823c9e246199d3a80a166a5341021366bcc6abb25c468abae815407c7d017c81170607975f1253368d93e66ff4db420fa43989ddb6737f674b7b7af9d42e7320471d2a7b5f88ac0dd2e01897235508d8d3cadbd6b1ec2ae19295e076eb9928d2899ec2b779be8ca2a46aca77d57be47c8c7108f8af75b6e17d74ede156b89fc30c8e9e4b5173efc75ea9289de68d3e9181e472d260d8ca678e2a21d7cc19e0b9bb2de5db29b024b29e4b2ef4cae076e20c461db809503062a"}, @NFTA_DATA_VALUE={0xae, 0x1, "390b58f68da84999138f61dd797a8a71dbed74eaff6a78bc7fc5cdb80eeb91ee312baca31d5396a962f7373b0e5576a7ff950226c88bef6c26722b34e44e34b5e62e0297fc36b79fc0a9844dca8c4e7d8a052c94c33537681491356b197eaaff6c7694d111c8d3c98406b75f70cf11df86343d82878ff3f1ff949c6194bd9251e116dac23662dfd6e584a441b17038baf0237ca6338e515c9ca72159aa140616c2a807b522f276042c4b"}, @NFTA_DATA_VERDICT={0xc, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}]}]}]}, {0x13c, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY_END={0x138, 0xa, 0x0, 0x1, [@NFTA_DATA_VALUE={0x2f, 0x1, "f79453f710390c566df403b37a5da2fa3b1d6ffa12ecae27a4af69354c3047c2d977acd0daec916117f8ff"}, @NFTA_DATA_VALUE={0xc3, 0x1, "bd34cacc6ba32f93e60e7fa4cb5a253774bf64e195d315841f49cc1e0fe98a2da917129589ebca27f204ba8e6323b4350bdf1ccc40f10958fe7cfcf2f4db7f6f4810e3afc1712684113cb9986af5cd9bbc81875d47e432bd42534b6e69c2f772ac512b3c75e11126ef287b7eb05163c184e7251305f5a5768cf9fa896c587b61b423fb56210a14380a865bb408e101d35322df6150601333a9ebe062212121af3d43ff98a46a6ff64fa313ec5eed4d2b8bdc3e0ec78ebb353d818e13c3dbe6"}, @NFTA_DATA_VALUE={0x11, 0x1, "8ff76f12d9583a3232ace5ce6b"}, @NFTA_DATA_VERDICT={0x2c, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}]}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0x414}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) (async) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000640)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000600)={&(0x7f00000001c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x7}}, [@NFT_MSG_DELSETELEM={0x3ec, 0xe, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_SET_ID={0x8, 0x4, 0x1, 0x0, 0x1}, @NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x3ac, 0x3, 0x0, 0x1, [{0x26c, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_EXPIRATION={0xc, 0x5, 0x1, 0x0, 0x7}, @NFTA_SET_ELEM_FLAGS={0x8}, @NFTA_SET_ELEM_EXPIRATION={0xc, 0x5, 0x1, 0x0, 0x6}, @NFTA_SET_ELEM_EXPIRATION={0xc, 0x5, 0x1, 0x0, 0x7}, @NFTA_SET_ELEM_EXPR={0x94, 0x7, 0x0, 0x1, @bitwise={{0xc}, @val={0x84, 0x2, 0x0, 0x1, [@NFTA_BITWISE_XOR={0x80, 0x5, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x30, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}]}, @NFTA_DATA_VALUE={0x3c, 0x1, "b5ca93239c077239fb6d6d8ecac74737611bb16780b78936182e9a95b90367cf050fcd1561ea1cb04d6e0d9e6440662afb3bf4b16a92f194"}, @NFTA_DATA_VERDICT={0x10, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}]}]}]}}}, @NFTA_SET_ELEM_DATA={0x1a8, 0x2, 0x0, 0x1, [@NFTA_DATA_VALUE={0xe5, 0x1, "5976506aaaa469f9a6d57fca5f79446031e0ccb4fe7e751699ff4b475fea4d5d6c1a140028be8516e823c9e246199d3a80a166a5341021366bcc6abb25c468abae815407c7d017c81170607975f1253368d93e66ff4db420fa43989ddb6737f674b7b7af9d42e7320471d2a7b5f88ac0dd2e01897235508d8d3cadbd6b1ec2ae19295e076eb9928d2899ec2b779be8ca2a46aca77d57be47c8c7108f8af75b6e17d74ede156b89fc30c8e9e4b5173efc75ea9289de68d3e9181e472d260d8ca678e2a21d7cc19e0b9bb2de5db29b024b29e4b2ef4cae076e20c461db809503062a"}, @NFTA_DATA_VALUE={0xae, 0x1, "390b58f68da84999138f61dd797a8a71dbed74eaff6a78bc7fc5cdb80eeb91ee312baca31d5396a962f7373b0e5576a7ff950226c88bef6c26722b34e44e34b5e62e0297fc36b79fc0a9844dca8c4e7d8a052c94c33537681491356b197eaaff6c7694d111c8d3c98406b75f70cf11df86343d82878ff3f1ff949c6194bd9251e116dac23662dfd6e584a441b17038baf0237ca6338e515c9ca72159aa140616c2a807b522f276042c4b"}, @NFTA_DATA_VERDICT={0xc, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}]}]}]}, {0x13c, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY_END={0x138, 0xa, 0x0, 0x1, [@NFTA_DATA_VALUE={0x2f, 0x1, "f79453f710390c566df403b37a5da2fa3b1d6ffa12ecae27a4af69354c3047c2d977acd0daec916117f8ff"}, @NFTA_DATA_VALUE={0xc3, 0x1, "bd34cacc6ba32f93e60e7fa4cb5a253774bf64e195d315841f49cc1e0fe98a2da917129589ebca27f204ba8e6323b4350bdf1ccc40f10958fe7cfcf2f4db7f6f4810e3afc1712684113cb9986af5cd9bbc81875d47e432bd42534b6e69c2f772ac512b3c75e11126ef287b7eb05163c184e7251305f5a5768cf9fa896c587b61b423fb56210a14380a865bb408e101d35322df6150601333a9ebe062212121af3d43ff98a46a6ff64fa313ec5eed4d2b8bdc3e0ec78ebb353d818e13c3dbe6"}, @NFTA_DATA_VALUE={0x11, 0x1, "8ff76f12d9583a3232ace5ce6b"}, @NFTA_DATA_VERDICT={0x2c, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}]}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0x414}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) syz_genetlink_get_family_id$net_dm(&(0x7f00000006c0), r0) (async) r2 = syz_genetlink_get_family_id$net_dm(&(0x7f00000006c0), r0) sendmsg$NET_DM_CMD_START(r0, &(0x7f0000000780)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000740)={&(0x7f0000000700)={0x14, r2, 0x400, 0x70bd26, 0x25dfdbff, {}, ["", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x20000000}, 0x40800) r3 = accept4$ax25(0xffffffffffffffff, &(0x7f00000007c0)={{0x3, @netrom}, [@bcast, @netrom, @remote, @remote, @remote, @rose, @netrom, @rose]}, &(0x7f0000000840)=0x48, 0x40800) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f0000000880)={'pim6reg\x00', 0x2000}) (async) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f0000000880)={'pim6reg\x00', 0x2000}) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f00000008c0)={r3}) (async) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f00000008c0)={r3}) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000900)={0x0, 0x19, "d7ed785e58d9c16fe6c84d6331b8ed8155d0a8af9425b53f1d"}, &(0x7f0000000940)=0x21) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r4, 0x84, 0x66, &(0x7f0000000980)={r5, 0x8}, &(0x7f00000009c0)=0x8) (async) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r4, 0x84, 0x66, &(0x7f0000000980)={r5, 0x8}, &(0x7f00000009c0)=0x8) setsockopt(r4, 0x4, 0x9, &(0x7f0000000a00)="c1259de46307d34ac86f5a1fd19c08cf8b837c4871ad4b61300f0a2ec3751bbab064f621a31cf6a6b065fa39db455b04fc1269b2d3969d563aa513dc7ed956715dc2310c008a5833fd83c3f0db3a9ece5f4de6d39d9bcfbf161833a234cb6f57fd001e382331ee53460c0307455853497f63a8edad5faf504ad4aba82f0ade6ddb6633b6853d5f39cda0063d72d6cc759a22fe8f06c89aca604e9125c26cbc2b863eb4a898d23bf480175f87bc6b008a3251d6005d16f5cf2a4a8510a4ab997a27", 0xc1) r6 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000b40), r0) sendmsg$IEEE802154_LLSEC_LIST_DEVKEY(r0, &(0x7f0000000c00)={&(0x7f0000000b00)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000bc0)={&(0x7f0000000b80)={0x14, r6, 0x10, 0x70bd29, 0x25dfdbfb, {}, ["", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x4000000}, 0x10) r7 = syz_genetlink_get_family_id$team(&(0x7f0000000c80), r4) ioctl$ifreq_SIOCGIFINDEX_team(r4, 0x8933, &(0x7f0000000cc0)) (async) ioctl$ifreq_SIOCGIFINDEX_team(r4, 0x8933, &(0x7f0000000cc0)={'team0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000d00)={'veth1_to_hsr\x00', 0x0}) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r4, 0x89f2, &(0x7f0000000e00)={'tunl0\x00', &(0x7f0000000d40)={'sit0\x00', 0x0, 0x10, 0x8000, 0xffffff01, 0x2, {{0x1f, 0x4, 0x3, 0x20, 0x7c, 0x65, 0x0, 0x9e, 0x4, 0x0, @multicast2, @local, {[@generic={0x44, 0x10, "7e593ae442a7c5b1102e11e40499"}, @ra={0x94, 0x4}, @cipso={0x86, 0x3c, 0x2, [{0x5, 0x5, "799217"}, {0x5, 0xa, "846ebea7b37dea5e"}, {0x6, 0xa, "d92abe1c87569229"}, {0x5, 0xe, "6e8480ce249ffe04107acdae"}, {0x2, 0xc, "a5965c0f223f44f0c6f1"}, {0x5, 0x3, "19"}]}, @ra={0x94, 0x4}, @noop, @cipso={0x86, 0x11, 0x1, [{0x7, 0x2}, {0x1, 0x9, "1af8a6975704c8"}]}, @noop]}}}}}) (async) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r4, 0x89f2, &(0x7f0000000e00)={'tunl0\x00', &(0x7f0000000d40)={'sit0\x00', 0x0, 0x10, 0x8000, 0xffffff01, 0x2, {{0x1f, 0x4, 0x3, 0x20, 0x7c, 0x65, 0x0, 0x9e, 0x4, 0x0, @multicast2, @local, {[@generic={0x44, 0x10, "7e593ae442a7c5b1102e11e40499"}, @ra={0x94, 0x4}, @cipso={0x86, 0x3c, 0x2, [{0x5, 0x5, "799217"}, {0x5, 0xa, "846ebea7b37dea5e"}, {0x6, 0xa, "d92abe1c87569229"}, {0x5, 0xe, "6e8480ce249ffe04107acdae"}, {0x2, 0xc, "a5965c0f223f44f0c6f1"}, {0x5, 0x3, "19"}]}, @ra={0x94, 0x4}, @noop, @cipso={0x86, 0x11, 0x1, [{0x7, 0x2}, {0x1, 0x9, "1af8a6975704c8"}]}, @noop]}}}}}) sendmsg$TEAM_CMD_OPTIONS_GET(r4, &(0x7f0000000f80)={&(0x7f0000000c40)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000f40)={&(0x7f0000000e40)={0xe8, r7, 0x400, 0x70bd27, 0x25dfdbff, {}, [{{0x8, 0x1, r8}, {0xcc, 0x2, 0x0, 0x1, [{0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x100}}, {0x8, 0x6, r9}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r10}}}, {0x4c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x19, 0x4, 'hash_to_port_mapping\x00'}}}]}}]}, 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x8080) setsockopt$inet6_icmp_ICMP_FILTER(r4, 0x1, 0x1, &(0x7f0000000fc0)={0x6}, 0x4) r11 = syz_genetlink_get_family_id$nl802154(&(0x7f0000001040), r0) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000001080)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_SET_PAN_ID(r0, &(0x7f0000001180)={&(0x7f0000001000)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000001140)={&(0x7f00000010c0)={0x68, r11, 0x800, 0x70bd2c, 0x25dfdbfb, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r12}, @NL802154_ATTR_PAN_ID={0x6}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_PAN_ID={0x6, 0x9, 0x2}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x68}, 0x1, 0x0, 0x0, 0x11}, 0xc0) (async) sendmsg$NL802154_CMD_SET_PAN_ID(r0, &(0x7f0000001180)={&(0x7f0000001000)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000001140)={&(0x7f00000010c0)={0x68, r11, 0x800, 0x70bd2c, 0x25dfdbfb, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r12}, @NL802154_ATTR_PAN_ID={0x6}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_PAN_ID={0x6, 0x9, 0x2}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x68}, 0x1, 0x0, 0x0, 0x11}, 0xc0) setsockopt$inet_sctp_SCTP_EVENTS(r4, 0x84, 0xb, &(0x7f00000011c0)={0x2, 0x6, 0xb9, 0xf7, 0x2, 0x0, 0x8, 0xa7, 0x0, 0x6, 0xdc, 0x6, 0x10, 0x5}, 0xe) recvfrom$inet6(r4, &(0x7f0000001200)=""/110, 0x6e, 0x20020, &(0x7f0000001280)={0xa, 0x4e21, 0x3, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x1}, 0x1c) (async) recvfrom$inet6(r4, &(0x7f0000001200)=""/110, 0x6e, 0x20020, &(0x7f0000001280)={0xa, 0x4e21, 0x3, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x1}, 0x1c) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000012c0)={'wlan1\x00'}) r13 = accept$phonet_pipe(r4, &(0x7f0000001300), &(0x7f0000001340)=0x10) ioctl$sock_SIOCINQ(r13, 0x541b, &(0x7f0000001380)) 1.475538434s ago: executing program 1 (id=12804): r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETRULE(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000680)=ANY=[@ANYBLOB="2c000000190a01010000000000000000000000000900010073"], 0x2c}}, 0x8004) close(0x4) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x11, 0x13, &(0x7f0000000300)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x22}, {{0x18, 0x1, 0x1, 0x0, 0x1}}, {}, [@btf_id={0x18, 0x8, 0x3, 0x0, 0x5}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000240)='GPL\x00', 0x9, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000280)={0x7, 0x2}, 0x8, 0x10, &(0x7f00000003c0)={0x1, 0x7, 0xdb2e, 0x56e}, 0x10, 0x0, 0x0, 0x2, &(0x7f0000000400)=[r0, 0x1, 0x1, 0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x1, 0x1], &(0x7f0000000440)=[{0x5, 0x5, 0xf, 0x2}, {0x1, 0x1, 0x10, 0x2}], 0x10, 0x1000}, 0x94) ioctl$F2FS_IOC_MOVE_RANGE(r2, 0xc020f509, &(0x7f0000000540)={r0, 0x1, 0x3, 0xffffffffffffffff}) r3 = syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/pid_for_children\x00') unshare(0x6a040000) ioctl$BTRFS_IOC_DEFRAG(r3, 0x50009402, 0x0) r4 = socket$inet6(0xa, 0x80002, 0x0) r5 = socket$inet_udp(0x2, 0x2, 0x0) unshare(0x40000480) setsockopt$SO_TIMESTAMPING(r5, 0x1, 0x25, &(0x7f00000001c0)=0x6533, 0x4) connect$inet(r5, &(0x7f00000002c0)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) sendmmsg(r5, &(0x7f0000007fc0), 0x800001d, 0x0) setsockopt$sock_int(r5, 0x1, 0x29, &(0x7f0000000000)=0x7b, 0x4) recvfrom$inet(r5, 0x0, 0x0, 0x2043, 0x0, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r6 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r6, 0x0, 0x487, &(0x7f0000002100), &(0x7f0000000000)=0x30) connect$inet6(r4, &(0x7f0000002140)={0xa, 0x4e25, 0x1, @mcast2, 0x7}, 0x1c) sendmmsg$inet6(r4, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}}], 0x400000000000172, 0x4001c00) r7 = socket(0x10, 0x3, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r5, 0x89f1, &(0x7f0000000180)={'gre0\x00', &(0x7f0000000040)={'erspan0\x00', 0x0, 0x7800, 0x1, 0x3, 0x6, {{0x40, 0x4, 0x1, 0xa, 0x100, 0x64, 0x0, 0xc, 0x29, 0x0, @remote, @multicast1, {[@ssrr={0x89, 0xb, 0x63, [@initdev={0xac, 0x1e, 0x1, 0x0}, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @timestamp_addr={0x44, 0x34, 0x4a, 0x1, 0x6, [{@local, 0x6}, {@dev={0xac, 0x14, 0x14, 0x1c}, 0xc8f}, {@multicast1, 0xff}, {@broadcast, 0x2}, {@remote, 0xc}, {@multicast2, 0x8}]}, @noop, @timestamp={0x44, 0x1c, 0xb7, 0x0, 0x5, [0x0, 0xffffffff, 0x8, 0x43, 0x80000001, 0x7fffffff]}, @lsrr={0x83, 0x17, 0xf, [@dev={0xac, 0x14, 0x14, 0x30}, @broadcast, @initdev={0xac, 0x1e, 0x0, 0x0}, @private=0xa010101, @dev={0xac, 0x14, 0x14, 0x30}]}, @generic={0x44, 0x10, "a263b6b846a853be63b19e5adc89"}, @timestamp_addr={0x44, 0x54, 0xaf, 0x1, 0x8, [{@multicast1, 0x3ff}, {@rand_addr=0x64010101, 0xfffffffa}, {@remote, 0xe}, {@remote, 0x8001}, {@broadcast, 0x4}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x3}, {@multicast2, 0x800}, {@loopback}, {@rand_addr=0x64010102, 0x9}, {@multicast2, 0xc}]}, @ssrr={0x89, 0x13, 0x4, [@private=0xa010101, @multicast1, @loopback, @remote]}]}}}}}) sendmsg$nl_route(r7, 0x0, 0x0) 1.471855609s ago: executing program 2 (id=12807): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x3, 0xc, &(0x7f0000000340)=ANY=[@ANYBLOB="180000000000000000000000000000008500000061000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000009b00000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000004c0)={r0, 0x1f2f, 0x14, 0x0, &(0x7f0000000440)="9f449470fe919559684010a408002d7a5d4153f0", 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, 0x0, 0x0) unshare(0x4020400) (async) unshare(0x4020400) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000140)={r1, &(0x7f0000000080)="c47377ee998cba9f1e8abecaaedcbb30f73e4c466652be36045199cc753a2eb29e7a37dae5a3bc18b44f2241d96c02c7bfdb6205aa33d7b940b74d663f245efd1eebf9596d4d4bc9863161ef542b479687e2e6f849d860a1c61c608cc46f6d5b0ec65e0a8f8c5081b7f36d019d67f9e42a981e463fd1f8ffa1bd7908c57192", &(0x7f0000000100)=""/27}, 0x20) socket$kcm(0x10, 0x2, 0x0) (async) r2 = socket$kcm(0x10, 0x2, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="08000000040000000400000004"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000fcffffff7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000025000000180100002020732500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000001000000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) (async) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000fcffffff7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000025000000180100002020732500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000001000000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000640)={r4}, 0x70) sendmsg$kcm(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000001340)=[{&(0x7f00000001c0)="2e00000010008188040f46ecdb4cb9cca7480ef40f000000e3bd6efb010509000b000a000d000000ba8000001201", 0x2e}], 0x336, 0x0, 0x0, 0xc9e}, 0x600) 1.467135669s ago: executing program 0 (id=12808): openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='cpuacct.usage_percpu\x00', 0x0, 0x0) (async, rerun: 64) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={0xffffffffffffffff, 0x18000000000002a0, 0x6, 0x0, &(0x7f0000000000)="b9fd03076804", 0x0, 0x40400, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000}, 0x50) (async, rerun: 64) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-serpent-avx\x00'}, 0x58) (async) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept4(r0, 0x0, 0x0, 0x0) setsockopt$sock_int(r1, 0x1, 0x7, &(0x7f00000014c0)=0x10000b, 0x4) (async) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x3}], 0x1, 0x40800) (async, rerun: 64) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000340)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000300)={0x0}, 0x1, 0x0, 0x0, 0x4004000}, 0x20) (async, rerun: 64) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x20f42, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000140)={'nr0\x00', 0x200}) (async) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0xfe3a) 1.267159964s ago: executing program 3 (id=12810): syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) listen(0xffffffffffffffff, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r0, 0x10e, 0x1, &(0x7f0000000a80)=0x1, 0x4) r1 = socket$inet6(0xa, 0x3, 0x88) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000980)={{{@in=@multicast1, @in6=@remote, 0x4e1f, 0x0, 0x0, 0x3, 0x2}, {0x10000, 0x200000004, 0x40000000007, 0x6811221d, 0x100000000, 0x4, 0x200000003, 0x9}, {0x5, 0xfffffffffffffffd, 0x7}, 0x1, 0x0, 0x1, 0x0, 0x6}, {{@in=@empty, 0x0, 0x6c}, 0xa, @in=@empty, 0x3502, 0x1, 0x0, 0x0, 0x9, 0x3}}, 0xe8) connect$inet6(r1, 0x0, 0x0) 1.266630661s ago: executing program 2 (id=12811): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)=ANY=[@ANYBLOB="2c0000861900090027bd700000000000040000001800180000244a743ff533aa09e701000000000000000000"], 0x2c}, 0x1, 0x0, 0x0, 0x42804}, 0x0) 1.266439193s ago: executing program 0 (id=12812): r0 = socket$packet(0x11, 0x2, 0x300) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1801000011000000000000000000000018120000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa20000000000000702"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=@framed={{0x18, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x8000}, [@call={0x85, 0x0, 0x0, 0x75}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000000180)=r2, 0x4) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x700, &(0x7f0000000040)={&(0x7f0000000480)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000010000000900010073797a300000000040000000030a01020000000000000000010000000900010073797a30000000000900030073797a3000000000140004800800024000000000080001400000000568000000060a010400000008000000000100000008000b4000000000400004803c0001800a0001006d617463680000002c0002800800010065636e000c000300e4edf2b75cc7c0a308000240000000000c000100706b7474797065000900010073797a3000000000"], 0xf0}}, 0x0) 1.216651157s ago: executing program 4 (id=12813): socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0f000000040000000400000002"], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r1, 0xffffffffffffffff}, &(0x7f0000000040), &(0x7f0000000140)=r0}, 0x20) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x11, 0xc, &(0x7f0000000100)=@framed={{0x18, 0x0, 0x0, 0x0, 0x7ffb, 0x0, 0x0, 0x0, 0x3}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r2}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x20}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x3}}]}, &(0x7f00000008c0)='syzkaller\x00', 0x4, 0xff8, &(0x7f0000000dc0)=""/4088}, 0x94) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="200000001000030429"], 0x20}, 0x1, 0x0, 0x0, 0x4802}, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000002c0)={[{0x2b, 'rdma'}, {0x2d, 'perf_event'}, {0x0, 'cpuset'}]}, 0x1a) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0xb, &(0x7f0000000000)=ANY=[@ANYRES16=r0], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x53c}, 0x94) setsockopt$sock_attach_bpf(r3, 0x1, 0x32, &(0x7f0000000180)=r4, 0x4) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) r7 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$sock_linger(r7, 0x1, 0xd, &(0x7f00000000c0)={0x60001}, 0x8) bind$bt_sco(r7, &(0x7f0000000400), 0x8) listen(r7, 0x0) shutdown(r7, 0x0) sendmsg$IPSET_CMD_CREATE(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x58, 0x2, 0x6, 0x3, 0xe4340000, 0x0, {0xa}, [@IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:ip,port\x00'}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_NETMASK={0x5, 0x14, 0xa9}]}]}, 0x58}}, 0x40040c2) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) socket$nl_route(0x10, 0x3, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) r9 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r9, &(0x7f00000000c0), 0x10) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYRES16=r9], 0x448}}, 0x0) sendmsg$can_bcm(r9, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=ANY=[@ANYBLOB="050000000808"], 0x80}}, 0x0) sendmmsg$inet(r9, &(0x7f0000001b00)=[{{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000080)="050000007402b8f4191db62b", 0xc}, {&(0x7f0000000440)="9f336d70bf41f19e47e98b4015e3b0384d86a1ceb4e530554ebc8154bf392bcf9ce0b09f879bd7aaf9d086e3", 0x2c}], 0x2}}, {{0x0, 0x0, &(0x7f0000000100), 0x2}}], 0x40000000000003a, 0x0) sendmsg$NL80211_CMD_NEW_INTERFACE(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="090d2000000000f0ff000700000008000300", @ANYRES32=r8, @ANYBLOB="0800051d000000001400060076657468115f746f5f7465616d0000000400cc00080005000900000014000400"], 0x58}, 0x1, 0x0, 0x0, 0x40000}, 0x0) 1.12761503s ago: executing program 2 (id=12814): socket$kcm(0x29, 0x7, 0x0) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_INITMSG(r0, 0x84, 0x2, &(0x7f00000000c0)={0xfffc, 0xc}, 0x8) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x38, &(0x7f0000000100)=[@in6={0xa, 0x0, 0x0, @loopback, 0xfffffffb}, @in6={0xa, 0x4e22, 0x1, @mcast2, 0xb68}]}, &(0x7f0000000140)=0x10) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r2, 0x107, 0xf, &(0x7f0000000240)=0x2, 0x4) setsockopt$packet_rx_ring(r2, 0x107, 0x5, &(0x7f0000000040)=@req3={0x1000, 0x3a, 0x1000, 0x3a}, 0x1c) socket$inet_udplite(0x2, 0x2, 0x88) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r3, &(0x7f0000000140)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x0, 0x1}, 0xe) setsockopt$bt_BT_DEFER_SETUP(r3, 0x112, 0xf, &(0x7f00000000c0)=0x3, 0x4) setsockopt$packet_int(r2, 0x107, 0x7, &(0x7f00000001c0)=0x7, 0x4) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r5 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r4, &(0x7f0000000080)=ANY=[], 0xfb5) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r6, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r6, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r6, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r6, 0x11a, 0x2, &(0x7f0000000000)=@ccm_128={{0x304}, "b39625e03be22ead", "8da0640c9e8f6b81143f1a1a6d81ee2b", "3b0e7088", "19a4216dfdbf6602"}, 0x28) setsockopt$inet6_tcp_TLS_TX(r6, 0x11a, 0x1, &(0x7f0000000080)=@ccm_128={{0x304}, "b63e4099140223f5", "53c272d8b763f690b35605dff8a4a8d2", "3da2d199", "72392a24199b5903"}, 0x3d) getsockopt$inet_sctp6_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f0000000040)={r1, 0x4, 0xd68, 0x8, 0x5a1, 0x8}, &(0x7f0000000080)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0004001a00080028df250210140600030005800100000000000000"], 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x20000000) 1.080163631s ago: executing program 3 (id=12815): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETGEN(r0, &(0x7f0000000140)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x715a1d57bd348009}, 0xc, &(0x7f00000001c0)={&(0x7f00000000c0)={0x14, 0x10, 0xa, 0x201, 0x0, 0x0, {0x2, 0x0, 0x5}, ["", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x4000004}, 0x4000) sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)={0x1c, 0x2, 0x3, 0x3, 0x0, 0x0, {}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1}}]}, 0x1c}}, 0x0) ioctl$XFS_IOC_START_COMMIT(r0, 0x80585882, &(0x7f0000000280)={0xffffffffffffffff}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000000000000000200000008000300", @ANYRES32=r5, @ANYBLOB="0c00990000000000000000000800a115ffff0000080026008d03000008009f"], 0x40}, 0x1, 0x0, 0x0, 0x20000001}, 0x28040010) sendmsg$NL80211_CMD_STOP_AP(r1, &(0x7f0000000380)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x20, r4, 0x1, 0x70bd26, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0x7, 0x17}}}}, ["", ""]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x800) sendmsg$NFQNL_MSG_VERDICT_BATCH(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000000)={0x20, 0x3, 0x3, 0x101, 0x0, 0x0, {}, [@NFQA_VERDICT_HDR={0xc, 0x2, {0x3, 0xff}}]}, 0x20}, 0x1, 0x0, 0x0, 0x20004000}, 0x4) 1.079105261s ago: executing program 0 (id=12816): socket$packet(0x11, 0x3, 0x300) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000000)=@req3={0x410000, 0x100000001, 0x210000, 0x1, 0xa, 0x0, 0xffffffff}, 0x1c) r1 = socket$inet_tcp(0x2, 0x1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$TOKEN_CREATE(0x24, &(0x7f00000001c0)={0x0, r0}, 0x8) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$inet(r2, 0x0, 0x0) bind$inet(r1, &(0x7f0000000100)={0x2, 0x4e21, @broadcast}, 0x10) connect$inet(r1, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) sendto$inet(r1, &(0x7f0000000000), 0xffffffffffffffaf, 0x4000280, 0x0, 0xffffffffffffffe1) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) unshare(0x2c060000) unshare(0x2c020400) r4 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000004c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, r3, 0x1, 0x8}, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x18, 0x10, &(0x7f0000000600)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000020000007040000f0ffffffb70200000800000018230000", @ANYRES32=r4, @ANYBLOB="0000000000000005b70500000800000085000000a50000009500000000000000"], &(0x7f0000000300)='GPL\x00', 0x8, 0x1006, &(0x7f0000000800)=""/4102}, 0x94) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) write$tun(r5, &(0x7f0000000340)=ANY=[@ANYRESOCT=r5, @ANYBLOB="41bf0359dedeb1c9a2af5381a5e01b0749a78b97f0047d6f64b166f1c4bdd43a558ca6ce35d71616429ddc0de0190ec6fa84fffe5aff637d197bfbc63394a4dc076cb4b826235b5953a530060efd532bd1f87fde32bd", @ANYRESHEX, @ANYRESHEX=r5, @ANYRESOCT=r5], 0x141) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r5, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.sectors\x00', 0x26e1, 0x0) r6 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r6, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r6, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4) connect$inet(r6, &(0x7f0000000100)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0xe}}, 0x57) shutdown(r6, 0x1) recvmmsg(r6, &(0x7f00000031c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x22, 0x0) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000003840)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000756c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000002000000850000000400000085000000050000009500"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x2, '\x00', 0x0, @fallback=0x21, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r3, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000007c0)={r7}, 0xc) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x7a44, 0x1700) mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0xe, 0x12, r8, 0x952de000) 979.813705ms ago: executing program 3 (id=12817): r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_RES_CQ_GET(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="1800000018140163"], 0x18}}, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$netlink(0x10, 0x3, 0x2) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'wlan1\x00'}) sendmsg$NL80211_CMD_SET_CHANNEL(r1, &(0x7f0000000340)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000280)={&(0x7f0000000300)=ANY=[@ANYRES32=r1], 0x50}, 0x1, 0x0, 0x0, 0x4040001}, 0xc800) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_FEATURES_SET(r2, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={0x0, 0x434}, 0x1, 0x0, 0x0, 0x4040800}, 0x0) socket$netlink(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) syz_genetlink_get_family_id$tipc2(0x0, 0xffffffffffffffff) syz_init_net_socket$llc(0x1a, 0x5, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r4) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r5) sendmsg$TIPC_CMD_ENABLE_BEARER(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) close(r7) r8 = socket$unix(0x1, 0x5, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000007b00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x78) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)=ANY=[], 0x2c}, 0x1, 0x0, 0x0, 0x42812}, 0x44044) 942.253987ms ago: executing program 4 (id=12818): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3) ioctl$FS_IOC_GETFSLABEL(r0, 0x400452c9, &(0x7f0000000100)) 708.252994ms ago: executing program 4 (id=12819): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYBLOB="1c00000046000701fe"], 0x1c}}, 0xc000) sendmsg$nl_route(r0, 0x0, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000000)=ANY=[@ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000ffffffffffffff7ffcffffffffffffff04000000000000000000000000000000fdffffffffffffff00"/62], 0xd8}, 0x1, 0x0, 0x0, 0x40044}, 0x20008004) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000200)={'bond0\x00', 0x0}) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup.cpu/syz1\x00', 0x1ff) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000140)={'gretap0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="500000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="400d0000200000003000128008000100687372002400028008000200", @ANYRES32=r4, @ANYBLOB="08000100", @ANYRES32=r3], 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) 499.936402ms ago: executing program 4 (id=12820): r0 = syz_init_net_socket$ax25(0x3, 0x5, 0xb4) close(r0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$RDMA_NLDEV_CMD_STAT_DEL(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000003c0)=ANY=[], 0x18}}, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)=@newlink={0x44, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @batadv={{0xb}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BATADV_ALGO_NAME={0x10, 0x1, 'BATMAN_IV'}]}}}]}, 0x44}}, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="200000002f2c5441669c273b78db7365b5e245c921487100002d6cca000006"], 0x20}, 0x1, 0x0, 0x0, 0x2000c000}, 0x4040000) r3 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(r3, 0x84, 0xc, &(0x7f0000000040)=@assoc_value={0x0}, &(0x7f0000000000)=0x8) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={r4, 0x2c2, 0x20, 0x6, 0xf97}, 0x0) r5 = socket$packet(0x11, 0x2, 0x300) getsockopt$packet_int(r5, 0x107, 0xb, &(0x7f0000000000), &(0x7f0000000040)=0x4) sendmsg$NLBL_UNLABEL_C_STATICADD(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={0x0}, 0x8, 0x3000000000002, 0x0, 0x20000800}, 0x4000042) 431.782513ms ago: executing program 3 (id=12821): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000002c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x80000001, '\x00', 0x0, 0x0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0xa, 0xf, &(0x7f0000000d80)=@ringbuf={{0x18, 0x8}, {{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {0x85, 0x0, 0x0, 0x5}, {0x4}}, {{0x5, 0x0, 0x3}}, [], {{0x7, 0x1, 0xc, 0x9, 0x4}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x8a}}}, &(0x7f0000000980)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x2f, '\x00', 0x0, @fallback=0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x94) 356.403418ms ago: executing program 2 (id=12822): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) bind$xdp(0xffffffffffffffff, &(0x7f0000000100)={0x2c, 0x2}, 0x10) sendmsg$NFT_BATCH(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="140000001000040000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000058000000160a01000000000000000000010000000900010073797a30000000000900020073797a30000000002c0003800800014000000000080002400000000010000380140001007465616d3000000000000000000000005c000000160a0101000b000000000000010000000900020073797a30000000000900010073797a3000000000300003802c00038014"], 0xfc}}, 0x0) write$tun(r0, &(0x7f0000000340)=ANY=[@ANYBLOB="000086dd0003110004"], 0xfdef) (fail_nth: 8) 356.15327ms ago: executing program 3 (id=12823): socket$nl_xfrm(0x10, 0x3, 0x6) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_FEATURES_SET(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={0x0, 0x434}, 0x1, 0x0, 0x0, 0x4040800}, 0x0) socket$netlink(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = syz_genetlink_get_family_id$tipc2(0x0, 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_LINK_GET(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000700)=ANY=[@ANYRES16=r2, @ANYBLOB="030700000000000000000800000068000480040007"], 0x7c}}, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=@bridge_delneigh={0x28, 0x1c, 0x1, 0x4, 0x0, {0x7, 0x0, 0x0, r4, 0x80, 0xf2, 0x4}, [@NDA_LLADDR={0xa, 0x2, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1b}}]}, 0x28}, 0x1, 0x1000000}, 0x0) (fail_nth: 3) syz_init_net_socket$netrom(0x6, 0x5, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0x7, 0x0, 0x0) 349.32132ms ago: executing program 4 (id=12824): r0 = socket$igmp(0x2, 0x3, 0x2) ioctl$F2FS_IOC_GET_COMPRESS_OPTION(r0, 0x8002f515, &(0x7f0000000000)) ioctl$F2FS_IOC_GET_PIN_FILE(r0, 0x8004f50e, &(0x7f0000000040)) (async) setsockopt$MRT_FLUSH(r0, 0x0, 0xd4, &(0x7f0000000080)=0x18, 0x4) (async) ioctl$BTRFS_IOC_RM_DEV(r0, 0x5000940b, &(0x7f00000000c0)={{r0}, "35b0d19af3d39ca48c25cd6931d2b1f50cf1c4e0805743f109cacff91c67a0a927739b3339d0a9a1039082220b96a6f3816ee115fc6f51832108e2d028b96066ac6c316f23ccb6369a71dff1578110b298115b04fe7dc0e93b091ae5b26a5bb7985c443b9bec99b9f6ef24b3418ccd76fb4d4fb9b3c78ec28b6a5a07259d5ac1f512f77caea8770158fb50db470c3b827190afb8e965c6fe80a889e172088bfbd36765b664ac8bb90ffba9ec92be4a05a98eba8586113746c70463785ee78c213200452bd0dbc0159ced49655f85348280d12592e331046d371a7825ccb984fd676d3a70d70d556d2d1fff1125d505860841e0afe024b0290d6cc2209ab7e71ebca7ca9d7e8da397b1eb7d43965c10c78dd3cc6b5609c03d1335552e92bfdb847b70f96dfd01a483f543ddf92bc2aa5e2edfa140bff16fe106ba52e3fab118a7a944624585615a16a97e4280c20d60fc8f901d17b94d9cb639218b876bcb1e247cbc04cc9ab442aa4c541fb1a23e78ad314d68cfacadbdbec2543a854bbcf35a0582530ac199fa100762aea41f2c070cd2a5c0aa5638d5b224760be28d44672ba4ad512422207586d8450e3a6a3f6f9ce9aed26f3a7975b40c242e21f151c1fa6fe9cf5192b3dcc371dc56525463ae0a3227193e525a552257d5f24daff209aca7e247e44d61ea5de939d13d7da1fd9f4d567a86889c888201233aa2c632cef135d8e5d3ed86c8be60f36217caf0696b1e4b967165868709d3318a54b82916c204341c3966a3c58510a396df8a16cc0a4844a1b55592aafcd221754d375adf32a12231a5ff0ccc59255d9fbbede2cbafd22da3a57417d0d00b9eb40ddaffae95ac602b10ea56f229db078abc5a1cc02b16419c8523dda64b751b4d3b1843e89f21cd81a1a0564ec04e4577461bf2af74c8e7974f79121d1b19e932d75d7f92b3790314e4760c6e7024046863649ef6003c00b14fa2e309b18ff22ac1a5c6f708f82de96d5bd3326ca331d870aebec8bc47bfa382182176682dcbe37cefaf25a41c2aa3c8e7c95cae1da8b0395aea757b3d569b3149145f6b06731b4446089cd106b20cdf321455987dab0fcc6011377880f05e6be525cc8fc3c46cc1ff57119c6c6476664c269c24f71d97e9daecac97942ac6ff6b6a11fc9f88c862980f13337783b479c3aaffd81bd1339b233ce0e77381d111cab035dac5e77d3972d50187579dcb213217af81bb89e24b69ebc63b6879cc811aab94055f31361c7b35a13c9b0faf9a86c8619b8f521579fec3a1177fc20d40930f37557aa12872f7339959b92b2c1db1d429c7995b6af4e4bd7c2243961ace3113c2a891af8bd32e82c273bc41cc4c04e48e5505afa3cc001d74285560fd951b1892f5c1ddb6242ca118ce3f9bca641c12327ecadc7002a8f6bbf74addd4f900bc7c8025288b3e7ec11619298e7bbe51bf9a38b015ad8683b5a4867fd8224658a7c862bcaccd001e210ca7614f41f01fc2e83e6b1a16c024ad6144c385a2c8c1a248f4f9e96b46dce4995379db0e146156c8fa3571c6450496ae6189f1093c154c2c01fb5574f9cdf12d16c05854bf98926e96cd27ff4829dc4020d3ed0e31a8ba2183b345de9a7580adcb7084b23324df30a4a8f610c132483fe9803dc5042c31c434bd049f4cd3ddf54239b0680d4c60695cb2195c1555c3e36b875cd0a03581a434654e6944f4935229836ea60525233d9eb01b6be5f0efadd8b558c6ef29aa2f037152ebbc10e8bd95f5d6029dec6ad9e03a3824d216db16e1b5d7eb4477392d4b68fcb3ce823ba934fb5fc14b066e2ca0858d8befdc74c25319dade1da25a702a2adbd7534c7bbd9db369467d198b146b93951c7bbee7de546605d15a12962a150a4f96066f49527e6e674d8a921d50659caa23c531515fd6aa140d5828c1c2cf6d51b60c4ea168b41495d03b506be4aaac0b22d40b046aad061fc439e46522325b39e9fe9f3b78ac8449535b5745df18a14a2fb887211741f537841e9d36dbd02d7159a9d1467cb76c35b688af2c09df06f09fc289b4c569c40bc232bd813b2e443052ceeb564a3a08537e03b8e50360be479ad230bbcfbba250f0c0b0b9299cd0e637e71b912b49e864f34db78b46be5686cbe97fb2ff3c58031796ac23bf538263ab1c06af35cf0ce2f49c18a001c7a7d2f1988bfe5eedca162ef35ec917be501061b9729fe77e95e626e20130b075d9cea8d770c0a313fdb0ff6196ac81d5494ab9491dd7b51def3169ed6c4414f4f27a523ffc2a419c5c42614e460e9e758e27e8a187476b886525d25e18c2f973e41bd73ac1f327e88d36dc29e319cda1567a0c40f618abcbfd480fe4fccca38e4c72fa0dac017f3b32271215fda039d8020c910b9c2175901d044be67466301141f4b75d407fa805a87572ccd4dc2d05357aea6db4b7ca86c219ca5ac42c18085644787caa2c761d27168427bdd968b6a69ce20f53dd863f40558314a0e15ed292e0a86a305b7aab86ae691f7e7cbf04c3f5d39fc775f439edc01063f61580726dde7900dfe91abc2cdd832a1ebdd467151017e52bde28e15c711c53179b68c7d9bbf651a820779dd75bd5508d303422c8c48ab8c02e5699ea004eebcc708cbb0e6d1dcf2534b86bf4da75e0279a907cf1a549d57ba65f3cfb1e8d67bc73ae23021a17c516499b8463434274b988ed234ebb6e23b57f90da51d3b4f6b5f784613673f5cb28d56c12d0cea2227b26e2aedde2786a57fe7feda280b1a4334d06d68325d1c25cfcf820a42a5d74a737359e62f80005fea834bc9b79b1c237b986da10574ff6711e65d1a58753aebfe75e73423f4318b722d9fb677b71dc6c9cf10901d5546a316a1f7c76c573214b7cb28b43eb8a79b1ac12e7e13d37184c885bc6f463b85c538ddeb944aff3cde53144c5a2c0ad64572a232210aae13b0f221d93aeb0e347a1fa9aca324c31cc0c403838ae11a312e2d3696001caa98ddcd3ef8aa993ae0a6ac06aae9c0196fa0e8cc30e1fb98a237e5a04c54de9778e802962374fe33dd4d4d99329532911eb31d431fe3463d48a64fec7306a8a2643a569fec6f1f693dfe358928e8b50354ba236cdceacefbc13a2ddf25c443abc0f678f1bd4292f227494989bdc2f04cef8b2d2c394fe6cc7590ac8855d4577897636a0aa1aba3932c2f82691c2f377a294dc055add541c98450e1dea6219b56b4f7a6275aae53d4df01a365e0b2379906f7ca675f31692e0f18ba7fa3d81c2abe8877c8df47ffa49caf959b1ba5c53090cf47a8d9140dfd06c131e13a0d20e09b8fafd3a9b0a1a3c5790ce484a3994d19f1578d8c33091bf3624273ada1fb561d2ae6a13cb19567cd36d5d7ff00e6aea28099cd7b2807c33757f5ff9586fac658c108ffe30ed98ba690c991730a3d113964b5590774766c969b3fcbbf09a6f7d2987999b0bba2bb57daadc9b9e8c40dbb374da8bc68b7caf530e39f27c8ed93c01bb2ef2db3cc9bee1475b49e736b91be4aaf70c0c7a72059d1af3d596fabc6c8b6b61f5c5af1631dda2a54ce8a188ec42ff24c3f9d6285de7418901e395a86e578c616690504ae7c01a7b30bb30bcd8e7755c11528d5da7a4ef9a24018cd41dc3bc827df919e8553ded83c79f68df36521fbd1af0ec80ff48732e164d340d1641c57b549ee98fd5428b78f0b92825bcc89f58717ddb4d33f47a69c9afc5ab713e3c0782da9885fbf1a044a4b1a093d6ac4e60f656b7a3d02d7f7f44602d468336b06562cc1539d986025d183d07637a4abe5454a0f09afc129430bc27db840c23b868e93f282aad6a644dc7ed3ccc3c8969c0d1491c5e3d9751143d9d6935cdb7876364345a39861a1379e88e7e25d44a8d7f3d1195c6ec3c3b4c2097d0ae489c0d0c2e5bf0b847d976ae1d28c00ba89d5f9d602a2983a096dc69d5b773c7cc91abfdeab5f069084140d3188d33cbf3108e592f12800c5e8a9e0dd774f6edcb3f7690313a82afd23c3c8a7653055bcdd0957f177b65e1415f0572e10d17f1556df2cad7d52a1e42f86e05f109c5d6a2f2462058a9bb81d5e45f76da096f9474372b140357ba283e4d2ad975ed29561aede4b2fb986c797686989b8125734b7b5e28dc557650006eca86313aa1b4375277b03ef6a2abe6a5eca516feeb4c111b7448f9f05ebb2df28ce0dc7bf5bcad23229b912c19d0e760d2929e28e6a29d9eebf47c8bea9f9832aaf5d0044c08535dd7545e16e5b18dae06790cd1583be3b2e4da8cb02ba94f30f9d6537dc368e44493f29d8475c1b921fad5319fb7983e343036fba91b55df004b72770861f84e7b416b37c476319fbd167b3250a66670ccaf3f80356bdb3eeea5e5e8f40e2e11d17536829dabac874ced301221701071e638328b45c69297bee305525b829603345491b6c3aefd870583826fe886b1332e2f53acb1a8f3a242ef5f8f310bc6477bea943d6790b561cd2de74fda01c14719d77061ab1481c2b6640a603ae904a99e9b1b43cc41f65049e2f89c7f6faeca7917f305dddf328128316595cf271109d9bbcdba76cbacee216df6aa8c40a12eec60291d6bc49eccd90117364fc87a794aed4cead3428e70c6b22a393132928b890e3cb62b2c1e8a14b164924ad8bbb52d70392e2ca1c5a661c42a927b58487507fcfcdbddaca06f2385489c1edb84d4c79ef00844c5799276515fb0147197c60602a5d06c1eb0b8b9d08f63c0cecc3bba5a2e7c91ca32c87b29f2057fc5bc76aede8165dd8e64f361c39b4d3be27cb90e46d692b66f4a322d9b4dda0ace4a6294e0517c6cb31706c946569afc1c52a543bc8983bf31b5512de1fd360427f89187f17bc577ea40879d0ab75da2df5c8e18af5788dd10f5c221bcd6eb6d52db5a169165f218f75f3848b8e7e9a6444551bcbf384bae9861076588a7409f3fbb864005d0d01130f4ea3c4c466b97b697bc1bd01224b5d73e1452729c985cc214f5d772c9a1602343fd3a4de365dae66ae4033a4d3259d712c477b9c7627e97e9d72a766a298de8ceb83342a1a58837066c97a28d29f4ad940142b5247183c17923c0bc1b7bf2e45eac3d6c2263fc1dc4f59d5a61bbb51eac5fbe33dd60bcfcb17e2095e6dfa83b1a62c1517d6fc9e8aa000aa07c05da9f4786ee36f43a05d320b1e945417fad0b4e4b7da012563c021dc6a4001715f29e52d51d4478a641638c1f54823cbeee9b6fa3f712caf1443239ca06bd74197124728c74cd1cd8ceb35143c74a3b9d4f6fa7b4a6260e326d04550faea74729a0167f65bbca28cf7058787481106ce9f3a23ba4f7c518d94c65873670d4423761c692c117239b206d59fdb1948c32bd39379af4795dd2d782616cb291f2b695e257738cdf32e963d489b0e3fcf63f2a128c593bf6dd4e97898fa0c392f830e0f539d7f02529ec2de62965f2ccc1c0f9ee937a6d0259ec7439fd3ac3100ca6efbe8154255e68a554968ea84e03d9118de7d4a9c01022c5283977b2deef59c313806de17c27ece3f8c7125db1fd077b59b27b0e6b0c37d3131689a8e74fda4d8645279ec59ddd5027c7d3c923c849d08434a2560ca5aca739740d9f477983ffce892163ebcde91849b701a8e7a8882252a7d617d350101b57bb4a6c5f8a9edcf10c99a2d44ff4011900b866e9efff24b4dcb81d48ab126524ebc2fdbc310a932c1aa9f46886f4fb1c0145f60e28ec9aba22a24d30cbcf813e00c9e71560ec1410cd2ef9bbb1504840295dbb8344f7e5cf8c428fbc44c61c90a81adb6da23441eec373"}) (async) ioctl$FS_IOC_GETFSMAP(r0, 0xc0c0583b, &(0x7f00000010c0)={0x0, 0x0, 0x6, 0x0, '\x00', [{0x3, 0x0, 0x2, 0x98, 0x2, 0xec}, {0xfff, 0x2, 0x63, 0x2, 0x2000000000, 0x17f3b0b2}], ['\x00', '\x00', '\x00', '\x00', '\x00', '\x00']}) (async) r1 = socket$l2tp6(0xa, 0x2, 0x73) ioctl$F2FS_IOC_RELEASE_COMPRESS_BLOCKS(r1, 0x8008f512, &(0x7f0000001300)) (async) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCADD6RD(r2, 0x89f9, &(0x7f0000001380)={'sit0\x00', &(0x7f0000001340)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @remote, 0x19, 0x1e}}) ioctl$INCFS_IOC_READ_FILE_SIGNATURE(r0, 0x8010671f, &(0x7f0000001400)={&(0x7f00000013c0)=""/1, 0x1}) (async) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r3, &(0x7f0000001540)={&(0x7f0000001440)={0x10, 0x0, 0x0, 0x414000}, 0xc, &(0x7f0000001500)={&(0x7f0000001480)={0x74, 0x9, 0x6, 0x5, 0x0, 0x0, {0xa, 0x0, 0x6}, [@IPSET_ATTR_DATA={0x44, 0x7, 0x0, 0x1, [@IPSET_ATTR_TIMEOUT={0x8, 0x6, 0x1, 0x0, 0xfffffffa}, @IPSET_ATTR_MARKMASK={0x8, 0xb, 0x1, 0x0, 0x1}, @IPSET_ATTR_MARKMASK={0x8, 0xb, 0x1, 0x0, 0x2}, @IPSET_ATTR_IP2={0x18, 0x14, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @private0={0xfc, 0x0, '\x00', 0x1}}}, @IPSET_ATTR_COMMENT={0x6, 0x1a, '^\x00'}, @IPSET_ATTR_LINENO={0x8, 0x9, 0x1, 0x0, 0x9}]}, @IPSET_ATTR_LINENO={0x8, 0x9, 0x1, 0x0, 0x7}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_LINENO={0x8, 0x9, 0x1, 0x0, 0x7}]}, 0x74}, 0x1, 0x0, 0x0, 0x80}, 0x800) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) (async) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f00000015c0), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000001600)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FLUSH_PMKSA(r4, &(0x7f00000016c0)={&(0x7f0000001580)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000001680)={&(0x7f0000001640)={0x1c, r5, 0x2, 0x70bd29, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r6}, @void}}, ["", "", "", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x840}, 0x1) (async) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r7, &(0x7f00000017c0)={&(0x7f0000001700)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000001780)={&(0x7f0000001740)={0x20, 0x7, 0x6, 0x401, 0x0, 0x0, {0x1}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x24040080}, 0x4000000) setsockopt$IP_VS_SO_SET_STARTDAEMON(r0, 0x0, 0x48b, &(0x7f0000001800)={0x2, 'veth1_to_team\x00', 0x2}, 0x18) r8 = syz_init_net_socket$x25(0x9, 0x5, 0x0) connect$x25(r8, &(0x7f0000001840), 0x12) (async) pwrite64(r4, &(0x7f0000001880)="3d8d96fd224a3294e4d9836eab695c694f40fd3e0253535eed918250e6dcc066103b38de85669e7f80f879af496ca37250c6bccd56d4760ab9168ccbc5f78f6622066a4da626d27172f4a0d16526", 0x4e, 0x4) socket$igmp6(0xa, 0x3, 0x2) (async) ioctl$sock_x25_SIOCADDRT(r8, 0x890b, &(0x7f0000001900)={@null, 0x1, 'dummy0\x00'}) r9 = socket$isdn(0x22, 0x3, 0x21) ioctl$IMCTRLREQ(r9, 0x80044945, &(0x7f0000001a00)={0x2, 0x7fff, 0xf153, 0x800}) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000001a40)={'batadv_slave_1\x00'}) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r3, 0x4048587b, &(0x7f0000001e80)={{0xffffffffffffffff, &(0x7f0000001a80)='.!.]]^}/\x00', 0x40040, &(0x7f0000001ac0)={@_ha_fsid={[0x9, 0xffffff42]}, {0x8, 0xb09, 0xfffffffc, 0x7724}}, 0x2, &(0x7f0000001b00)={@_ha_fsid}, &(0x7f0000001b40)=0xe0}, 0x4, &(0x7f0000001e00)=[{0x2, 0x1ff, &(0x7f0000001b80)='^\x00', &(0x7f0000001bc0)="9202c22b72e2ee65c047b4bf463840785da451fc18d25eb30907ddd975572aef8686df30470992f328381f3ecf51d1", 0x2f}, {0x3, 0x3, &(0x7f0000001c00)='sit0\x00', &(0x7f0000001c40)="bc23f52679c7ba38c06bcc7847", 0xd}, {0x1, 0x6, &(0x7f0000001c80)='wlan0\x00', &(0x7f0000001cc0)="971ab5623abcbe3b2c9a6bf3d91d826b", 0x10, 0x127e8559a066c835}, {0x2, 0x9, &(0x7f0000001d00)='nl80211\x00', &(0x7f0000001d40)="3d8c6b1a2109afbf3c7d0f0a76073b74fa893dc8873e4415b3b1129bf47dd1b9bc2a5716eebc79a88c5029449b7acbccf781633b737a59ba013b311dfb3118d361d2a6506b5c134366ae5c5465e1f7a73a4e1d7fe54001e2e448b7d07a25126540851ff035dae2350a0deec91e3b69002413d5464742ba8e0e596b82362d374548758903023f", 0x86, 0x2}]}) ioctl$TUNGETVNETBE(r10, 0x800454df, &(0x7f0000001f00)) 135.442956ms ago: executing program 4 (id=12825): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000380)={'syzkaller0\x00'}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000100)=@newlink={0x3c, 0x10, 0x401, 0x3, 0x25dfdbfa, {0x0, 0x0, 0x0, 0x0, 0x190, 0xf1f80502f07a58b}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_PACKETS_PER_SLAVE={0x8, 0x14, 0xff}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40010}, 0x240080c1) ioctl$sock_SIOCGIFVLAN_SET_VLAN_NAME_TYPE_CMD(r2, 0x8982, &(0x7f00000000c0)={0x6, 'dummy0\x00', {0xffffe371}, 0x3}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000008000280012800a00010076786c616e"], 0x50}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) r4 = socket(0x10, 0x3, 0x0) sendmmsg(r4, &(0x7f0000000000), 0x400000000000235, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)) r5 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) setsockopt(0xffffffffffffffff, 0x84, 0x7f, 0x0, 0x0) ioctl$sock_netdev_private(r5, 0x8914, &(0x7f0000000000)) ioctl$sock_rose_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000380)={@remote={0xcc, 0xcc, 0xcc, 0xcc, 0x0}, 0x6, @null, @bpq0, 0x0, [@bcast, @default, @null, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]}) r6 = syz_init_net_socket$rose(0xb, 0x5, 0x0) ioctl$sock_rose_SIOCADDRT(r6, 0x890b, &(0x7f00000007c0)={@dev={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0x5, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bpq0, 0x5, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @null, @null, @null, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default]}) connect$rose(r6, &(0x7f0000000040)=@short={0xb, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, 0x1, @null}, 0x1c) connect$rose(r6, &(0x7f0000000240)=@short={0xb, @dev={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x1, @null}, 0x1c) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0xc, &(0x7f0000000340)={0xfffbfffc, 0x2000000, 0x5, 0x6}, 0x10) bind$inet(r3, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) connect$inet(r3, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r3, &(0x7f0000007fc0), 0x800001d, 0x0) setsockopt$IP_VS_SO_SET_ADD(r3, 0x0, 0x482, &(0x7f0000000040)={0x100000011, @multicast2, 0x0, 0x0, 'wrr\x00', 0x15, 0xff, 0xf}, 0x2c) sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000580)=ANY=[@ANYBLOB="7800000010000104fcfffffffcdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="0315000000000000480012800b0001006772657461700000380002800400120008001500d570020005001300000000000800050000000000050008000900010005000a000000000008000400ff0300000800b5a5", @ANYRES8=r0, @ANYBLOB='\b\x00\n\x00', @ANYRES32], 0x78}, 0x1, 0x0, 0x0, 0x240088d1}, 0x0) syz_extract_tcp_res$synack(&(0x7f00000001c0), 0x1, 0x0) 0s ago: executing program 3 (id=12826): r0 = socket$packet(0x11, 0x2, 0x300) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1801000011000000000000000000000018120000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa20000000000000702"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=@framed={{0x18, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x8000}, [@call={0x85, 0x0, 0x0, 0x75}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000000180)=r2, 0x4) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x4000, &(0x7f0000000040)={&(0x7f0000000480)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000010000000900010073797a300000000040000000030a01020000000000000000010000000900010073797a30000000000900030073797a3000000000140004800800024000000000080001400000000568000000060a010400000008000000000100000008000b4000000000400004803c0001800a0001006d617463680000002c0002800800010065636e000c000300e4edf2b75cc7c0a308000240000000000c000100706b7474797065000900010073797a3000000000"], 0xf0}}, 0x0) kernel console output (not intermixed with test programs): 0_vlan: entered promiscuous mode [ 962.945286][T12426] veth1_vlan: entered promiscuous mode [ 963.064991][T12426] veth0_macvtap: entered promiscuous mode [ 963.114146][T12426] veth1_macvtap: entered promiscuous mode [ 963.263591][T12426] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 963.334798][T12426] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 963.403385][ T3001] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 963.459121][ T3001] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 963.508048][ T3001] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 964.436532][ T3001] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 965.061747][T12992] __nla_validate_parse: 1 callbacks suppressed [ 965.061765][T12992] netlink: 16 bytes leftover after parsing attributes in process `syz.1.11895'. [ 965.517926][T12967] tipc: Enabled bearer , priority 0 [ 965.553010][T12970] syzkaller0: entered promiscuous mode [ 965.580565][T12970] syzkaller0: entered allmulticast mode [ 965.916165][ T9677] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 965.947125][ T9677] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 966.030797][ T3001] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 966.039200][ T9677] net_ratelimit: 29 callbacks suppressed [ 966.039221][ T9677] bond3: (slave bridge0): failed to get link speed/duplex [ 966.061152][ T3001] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 966.086855][ T8816] bond6: (slave bridge2): failed to get link speed/duplex [ 966.105863][ T8816] bond2: (slave bridge2): failed to get link speed/duplex [ 966.195776][ T8814] bond3: (slave bridge0): failed to get link speed/duplex [ 966.205987][ T8816] bond6: (slave bridge2): failed to get link speed/duplex [ 966.245936][ T8814] bond2: (slave bridge2): failed to get link speed/duplex [ 966.305647][ T8814] bond3: (slave bridge0): failed to get link speed/duplex [ 966.325681][ T8814] bond6: (slave bridge2): failed to get link speed/duplex [ 966.355910][ T8816] bond2: (slave bridge2): failed to get link speed/duplex [ 966.415709][ T8814] bond3: (slave bridge0): failed to get link speed/duplex [ 966.591044][T12979] tipc: Resetting bearer [ 967.148174][T12979] tipc: Disabling bearer [ 967.194812][T13036] netlink: 4 bytes leftover after parsing attributes in process `syz.1.11899'. [ 967.237260][T13039] FAULT_INJECTION: forcing a failure. [ 967.237260][T13039] name failslab, interval 1, probability 0, space 0, times 0 [ 967.269055][T24858] tipc: Node number set to 425389597 [ 967.314393][T13039] CPU: 0 UID: 0 PID: 13039 Comm: syz.2.11900 Not tainted syzkaller #0 PREEMPT(full) [ 967.314415][T13039] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 967.314424][T13039] Call Trace: [ 967.314431][T13039] [ 967.314438][T13039] dump_stack_lvl+0xe8/0x150 [ 967.314463][T13039] should_fail_ex+0x412/0x560 [ 967.314485][T13039] should_failslab+0xa8/0x100 [ 967.314505][T13039] __kmalloc_cache_noprof+0x88/0x660 [ 967.314521][T13039] ? __pfx___mutex_trylock_common+0x10/0x10 [ 967.314545][T13039] ? nft_netdev_hook_alloc+0x5a/0x570 [ 967.314566][T13039] nft_netdev_hook_alloc+0x5a/0x570 [ 967.314591][T13039] nf_tables_parse_netdev_hooks+0x138/0x950 [ 967.314641][T13039] nft_flowtable_parse_hook+0x46a/0x920 [ 967.314665][T13039] ? queue_delayed_work_on+0x12f/0x1e0 [ 967.314689][T13039] ? __pfx_nft_flowtable_parse_hook+0x10/0x10 [ 967.314716][T13039] ? nf_flow_table_init+0x280/0x2a0 [ 967.314752][T13039] nf_tables_newflowtable+0x14e4/0x23d0 [ 967.314785][T13039] ? __pfx_nf_tables_newflowtable+0x10/0x10 [ 967.314820][T13039] ? __nla_parse+0x40/0x60 [ 967.314844][T13039] nfnetlink_rcv+0x1240/0x27b0 [ 967.314858][T13039] ? is_bpf_text_address+0x26/0x2b0 [ 967.314900][T13039] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 967.314927][T13039] ? __lock_acquire+0x6b5/0x2cf0 [ 967.314979][T13039] ? netlink_deliver_tap+0x2e/0x1b0 [ 967.315014][T13039] netlink_unicast+0x80f/0x9b0 [ 967.315036][T13039] ? __pfx_netlink_unicast+0x10/0x10 [ 967.315053][T13039] ? netlink_sendmsg+0x650/0xb40 [ 967.315069][T13039] ? skb_put+0x11b/0x210 [ 967.315094][T13039] netlink_sendmsg+0x813/0xb40 [ 967.315121][T13039] ? __pfx_netlink_sendmsg+0x10/0x10 [ 967.315144][T13039] ? aa_sock_msg_perm+0xf1/0x1b0 [ 967.315167][T13039] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 967.315188][T13039] ? __pfx_netlink_sendmsg+0x10/0x10 [ 967.315208][T13039] ____sys_sendmsg+0xa68/0xad0 [ 967.315242][T13039] ? __pfx_____sys_sendmsg+0x10/0x10 [ 967.315276][T13039] ? import_iovec+0x73/0xa0 [ 967.315305][T13039] ___sys_sendmsg+0x2a5/0x360 [ 967.315337][T13039] ? __pfx____sys_sendmsg+0x10/0x10 [ 967.315398][T13039] ? __fget_files+0x2a/0x420 [ 967.315428][T13039] ? __fget_files+0x3a0/0x420 [ 967.315463][T13039] __x64_sys_sendmsg+0x1bd/0x2a0 [ 967.315490][T13039] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 967.315522][T13039] ? __pfx_ksys_write+0x10/0x10 [ 967.315553][T13039] do_syscall_64+0x14d/0xf80 [ 967.315576][T13039] ? trace_irq_disable+0x3b/0x150 [ 967.315600][T13039] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 967.315620][T13039] ? clear_bhb_loop+0x40/0x90 [ 967.315642][T13039] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 967.315660][T13039] RIP: 0033:0x7f7e6b19c799 [ 967.315678][T13039] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 967.315694][T13039] RSP: 002b:00007f7e6c031028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 967.315714][T13039] RAX: ffffffffffffffda RBX: 00007f7e6b415fa0 RCX: 00007f7e6b19c799 [ 967.315728][T13039] RDX: 0000000000000080 RSI: 0000200000000c40 RDI: 0000000000000003 [ 967.315748][T13039] RBP: 00007f7e6c031090 R08: 0000000000000000 R09: 0000000000000000 [ 967.315759][T13039] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 967.315770][T13039] R13: 00007f7e6b416038 R14: 00007f7e6b415fa0 R15: 00007ffcc84922e8 [ 967.315800][T13039] [ 967.689176][T13036] veth0_macvtap: left promiscuous mode [ 968.384284][T13059] netlink: 92 bytes leftover after parsing attributes in process `syz.4.11904'. [ 968.458054][T13063] netlink: 4 bytes leftover after parsing attributes in process `syz.3.11906'. [ 968.468087][T13059] netlink: 'syz.4.11904': attribute type 28 has an invalid length. [ 968.495300][T13060] netlink: 192 bytes leftover after parsing attributes in process `syz.1.11905'. [ 968.535154][T13064] netlink: 12 bytes leftover after parsing attributes in process `syz.3.11906'. [ 968.607186][T13070] netlink: 4 bytes leftover after parsing attributes in process `syz.2.11907'. [ 968.647931][T13070] netlink: 12 bytes leftover after parsing attributes in process `syz.2.11907'. [ 968.909963][T13077] workqueue: Failed to create a rescuer kthread for wq "nfc3_nci_cmd_wq": -EINTR [ 970.382040][ T29] audit: type=1804 audit(1772179525.663:20): pid=13108 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.2.11910" name="/newroot/480/cgroup.controllers" dev="tmpfs" ino=2459 res=1 errno=0 [ 970.453608][ T29] audit: type=1800 audit(1772179525.663:21): pid=13108 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.11910" name="cgroup.controllers" dev="tmpfs" ino=2459 res=0 errno=0 [ 970.868942][T13122] FAULT_INJECTION: forcing a failure. [ 970.868942][T13122] name failslab, interval 1, probability 0, space 0, times 0 [ 970.949744][T13122] CPU: 0 UID: 0 PID: 13122 Comm: syz.2.11914 Not tainted syzkaller #0 PREEMPT(full) [ 970.949771][T13122] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 970.949783][T13122] Call Trace: [ 970.949792][T13122] [ 970.949800][T13122] dump_stack_lvl+0xe8/0x150 [ 970.949832][T13122] should_fail_ex+0x412/0x560 [ 970.949859][T13122] should_failslab+0xa8/0x100 [ 970.949883][T13122] __kvmalloc_node_noprof+0x178/0x8a0 [ 970.949904][T13122] ? rhashtable_init_noprof+0x52e/0xa70 [ 970.949928][T13122] ? rhashtable_init_noprof+0x12d/0xa70 [ 970.949956][T13122] rhashtable_init_noprof+0x52e/0xa70 [ 970.949986][T13122] nf_flow_table_init+0x17f/0x2a0 [ 970.950018][T13122] nf_tables_newflowtable+0x149f/0x23d0 [ 970.950062][T13122] ? __pfx_nf_tables_newflowtable+0x10/0x10 [ 970.950108][T13122] ? __nla_parse+0x40/0x60 [ 970.950136][T13122] nfnetlink_rcv+0x1240/0x27b0 [ 970.950154][T13122] ? is_bpf_text_address+0x26/0x2b0 [ 970.950206][T13122] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 970.950237][T13122] ? __lock_acquire+0x6b5/0x2cf0 [ 970.950296][T13122] ? netlink_deliver_tap+0x2e/0x1b0 [ 970.950336][T13122] netlink_unicast+0x80f/0x9b0 [ 970.950365][T13122] ? __pfx_netlink_unicast+0x10/0x10 [ 970.950387][T13122] ? netlink_sendmsg+0x650/0xb40 [ 970.950407][T13122] ? skb_put+0x11b/0x210 [ 970.950442][T13122] netlink_sendmsg+0x813/0xb40 [ 970.950473][T13122] ? __pfx_netlink_sendmsg+0x10/0x10 [ 970.950499][T13122] ? aa_sock_msg_perm+0xf1/0x1b0 [ 970.950523][T13122] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 970.950545][T13122] ? __pfx_netlink_sendmsg+0x10/0x10 [ 970.950565][T13122] ____sys_sendmsg+0xa68/0xad0 [ 970.950601][T13122] ? __pfx_____sys_sendmsg+0x10/0x10 [ 970.950636][T13122] ? import_iovec+0x73/0xa0 [ 970.950665][T13122] ___sys_sendmsg+0x2a5/0x360 [ 970.950696][T13122] ? __pfx____sys_sendmsg+0x10/0x10 [ 970.950756][T13122] ? __fget_files+0x2a/0x420 [ 970.950786][T13122] ? __fget_files+0x3a0/0x420 [ 970.950820][T13122] __x64_sys_sendmsg+0x1bd/0x2a0 [ 970.950849][T13122] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 970.950884][T13122] ? __pfx_ksys_write+0x10/0x10 [ 970.950915][T13122] do_syscall_64+0x14d/0xf80 [ 970.950939][T13122] ? trace_irq_disable+0x3b/0x150 [ 970.950963][T13122] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 970.950982][T13122] ? clear_bhb_loop+0x40/0x90 [ 970.951005][T13122] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 970.951023][T13122] RIP: 0033:0x7f7e6b19c799 [ 970.951042][T13122] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 970.951058][T13122] RSP: 002b:00007f7e6c031028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 970.951078][T13122] RAX: ffffffffffffffda RBX: 00007f7e6b415fa0 RCX: 00007f7e6b19c799 [ 970.951092][T13122] RDX: 0000000000000080 RSI: 0000200000000c40 RDI: 0000000000000003 [ 970.951103][T13122] RBP: 00007f7e6c031090 R08: 0000000000000000 R09: 0000000000000000 [ 970.951115][T13122] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 970.951125][T13122] R13: 00007f7e6b416038 R14: 00007f7e6b415fa0 R15: 00007ffcc84922e8 [ 970.951156][T13122] [ 971.270845][ T8816] net_ratelimit: 35 callbacks suppressed [ 971.270867][ T8816] bond6: (slave bridge2): failed to get link speed/duplex [ 971.283754][ T8816] bond2: (slave bridge2): failed to get link speed/duplex [ 971.291126][ T8816] bond3: (slave bridge0): failed to get link speed/duplex [ 971.652834][ T8816] bond3: (slave bridge0): failed to get link speed/duplex [ 971.736009][ T8816] bond2: (slave bridge2): failed to get link speed/duplex [ 971.815717][ T8816] bond6: (slave bridge2): failed to get link speed/duplex [ 971.837015][ T83] bond3: (slave bridge0): failed to get link speed/duplex [ 971.867068][ T83] bond2: (slave bridge2): failed to get link speed/duplex [ 972.074719][T13151] netlink: 16 bytes leftover after parsing attributes in process `syz.2.11921'. [ 972.479402][T13142] team0: Failed to send port change of device team_slave_0 via netlink (err -105) [ 972.679196][T13142] team0: Failed to send port change of device team_slave_1 via netlink (err -105) [ 972.804217][T13142] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 972.880463][T13142] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 973.198360][T13166] netlink: 192 bytes leftover after parsing attributes in process `syz.4.11923'. [ 973.233505][T13169] netlink: 24 bytes leftover after parsing attributes in process `syz.0.11924'. [ 973.260460][T13168] xt_hashlimit: Unknown mode mask C4, kernel too old? [ 973.330889][ T8816] bond2: (slave bridge2): failed to get link speed/duplex [ 973.382051][ T8814] netdevsim netdevsim3 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 973.408240][ T8814] netdevsim netdevsim3 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 973.445808][ T8816] bond6: (slave bridge2): failed to get link speed/duplex [ 973.474445][ T8814] netdevsim netdevsim3 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 973.558641][T13182] FAULT_INJECTION: forcing a failure. [ 973.558641][T13182] name failslab, interval 1, probability 0, space 0, times 0 [ 973.595666][T13182] CPU: 1 UID: 0 PID: 13182 Comm: syz.2.11927 Not tainted syzkaller #0 PREEMPT(full) [ 973.595692][T13182] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 973.595703][T13182] Call Trace: [ 973.595710][T13182] [ 973.595718][T13182] dump_stack_lvl+0xe8/0x150 [ 973.595747][T13182] should_fail_ex+0x412/0x560 [ 973.595772][T13182] should_failslab+0xa8/0x100 [ 973.595796][T13182] __kmalloc_cache_noprof+0x88/0x660 [ 973.595813][T13182] ? __sctp_v6_cmp_addr+0x1e6/0x510 [ 973.595834][T13182] ? sctp_add_bind_addr+0x8c/0x370 [ 973.595859][T13182] sctp_add_bind_addr+0x8c/0x370 [ 973.595883][T13182] sctp_copy_local_addr_list+0x314/0x4f0 [ 973.595906][T13182] ? sctp_copy_local_addr_list+0xa4/0x4f0 [ 973.595926][T13182] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 973.595947][T13182] ? sctp_v6_is_any+0x64/0x80 [ 973.595967][T13182] ? sctp_copy_one_addr+0x93/0x360 [ 973.595989][T13182] sctp_bind_addr_copy+0xb3/0x3c0 [ 973.596009][T13182] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 973.596039][T13182] sctp_connect_new_asoc+0x2ff/0x6b0 [ 973.596067][T13182] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 973.596098][T13182] ? __local_bh_enable_ip+0xd0/0x130 [ 973.596119][T13182] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 973.596140][T13182] ? security_sctp_bind_connect+0x7e/0x2c0 [ 973.596171][T13182] sctp_sendmsg+0x1528/0x2c10 [ 973.596209][T13182] ? __pfx_sctp_sendmsg+0x10/0x10 [ 973.596235][T13182] ? aa_sk_perm+0x6d5/0x900 [ 973.596265][T13182] ? __pfx_aa_sk_perm+0x10/0x10 [ 973.596288][T13182] ? sock_rps_record_flow+0x19/0x400 [ 973.596313][T13182] ? inet_sendmsg+0x2f4/0x370 [ 973.596341][T13182] __sys_sendto+0x627/0x7a0 [ 973.596368][T13182] ? __pfx___sys_sendto+0x10/0x10 [ 973.596389][T13182] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 973.596429][T13182] ? __fget_files+0x3a0/0x420 [ 973.596466][T13182] ? ksys_write+0x242/0x270 [ 973.596486][T13182] ? __pfx_ksys_write+0x10/0x10 [ 973.596506][T13182] __x64_sys_sendto+0xde/0x100 [ 973.596539][T13182] do_syscall_64+0x14d/0xf80 [ 973.596561][T13182] ? trace_irq_disable+0x3b/0x150 [ 973.596583][T13182] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 973.596601][T13182] ? clear_bhb_loop+0x40/0x90 [ 973.596624][T13182] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 973.596642][T13182] RIP: 0033:0x7f7e6b19c799 [ 973.596658][T13182] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 973.596672][T13182] RSP: 002b:00007f7e6c031028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 973.596691][T13182] RAX: ffffffffffffffda RBX: 00007f7e6b415fa0 RCX: 00007f7e6b19c799 [ 973.596703][T13182] RDX: 0000000000034000 RSI: 0000200000847fff RDI: 0000000000000003 [ 973.596714][T13182] RBP: 00007f7e6c031090 R08: 000020000005ffe4 R09: 000000000000001c [ 973.596726][T13182] R10: 00000000000000e0 R11: 0000000000000246 R12: 0000000000000002 [ 973.596737][T13182] R13: 00007f7e6b416038 R14: 00007f7e6b415fa0 R15: 00007ffcc84922e8 [ 973.596768][T13182] [ 973.596881][ T8814] netdevsim netdevsim3 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 974.000102][T13185] Bluetooth: MGMT ver 1.23 [ 974.121692][T13205] lo speed is unknown, defaulting to 1000 [ 974.258110][T13203] batadv9: entered promiscuous mode [ 974.263370][T13203] batadv9: entered allmulticast mode [ 974.407734][T13222] netlink: 'syz.1.11935': attribute type 1 has an invalid length. [ 974.425236][T13203] 8021q: adding VLAN 0 to HW filter on device batadv9 [ 974.920393][T13245] netlink: 16 bytes leftover after parsing attributes in process `syz.3.11937'. [ 975.367712][T13257] lo speed is unknown, defaulting to 1000 [ 975.537181][T13267] netlink: 8 bytes leftover after parsing attributes in process `syz.4.11938'. [ 976.366480][ T8814] net_ratelimit: 54 callbacks suppressed [ 976.366501][ T8814] bond6: (slave bridge2): failed to get link speed/duplex [ 976.435663][ T8816] bond3: (slave bridge0): failed to get link speed/duplex [ 976.456448][ T8814] bond2: (slave bridge2): failed to get link speed/duplex [ 976.507379][ T83] bond6: (slave bridge2): failed to get link speed/duplex [ 976.546030][ T83] bond3: (slave bridge0): failed to get link speed/duplex [ 976.565963][ T83] bond2: (slave bridge2): failed to get link speed/duplex [ 976.615624][ T8835] bond6: (slave bridge2): failed to get link speed/duplex [ 976.655671][ T8835] bond3: (slave bridge0): failed to get link speed/duplex [ 976.675889][ T8835] bond2: (slave bridge2): failed to get link speed/duplex [ 976.735800][ T8835] bond6: (slave bridge2): failed to get link speed/duplex [ 977.212003][T13217] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 977.448083][T13304] syzkaller0: entered promiscuous mode [ 977.477771][T13304] syzkaller0: entered allmulticast mode [ 977.758935][ T8814] netdevsim netdevsim2 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 977.780440][ T8814] netdevsim netdevsim2 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 977.940873][ T8814] netdevsim netdevsim2 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 977.968139][ T8814] netdevsim netdevsim2 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 977.991084][T13339] netlink: 12 bytes leftover after parsing attributes in process `syz.3.11950'. [ 978.087489][T13344] netlink: 40 bytes leftover after parsing attributes in process `syz.1.11952'. [ 978.099967][T13342] vlan3: entered promiscuous mode [ 978.193526][T13344] lo speed is unknown, defaulting to 1000 [ 978.208405][T13351] netlink: 8 bytes leftover after parsing attributes in process `syz.1.11952'. [ 978.380044][T13356] netlink: 16 bytes leftover after parsing attributes in process `syz.3.11955'. [ 978.688369][T13366] netlink: 8 bytes leftover after parsing attributes in process `syz.3.11959'. [ 978.709828][T13366] netlink: 8 bytes leftover after parsing attributes in process `syz.3.11959'. [ 978.749571][T13366] netlink: 20 bytes leftover after parsing attributes in process `syz.3.11959'. [ 978.939077][T13366] nbd: socks must be embedded in a SOCK_ITEM attr [ 978.981351][T13120] block nbd64: NBD_DISCONNECT [ 979.104198][T13388] netlink: 32 bytes leftover after parsing attributes in process `syz.1.11963'. [ 979.284173][T13002] udevd[13002]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 979.663325][T13403] netlink: 16 bytes leftover after parsing attributes in process `syz.4.11970'. [ 979.683058][T13403] bond0: entered promiscuous mode [ 979.705646][T13403] bond_slave_0: entered promiscuous mode [ 979.711519][T13403] bond_slave_1: entered promiscuous mode [ 979.719447][T13403] gretap0: entered promiscuous mode [ 979.728699][T13403] debugfs: 'hsr1' already exists in 'hsr' [ 979.745805][T13403] Cannot create hsr debugfs directory [ 980.034488][T13419] netlink: 'syz.0.11974': attribute type 1 has an invalid length. [ 980.179893][T13425] bond9: option lacp_active: mode dependency failed, not supported in mode balance-alb(6) [ 980.198192][T13425] bond9 (unregistering): Released all slaves [ 980.212927][T13436] xt_cgroup: xt_cgroup: no path or classid specified [ 980.522010][T13455] syzkaller0: entered promiscuous mode [ 980.530234][T13455] syzkaller0: entered allmulticast mode [ 980.687167][T13466] FAULT_INJECTION: forcing a failure. [ 980.687167][T13466] name failslab, interval 1, probability 0, space 0, times 0 [ 980.719119][T13466] CPU: 1 UID: 0 PID: 13466 Comm: syz.1.11989 Not tainted syzkaller #0 PREEMPT(full) [ 980.719145][T13466] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 980.719157][T13466] Call Trace: [ 980.719164][T13466] [ 980.719172][T13466] dump_stack_lvl+0xe8/0x150 [ 980.719202][T13466] should_fail_ex+0x412/0x560 [ 980.719229][T13466] should_failslab+0xa8/0x100 [ 980.719252][T13466] __kmalloc_cache_noprof+0x88/0x660 [ 980.719270][T13466] ? __sctp_v6_cmp_addr+0x1e6/0x510 [ 980.719290][T13466] ? sctp_add_bind_addr+0x8c/0x370 [ 980.719313][T13466] sctp_add_bind_addr+0x8c/0x370 [ 980.719335][T13466] sctp_copy_local_addr_list+0x314/0x4f0 [ 980.719358][T13466] ? sctp_copy_local_addr_list+0xa4/0x4f0 [ 980.719377][T13466] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 980.719400][T13466] ? sctp_v6_is_any+0x64/0x80 [ 980.719421][T13466] ? sctp_copy_one_addr+0x93/0x360 [ 980.719444][T13466] sctp_bind_addr_copy+0xb3/0x3c0 [ 980.719464][T13466] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 980.719493][T13466] sctp_connect_new_asoc+0x2ff/0x6b0 [ 980.719519][T13466] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 980.719549][T13466] ? __local_bh_enable_ip+0xd0/0x130 [ 980.719571][T13466] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 980.719591][T13466] ? security_sctp_bind_connect+0x7e/0x2c0 [ 980.719622][T13466] sctp_sendmsg+0x1528/0x2c10 [ 980.719662][T13466] ? __pfx_sctp_sendmsg+0x10/0x10 [ 980.719688][T13466] ? aa_sk_perm+0x6d5/0x900 [ 980.719716][T13466] ? __pfx_aa_sk_perm+0x10/0x10 [ 980.719739][T13466] ? sock_rps_record_flow+0x19/0x400 [ 980.719765][T13466] ? inet_sendmsg+0x2f4/0x370 [ 980.719792][T13466] __sys_sendto+0x627/0x7a0 [ 980.719825][T13466] ? __pfx___sys_sendto+0x10/0x10 [ 980.719846][T13466] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 980.719882][T13466] ? __fget_files+0x3a0/0x420 [ 980.719914][T13466] ? ksys_write+0x242/0x270 [ 980.719933][T13466] ? __pfx_ksys_write+0x10/0x10 [ 980.719954][T13466] __x64_sys_sendto+0xde/0x100 [ 980.719980][T13466] do_syscall_64+0x14d/0xf80 [ 980.720000][T13466] ? trace_irq_disable+0x3b/0x150 [ 980.720022][T13466] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 980.720040][T13466] ? clear_bhb_loop+0x40/0x90 [ 980.720060][T13466] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 980.720076][T13466] RIP: 0033:0x7fdf6ad9c799 [ 980.720094][T13466] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 980.720112][T13466] RSP: 002b:00007fdf6bc4e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 980.720132][T13466] RAX: ffffffffffffffda RBX: 00007fdf6b015fa0 RCX: 00007fdf6ad9c799 [ 980.720146][T13466] RDX: 0000000000034000 RSI: 0000200000847fff RDI: 0000000000000003 [ 980.720157][T13466] RBP: 00007fdf6bc4e090 R08: 000020000005ffe4 R09: 000000000000001c [ 980.720170][T13466] R10: 00000000000000e0 R11: 0000000000000246 R12: 0000000000000002 [ 980.720180][T13466] R13: 00007fdf6b016038 R14: 00007fdf6b015fa0 R15: 00007ffce498ed38 [ 980.720210][T13466] [ 980.735037][T13469] netlink: 60 bytes leftover after parsing attributes in process `syz.3.11990'. [ 981.348032][T13495] netlink: 'syz.1.11995': attribute type 1 has an invalid length. [ 981.374410][T13494] vlan2: entered promiscuous mode [ 981.575644][ T8816] net_ratelimit: 58 callbacks suppressed [ 981.575662][ T8816] bond3: (slave bridge0): failed to get link speed/duplex [ 981.605665][ T8816] bond2: (slave bridge2): failed to get link speed/duplex [ 981.695625][ T3509] bond3: (slave bridge0): failed to get link speed/duplex [ 981.715697][ T3001] bond2: (slave bridge2): failed to get link speed/duplex [ 981.807150][ T3509] bond3: (slave bridge0): failed to get link speed/duplex [ 981.856647][ T8835] bond2: (slave bridge2): failed to get link speed/duplex [ 981.938047][ T8835] bond3: (slave bridge0): failed to get link speed/duplex [ 981.965834][ T8835] bond2: (slave bridge2): failed to get link speed/duplex [ 981.988643][T13522] netlink: 'syz.4.12002': attribute type 9 has an invalid length. [ 982.031592][T13522] netlink: 'syz.4.12002': attribute type 4 has an invalid length. [ 982.055782][ T3001] bond3: (slave bridge0): failed to get link speed/duplex [ 982.124497][T13533] IPVS: sync thread started: state = MASTER, mcast_ifn = veth1_to_team, syncid = 0, id = 0 [ 982.135631][ T8835] bond2: (slave bridge2): failed to get link speed/duplex [ 982.136739][T13522] netlink: 'syz.4.12002': attribute type 1 has an invalid length. [ 982.244674][T13530] bond0: left promiscuous mode [ 982.260213][T13530] bond_slave_0: left promiscuous mode [ 982.278507][T13530] bond_slave_1: left promiscuous mode [ 982.317069][T13530] gretap0: left promiscuous mode [ 982.927941][T13589] sit3: entered promiscuous mode [ 983.229038][T13599] netlink: 'syz.4.12027': attribute type 11 has an invalid length. [ 983.294600][T13608] __nla_validate_parse: 8 callbacks suppressed [ 983.294618][T13608] netlink: 144 bytes leftover after parsing attributes in process `syz.4.12032'. [ 983.654827][T13638] tipc: Enabled bearer , priority 0 [ 983.697768][T13638] syzkaller0: entered promiscuous mode [ 983.703274][T13638] syzkaller0: entered allmulticast mode [ 983.742626][T13645] netlink: 'syz.1.12042': attribute type 5 has an invalid length. [ 983.760217][T13638] tipc: Resetting bearer [ 983.816636][T13638] bond2: (slave @): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 983.850595][T13638] bond2: (slave @): Enslaving as an active interface with an up link [ 983.910233][T13637] tipc: Resetting bearer [ 983.948724][T13637] tipc: Disabling bearer [ 983.986204][T13657] wg1: left promiscuous mode [ 983.998803][T13657] wg1: left allmulticast mode [ 984.027559][T13657] bond1: left promiscuous mode [ 984.048190][T13657] bond1: left allmulticast mode [ 984.084395][T13657] bridge1: left promiscuous mode [ 984.115774][T13657] bridge1: left allmulticast mode [ 984.142328][T13657] hsr1: left promiscuous mode [ 984.157965][T13657] vlan0: left promiscuous mode [ 984.172589][T13657] vlan0: left allmulticast mode [ 984.178419][T13657] geneve1: left allmulticast mode [ 984.186934][T13657] veth5: left promiscuous mode [ 984.192917][T13657] vlan1: left promiscuous mode [ 984.224321][T13657] geneve1: left promiscuous mode [ 984.250551][T13657] sit3: left promiscuous mode [ 984.600202][T13693] netlink: 12 bytes leftover after parsing attributes in process `syz.0.12057'. [ 984.833044][T13710] netlink: 428 bytes leftover after parsing attributes in process `syz.4.12065'. [ 984.866517][T13710] netlink: 32 bytes leftover after parsing attributes in process `syz.4.12065'. [ 985.045695][T13723] vlan2: entered promiscuous mode [ 985.113431][T13733] netlink: 12 bytes leftover after parsing attributes in process `syz.3.12072'. [ 985.166390][T13735] netlink: 16 bytes leftover after parsing attributes in process `syz.0.12074'. [ 985.258187][T13739] xt_ecn: cannot match TCP bits for non-tcp packets [ 985.274455][T13743] FAULT_INJECTION: forcing a failure. [ 985.274455][T13743] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 985.290160][T13739] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 985.295760][T13744] xt_ecn: cannot match TCP bits for non-tcp packets [ 985.308605][T13743] CPU: 0 UID: 0 PID: 13743 Comm: syz.3.12078 Not tainted syzkaller #0 PREEMPT(full) [ 985.308630][T13743] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 985.308642][T13743] Call Trace: [ 985.308650][T13743] [ 985.308658][T13743] dump_stack_lvl+0xe8/0x150 [ 985.308688][T13743] should_fail_ex+0x412/0x560 [ 985.308714][T13743] _copy_from_iter+0x1d3/0x1670 [ 985.308735][T13743] ? sctp_chunkify+0x5a/0x260 [ 985.308754][T13743] ? kmem_cache_alloc_noprof+0x15a/0x650 [ 985.308783][T13743] ? __pfx__copy_from_iter+0x10/0x10 [ 985.308804][T13743] ? __asan_memcpy+0x40/0x70 [ 985.308831][T13743] ? sctp_make_datafrag_empty+0x184/0x240 [ 985.308853][T13743] ? skb_put+0x11b/0x210 [ 985.308882][T13743] sctp_user_addto_chunk+0x87/0x240 [ 985.308909][T13743] sctp_datamsg_from_user+0x748/0xef0 [ 985.308948][T13743] sctp_sendmsg_to_asoc+0x1416/0x1900 [ 985.308971][T13743] ? __asan_memcpy+0x40/0x70 [ 985.309004][T13743] ? sctp_assoc_add_peer+0xce1/0x13b0 [ 985.309043][T13743] ? __pfx_sctp_sendmsg_to_asoc+0x10/0x10 [ 985.309067][T13743] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 985.309098][T13743] ? __local_bh_enable_ip+0xd0/0x130 [ 985.309120][T13743] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 985.309141][T13743] ? security_sctp_bind_connect+0x7e/0x2c0 [ 985.309172][T13743] sctp_sendmsg+0x1b3d/0x2c10 [ 985.309219][T13743] ? __pfx_sctp_sendmsg+0x10/0x10 [ 985.309245][T13743] ? aa_sk_perm+0x6d5/0x900 [ 985.309275][T13743] ? __pfx_aa_sk_perm+0x10/0x10 [ 985.309298][T13743] ? sock_rps_record_flow+0x19/0x400 [ 985.309327][T13743] ? inet_sendmsg+0x2f4/0x370 [ 985.309355][T13743] __sys_sendto+0x627/0x7a0 [ 985.309382][T13743] ? __pfx___sys_sendto+0x10/0x10 [ 985.309403][T13743] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 985.309442][T13743] ? __fget_files+0x3a0/0x420 [ 985.309478][T13743] ? ksys_write+0x242/0x270 [ 985.309498][T13743] ? __pfx_ksys_write+0x10/0x10 [ 985.309523][T13743] __x64_sys_sendto+0xde/0x100 [ 985.309551][T13743] do_syscall_64+0x14d/0xf80 [ 985.309574][T13743] ? trace_irq_disable+0x3b/0x150 [ 985.309599][T13743] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 985.309618][T13743] ? clear_bhb_loop+0x40/0x90 [ 985.309640][T13743] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 985.309659][T13743] RIP: 0033:0x7fb3abf9c799 [ 985.309677][T13743] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 985.309692][T13743] RSP: 002b:00007fb3acf42028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 985.309713][T13743] RAX: ffffffffffffffda RBX: 00007fb3ac215fa0 RCX: 00007fb3abf9c799 [ 985.309726][T13743] RDX: 0000000000034000 RSI: 0000200000847fff RDI: 0000000000000003 [ 985.309738][T13743] RBP: 00007fb3acf42090 R08: 000020000005ffe4 R09: 000000000000001c [ 985.309750][T13743] R10: 00000000000000e0 R11: 0000000000000246 R12: 0000000000000002 [ 985.309762][T13743] R13: 00007fb3ac216038 R14: 00007fb3ac215fa0 R15: 00007ffecbabad68 [ 985.309791][T13743] [ 985.745693][T13744] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 985.808951][T13739] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 985.939255][T13744] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 985.987188][T13739] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 986.023314][T13762] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 986.128611][T13744] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 986.170779][T13739] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 986.215343][T13769] vlan3: entered promiscuous mode [ 986.250792][T13744] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 986.272342][T13774] netlink: 'syz.3.12088': attribute type 8 has an invalid length. [ 986.331218][ T3001] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 20004 - 0 [ 986.377782][T13781] netlink: 16 bytes leftover after parsing attributes in process `syz.2.12090'. [ 986.387751][ T3001] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 20004 - 0 [ 986.421336][ T3001] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 20004 - 0 [ 986.457136][ T3509] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 986.521727][ T3509] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 20004 - 0 [ 986.559873][ T3509] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 986.572077][T13785] netlink: 144 bytes leftover after parsing attributes in process `syz.2.12092'. [ 986.589191][ T3509] net_ratelimit: 54 callbacks suppressed [ 986.589209][ T3509] bond2: (slave bridge2): failed to get link speed/duplex [ 986.634655][ T3509] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 986.672153][ T3509] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 986.695603][ T8835] bond3: (slave bridge0): failed to get link speed/duplex [ 986.735862][ T8816] bond2: (slave bridge2): failed to get link speed/duplex [ 986.836929][ T3509] bond3: (slave bridge0): failed to get link speed/duplex [ 986.867838][ T83] bond2: (slave bridge2): failed to get link speed/duplex [ 986.912974][T13807] vlan3: entered promiscuous mode [ 986.956048][ T3509] bond3: (slave bridge0): failed to get link speed/duplex [ 986.992374][T13818] netlink: 16 bytes leftover after parsing attributes in process `syz.4.12103'. [ 987.020010][T13818] bond0: entered promiscuous mode [ 987.040087][T13818] bond_slave_0: entered promiscuous mode [ 987.061774][T13818] bond_slave_1: entered promiscuous mode [ 987.077887][T13822] netlink: 'syz.1.12106': attribute type 39 has an invalid length. [ 987.086475][T13818] gretap0: entered promiscuous mode [ 987.106646][T13818] debugfs: 'hsr1' already exists in 'hsr' [ 987.132891][T13818] Cannot create hsr debugfs directory [ 987.136782][T13823] netlink: 'syz.1.12106': attribute type 22 has an invalid length. [ 987.143322][T13818] hsr1: entered promiscuous mode [ 987.175748][ T3509] bond3: (slave bridge0): failed to get link speed/duplex [ 987.182957][ T3509] bond2: (slave bridge2): failed to get link speed/duplex [ 987.211228][T13823] netlink: 4 bytes leftover after parsing attributes in process `syz.1.12106'. [ 987.448985][T13842] xt_ecn: cannot match TCP bits for non-tcp packets [ 987.465570][ T83] bond3: (slave bridge0): failed to get link speed/duplex [ 987.510291][T13832] tipc: Enabled bearer , priority 0 [ 987.517375][T13823] netlink: 'syz.1.12106': attribute type 22 has an invalid length. [ 987.540377][ T83] bond2: (slave bridge2): failed to get link speed/duplex [ 987.554973][ T8816] netdevsim netdevsim1 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 987.564986][ T8816] netdevsim netdevsim1 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 987.640492][T13834] syzkaller0: entered promiscuous mode [ 987.646277][T13834] syzkaller0: entered allmulticast mode [ 987.652765][T13834] tipc: Resetting bearer [ 987.672850][T13824] tipc: Resetting bearer [ 989.441049][T13824] tipc: Disabling bearer [ 989.449758][ T8816] netdevsim netdevsim1 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 989.458155][ T8816] netdevsim netdevsim1 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 989.511984][T13846] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 989.560804][T22319] tipc: Node number set to 2722583368 [ 989.589257][T13858] __nla_validate_parse: 4 callbacks suppressed [ 989.589277][T13858] netlink: 12 bytes leftover after parsing attributes in process `syz.3.12113'. [ 989.645048][T13846] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 989.669272][T13862] dvmrp1: entered allmulticast mode [ 989.703956][T13860] ip6tnl0: Caught tx_queue_len zero misconfig [ 989.710526][T13860] sch_tbf: burst 3 is lower than device ip6tnl0 mtu (1536) ! [ 989.757845][T13846] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 989.850463][T13846] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 989.874469][T13865] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 989.916247][T13862] dvmrp1: left allmulticast mode [ 989.964547][ T3509] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 989.983488][ T3509] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 990.000001][T13865] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 990.031732][ T8816] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 990.052709][T13865] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 990.097178][ T8816] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 990.148661][T13865] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 990.180126][T13874] netlink: 16 bytes leftover after parsing attributes in process `syz.4.12119'. [ 990.213729][T15873] lec:lec_start_xmit: lec0:No lecd attached [ 990.225860][ T3509] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 20004 - 0 [ 990.243504][ T8816] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 20004 - 0 [ 990.261779][ T8816] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 20004 - 0 [ 990.299773][ T8816] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 20004 - 0 [ 990.562150][T13891] netlink: 12 bytes leftover after parsing attributes in process `syz.4.12125'. [ 990.574439][T13894] dvmrp1: entered allmulticast mode [ 990.670788][T13895] dvmrp1: left allmulticast mode [ 990.889246][T13900] bridge0: port 2(bridge_slave_1) entered disabled state [ 990.896911][T13900] bridge0: port 1(bridge_slave_0) entered disabled state [ 991.121162][T13900] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 991.146680][T13900] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 991.264816][T13900] hsr1: left promiscuous mode [ 991.301797][T13907] vlan3: entered promiscuous mode [ 991.350026][ T8816] netdevsim netdevsim4 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 991.377475][ T8816] netdevsim netdevsim4 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 991.406308][ T8816] netdevsim netdevsim4 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 991.414712][ T8816] netdevsim netdevsim4 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 991.448507][T13927] netlink: 12 bytes leftover after parsing attributes in process `syz.1.12139'. [ 991.680177][T13951] netlink: 'syz.2.12143': attribute type 1 has an invalid length. [ 991.707747][T13951] workqueue: Failed to create a rescuer kthread for wq "bond9": -EINTR [ 991.726084][ T8816] net_ratelimit: 26 callbacks suppressed [ 991.726106][ T8816] bond3: (slave bridge0): failed to get link speed/duplex [ 991.798768][ T8816] bond2: (slave bridge2): failed to get link speed/duplex [ 991.812835][T13959] netlink: 20 bytes leftover after parsing attributes in process `syz.1.12145'. [ 991.845925][T13959] netlink: 'syz.1.12145': attribute type 4 has an invalid length. [ 991.893114][ T8816] bond3: (slave bridge0): failed to get link speed/duplex [ 991.935997][ T3509] bond2: (slave bridge2): failed to get link speed/duplex [ 992.036306][ T8816] bond3: (slave bridge0): failed to get link speed/duplex [ 992.055708][ T8816] bond2: (slave bridge2): failed to get link speed/duplex [ 992.132372][T13976] lo speed is unknown, defaulting to 1000 [ 992.145753][ T8816] bond3: (slave bridge0): failed to get link speed/duplex [ 992.185754][ T3509] bond2: (slave bridge2): failed to get link speed/duplex [ 992.263882][ T3001] bond3: (slave bridge0): failed to get link speed/duplex [ 992.278703][T13981] netlink: 12 bytes leftover after parsing attributes in process `syz.0.12150'. [ 992.295620][ T3001] bond2: (slave bridge2): failed to get link speed/duplex [ 992.439763][T13987] vlan2: entered promiscuous mode [ 992.631748][T13992] : entered promiscuous mode [ 992.884040][T13992] lo speed is unknown, defaulting to 1000 [ 993.534101][T21827] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 993.551391][T21827] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 993.562215][T21827] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 993.656875][T21827] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 993.678408][T21827] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 995.566484][T14022] lo speed is unknown, defaulting to 1000 [ 995.806597][ T5823] Bluetooth: hci2: command tx timeout [ 995.885612][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5670 ms [ 995.893635][ C0] lec:lec_tx_timeout: lec0 [ 995.899107][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 995.943873][T14035] vlan2: entered promiscuous mode [ 996.614562][T14071] bridge2: entered promiscuous mode [ 996.721701][T14073] netlink: 8 bytes leftover after parsing attributes in process `syz.4.12172'. [ 996.763928][T14073] netlink: 24 bytes leftover after parsing attributes in process `syz.4.12172'. [ 996.885666][ T8816] net_ratelimit: 20 callbacks suppressed [ 996.885685][ T8816] bond3: (slave bridge0): failed to get link speed/duplex [ 997.043811][T14084] netlink: 'syz.3.12174': attribute type 1 has an invalid length. [ 997.066504][T14089] netlink: 'syz.4.12175': attribute type 16 has an invalid length. [ 997.074750][T14089] netlink: 'syz.4.12175': attribute type 17 has an invalid length. [ 997.083513][ T3509] bond3: (slave bridge0): failed to get link speed/duplex [ 997.244123][T14089] 8021q: adding VLAN 0 to HW filter on device bond0 [ 997.281278][T14089] 8021q: adding VLAN 0 to HW filter on device team0 [ 997.312082][T14089] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 997.605997][T14084] 8021q: adding VLAN 0 to HW filter on device bond4 [ 997.653020][T14022] chnl_net:caif_netlink_parms(): no params data found [ 997.885825][ T5823] Bluetooth: hci2: command tx timeout [ 998.062244][T14022] bridge0: port 1(bridge_slave_0) entered blocking state [ 998.094445][T14022] bridge0: port 1(bridge_slave_0) entered disabled state [ 998.115303][T14022] bridge_slave_0: entered allmulticast mode [ 998.160415][T14022] bridge_slave_0: entered promiscuous mode [ 998.194313][T14022] bridge0: port 2(bridge_slave_1) entered blocking state [ 998.220673][T14022] bridge0: port 2(bridge_slave_1) entered disabled state [ 998.232152][T14169] netlink: 28 bytes leftover after parsing attributes in process `syz.4.12189'. [ 998.249957][T14022] bridge_slave_1: entered allmulticast mode [ 998.258770][T14022] bridge_slave_1: entered promiscuous mode [ 998.387201][T14022] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 998.402795][T14022] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 998.471699][T14180] dvmrp1: entered allmulticast mode [ 998.489889][T14022] team0: Port device team_slave_0 added [ 998.505064][T14022] team0: Port device team_slave_1 added [ 998.560374][T14185] netlink: 16 bytes leftover after parsing attributes in process `syz.4.12195'. [ 998.587060][T14022] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 998.594893][T14022] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 998.623689][T14022] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 998.665024][T14022] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 998.672810][T14022] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 998.699747][T14022] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 998.749483][T14180] dvmrp1: left allmulticast mode [ 998.856243][ T8560] bond2: (slave bridge2): failed to get link speed/duplex [ 998.875883][ T8560] bond3: (slave bridge0): failed to get link speed/duplex [ 998.903828][T14022] hsr_slave_0: entered promiscuous mode [ 998.937881][T14022] hsr_slave_1: entered promiscuous mode [ 998.944435][T14022] debugfs: 'hsr0' already exists in 'hsr' [ 998.967644][T14022] Cannot create hsr debugfs directory [ 998.978118][ T8814] bond2: (slave bridge2): failed to get link speed/duplex [ 999.033203][T14203] netlink: 4 bytes leftover after parsing attributes in process `syz.4.12202'. [ 999.035803][ T3509] bond3: (slave bridge0): failed to get link speed/duplex [ 999.138034][T14201] lo speed is unknown, defaulting to 1000 [ 999.175462][ T8560] bond2: (slave bridge2): failed to get link speed/duplex [ 999.416591][T14215] netlink: 16 bytes leftover after parsing attributes in process `syz.4.12208'. [ 999.737223][T14022] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 999.775641][T14236] netlink: 8 bytes leftover after parsing attributes in process `syz.4.12213'. [ 999.784657][T14236] netlink: 44 bytes leftover after parsing attributes in process `syz.4.12213'. [ 999.806364][ T8835] bond3: (slave bridge0): failed to get link speed/duplex [ 999.809614][T14238] xt_ecn: cannot match TCP bits for non-tcp packets [ 999.971366][ T5823] Bluetooth: hci2: command tx timeout [ 999.988582][T14243] netdevsim netdevsim1 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1000.021505][T14247] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci2/hci2:200/input6 [ 1000.023355][T14243] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1000.067197][T14250] netlink: 16 bytes leftover after parsing attributes in process `syz.2.12220'. [ 1000.115222][T14022] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 1000.148155][ T8816] bond3: (slave bridge0): failed to get link speed/duplex [ 1000.217772][T14260] netlink: 16 bytes leftover after parsing attributes in process `syz.3.12223'. [ 1000.321763][T14243] netdevsim netdevsim1 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1000.354633][T14243] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1000.410570][T14022] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 1000.470560][T14243] netdevsim netdevsim1 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1000.483393][T14243] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1000.533052][T14022] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 1000.561375][T14243] netdevsim netdevsim1 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1000.571268][T14243] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1000.671941][T14272] 9iLL: renamed from lo (while UP) [ 1000.765219][ T8814] netdevsim netdevsim1 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1000.785814][ T8814] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1000.829533][ T8814] netdevsim netdevsim1 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1000.838215][ T8814] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1000.852345][T14022] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 1000.880237][ T8814] netdevsim netdevsim1 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1000.889629][ T8814] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1000.901675][T14022] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 1000.923807][ T8814] netdevsim netdevsim1 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1000.932132][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5030 ms [ 1000.932162][ C0] lec:lec_tx_timeout: lec0 [ 1000.966064][ T8814] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1000.975778][T14022] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 1000.994114][T14022] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 1001.219474][T14022] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1001.293573][T14022] 8021q: adding VLAN 0 to HW filter on device team0 [ 1001.332146][ T8560] bridge0: port 1(bridge_slave_0) entered blocking state [ 1001.339307][ T8560] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1001.385316][ T8560] bridge0: port 2(bridge_slave_1) entered blocking state [ 1001.392522][ T8560] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1001.455309][T14320] xt_hashlimit: size too large, truncated to 1048576 [ 1001.558071][T14321] netlink: 'syz.1.12237': attribute type 5 has an invalid length. [ 1001.871289][T14341] __nla_validate_parse: 7 callbacks suppressed [ 1001.871310][T14341] netlink: 8 bytes leftover after parsing attributes in process `syz.1.12244'. [ 1001.908004][T14341] netlink: 44 bytes leftover after parsing attributes in process `syz.1.12244'. [ 1001.932303][T14347] vlan2: entered promiscuous mode [ 1002.045983][ T5823] Bluetooth: hci2: command tx timeout [ 1002.085618][ T3509] net_ratelimit: 17 callbacks suppressed [ 1002.085638][ T3509] bond3: (slave bridge0): failed to get link speed/duplex [ 1002.110996][T14022] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1002.144524][T14364] netlink: 16 bytes leftover after parsing attributes in process `syz.4.12250'. [ 1002.172790][T14361] lo speed is unknown, defaulting to 1000 [ 1002.237150][T14022] veth0_vlan: entered promiscuous mode [ 1002.274422][T14022] veth1_vlan: entered promiscuous mode [ 1002.346772][ T8816] bond2: (slave bridge2): failed to get link speed/duplex [ 1002.376040][T14022] veth0_macvtap: entered promiscuous mode [ 1002.399045][T14022] veth1_macvtap: entered promiscuous mode [ 1002.438843][T14022] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1002.463097][ T8835] bond2: (slave bridge2): failed to get link speed/duplex [ 1002.484537][T14022] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1002.513256][ T3001] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1002.525197][ T3001] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1002.551342][ T3001] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1002.561604][ T3001] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1002.586252][ T3001] bond2: (slave bridge2): failed to get link speed/duplex [ 1002.595792][ T3001] bond3: (slave bridge0): failed to get link speed/duplex [ 1002.821147][ T3509] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1002.844247][ T3509] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1002.889946][T14393] vlan2: entered promiscuous mode [ 1002.915726][ T8814] bond3: (slave bridge0): failed to get link speed/duplex [ 1002.922934][ T8814] bond2: (slave bridge2): failed to get link speed/duplex [ 1002.938272][T14391] netlink: 8 bytes leftover after parsing attributes in process `syz.4.12259'. [ 1002.951987][T14396] syzkaller0: entered promiscuous mode [ 1002.958110][T14396] syzkaller0: entered allmulticast mode [ 1003.235198][ T8816] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1003.245170][ T8816] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1003.287957][T14406] tipc: Enabled bearer , priority 10 [ 1003.294464][T18489] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 1003.327391][T14406] tipc: Enabling of bearer rejected, failed to enable media [ 1003.376217][ T3509] bond2: (slave bridge2): failed to get link speed/duplex [ 1003.405857][ T3509] bond3: (slave bridge0): failed to get link speed/duplex [ 1003.514684][T14413] netlink: 24 bytes leftover after parsing attributes in process `syz.0.12160'. [ 1003.534161][T14413] nbd: must specify a size in bytes for the device [ 1003.601276][T14419] xt_ecn: cannot match TCP bits for non-tcp packets [ 1003.790999][T14429] vlan2: entered promiscuous mode [ 1003.999979][T14443] netlink: 'syz.0.12276': attribute type 6 has an invalid length. [ 1004.028416][T14443] netlink: 'syz.0.12276': attribute type 7 has an invalid length. [ 1004.049070][T14443] netlink: 'syz.0.12276': attribute type 8 has an invalid length. [ 1004.071183][T14443] netlink: 'syz.0.12276': attribute type 15 has an invalid length. [ 1004.100818][T14443] netlink: 'syz.0.12276': attribute type 1 has an invalid length. [ 1004.112707][T14443] netlink: 'syz.0.12276': attribute type 8 has an invalid length. [ 1004.146941][T14443] netlink: 'syz.0.12276': attribute type 9 has an invalid length. [ 1004.155738][T14443] netlink: 'syz.0.12276': attribute type 10 has an invalid length. [ 1004.163775][T14443] netlink: 'syz.0.12276': attribute type 11 has an invalid length. [ 1004.172336][T14443] netlink: 12 bytes leftover after parsing attributes in process `syz.0.12276'. [ 1004.361483][T14460] netlink: 20 bytes leftover after parsing attributes in process `syz.3.12282'. [ 1004.400055][T14464] netlink: 12 bytes leftover after parsing attributes in process `syz.2.12283'. [ 1004.409425][T24858] tipc: Node number set to 2978448489 [ 1005.078122][T14516] netlink: 8 bytes leftover after parsing attributes in process `syz.4.12295'. [ 1005.079789][T14513] lo speed is unknown, defaulting to 1000 [ 1005.571016][T14545] netlink: 20 bytes leftover after parsing attributes in process `syz.2.12301'. [ 1005.732122][T14552] netlink: 'syz.0.12303': attribute type 2 has an invalid length. [ 1006.091795][T14570] vlan2: entered promiscuous mode [ 1006.583999][T14601] syzkaller1: entered promiscuous mode [ 1006.589719][T14601] syzkaller1: entered allmulticast mode [ 1007.035339][T14634] __nla_validate_parse: 3 callbacks suppressed [ 1007.035360][T14634] netlink: 8 bytes leftover after parsing attributes in process `syz.4.12326'. [ 1007.082134][T14636] netlink: 12 bytes leftover after parsing attributes in process `syz.0.12328'. [ 1007.132963][T14641] netlink: 8 bytes leftover after parsing attributes in process `syz.4.12326'. [ 1007.136441][T14640] netlink: 12 bytes leftover after parsing attributes in process `syz.3.12329'. [ 1007.173727][T14641] net_ratelimit: 62 callbacks suppressed [ 1007.173745][T14641] openvswitch: netlink: Missing key (keys=40, expected=80) [ 1007.318892][ T3509] bond2: (slave bridge2): failed to get link speed/duplex [ 1007.385868][ T3001] bond3: (slave bridge0): failed to get link speed/duplex [ 1007.412374][T24858] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 1007.445791][ T3001] bond2: (slave bridge2): failed to get link speed/duplex [ 1007.525906][ T3001] bond3: (slave bridge0): failed to get link speed/duplex [ 1007.555726][ T3001] bond2: (slave bridge2): failed to get link speed/duplex [ 1007.609203][T14666] bond_slave_0: entered promiscuous mode [ 1007.614917][T14666] bond_slave_1: entered promiscuous mode [ 1007.623719][T14666] vlan2: entered promiscuous mode [ 1007.629022][T14666] bond0: entered promiscuous mode [ 1007.657446][ T3001] bond3: (slave bridge0): failed to get link speed/duplex [ 1007.695713][ T8835] bond2: (slave bridge2): failed to get link speed/duplex [ 1007.766849][ T8835] bond3: (slave bridge0): failed to get link speed/duplex [ 1007.786015][T14679] netlink: 13 bytes leftover after parsing attributes in process `syz.3.12339'. [ 1007.860804][T14684] netlink: 12 bytes leftover after parsing attributes in process `syz.0.12341'. [ 1007.940475][ C0] Unknown status report in ack skb [ 1008.014852][T14693] netlink: 332 bytes leftover after parsing attributes in process `syz.3.12344'. [ 1008.177298][T14703] netlink: 4 bytes leftover after parsing attributes in process `syz.3.12346'. [ 1008.211837][T14706] vlan2: entered promiscuous mode [ 1008.259495][T14703] RDS: rds_bind could not find a transport for 4004:0:20:0:c002:0:20:0, load rds_tcp or rds_rdma? [ 1008.271396][T14709] netlink: 28 bytes leftover after parsing attributes in process `syz.0.12350'. [ 1008.402615][T14719] netlink: 12 bytes leftover after parsing attributes in process `syz.0.12353'. [ 1008.665416][T14736] lo speed is unknown, defaulting to 1000 [ 1009.139118][T14761] : entered promiscuous mode [ 1009.551347][T14784] FAULT_INJECTION: forcing a failure. [ 1009.551347][T14784] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1009.575811][T14784] CPU: 1 UID: 0 PID: 14784 Comm: syz.2.12368 Not tainted syzkaller #0 PREEMPT(full) [ 1009.575838][T14784] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1009.575850][T14784] Call Trace: [ 1009.575857][T14784] [ 1009.575865][T14784] dump_stack_lvl+0xe8/0x150 [ 1009.575896][T14784] should_fail_ex+0x412/0x560 [ 1009.575923][T14784] _copy_from_user+0x2d/0xb0 [ 1009.575949][T14784] sctp_getsockopt_associnfo+0xd5/0x730 [ 1009.575972][T14784] ? __pfx_autoremove_wake_function+0x10/0x10 [ 1009.575992][T14784] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 1009.576012][T14784] ? __pfx_sctp_getsockopt_associnfo+0x10/0x10 [ 1009.576041][T14784] ? sctp_getsockopt+0x12f/0xb90 [ 1009.576066][T14784] ? __local_bh_enable_ip+0xd0/0x130 [ 1009.576095][T14784] sctp_getsockopt+0x7ca/0xb90 [ 1009.576116][T14784] ? __pfx_sock_common_getsockopt+0x10/0x10 [ 1009.576140][T14784] do_sock_getsockopt+0x2d3/0x3f0 [ 1009.576169][T14784] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 1009.576194][T14784] ? __fget_files+0x3a0/0x420 [ 1009.576218][T14784] ? __fget_files+0x2a/0x420 [ 1009.576250][T14784] __x64_sys_getsockopt+0x1a4/0x240 [ 1009.576288][T14784] do_syscall_64+0x14d/0xf80 [ 1009.576311][T14784] ? trace_irq_disable+0x3b/0x150 [ 1009.576335][T14784] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1009.576354][T14784] ? clear_bhb_loop+0x40/0x90 [ 1009.576376][T14784] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1009.576395][T14784] RIP: 0033:0x7f7e6b19c799 [ 1009.576413][T14784] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1009.576429][T14784] RSP: 002b:00007f7e6c010028 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 1009.576448][T14784] RAX: ffffffffffffffda RBX: 00007f7e6b416090 RCX: 00007f7e6b19c799 [ 1009.576462][T14784] RDX: 0000000000000001 RSI: 0000000000000084 RDI: 0000000000000003 [ 1009.576473][T14784] RBP: 00007f7e6c010090 R08: 0000200000000080 R09: 0000000000000000 [ 1009.576486][T14784] R10: 0000200000000040 R11: 0000000000000246 R12: 0000000000000001 [ 1009.576498][T14784] R13: 00007f7e6b416128 R14: 00007f7e6b416090 R15: 00007ffcc84922e8 [ 1009.576529][T14784] [ 1009.933177][T14794] lo speed is unknown, defaulting to 1000 [ 1010.823712][T14835] validate_nla: 1 callbacks suppressed [ 1010.823731][T14835] netlink: 'syz.0.12383': attribute type 2 has an invalid length. [ 1010.866102][T14835] netlink: 'syz.0.12383': attribute type 1 has an invalid length. [ 1011.776555][T14798] IPVS: length: 114 != 8 [ 1012.061866][T14882] __nla_validate_parse: 11 callbacks suppressed [ 1012.061887][T14882] netlink: 12 bytes leftover after parsing attributes in process `syz.1.12393'. [ 1012.432879][T14878] syzkaller0: entered promiscuous mode [ 1012.438847][T14878] syzkaller0: entered allmulticast mode [ 1012.609115][ T2191] net_ratelimit: 53 callbacks suppressed [ 1012.609133][ T2191] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 1012.692974][T14907] netlink: 'syz.1.12395': attribute type 2 has an invalid length. [ 1013.156852][T21827] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 1013.165964][T21827] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 1013.181822][T21827] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 1013.209475][T21827] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 1013.235150][T21827] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 1013.653777][T18489] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 1014.688330][ T2191] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 1014.990772][T14930] syzkaller0: entered promiscuous mode [ 1015.004499][T14935] netlink: 20 bytes leftover after parsing attributes in process `syz.1.12404'. [ 1015.020460][T14934] netlink: 12 bytes leftover after parsing attributes in process `syz.2.12405'. [ 1015.029828][T14930] syzkaller0: entered allmulticast mode [ 1015.039459][T14923] lo speed is unknown, defaulting to 1000 [ 1015.063118][ T3001] bond0: left allmulticast mode [ 1015.077573][ T3001] bond_slave_0: left allmulticast mode [ 1015.092518][ T3001] bond_slave_1: left allmulticast mode [ 1015.101754][ T3001] bridge0: port 2(bond0) entered disabled state [ 1015.113537][ T3001] macsec0: left allmulticast mode [ 1015.119003][ T3001] macsec0: left promiscuous mode [ 1015.124096][ T3001] bridge0: port 3(macsec0) entered disabled state [ 1015.163134][ T3001] bridge_slave_0: left allmulticast mode [ 1015.185894][ T3001] bridge_slave_0: left promiscuous mode [ 1015.199723][ T3001] bridge0: port 1(bridge_slave_0) entered disabled state [ 1015.245360][T13940] udevd[13940]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 1015.262985][T14838] udevd[14838]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 1015.332297][ T5823] Bluetooth: hci5: command tx timeout [ 1015.358318][ T3001] bond7 (unregistering): (slave ip6gretap1): Releasing active interface [ 1015.459236][ T3001] bond6 (unregistering): (slave gretap3): Releasing active interface [ 1015.726157][T18489] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 1015.850190][ T3001] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1015.859118][ T3001] bond_slave_0: left promiscuous mode [ 1015.866210][ T3001] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1015.875445][ T3001] bond_slave_1: left promiscuous mode [ 1015.881606][ T3001] bond0 (unregistering): Released all slaves [ 1015.891474][ T3001] bond1 (unregistering): Released all slaves [ 1015.907610][ T3001] bond2 (unregistering): Released all slaves [ 1015.920050][ T3001] bond3 (unregistering): Released all slaves [ 1015.934040][ T3001] bond4 (unregistering): Released all slaves [ 1015.950175][ T3001] team0: Port device bond5 removed [ 1015.956111][ T3001] bond5 (unregistering): Released all slaves [ 1015.972312][ T3001] bond6 (unregistering): Released all slaves [ 1015.984854][ T3001] bond7 (unregistering): Released all slaves [ 1015.997416][ T3001] bond8 (unregistering): Released all slaves [ 1016.013410][ T3001] bond9 (unregistering): Released all slaves [ 1016.137245][ T8835] bond3: (slave bridge0): failed to get link speed/duplex [ 1016.144439][ T8835] bond2: (slave bridge2): failed to get link speed/duplex [ 1016.204049][ T3001] : left promiscuous mode [ 1016.260944][T14946] tipc: Enabled bearer , priority 10 [ 1016.288446][ T3001] !9: left promiscuous mode [ 1016.356855][ T9677] bond2: (slave bridge2): failed to get link speed/duplex [ 1016.373813][ T9677] bond3: (slave bridge0): failed to get link speed/duplex [ 1016.469685][ T3001] tipc: Disabling bearer [ 1016.484064][T14959] netlink: 16 bytes leftover after parsing attributes in process `syz.1.12410'. [ 1016.495141][ T3001] tipc: Left network mode [ 1016.586065][ T8835] bond2: (slave bridge2): failed to get link speed/duplex [ 1016.696583][ T8835] bond2: (slave bridge2): failed to get link speed/duplex [ 1016.773765][T14969] netlink: 8 bytes leftover after parsing attributes in process `syz.1.12414'. [ 1016.798030][T14962] netlink: 'syz.2.12412': attribute type 21 has an invalid length. [ 1016.824986][T14962] netlink: 132 bytes leftover after parsing attributes in process `syz.2.12412'. [ 1016.835809][T14962] netlink: 'syz.2.12412': attribute type 1 has an invalid length. [ 1016.882753][T14967] lo speed is unknown, defaulting to 1000 [ 1016.931962][T14970] netlink: 'syz.2.12412': attribute type 1 has an invalid length. [ 1016.941486][T14969] netlink: 8 bytes leftover after parsing attributes in process `syz.1.12414'. [ 1017.015963][T14969] netlink: 8 bytes leftover after parsing attributes in process `syz.1.12414'. [ 1017.120767][T14969] netlink: 8 bytes leftover after parsing attributes in process `syz.1.12414'. [ 1017.144083][T14969] netlink: 8 bytes leftover after parsing attributes in process `syz.1.12414'. [ 1017.405970][ T5823] Bluetooth: hci5: command tx timeout [ 1017.520568][T14923] chnl_net:caif_netlink_parms(): no params data found [ 1017.758313][T15015] netlink: 8 bytes leftover after parsing attributes in process `syz.2.12429'. [ 1017.759852][T15020] vlan2: entered promiscuous mode [ 1017.809352][T18489] net_ratelimit: 6 callbacks suppressed [ 1017.809370][T18489] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 1018.077157][T14923] bridge0: port 1(bridge_slave_0) entered blocking state [ 1018.088574][T14923] bridge0: port 1(bridge_slave_0) entered disabled state [ 1018.106379][T14923] bridge_slave_0: entered allmulticast mode [ 1018.114490][T14923] bridge_slave_0: entered promiscuous mode [ 1018.157636][T14923] bridge0: port 2(bridge_slave_1) entered blocking state [ 1018.183395][T14923] bridge0: port 2(bridge_slave_1) entered disabled state [ 1018.197679][T14923] bridge_slave_1: entered allmulticast mode [ 1018.209880][T14923] bridge_slave_1: entered promiscuous mode [ 1018.308548][T14923] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1018.358914][T14923] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1018.568883][T15064] vlan2: entered promiscuous mode [ 1018.648794][T14923] team0: Port device team_slave_0 added [ 1018.702559][T14923] team0: Port device team_slave_1 added [ 1018.747529][T15075] netlink: 8 bytes leftover after parsing attributes in process `syz.4.12445'. [ 1018.851556][ T5829] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 1018.872066][T14923] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1018.927069][T14923] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1018.985220][T14923] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1019.107962][ T3509] bond3: (slave bridge0): failed to get link speed/duplex [ 1019.129728][T15092] netlink: 28 bytes leftover after parsing attributes in process `syz.2.12452'. [ 1019.146026][T14923] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1019.148122][T15092] netlink: 28 bytes leftover after parsing attributes in process `syz.2.12452'. [ 1019.166937][T14923] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1019.225916][T14923] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1019.301264][ T3001] hsr_slave_0: left promiscuous mode [ 1019.333674][ T3001] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1019.339839][T15108] netlink: 36 bytes leftover after parsing attributes in process `syz.4.12455'. [ 1019.482290][T15116] netlink: 16 bytes leftover after parsing attributes in process `syz.1.12458'. [ 1019.491616][ T5823] Bluetooth: hci5: command tx timeout [ 1019.510390][ T8816] smc: removing ib device syz1 [ 1019.601209][ T3001] team0 (unregistering): Port device team_slave_1 removed [ 1019.629836][ T3001] team0 (unregistering): Port device team_slave_0 removed [ 1019.799387][T15092] dummy0: entered promiscuous mode [ 1019.815257][T15092] team0: entered promiscuous mode [ 1019.820921][T15092] team_slave_0: entered promiscuous mode [ 1019.826970][T15092] team_slave_1: entered promiscuous mode [ 1019.835173][T15092] debugfs: 'hsr1' already exists in 'hsr' [ 1019.841109][T15092] Cannot create hsr debugfs directory [ 1019.851483][T15092] hsr1: Slave A (dummy0) is not up; please bring it up to get a fully working HSR network [ 1019.861661][T15092] hsr1: Slave B (team0) is not up; please bring it up to get a fully working HSR network [ 1019.901853][T24858] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 1019.997860][ T8560] bond3: (slave bridge0): failed to get link speed/duplex [ 1020.119017][T14923] hsr_slave_0: entered promiscuous mode [ 1020.141615][T15141] netlink: 'syz.2.12462': attribute type 1 has an invalid length. [ 1020.165283][T14923] hsr_slave_1: entered promiscuous mode [ 1020.267213][T15141] workqueue: Failed to create a rescuer kthread for wq "bond9": -EINTR [ 1020.273549][T15149] netlink: 8 bytes leftover after parsing attributes in process `syz.4.12463'. [ 1020.306422][ T83] bond3: (slave bridge0): failed to get link speed/duplex [ 1020.313611][ T83] bond2: (slave bridge2): failed to get link speed/duplex [ 1020.822330][T15155] lo speed is unknown, defaulting to 1000 [ 1020.929501][ T5829] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 1021.017585][T15175] netlink: 'syz.4.12471': attribute type 5 has an invalid length. [ 1021.524223][T15196] netlink: 'syz.2.12476': attribute type 3 has an invalid length. [ 1021.565766][ T5823] Bluetooth: hci5: command tx timeout [ 1021.804300][T15196] netlink: 'syz.2.12476': attribute type 3 has an invalid length. [ 1021.915634][ T8835] bond3: (slave bridge0): failed to get link speed/duplex [ 1021.950396][ T8835] bond2: (slave bridge2): failed to get link speed/duplex [ 1022.029826][T15210] netlink: 16 bytes leftover after parsing attributes in process `syz.0.12482'. [ 1022.536945][T15230] xt_ecn: cannot match TCP bits for non-tcp packets [ 1022.598500][T15230] netdevsim netdevsim1 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1022.610900][T15230] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1022.733063][T15230] netdevsim netdevsim1 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1022.760655][T15230] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1023.008205][ T2191] net_ratelimit: 3 callbacks suppressed [ 1023.008221][ T2191] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 1023.061597][T15230] netdevsim netdevsim1 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1023.116273][T15230] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1023.136312][T15248] "syz.2.12488" (15248) uses obsolete ecb(arc4) skcipher [ 1023.227767][T15253] netlink: 'syz.0.12490': attribute type 3 has an invalid length. [ 1023.443099][T15230] netdevsim netdevsim1 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1023.466209][T15230] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1023.585684][ T83] bond3: (slave bridge0): failed to get link speed/duplex [ 1023.592887][ T83] bond2: (slave bridge2): failed to get link speed/duplex [ 1023.693571][T14923] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 1023.752749][ T3509] netdevsim netdevsim1 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1023.769063][ T3509] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1023.791085][T14923] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 1023.811714][T14923] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 1023.910786][T15276] __nla_validate_parse: 4 callbacks suppressed [ 1023.910806][T15276] netlink: 8 bytes leftover after parsing attributes in process `syz.4.12493'. [ 1023.990846][T15274] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 1024.004223][T15274] syzkaller1: linktype set to 778 [ 1024.012810][T15280] netlink: 8 bytes leftover after parsing attributes in process `syz.0.12495'. [ 1024.033626][T14923] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 1024.048013][T18486] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 1024.122742][ T8831] bond3: (slave bridge0): failed to get link speed/duplex [ 1024.146162][ T9677] netdevsim netdevsim1 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1024.175905][ T9677] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1024.278904][T15294] sctp: [Deprecated]: syz.2.12497 (pid 15294) Use of int in maxseg socket option. [ 1024.278904][T15294] Use struct sctp_assoc_value instead [ 1024.411779][ T3509] netdevsim netdevsim1 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1024.441000][ T3509] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1024.589875][ T3509] netdevsim netdevsim1 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1024.626965][ T3509] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1024.674585][T15310] netlink: 56 bytes leftover after parsing attributes in process `syz.2.12501'. [ 1024.694377][ T83] bond3: (slave bridge0): failed to get link speed/duplex [ 1024.738191][T15310] netlink: 8 bytes leftover after parsing attributes in process `syz.2.12501'. [ 1024.781536][T15314] netlink: zone id is out of range [ 1024.795657][T15314] netlink: zone id is out of range [ 1024.821126][T15314] netlink: zone id is out of range [ 1024.838012][T15314] netlink: zone id is out of range [ 1024.855429][T15311] bridge_slave_0: left allmulticast mode [ 1024.863306][T15311] bridge_slave_0: left promiscuous mode [ 1024.879394][T15311] bridge0: port 1(bridge_slave_0) entered disabled state [ 1024.900381][T15311] bridge_slave_1: left allmulticast mode [ 1024.928971][T15311] bridge_slave_1: left promiscuous mode [ 1024.940596][T15323] netlink: 156 bytes leftover after parsing attributes in process `syz.1.12504'. [ 1024.956004][T15311] bridge0: port 2(bridge_slave_1) entered disabled state [ 1024.998460][T15311] bond0: (slave bond_slave_0): Releasing backup interface [ 1025.048822][T15311] bond_slave_0: left promiscuous mode [ 1025.076828][T15311] bond0: (slave bond_slave_1): Releasing backup interface [ 1025.089189][T15311] bond_slave_1: left promiscuous mode [ 1025.124486][T15311] team0: Port device team_slave_0 removed [ 1025.161581][T15311] team0: Port device team_slave_1 removed [ 1025.188953][T15311] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1025.204704][T15311] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1025.235079][T15311] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1025.263902][T15311] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1025.291008][T15313] netlink: 48 bytes leftover after parsing attributes in process `syz.2.12501'. [ 1025.403216][ T3001] IPVS: stop unused estimator thread 0... [ 1025.404803][T15323] syzkaller0: entered promiscuous mode [ 1025.446567][T15323] syzkaller0: entered allmulticast mode [ 1025.628335][T15346] FAULT_INJECTION: forcing a failure. [ 1025.628335][T15346] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1025.685743][T15346] CPU: 1 UID: 0 PID: 15346 Comm: syz.0.12507 Not tainted syzkaller #0 PREEMPT(full) [ 1025.685768][T15346] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1025.685778][T15346] Call Trace: [ 1025.685785][T15346] [ 1025.685792][T15346] dump_stack_lvl+0xe8/0x150 [ 1025.685819][T15346] should_fail_ex+0x412/0x560 [ 1025.685843][T15346] _copy_from_iter+0x1d3/0x1670 [ 1025.685875][T15346] ? rcu_is_watching+0x15/0xb0 [ 1025.685901][T15346] ? __pfx__copy_from_iter+0x10/0x10 [ 1025.685929][T15346] ? netlink_sendmsg+0x650/0xb40 [ 1025.685949][T15346] ? skb_put+0x11b/0x210 [ 1025.685973][T15346] netlink_sendmsg+0x6c0/0xb40 [ 1025.685999][T15346] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1025.686017][T15346] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1025.686039][T15346] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1025.686060][T15346] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1025.686079][T15346] ____sys_sendmsg+0xa68/0xad0 [ 1025.686112][T15346] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1025.686143][T15346] ? import_iovec+0x73/0xa0 [ 1025.686169][T15346] ___sys_sendmsg+0x2a5/0x360 [ 1025.686196][T15346] ? __pfx____sys_sendmsg+0x10/0x10 [ 1025.686249][T15346] ? __fget_files+0x2a/0x420 [ 1025.686268][T15346] ? __fget_files+0x3a0/0x420 [ 1025.686294][T15346] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1025.686316][T15346] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1025.686342][T15346] ? __pfx_ksys_write+0x10/0x10 [ 1025.686365][T15346] do_syscall_64+0x14d/0xf80 [ 1025.686383][T15346] ? trace_irq_disable+0x3b/0x150 [ 1025.686402][T15346] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1025.686417][T15346] ? clear_bhb_loop+0x40/0x90 [ 1025.686434][T15346] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1025.686448][T15346] RIP: 0033:0x7efe44f9c799 [ 1025.686463][T15346] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1025.686476][T15346] RSP: 002b:00007efe45db8028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1025.686492][T15346] RAX: ffffffffffffffda RBX: 00007efe45215fa0 RCX: 00007efe44f9c799 [ 1025.686503][T15346] RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000000000000003 [ 1025.686512][T15346] RBP: 00007efe45db8090 R08: 0000000000000000 R09: 0000000000000000 [ 1025.686521][T15346] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1025.686529][T15346] R13: 00007efe45216038 R14: 00007efe45215fa0 R15: 00007fff59de9d08 [ 1025.686552][T15346] [ 1025.956686][T14923] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1025.974543][T14923] 8021q: adding VLAN 0 to HW filter on device team0 [ 1026.013019][T14923] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 1026.023544][T14923] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1026.052829][ T8816] bridge0: port 1(bridge_slave_0) entered blocking state [ 1026.060034][ T8816] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1026.071398][ T8816] bridge0: port 2(bridge_slave_1) entered blocking state [ 1026.078593][ T8816] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1026.250963][T15359] netlink: 'syz.4.12508': attribute type 1 has an invalid length. [ 1026.263314][T15359] netlink: 96 bytes leftover after parsing attributes in process `syz.4.12508'. [ 1026.280248][T15357] netlink: 4 bytes leftover after parsing attributes in process `syz.1.12510'. [ 1026.319483][T15357] netlink: 4 bytes leftover after parsing attributes in process `syz.1.12510'. [ 1026.348642][T15359] netlink: 'syz.4.12508': attribute type 1 has an invalid length. [ 1026.395712][T15359] netlink: 'syz.4.12508': attribute type 8 has an invalid length. [ 1026.409973][T15359] netlink: 582 bytes leftover after parsing attributes in process `syz.4.12508'. [ 1026.594669][T15376] xt_ecn: cannot match TCP bits for non-tcp packets [ 1026.651779][T15376] netdevsim netdevsim1 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1026.675248][T15376] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1026.686716][T15382] xt_ecn: cannot match TCP bits for non-tcp packets [ 1026.758347][T15381] bridge3: entered allmulticast mode [ 1026.881950][T15376] netdevsim netdevsim1 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1026.892260][T15376] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1027.008671][T15376] netdevsim netdevsim1 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1027.028938][T15376] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1027.108509][T14923] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1027.132451][T15399] netlink: 'syz.0.12518': attribute type 22 has an invalid length. [ 1027.162807][T15376] netdevsim netdevsim1 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1027.191930][T15376] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1027.224830][T15404] bridge4: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 1027.262708][T15403] vlan0: entered promiscuous mode [ 1027.312257][ T8831] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1027.328989][T15411] netlink: 'syz.0.12521': attribute type 1 has an invalid length. [ 1027.349088][T15409] netlink: 'syz.0.12521': attribute type 1 has an invalid length. [ 1027.360727][ T8831] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1027.389583][ T8831] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1027.419892][ T8831] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1027.478563][T14923] veth0_vlan: entered promiscuous mode [ 1027.544471][T14923] veth1_vlan: entered promiscuous mode [ 1027.644672][T14923] veth0_macvtap: entered promiscuous mode [ 1027.673045][T14923] veth1_macvtap: entered promiscuous mode [ 1027.703076][T14923] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1027.724587][T14923] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1027.752946][T15426] syzkaller1: entered promiscuous mode [ 1027.759760][T15426] syzkaller1: entered allmulticast mode [ 1027.773941][ T3509] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1027.793575][ T3509] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1027.841513][ T3509] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1027.879314][ T3509] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1027.934008][ T3509] netdevsim netdevsim1 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1027.953336][ T3509] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1027.986228][ T3001] netdevsim netdevsim1 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1027.994719][ T3001] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1028.027230][ T3001] netdevsim netdevsim1 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1028.057083][ T3001] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1028.103102][ T3001] netdevsim netdevsim1 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1028.134804][ T3001] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1028.208008][ T9] net_ratelimit: 160 callbacks suppressed [ 1028.208056][ T9] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 1028.255713][ T8831] bond3: (slave bridge0): failed to get link speed/duplex [ 1028.274938][ T8831] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1028.284664][ T3509] bond2: (slave bridge2): failed to get link speed/duplex [ 1028.303161][ T8831] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1028.528440][T15447] bond1: Removing last arp target with arp_interval on [ 1028.634657][ T8831] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1028.648083][ T8560] bond2: (slave bridge2): failed to get link speed/duplex [ 1028.657205][ T8831] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1028.717963][ T8831] bond3: (slave bridge0): failed to get link speed/duplex [ 1028.785753][ T8831] bond2: (slave bridge2): failed to get link speed/duplex [ 1028.855632][ T8831] bond3: (slave bridge0): failed to get link speed/duplex [ 1028.906727][ T8831] bond2: (slave bridge2): failed to get link speed/duplex [ 1028.995791][ T8831] bond3: (slave bridge0): failed to get link speed/duplex [ 1029.036124][ T8816] bond2: (slave bridge2): failed to get link speed/duplex [ 1029.160937][T15484] netlink: 'syz.3.12534': attribute type 1 has an invalid length. [ 1029.209820][T15484] netlink: 'syz.3.12534': attribute type 2 has an invalid length. [ 1029.262227][T15487] __nla_validate_parse: 12 callbacks suppressed [ 1029.262246][T15487] netlink: 12 bytes leftover after parsing attributes in process `syz.3.12534'. [ 1029.287581][T15484] netlink: 'syz.3.12534': attribute type 1 has an invalid length. [ 1029.323827][T15487] netlink: 28 bytes leftover after parsing attributes in process `syz.3.12534'. [ 1029.344494][T15490] xt_ecn: cannot match TCP bits for non-tcp packets [ 1029.368677][T15484] netlink: 'syz.3.12534': attribute type 3 has an invalid length. [ 1029.387320][T15487] netlink: 12 bytes leftover after parsing attributes in process `syz.3.12534'. [ 1029.410165][T15487] netlink: 28 bytes leftover after parsing attributes in process `syz.3.12534'. [ 1029.430409][T15487] netlink: 'syz.3.12534': attribute type 6 has an invalid length. [ 1029.488087][T21827] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 1029.500813][ T3297] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 1029.513185][ T3297] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 1029.522814][ T3297] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 1029.533127][ T3297] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 1029.656999][T15495] netdevsim netdevsim0 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1029.685730][T15495] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1029.790244][T15507] netlink: 8 bytes leftover after parsing attributes in process `syz.3.12539'. [ 1029.823793][T15507] syzkaller1: entered promiscuous mode [ 1029.829875][T15507] syzkaller1: entered allmulticast mode [ 1029.879655][T15495] netdevsim netdevsim0 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1029.890267][T15495] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1030.058123][T15495] netdevsim netdevsim0 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1030.070587][T15495] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1030.149343][T15497] lo speed is unknown, defaulting to 1000 [ 1030.312161][T15495] netdevsim netdevsim0 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1030.333331][T15495] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1030.440131][T15545] netlink: 128 bytes leftover after parsing attributes in process `syz.3.12549'. [ 1030.462844][T15546] netlink: 4 bytes leftover after parsing attributes in process `syz.3.12549'. [ 1030.482771][ T8831] netdevsim netdevsim0 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1030.496163][T15545] netlink: 4 bytes leftover after parsing attributes in process `syz.3.12549'. [ 1030.504837][ T8831] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1030.594087][ T83] netdevsim netdevsim0 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1030.605019][ T83] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1030.636835][ T83] netdevsim netdevsim0 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1030.645448][ T83] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1030.678427][ T83] netdevsim netdevsim0 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1030.700257][ T83] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1030.724576][T15562] netlink: 8 bytes leftover after parsing attributes in process `syz.3.12552'. [ 1030.725385][T15549] lo speed is unknown, defaulting to 1000 [ 1030.747030][T15497] chnl_net:caif_netlink_parms(): no params data found [ 1030.793632][T15559] batadv1: entered promiscuous mode [ 1030.799474][T15559] batadv1: entered allmulticast mode [ 1030.806131][T15559] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 1030.915951][T18486] IPVS: starting estimator thread 0... [ 1031.005728][T15577] IPVS: using max 36 ests per chain, 86400 per kthread [ 1031.174278][T15594] xt_ecn: cannot match TCP bits for non-tcp packets [ 1031.189103][T15592] netlink: 12 bytes leftover after parsing attributes in process `syz.4.12561'. [ 1031.203161][T15497] bridge0: port 1(bridge_slave_0) entered blocking state [ 1031.228513][T15497] bridge0: port 1(bridge_slave_0) entered disabled state [ 1031.239835][T15497] bridge_slave_0: entered allmulticast mode [ 1031.248771][T15497] bridge_slave_0: entered promiscuous mode [ 1031.273412][T15497] bridge0: port 2(bridge_slave_1) entered blocking state [ 1031.290769][T15497] bridge0: port 2(bridge_slave_1) entered disabled state [ 1031.307295][T15598] FAULT_INJECTION: forcing a failure. [ 1031.307295][T15598] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1031.310232][T15497] bridge_slave_1: entered allmulticast mode [ 1031.322484][T15598] CPU: 0 UID: 0 PID: 15598 Comm: syz.4.12563 Not tainted syzkaller #0 PREEMPT(full) [ 1031.322508][T15598] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1031.322519][T15598] Call Trace: [ 1031.322527][T15598] [ 1031.322534][T15598] dump_stack_lvl+0xe8/0x150 [ 1031.322565][T15598] should_fail_ex+0x412/0x560 [ 1031.322591][T15598] _copy_from_user+0x2d/0xb0 [ 1031.322617][T15598] ___sys_sendmsg+0x1c6/0x360 [ 1031.322648][T15598] ? __pfx____sys_sendmsg+0x10/0x10 [ 1031.322678][T15598] ? kstrtouint+0x6e/0xe0 [ 1031.322721][T15598] ? __fget_files+0x2a/0x420 [ 1031.322745][T15598] ? __fget_files+0x3a0/0x420 [ 1031.322777][T15598] __sys_sendmmsg+0x27c/0x4e0 [ 1031.322808][T15598] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1031.322830][T15598] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 1031.322878][T15598] ? ksys_write+0x242/0x270 [ 1031.322899][T15598] ? __pfx_ksys_write+0x10/0x10 [ 1031.322922][T15598] __x64_sys_sendmmsg+0xa0/0xc0 [ 1031.322949][T15598] do_syscall_64+0x14d/0xf80 [ 1031.322981][T15598] ? trace_irq_disable+0x3b/0x150 [ 1031.323006][T15598] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1031.323028][T15598] ? clear_bhb_loop+0x40/0x90 [ 1031.323091][T15598] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1031.323152][T15598] RIP: 0033:0x7f2d31d9c799 [ 1031.323179][T15598] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1031.323197][T15598] RSP: 002b:00007f2d32c84028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1031.323217][T15598] RAX: ffffffffffffffda RBX: 00007f2d32015fa0 RCX: 00007f2d31d9c799 [ 1031.323230][T15598] RDX: 0000000000000001 RSI: 0000200000009a00 RDI: 0000000000000003 [ 1031.323241][T15598] RBP: 00007f2d32c84090 R08: 0000000000000000 R09: 0000000000000000 [ 1031.323252][T15598] R10: 00000000240488d1 R11: 0000000000000246 R12: 0000000000000001 [ 1031.323264][T15598] R13: 00007f2d32016038 R14: 00007f2d32015fa0 R15: 00007ffcb236dc98 [ 1031.323292][T15598] [ 1031.530928][T15497] bridge_slave_1: entered promiscuous mode [ 1031.572737][ T5823] Bluetooth: hci4: command tx timeout [ 1031.579358][T15497] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1031.666753][T15594] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1031.689463][T15497] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1031.735273][T15497] team0: Port device team_slave_0 added [ 1031.768502][T15594] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1031.786709][T15497] team0: Port device team_slave_1 added [ 1031.792517][T15613] netlink: 'syz.4.12568': attribute type 1 has an invalid length. [ 1031.856980][T15497] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1031.864536][T15497] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1031.892334][T15497] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1031.937371][T15594] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1031.959487][T15497] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1031.967645][T15497] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1031.994897][T15497] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1032.852155][T15594] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1033.000524][T15497] hsr_slave_0: entered promiscuous mode [ 1033.023381][T15641] nbd: illegal input index -1113835520 [ 1033.027933][T15497] hsr_slave_1: entered promiscuous mode [ 1033.036037][T15497] debugfs: 'hsr0' already exists in 'hsr' [ 1033.041800][T15497] Cannot create hsr debugfs directory [ 1033.159230][ T8831] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1033.250650][ T8831] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1033.326993][ T8831] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1033.358052][ T3001] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1033.407675][ T2191] net_ratelimit: 24 callbacks suppressed [ 1033.407694][ T2191] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 1033.618817][T15666] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1033.641857][T15666] bond_slave_0: left promiscuous mode [ 1033.645757][T15676] sctp: [Deprecated]: syz.3.12589 (pid 15676) Use of int in maxseg socket option. [ 1033.645757][T15676] Use struct sctp_assoc_value instead [ 1033.648929][ T5823] Bluetooth: hci4: command tx timeout [ 1033.681651][T15666] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1033.705405][T15666] bond_slave_1: left promiscuous mode [ 1033.721289][T15666] bond0 (unregistering): Released all slaves [ 1033.800733][T15676] pim6reg: entered allmulticast mode [ 1033.809356][T15687] xt_bpf: check failed: parse error [ 1033.846861][T15676] pim6reg: left allmulticast mode [ 1033.915798][ T8831] bond3: (slave bridge0): failed to get link speed/duplex [ 1033.958875][ T8831] bond2: (slave bridge2): failed to get link speed/duplex [ 1034.365130][ T3509] gretap0 (unregistering): left promiscuous mode [ 1034.447104][T24858] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 1034.768943][ T3509] bond0 (unregistering): (slave c5): Releasing backup interface [ 1034.789606][ T3509] : left promiscuous mode [ 1034.806027][ T3509] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1034.815192][ T3509] bond_slave_1: left promiscuous mode [ 1034.821638][ T3509] bond0 (unregistering): Released all slaves [ 1034.834905][ T3509] bond1 (unregistering): Released all slaves [ 1034.853785][ T3509] bond2 (unregistering): Released all slaves [ 1034.873620][ T3509] bond3 (unregistering): Released all slaves [ 1034.895407][ T3509] bond4 (unregistering): Released all slaves [ 1034.946066][ T8816] bond3: (slave bridge0): failed to get link speed/duplex [ 1034.965984][ T8816] bond2: (slave bridge2): failed to get link speed/duplex [ 1035.025349][ T3509] tipc: Left network mode [ 1035.066865][ T3001] bond3: (slave bridge0): failed to get link speed/duplex [ 1035.081749][ T3001] bond2: (slave bridge2): failed to get link speed/duplex [ 1035.376708][ T8816] bond3: (slave bridge0): failed to get link speed/duplex [ 1035.395849][T15497] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 1035.437085][T15497] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 1035.488253][ T2191] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 1035.524165][T15497] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 1035.552790][T15497] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 1035.617509][T15753] __nla_validate_parse: 4 callbacks suppressed [ 1035.617526][T15753] netlink: 8 bytes leftover after parsing attributes in process `syz.0.12612'. [ 1035.677375][T15756] xt_TCPMSS: Only works on TCP SYN packets [ 1035.683597][T15753] xt_TCPMSS: Only works on TCP SYN packets [ 1035.725775][ T5823] Bluetooth: hci4: command tx timeout [ 1035.733332][T15760] vlan2: entered promiscuous mode [ 1035.747747][T15760] bridge0: entered promiscuous mode [ 1035.822822][T15772] netlink: 8 bytes leftover after parsing attributes in process `syz.4.12616'. [ 1036.251287][T15795] netlink: 20 bytes leftover after parsing attributes in process `syz.3.12624'. [ 1036.320270][T15497] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1036.437822][T15806] xt_ecn: cannot match TCP bits for non-tcp packets [ 1036.563238][T15497] 8021q: adding VLAN 0 to HW filter on device team0 [ 1036.588338][T15812] netdevsim netdevsim0 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1036.613954][T15812] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1036.622699][T15817] netlink: 216 bytes leftover after parsing attributes in process `syz.1.12632'. [ 1036.646476][T15817] netlink: 24 bytes leftover after parsing attributes in process `syz.1.12632'. [ 1036.664865][T15817] netlink: 16 bytes leftover after parsing attributes in process `syz.1.12632'. [ 1036.681630][ T3509] hsr_slave_0: left promiscuous mode [ 1036.693907][ T3509] hsr_slave_1: left promiscuous mode [ 1036.717293][ T3509] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1036.731115][ T3509] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1036.766597][T15824] netlink: 8 bytes leftover after parsing attributes in process `syz.1.12632'. [ 1036.777301][T15828] netlink: 8 bytes leftover after parsing attributes in process `syz.3.12634'. [ 1036.972078][ T3509] team0 (unregistering): Port device team_slave_1 removed [ 1036.985679][ T3509] team0 (unregistering): Port device team_slave_0 removed [ 1037.102136][ T3001] bridge0: port 1(bridge_slave_0) entered blocking state [ 1037.109287][ T3001] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1037.130024][T15812] netdevsim netdevsim0 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1037.140096][T15812] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1037.291251][ T3001] bridge0: port 2(bridge_slave_1) entered blocking state [ 1037.298431][ T3001] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1037.351173][T15812] netdevsim netdevsim0 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1037.386028][T15812] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1037.534942][T15812] netdevsim netdevsim0 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1037.568991][T15812] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1037.672633][ T3509] IPVS: stop unused estimator thread 0... [ 1037.813671][ T5823] Bluetooth: hci4: command tx timeout [ 1037.824288][ T3001] netdevsim netdevsim0 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1037.845453][ T3001] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1037.913197][ T8831] netdevsim netdevsim0 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1037.938807][T15867] netlink: 8 bytes leftover after parsing attributes in process `syz.4.12645'. [ 1037.955810][ T8831] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1037.989591][ T8831] netdevsim netdevsim0 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1038.046289][ T8831] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1038.069328][ T83] netdevsim netdevsim0 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1038.092894][ T83] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1038.118958][T15497] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1038.236694][T15497] veth0_vlan: entered promiscuous mode [ 1038.261693][T15497] veth1_vlan: entered promiscuous mode [ 1038.309559][T15497] veth0_macvtap: entered promiscuous mode [ 1038.328005][T15497] veth1_macvtap: entered promiscuous mode [ 1038.383552][T15497] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1038.412781][T15497] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1038.461227][ T3509] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1038.481334][ T3509] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1038.507632][ T3509] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1038.527119][ T3509] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1038.567238][ T8831] net_ratelimit: 20 callbacks suppressed [ 1038.567257][ T8831] bond2: (slave bridge2): failed to get link speed/duplex [ 1038.608504][T24858] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 1038.656740][ T8831] bond3: (slave bridge0): failed to get link speed/duplex [ 1038.705990][ T8831] bond2: (slave bridge2): failed to get link speed/duplex [ 1038.773592][ T3001] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1038.788818][T15902] netlink: 8 bytes leftover after parsing attributes in process `syz.0.12656'. [ 1038.791584][ T3001] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1038.842120][ T8831] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1038.855769][ T8831] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1038.915966][ T8816] bond3: (slave bridge0): failed to get link speed/duplex [ 1038.936513][ T8816] bond2: (slave bridge2): failed to get link speed/duplex [ 1038.992833][T15908] netlink: 'syz.0.12659': attribute type 3 has an invalid length. [ 1039.023000][T15908] netlink: 'syz.0.12659': attribute type 3 has an invalid length. [ 1039.033836][T15911] netlink: 'syz.3.12661': attribute type 2 has an invalid length. [ 1039.053469][T15916] gretap1: entered promiscuous mode [ 1039.088879][ T8831] bond2: (slave bridge2): failed to get link speed/duplex [ 1039.135987][ T3001] bond3: (slave bridge0): failed to get link speed/duplex [ 1039.196151][T15925] gretap0: entered promiscuous mode [ 1039.226724][ T3001] bond2: (slave bridge2): failed to get link speed/duplex [ 1039.268737][ T3001] bond3: (slave bridge0): failed to get link speed/duplex [ 1039.315135][T15931] syzkaller0: entered promiscuous mode [ 1039.362732][T15931] syzkaller0: entered allmulticast mode [ 1039.532733][T15937] sctp: [Deprecated]: syz.0.12668 (pid 15937) Use of int in max_burst socket option. [ 1039.532733][T15937] Use struct sctp_assoc_value instead [ 1040.284653][T15978] syzkaller0: entered promiscuous mode [ 1040.293760][T15978] syzkaller0: entered allmulticast mode [ 1040.428752][T16003] geneve2: entered promiscuous mode [ 1040.434005][T16003] geneve2: entered allmulticast mode [ 1040.547386][T16011] FAULT_INJECTION: forcing a failure. [ 1040.547386][T16011] name failslab, interval 1, probability 0, space 0, times 0 [ 1040.561075][T16011] CPU: 0 UID: 0 PID: 16011 Comm: syz.0.12694 Not tainted syzkaller #0 PREEMPT(full) [ 1040.561101][T16011] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1040.561113][T16011] Call Trace: [ 1040.561121][T16011] [ 1040.561129][T16011] dump_stack_lvl+0xe8/0x150 [ 1040.561159][T16011] should_fail_ex+0x412/0x560 [ 1040.561186][T16011] should_failslab+0xa8/0x100 [ 1040.561211][T16011] __kvmalloc_node_noprof+0x178/0x8a0 [ 1040.561231][T16011] ? nla_strdup+0xb8/0x140 [ 1040.561254][T16011] ? nf_tables_newchain+0x1c7a/0x2890 [ 1040.561298][T16011] nf_tables_newchain+0x1c7a/0x2890 [ 1040.561344][T16011] ? __pfx_nf_tables_newchain+0x10/0x10 [ 1040.561393][T16011] ? nft_trans_table_add+0x230/0x430 [ 1040.561427][T16011] ? nfnl_pernet+0x23/0x240 [ 1040.561455][T16011] ? __nla_parse+0x40/0x60 [ 1040.561484][T16011] nfnetlink_rcv+0x1240/0x27b0 [ 1040.561536][T16011] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 1040.561573][T16011] ? ref_tracker_free+0x693/0x840 [ 1040.561623][T16011] ? __netlink_deliver_tap+0x807/0x850 [ 1040.561645][T16011] ? netlink_deliver_tap+0x2e/0x1b0 [ 1040.561684][T16011] netlink_unicast+0x80f/0x9b0 [ 1040.561714][T16011] ? __pfx_netlink_unicast+0x10/0x10 [ 1040.561736][T16011] ? netlink_sendmsg+0x650/0xb40 [ 1040.561756][T16011] ? skb_put+0x11b/0x210 [ 1040.561784][T16011] netlink_sendmsg+0x813/0xb40 [ 1040.561815][T16011] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1040.561840][T16011] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1040.561865][T16011] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1040.561887][T16011] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1040.561908][T16011] ____sys_sendmsg+0xa68/0xad0 [ 1040.561943][T16011] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1040.561979][T16011] ? import_iovec+0x73/0xa0 [ 1040.562008][T16011] ___sys_sendmsg+0x2a5/0x360 [ 1040.562040][T16011] ? __pfx____sys_sendmsg+0x10/0x10 [ 1040.562101][T16011] ? __fget_files+0x2a/0x420 [ 1040.562125][T16011] ? __fget_files+0x3a0/0x420 [ 1040.562160][T16011] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1040.562189][T16011] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1040.562225][T16011] ? __pfx_ksys_write+0x10/0x10 [ 1040.562256][T16011] do_syscall_64+0x14d/0xf80 [ 1040.562286][T16011] ? trace_irq_disable+0x3b/0x150 [ 1040.562310][T16011] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1040.562329][T16011] ? clear_bhb_loop+0x40/0x90 [ 1040.562352][T16011] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1040.562371][T16011] RIP: 0033:0x7efe44f9c799 [ 1040.562389][T16011] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1040.562404][T16011] RSP: 002b:00007efe45db8028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1040.562425][T16011] RAX: ffffffffffffffda RBX: 00007efe45215fa0 RCX: 00007efe44f9c799 [ 1040.562438][T16011] RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000000000000003 [ 1040.562450][T16011] RBP: 00007efe45db8090 R08: 0000000000000000 R09: 0000000000000000 [ 1040.562461][T16011] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1040.562471][T16011] R13: 00007efe45216038 R14: 00007efe45215fa0 R15: 00007fff59de9d08 [ 1040.562502][T16011] [ 1040.929309][T16014] ip6t_srh: unknown srh match flags 4000 [ 1041.066752][T16020] __nla_validate_parse: 11 callbacks suppressed [ 1041.066772][T16020] netlink: 12 bytes leftover after parsing attributes in process `syz.3.12699'. [ 1041.279970][T16027] netlink: 12 bytes leftover after parsing attributes in process `syz.4.12700'. [ 1041.343070][T16033] dvmrp1: entered allmulticast mode [ 1041.456872][T16043] netlink: 16 bytes leftover after parsing attributes in process `syz.4.12708'. [ 1041.557686][T16045] lo speed is unknown, defaulting to 1000 [ 1041.725988][T16052] bond_slave_0: entered promiscuous mode [ 1041.731668][T16052] bond_slave_1: entered promiscuous mode [ 1041.791829][T16052] vlan3: entered promiscuous mode [ 1041.807549][T16061] netlink: 12 bytes leftover after parsing attributes in process `syz.1.12714'. [ 1041.807956][T16052] bond0: entered promiscuous mode [ 1041.828862][T16062] netlink: 'syz.2.12712': attribute type 10 has an invalid length. [ 1041.864911][T16058] netlink: 16186 bytes leftover after parsing attributes in process `syz.4.12713'. [ 1041.879621][T16063] netlink: 16186 bytes leftover after parsing attributes in process `syz.4.12713'. [ 1041.992478][T16062] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 1042.002339][T16071] netlink: 'syz.4.12716': attribute type 1 has an invalid length. [ 1042.085960][T16075] bond1: (slave vxcan5): The slave device specified does not support setting the MAC address [ 1042.097433][T16075] bond1: (slave vxcan5): Error -95 calling set_mac_address [ 1042.115405][T16071] netlink: 20 bytes leftover after parsing attributes in process `syz.4.12716'. [ 1042.187585][T16077] netlink: 'syz.3.12720': attribute type 21 has an invalid length. [ 1042.195867][T16077] netlink: 156 bytes leftover after parsing attributes in process `syz.3.12720'. [ 1042.248215][T16075] netlink: 28 bytes leftover after parsing attributes in process `syz.4.12716'. [ 1042.254100][T16080] team0: Device veth3 is up. Set it down before adding it as a team port [ 1042.349720][T16089] netlink: 12 bytes leftover after parsing attributes in process `syz.3.12721'. [ 1042.405432][T16071] bond1: (slave bridge4): Enslaving as an active interface with a down link [ 1042.466523][T16075] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1042.777732][T16108] lo speed is unknown, defaulting to 1000 [ 1042.831203][T16123] bond_slave_0: entered promiscuous mode [ 1042.837001][T16123] bond_slave_1: entered promiscuous mode [ 1042.842743][T16123] dummy0: entered promiscuous mode [ 1042.855433][T16123] vlan2: entered promiscuous mode [ 1042.860713][T16123] bond0: entered promiscuous mode [ 1042.931176][T16120] lo speed is unknown, defaulting to 1000 [ 1043.297373][T16149] gretap0: entered promiscuous mode [ 1043.304066][T16149] debugfs: 'hsr1' already exists in 'hsr' [ 1043.310876][T16149] Cannot create hsr debugfs directory [ 1043.321527][T16149] hsr1: entered promiscuous mode [ 1043.513514][T16158] xt_ecn: cannot match TCP bits for non-tcp packets [ 1043.541416][T16158] netdevsim netdevsim0 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1043.554803][T16158] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1043.717084][T16158] netdevsim netdevsim0 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1043.753161][T16158] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1043.785959][ T8816] net_ratelimit: 47 callbacks suppressed [ 1043.785979][ T8816] bond3: (slave bridge0): failed to get link speed/duplex [ 1043.837037][T16158] netdevsim netdevsim0 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1043.864738][T16158] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1043.950264][T16179] bridge0: port 2(bridge_slave_1) entered disabled state [ 1043.957708][T16179] bridge0: port 1(bridge_slave_0) entered disabled state [ 1043.967146][ T2191] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 1043.990404][T16179] bridge0: entered allmulticast mode [ 1044.016445][ T8816] bond3: (slave bridge0): failed to get link speed/duplex [ 1044.024083][T16185] bridge_slave_1: left allmulticast mode [ 1044.031728][T16185] bridge_slave_1: left promiscuous mode [ 1044.039472][T16185] bridge0: port 2(bridge_slave_1) entered disabled state [ 1044.072918][T16185] bridge_slave_0: left allmulticast mode [ 1044.080144][T16185] bridge_slave_0: left promiscuous mode [ 1044.095272][T16185] bridge0: port 1(bridge_slave_0) entered disabled state [ 1044.154158][T16158] netdevsim netdevsim0 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1044.164852][T16158] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1044.270108][ T8560] bond2: (slave bridge2): failed to get link speed/duplex [ 1044.299882][ T8831] bond3: (slave bridge0): failed to get link speed/duplex [ 1044.311468][T16191] FAULT_INJECTION: forcing a failure. [ 1044.311468][T16191] name failslab, interval 1, probability 0, space 0, times 0 [ 1044.325004][T16191] CPU: 0 UID: 0 PID: 16191 Comm: syz.1.12749 Not tainted syzkaller #0 PREEMPT(full) [ 1044.325026][T16191] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1044.325035][T16191] Call Trace: [ 1044.325041][T16191] [ 1044.325047][T16191] dump_stack_lvl+0xe8/0x150 [ 1044.325071][T16191] should_fail_ex+0x412/0x560 [ 1044.325092][T16191] should_failslab+0xa8/0x100 [ 1044.325111][T16191] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 1044.325133][T16191] ? __alloc_skb+0x186/0x7d0 [ 1044.325151][T16191] ? __alloc_skb+0x1d0/0x7d0 [ 1044.325166][T16191] ? __local_bh_enable_ip+0xd0/0x130 [ 1044.325189][T16191] __alloc_skb+0x1d0/0x7d0 [ 1044.325213][T16191] netlink_sendmsg+0x5d4/0xb40 [ 1044.325237][T16191] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1044.325255][T16191] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1044.325273][T16191] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1044.325291][T16191] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1044.325308][T16191] ____sys_sendmsg+0xa68/0xad0 [ 1044.325335][T16191] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1044.325363][T16191] ? import_iovec+0x73/0xa0 [ 1044.325386][T16191] ___sys_sendmsg+0x2a5/0x360 [ 1044.325410][T16191] ? __pfx____sys_sendmsg+0x10/0x10 [ 1044.325459][T16191] ? __fget_files+0x2a/0x420 [ 1044.325477][T16191] ? __fget_files+0x3a0/0x420 [ 1044.325508][T16191] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1044.325529][T16191] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1044.325555][T16191] ? __pfx_ksys_write+0x10/0x10 [ 1044.325578][T16191] do_syscall_64+0x14d/0xf80 [ 1044.325595][T16191] ? trace_irq_disable+0x3b/0x150 [ 1044.325614][T16191] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1044.325628][T16191] ? clear_bhb_loop+0x40/0x90 [ 1044.325645][T16191] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1044.325658][T16191] RIP: 0033:0x7fdf6ad9c799 [ 1044.325674][T16191] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1044.325686][T16191] RSP: 002b:00007fdf6bc4e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1044.325702][T16191] RAX: ffffffffffffffda RBX: 00007fdf6b015fa0 RCX: 00007fdf6ad9c799 [ 1044.325712][T16191] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000006 [ 1044.325721][T16191] RBP: 00007fdf6bc4e090 R08: 0000000000000000 R09: 0000000000000000 [ 1044.325729][T16191] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1044.325737][T16191] R13: 00007fdf6b016038 R14: 00007fdf6b015fa0 R15: 00007ffce498ed38 [ 1044.325761][T16191] [ 1044.595713][ T3509] bond2: (slave bridge2): failed to get link speed/duplex [ 1044.638390][ T8816] netdevsim netdevsim0 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1044.663581][ T8816] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1044.681591][T16198] dvmrp1: entered allmulticast mode [ 1044.702875][ T8831] netdevsim netdevsim0 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1044.721409][ T8831] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1044.763912][ T8831] bond3: (slave bridge0): failed to get link speed/duplex [ 1044.806381][ T3509] netdevsim netdevsim0 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1044.824980][ T3509] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1044.904849][T16203] hsr0: entered promiscuous mode [ 1044.914570][T16206] hsr_slave_0: left promiscuous mode [ 1044.921836][T16206] hsr_slave_1: left promiscuous mode [ 1044.978460][T16206] hsr0 (unregistering): left promiscuous mode [ 1044.998046][ T3509] bond2: (slave bridge2): failed to get link speed/duplex [ 1045.009664][T13584] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 1045.017070][ T9677] bond3: (slave bridge0): failed to get link speed/duplex [ 1045.026656][ T8831] netdevsim netdevsim0 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1045.036189][ T8831] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1045.146314][T16198] dvmrp1: left allmulticast mode [ 1045.170923][T16219] netlink: 'syz.2.12759': attribute type 4 has an invalid length. [ 1045.538609][T16246] FAULT_INJECTION: forcing a failure. [ 1045.538609][T16246] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1045.555753][T16246] CPU: 1 UID: 0 PID: 16246 Comm: syz.4.12769 Not tainted syzkaller #0 PREEMPT(full) [ 1045.555781][T16246] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1045.555791][T16246] Call Trace: [ 1045.555798][T16246] [ 1045.555806][T16246] dump_stack_lvl+0xe8/0x150 [ 1045.555835][T16246] should_fail_ex+0x412/0x560 [ 1045.555862][T16246] _copy_from_user+0x2d/0xb0 [ 1045.555890][T16246] kstrtouint_from_user+0xd6/0x180 [ 1045.555915][T16246] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 1045.555954][T16246] proc_fail_nth_write+0x8e/0x210 [ 1045.555980][T16246] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 1045.556010][T16246] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 1045.556036][T16246] vfs_write+0x29a/0xb90 [ 1045.556062][T16246] ? __pfx_vfs_write+0x10/0x10 [ 1045.556083][T16246] ? __fget_files+0x2a/0x420 [ 1045.556120][T16246] ? __fget_files+0x3a0/0x420 [ 1045.556142][T16246] ? __fget_files+0x2a/0x420 [ 1045.556176][T16246] ksys_write+0x150/0x270 [ 1045.556198][T16246] ? __pfx_ksys_write+0x10/0x10 [ 1045.556229][T16246] do_syscall_64+0x14d/0xf80 [ 1045.556253][T16246] ? trace_irq_disable+0x3b/0x150 [ 1045.556278][T16246] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1045.556297][T16246] ? clear_bhb_loop+0x40/0x90 [ 1045.556320][T16246] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1045.556338][T16246] RIP: 0033:0x7f2d31d5cfce [ 1045.556357][T16246] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1045.556372][T16246] RSP: 002b:00007f2d32c83fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1045.556392][T16246] RAX: ffffffffffffffda RBX: 00007f2d32c846c0 RCX: 00007f2d31d5cfce [ 1045.556406][T16246] RDX: 0000000000000001 RSI: 00007f2d32c840a0 RDI: 0000000000000004 [ 1045.556417][T16246] RBP: 00007f2d32c84090 R08: 0000000000000000 R09: 0000000000000000 [ 1045.556429][T16246] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1045.556440][T16246] R13: 00007f2d32016038 R14: 00007f2d32015fa0 R15: 00007ffcb236dc98 [ 1045.556472][T16246] [ 1046.063620][T16271] xt_ecn: cannot match TCP bits for non-tcp packets [ 1046.188463][T16271] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1046.363601][T16271] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1046.490590][T16271] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1046.666389][T16271] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1046.763955][T16311] __nla_validate_parse: 19 callbacks suppressed [ 1046.763978][T16311] netlink: 8 bytes leftover after parsing attributes in process `syz.4.12788'. [ 1046.845064][T16322] netlink: 16 bytes leftover after parsing attributes in process `syz.0.12790'. [ 1046.995298][T16317] bridge0: port 2(bridge_slave_1) entered disabled state [ 1047.002809][T16317] bridge0: port 1(bridge_slave_0) entered disabled state [ 1047.270418][T16317] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1047.307406][T16317] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1047.703238][ T3001] netdevsim netdevsim1 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1047.710842][T16325] netlink: 4 bytes leftover after parsing attributes in process `syz.1.12791'. [ 1047.711860][ T3001] netdevsim netdevsim1 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1047.735055][ T3001] netdevsim netdevsim1 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1047.745176][ T3001] netdevsim netdevsim1 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1047.754318][ T3001] netdevsim netdevsim1 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1047.763141][ T3001] netdevsim netdevsim1 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1047.772311][ T3001] netdevsim netdevsim1 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1047.781462][ T3001] netdevsim netdevsim1 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1047.822439][ T3001] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1047.843217][ T3001] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1047.864887][ T3001] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1047.884166][ T3001] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1048.248760][T16350] netlink: 12 bytes leftover after parsing attributes in process `syz.2.12801'. [ 1048.258769][T16350] netlink: 8 bytes leftover after parsing attributes in process `syz.2.12801'. [ 1048.835831][ T3001] net_ratelimit: 48 callbacks suppressed [ 1048.835853][ T3001] bond3: (slave bridge0): failed to get link speed/duplex [ 1048.865848][ T3001] bond2: (slave bridge2): failed to get link speed/duplex [ 1048.965727][ T9677] bond3: (slave bridge0): failed to get link speed/duplex [ 1048.985744][ T9677] bond2: (slave bridge2): failed to get link speed/duplex [ 1049.075641][ T8816] bond3: (slave bridge0): failed to get link speed/duplex [ 1049.095697][ T8816] bond2: (slave bridge2): failed to get link speed/duplex [ 1049.166211][ T798] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 1049.185790][ T9677] bond3: (slave bridge0): failed to get link speed/duplex [ 1049.215666][ T9677] bond2: (slave bridge2): failed to get link speed/duplex [ 1049.295794][ T3001] bond3: (slave bridge0): failed to get link speed/duplex [ 1049.509815][T16302] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1049.691047][T16364] netlink: 'syz.2.12807': attribute type 10 has an invalid length. [ 1049.699205][T16364] netlink: 2 bytes leftover after parsing attributes in process `syz.2.12807'. [ 1049.734910][T16374] netlink: 12 bytes leftover after parsing attributes in process `syz.1.12804'. [ 1049.883951][T16365] lo speed is unknown, defaulting to 1000 [ 1049.951291][T16374] lo speed is unknown, defaulting to 1000 [ 1049.955944][T16386] netlink: 'syz.4.12813': attribute type 11 has an invalid length. [ 1050.160367][ T29] audit: type=1804 audit(1772179605.453:22): pid=16396 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.0.12816" name="/newroot/129/x000000000000000a00000000000000000000012" dev="tmpfs" ino=671 res=1 errno=0 [ 1050.261864][ T29] audit: type=1800 audit(1772179605.453:23): pid=16396 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.12816" name="x000000000000000a00000000000000000000012" dev="tmpfs" ino=671 res=0 errno=0 [ 1050.307911][T16407] tipc: Enabling of bearer rejected, failed to enable media [ 1050.364191][T16410] netlink: 16 bytes leftover after parsing attributes in process `syz.4.12819'. [ 1050.469320][T16407] syzkaller0: entered promiscuous mode [ 1050.475023][T16407] syzkaller0: entered allmulticast mode [ 1050.769562][T16424] netlink: 8 bytes leftover after parsing attributes in process `syz.2.12822'. [ 1050.789381][T16427] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth1_to_team, syncid = 2, id = 0 [ 1050.809128][T16428] FAULT_INJECTION: forcing a failure. [ 1050.809128][T16428] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1050.826778][T16429] FAULT_INJECTION: forcing a failure. [ 1050.826778][T16429] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1050.851904][T16429] CPU: 1 UID: 0 PID: 16429 Comm: syz.2.12822 Not tainted syzkaller #0 PREEMPT(full) [ 1050.851929][T16429] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1050.851940][T16429] Call Trace: [ 1050.851948][T16429] [ 1050.851956][T16429] dump_stack_lvl+0xe8/0x150 [ 1050.851986][T16429] should_fail_ex+0x412/0x560 [ 1050.852013][T16429] _copy_from_iter+0x1d3/0x1670 [ 1050.852048][T16429] ? __pfx__copy_from_iter+0x10/0x10 [ 1050.852070][T16429] ? sock_alloc_send_pskb+0x896/0x990 [ 1050.852101][T16429] ? __pfx__copy_from_iter+0x10/0x10 [ 1050.852127][T16429] ? page_copy_sane+0x16a/0x270 [ 1050.852152][T16429] copy_page_from_iter+0xdd/0x170 [ 1050.852179][T16429] skb_copy_datagram_from_iter+0x306/0x710 [ 1050.852218][T16429] tun_get_user+0xc38/0x3dd0 [ 1050.852255][T16429] ? aa_file_perm+0x192/0x15e0 [ 1050.852283][T16429] ? aa_file_perm+0x50e/0x15e0 [ 1050.852304][T16429] ? __pfx_tun_get_user+0x10/0x10 [ 1050.852326][T16429] ? aa_file_perm+0x192/0x15e0 [ 1050.852354][T16429] ? __lock_acquire+0x6b5/0x2cf0 [ 1050.852385][T16429] ? ref_tracker_alloc+0x35c/0x4c0 [ 1050.852410][T16429] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 1050.852438][T16429] ? tun_get+0x1c/0x2f0 [ 1050.852466][T16429] ? tun_get+0x1c/0x2f0 [ 1050.852488][T16429] ? tun_get+0x1c/0x2f0 [ 1050.852515][T16429] tun_chr_write_iter+0x113/0x200 [ 1050.852542][T16429] vfs_write+0x61d/0xb90 [ 1050.852570][T16429] ? __pfx_vfs_write+0x10/0x10 [ 1050.852597][T16429] ? __fget_files+0x2a/0x420 [ 1050.852635][T16429] ksys_write+0x150/0x270 [ 1050.852655][T16429] ? __pfx_ksys_write+0x10/0x10 [ 1050.852684][T16429] do_syscall_64+0x14d/0xf80 [ 1050.852709][T16429] ? trace_irq_disable+0x3b/0x150 [ 1050.852734][T16429] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1050.852752][T16429] ? clear_bhb_loop+0x40/0x90 [ 1050.852776][T16429] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1050.852794][T16429] RIP: 0033:0x7f5464b9c799 [ 1050.852812][T16429] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1050.852828][T16429] RSP: 002b:00007f546598a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1050.852849][T16429] RAX: ffffffffffffffda RBX: 00007f5464e16090 RCX: 00007f5464b9c799 [ 1050.852861][T16429] RDX: 000000000000fdef RSI: 0000200000000340 RDI: 0000000000000003 [ 1050.852873][T16429] RBP: 00007f546598a090 R08: 0000000000000000 R09: 0000000000000000 [ 1050.852884][T16429] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1050.852895][T16429] R13: 00007f5464e16128 R14: 00007f5464e16090 R15: 00007ffc3b63e2a8 [ 1050.852925][T16429] [ 1050.853304][T16428] CPU: 1 UID: 0 PID: 16428 Comm: syz.3.12823 Not tainted syzkaller #0 PREEMPT(full) [ 1050.853326][T16428] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1050.853337][T16428] Call Trace: [ 1050.853345][T16428] [ 1050.853353][T16428] dump_stack_lvl+0xe8/0x150 [ 1050.853379][T16428] should_fail_ex+0x412/0x560 [ 1050.853406][T16428] _copy_from_iter+0x1d3/0x1670 [ 1050.853432][T16428] ? rcu_is_watching+0x15/0xb0 [ 1050.853462][T16428] ? __pfx__copy_from_iter+0x10/0x10 [ 1050.853493][T16428] ? netlink_sendmsg+0x650/0xb40 [ 1050.853513][T16428] ? skb_put+0x11b/0x210 [ 1050.853540][T16428] netlink_sendmsg+0x6c0/0xb40 [ 1050.853570][T16428] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1050.853595][T16428] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1050.853617][T16428] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1050.853645][T16428] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1050.853664][T16428] ____sys_sendmsg+0xa68/0xad0 [ 1050.853699][T16428] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1050.853731][T16428] ? import_iovec+0x73/0xa0 [ 1050.853759][T16428] ___sys_sendmsg+0x2a5/0x360 [ 1050.853790][T16428] ? __pfx____sys_sendmsg+0x10/0x10 [ 1050.853850][T16428] ? __fget_files+0x2a/0x420 [ 1050.853874][T16428] ? __fget_files+0x3a0/0x420 [ 1050.853908][T16428] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1050.853937][T16428] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1050.853973][T16428] ? __pfx_ksys_write+0x10/0x10 [ 1050.854003][T16428] do_syscall_64+0x14d/0xf80 [ 1050.854026][T16428] ? trace_irq_disable+0x3b/0x150 [ 1050.854050][T16428] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1050.854069][T16428] ? clear_bhb_loop+0x40/0x90 [ 1050.854092][T16428] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1050.854110][T16428] RIP: 0033:0x7f04e919c799 [ 1050.854127][T16428] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1050.854142][T16428] RSP: 002b:00007f04e9fde028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1050.854160][T16428] RAX: ffffffffffffffda RBX: 00007f04e9416090 RCX: 00007f04e919c799 [ 1050.854174][T16428] RDX: 0000000000000000 RSI: 0000200000000240 RDI: 0000000000000006 [ 1050.854186][T16428] RBP: 00007f04e9fde090 R08: 0000000000000000 R09: 0000000000000000 [ 1050.854197][T16428] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1050.854208][T16428] R13: 00007f04e9416128 R14: 00007f04e9416090 R15: 00007ffc0beda7a8 [ 1050.854238][T16428] [ 1050.923249][T16432] netlink: 8 bytes leftover after parsing attributes in process `syz.4.12825'. [ 1051.378648][T16432] netlink: 'syz.4.12825': attribute type 20 has an invalid length. [ 1051.387893][T16435] [ 1051.390243][T16435] ====================================================== [ 1051.397249][T16435] WARNING: possible circular locking dependency detected [ 1051.404264][T16435] syzkaller #0 Not tainted [ 1051.408666][T16435] ------------------------------------------------------ [ 1051.415670][T16435] syz.4.12825/16435 is trying to acquire lock: [ 1051.421802][T16435] ffffffff8fd47df8 (nr_node_list_lock){+...}-{3:3}, at: nr_rt_device_down+0xbe/0x860 [ 1051.431287][T16435] [ 1051.431287][T16435] but task is already holding lock: [ 1051.438669][T16435] ffffffff8fd47d98 (nr_neigh_list_lock){+...}-{3:3}, at: nr_rt_device_down+0x28/0x860 [ 1051.448241][T16435] [ 1051.448241][T16435] which lock already depends on the new lock. [ 1051.448241][T16435] [ 1051.458627][T16435] [ 1051.458627][T16435] the existing dependency chain (in reverse order) is: [ 1051.467622][T16435] [ 1051.467622][T16435] -> #2 (nr_neigh_list_lock){+...}-{3:3}: [ 1051.475519][T16435] _raw_spin_lock_bh+0x36/0x50 [ 1051.480800][T16435] nr_rt_ioctl+0x40c/0xf90 [ 1051.485732][T16435] sock_do_ioctl+0x101/0x320 [ 1051.490842][T16435] sock_ioctl+0x5c6/0x7f0 [ 1051.495680][T16435] __se_sys_ioctl+0xfc/0x170 [ 1051.500787][T16435] do_syscall_64+0x14d/0xf80 [ 1051.505890][T16435] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1051.512291][T16435] [ 1051.512291][T16435] -> #1 (&nr_node->node_lock){+...}-{3:3}: [ 1051.520276][T16435] _raw_spin_lock_bh+0x36/0x50 [ 1051.525555][T16435] nr_rt_ioctl+0x215/0xf90 [ 1051.530483][T16435] sock_do_ioctl+0x101/0x320 [ 1051.535596][T16435] sock_ioctl+0x5c6/0x7f0 [ 1051.540443][T16435] __se_sys_ioctl+0xfc/0x170 [ 1051.545548][T16435] do_syscall_64+0x14d/0xf80 [ 1051.550651][T16435] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1051.557050][T16435] [ 1051.557050][T16435] -> #0 (nr_node_list_lock){+...}-{3:3}: [ 1051.564859][T16435] __lock_acquire+0x15a5/0x2cf0 [ 1051.570228][T16435] lock_acquire+0xf0/0x2e0 [ 1051.575161][T16435] _raw_spin_lock_bh+0x36/0x50 [ 1051.580436][T16435] nr_rt_device_down+0xbe/0x860 [ 1051.585800][T16435] nr_device_event+0x137/0x150 [ 1051.591074][T16435] notifier_call_chain+0x1be/0x400 [ 1051.596703][T16435] __dev_notify_flags+0x16d/0x310 [ 1051.602242][T16435] netif_change_flags+0xe8/0x1a0 [ 1051.607693][T16435] dev_change_flags+0x130/0x260 [ 1051.613055][T16435] dev_ioctl+0x7b4/0x1150 [ 1051.617892][T16435] sock_do_ioctl+0x23e/0x320 [ 1051.622988][T16435] sock_ioctl+0x5c6/0x7f0 [ 1051.627825][T16435] __se_sys_ioctl+0xfc/0x170 [ 1051.632926][T16435] do_syscall_64+0x14d/0xf80 [ 1051.638029][T16435] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1051.644432][T16435] [ 1051.644432][T16435] other info that might help us debug this: [ 1051.644432][T16435] [ 1051.654642][T16435] Chain exists of: [ 1051.654642][T16435] nr_node_list_lock --> &nr_node->node_lock --> nr_neigh_list_lock [ 1051.654642][T16435] [ 1051.668454][T16435] Possible unsafe locking scenario: [ 1051.668454][T16435] [ 1051.675888][T16435] CPU0 CPU1 [ 1051.681237][T16435] ---- ---- [ 1051.686583][T16435] lock(nr_neigh_list_lock); [ 1051.691252][T16435] lock(&nr_node->node_lock); [ 1051.698523][T16435] lock(nr_neigh_list_lock); [ 1051.705706][T16435] lock(nr_node_list_lock); [ 1051.710285][T16435] [ 1051.710285][T16435] *** DEADLOCK *** [ 1051.710285][T16435] [ 1051.718409][T16435] 2 locks held by syz.4.12825/16435: [ 1051.723674][T16435] #0: ffffffff8fbcc848 (rtnl_mutex){+.+.}-{4:4}, at: dev_ioctl+0x7a4/0x1150 [ 1051.732460][T16435] #1: ffffffff8fd47d98 (nr_neigh_list_lock){+...}-{3:3}, at: nr_rt_device_down+0x28/0x860 [ 1051.742464][T16435] [ 1051.742464][T16435] stack backtrace: [ 1051.748346][T16435] CPU: 0 UID: 0 PID: 16435 Comm: syz.4.12825 Not tainted syzkaller #0 PREEMPT(full) [ 1051.748367][T16435] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1051.748377][T16435] Call Trace: [ 1051.748384][T16435] [ 1051.748390][T16435] dump_stack_lvl+0xe8/0x150 [ 1051.748414][T16435] print_circular_bug+0x2e1/0x300 [ 1051.748440][T16435] check_noncircular+0x12e/0x150 [ 1051.748465][T16435] __lock_acquire+0x15a5/0x2cf0 [ 1051.748488][T16435] ? __lock_acquire+0x6b5/0x2cf0 [ 1051.748511][T16435] lock_acquire+0xf0/0x2e0 [ 1051.748528][T16435] ? nr_rt_device_down+0xbe/0x860 [ 1051.748552][T16435] ? nr_rt_device_down+0xbe/0x860 [ 1051.748571][T16435] _raw_spin_lock_bh+0x36/0x50 [ 1051.748591][T16435] ? nr_rt_device_down+0xbe/0x860 [ 1051.748612][T16435] nr_rt_device_down+0xbe/0x860 [ 1051.748631][T16435] ? nr_device_event+0x12f/0x150 [ 1051.748653][T16435] nr_device_event+0x137/0x150 [ 1051.748672][T16435] notifier_call_chain+0x1be/0x400 [ 1051.748699][T16435] __dev_notify_flags+0x16d/0x310 [ 1051.748722][T16435] ? __pfx___dev_notify_flags+0x10/0x10 [ 1051.748742][T16435] ? __dev_change_flags+0x4c6/0x690 [ 1051.748764][T16435] ? __pfx___dev_change_flags+0x10/0x10 [ 1051.748786][T16435] ? full_name_hash+0x92/0xe0 [ 1051.748808][T16435] netif_change_flags+0xe8/0x1a0 [ 1051.748831][T16435] dev_change_flags+0x130/0x260 [ 1051.748853][T16435] dev_ioctl+0x7b4/0x1150 [ 1051.748873][T16435] sock_do_ioctl+0x23e/0x320 [ 1051.748890][T16435] ? __pfx_sock_do_ioctl+0x10/0x10 [ 1051.748905][T16435] ? do_futex+0x333/0x420 [ 1051.748929][T16435] sock_ioctl+0x5c6/0x7f0 [ 1051.748945][T16435] ? __pfx_sock_ioctl+0x10/0x10 [ 1051.748959][T16435] ? __fget_files+0x2a/0x420 [ 1051.748980][T16435] ? __fget_files+0x3a0/0x420 [ 1051.749000][T16435] ? __fget_files+0x2a/0x420 [ 1051.749022][T16435] ? bpf_lsm_file_ioctl+0x9/0x20 [ 1051.749040][T16435] ? __pfx_sock_ioctl+0x10/0x10 [ 1051.749055][T16435] __se_sys_ioctl+0xfc/0x170 [ 1051.749072][T16435] do_syscall_64+0x14d/0xf80 [ 1051.749093][T16435] ? trace_irq_disable+0x3b/0x150 [ 1051.749115][T16435] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1051.749131][T16435] ? clear_bhb_loop+0x40/0x90 [ 1051.749148][T16435] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1051.749163][T16435] RIP: 0033:0x7f2d31d9c799 [ 1051.749178][T16435] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1051.749192][T16435] RSP: 002b:00007f2d32c63028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1051.749210][T16435] RAX: ffffffffffffffda RBX: 00007f2d32016090 RCX: 00007f2d31d9c799 [ 1051.749222][T16435] RDX: 0000200000000000 RSI: 0000000000008914 RDI: 000000000000000c [ 1051.749233][T16435] RBP: 00007f2d31e32bd9 R08: 0000000000000000 R09: 0000000000000000 [ 1051.749243][T16435] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1051.749253][T16435] R13: 00007f2d32016128 R14: 00007f2d32016090 R15: 00007ffcb236dc98 [ 1051.749271][T16435] [ 1052.091610][T16436] gretap2: entered promiscuous mode [ 1053.895648][ T9677] net_ratelimit: 57 callbacks suppressed [ 1053.895669][ T9677] bond2: (slave bridge2): failed to get link speed/duplex [ 1053.925661][ T9677] bond3: (slave bridge0): failed to get link speed/duplex [ 1054.015615][ T8831] bond2: (slave bridge2): failed to get link speed/duplex [ 1054.035674][ T8831] bond3: (slave bridge0): failed to get link speed/duplex [ 1054.125835][ T9677] bond2: (slave bridge2): failed to get link speed/duplex [ 1054.145657][ T8831] bond3: (slave bridge0): failed to get link speed/duplex [ 1054.235656][ T83] bond2: (slave bridge2): failed to get link speed/duplex [ 1054.255605][ T83] bond3: (slave bridge0): failed to get link speed/duplex [ 1054.345628][ T8831] bond2: (slave bridge2): failed to get link speed/duplex [ 1054.365934][ T83] bond3: (slave bridge0): failed to get link speed/duplex [ 1054.448451][ T1299] lec:lec_start_xmit: lec0:No lecd attached [ 1058.915677][ T9677] net_ratelimit: 86 callbacks suppressed [ 1058.915701][ T9677] bond3: (slave bridge0): failed to get link speed/duplex [ 1058.995676][ T8816] bond2: (slave bridge2): failed to get link speed/duplex [ 1059.035711][ T8816] bond3: (slave bridge0): failed to get link speed/duplex [ 1059.105635][ T8816] bond2: (slave bridge2): failed to get link speed/duplex [ 1059.145706][ T9677] bond3: (slave bridge0): failed to get link speed/duplex [ 1059.215628][ T9677] bond2: (slave bridge2): failed to get link speed/duplex [ 1059.255629][ T9677] bond3: (slave bridge0): failed to get link speed/duplex [ 1059.325928][ T8831] bond2: (slave bridge2): failed to get link speed/duplex [ 1059.365665][ T8816] bond3: (slave bridge0): failed to get link speed/duplex [ 1059.435664][ T9677] bond2: (slave bridge2): failed to get link speed/duplex [ 1059.885600][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5440 ms [ 1059.893660][ C0] lec:lec_tx_timeout: lec0 [ 1059.898264][ C0] lec:lec_start_xmit: lec0:No lecd attached