last executing test programs: 10.333168528s ago: executing program 0 (id=3248): socket$kcm(0x23, 0x2, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$inet_tcp(0x2, 0x1, 0x0) shutdown(r1, 0x1) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r3, &(0x7f00000001c0)={0x2, 0x1, @local}, 0x10) connect$inet(r3, &(0x7f0000000480)={0x2, 0x4e22, @multicast1}, 0x10) sendmmsg(r3, &(0x7f0000007fc0), 0x0, 0xc004) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40801}, 0x4000000) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000001240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)={0x14, 0x2, 0x6, 0x201, 0xa, 0x0, {0x0, 0x0, 0x2000}}, 0x14}}, 0x40880) r5 = socket(0x2b, 0x6, 0x1) setsockopt$inet6_MCAST_MSFILTER(r5, 0x29, 0x30, &(0x7f0000000080)={0x2, {{0xa, 0x4e21, 0xffffffda, @mcast1, 0x72}}, 0x1}, 0x20000) bind$inet(r1, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x47) connect$inet(r1, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r7, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000010c0)=@deltaction={0x24, 0x31, 0x1, 0x70bd2b, 0x25dfdbfd, {}, [@TCA_ACT_TAB={0x10, 0x1, [{0xc, 0x1, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0xfffffffd}}]}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) r8 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) r9 = socket$igmp6(0xa, 0x3, 0x2) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r9, 0x8983, &(0x7f0000000300)={0x0, 'syzkaller1\x00', {0x2}}) write$tun(r6, &(0x7f0000000340)=ANY=[@ANYBLOB="000022f0ffffffffffff0180c200000e810000020800450000b0000000000011907800000000e0000001000017c1009c90780100000001000000626abd460020000000000079a7000000400000000000000000002beb790344022cb8c49cc8022b5296be4673eff35df3fdc5a71ed1c7bc91922574977f82c2076edcf39f5550601185fa4afcc815bc21b9e7be1497a9edd45189dacc307c357402a8c5a9c5b5b06cbc715d9569f2b2ee1cf210c588b60723e0cc4e1fdd8d6d18e2c9ee4939689f"], 0xc6) socketpair(0x1d, 0x3, 0x1, &(0x7f00000008c0)={0xffffffffffffffff}) getsockopt$inet_sctp6_SCTP_RECVRCVINFO(r10, 0x84, 0x20, &(0x7f0000000000), &(0x7f0000000040)=0x4) r11 = socket(0x10, 0x3, 0x9) sendmsg$NFT_BATCH(r11, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000013c0)={{0x14, 0x453, 0x1f, 0x0, 0x0, {0x5}}, [], {0x14, 0x3f6}}, 0x28}, 0x1, 0x0, 0x0, 0x64841}, 0x40000) syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000180)={'wlan1\x00'}) 10.027847737s ago: executing program 0 (id=3249): r0 = socket$packet(0x11, 0x2, 0x300) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xe, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r1], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x59, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000000180)=r2, 0x4) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000000)={0x14, 0x38, 0x825, 0x70bd25, 0x25dfdbf9, {0xf}}, 0x14}, 0x1, 0x0, 0x0, 0x4050}, 0x804c050) socket$inet_mptcp(0x2, 0x1, 0x106) r4 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r4, 0x107, 0xf, &(0x7f00000001c0)=0x9, 0x4) sendto$packet(r4, &(0x7f0000000180)="0b032200e0ff25000200475400f6a13bb1000000080088484803", 0x10000, 0x0, &(0x7f0000000140), 0x14) 9.777175581s ago: executing program 0 (id=3253): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x801, 0x4) setsockopt$TIPC_DEST_DROPPABLE(r1, 0x10f, 0x81, &(0x7f0000000140)=0x7, 0x4) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffdfd, {0x0, 0x0, 0x0, r3, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) 9.525617867s ago: executing program 0 (id=3256): socket$kcm(0x23, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$inet_tcp(0x2, 0x1, 0x0) shutdown(r0, 0x1) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f00000001c0)={0x2, 0x1, @local}, 0x10) connect$inet(r2, &(0x7f0000000480)={0x2, 0x4e22, @multicast1}, 0x10) sendmmsg(r2, &(0x7f0000007fc0), 0x800001d, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r3 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) getsockname$packet(r3, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000002c0)=@newlink={0x38, 0x10, 0x439, 0x0, 0xfffffffc, {0x0, 0x0, 0x0, r4, 0x9801, 0x802}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gre={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GRE_REMOTE={0x8, 0x7, @dev={0xac, 0x14, 0x14, 0x29}}]}}}]}, 0x38}}, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r6, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="1c000000010401010000000000000000000004000500010001"], 0x1c}}, 0x40040) close(r6) sendmsg$nl_route(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)=ANY=[@ANYBLOB="7400000010003904020100000014000000000000", @ANYRES32=r4, @ANYBLOB="40100000004104002800128008000100677265001c000280080007000a01010208001400d600000006000f00030000000a000100977774604b7e0000140014007465616d300000000000000000000000040022000800040006000000"], 0x74}, 0x1, 0x0, 0x0, 0x1}, 0x4004000) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40801}, 0x4000000) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000001240)={0x0, 0x0, 0x0}, 0x40880) socket(0x2b, 0x1, 0x1) bind$inet(r0, 0x0, 0x0) connect$inet(r0, 0x0, 0x0) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r8, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r9 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r9, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) socket$igmp6(0xa, 0x3, 0x2) 8.581697722s ago: executing program 0 (id=3262): r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_ro(r0, &(0x7f0000000100)='cpuacct.usage_all\x00', 0x0, 0x0) getsockname$packet(r1, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000640)=0x14) ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f0000000680)={r1, 0xfffffffffffffc01, 0x8001, 0x100000000}) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000b703000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='cpuacct.usage_user\x00', 0x26e1, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000280)={{r2}, &(0x7f00000002c0), &(0x7f0000000240)=r3}, 0x20) r4 = openat$cgroup(r0, &(0x7f0000000140)='syz1\x00', 0x200002, 0x0) r5 = openat$cgroup_ro(r4, &(0x7f0000000040)='memory.stat\x00', 0x275a, 0x0) mmap(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x0, 0x12, r5, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x13, &(0x7f0000000080)=ANY=[@ANYBLOB="18080000000010c3000000000300003e851000000600000018000000", @ANYRES32, @ANYBLOB="00000000000000116608fffffff30500180000000000000000000000000010009500000000000000360a020000000001180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b50a00000000000085000000060000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0xa, 0xff5c, &(0x7f0000000340)=""/222, 0x0, 0x8}, 0x78) 8.514332756s ago: executing program 0 (id=3265): r0 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000000)={'vxcan1\x00', 0x0}) bind$can_j1939(r0, &(0x7f00000000c0)={0x1d, r1}, 0x18) connect$can_j1939(r0, &(0x7f0000000140)={0x1d, r1, 0x0, {0x1, 0xff, 0xa8fe8ad4eea2351f}}, 0x18) sendmmsg(r0, &(0x7f0000006fc0)=[{{0x0, 0x0, &(0x7f00000032c0)=[{&(0x7f0000001fc0)="0f9c053e2b8e2e6dc5d99ce519b06f48aa99ff384e143793398856a5e9bdd2499da0e09adcaa3d08eb068f364915e848d1ef2373f4", 0x35}, {&(0x7f0000002180)="7a18f3abb7b35eafa165ce59affd63a9aea30c3d626e9728e6172c515a1f595e8f3dba8697a3e095b4480a23f03d397f0f77087f0a16eb8e849879c0d9c3d05ba37c436f83a01862c9b01b1bce643c57f98e69856b622066552e26ad4c2fb3c65072f2a98ea14c451e21e8b59989dd1e6deaf2b6183fa4df203afc71fb2f81d0ab18f2e8a80a592af79587f05795524b3e89231e8729dac69e1c641782329895d33ca41cee62deaa29ed1314c9453efe136853c401c2f7fb896a24bff5f3ca0160401562858bc9ec9080d1153db6f38abfd572c18fa0cacc7af087ad1545f79d1c7ea12fb27b13fd28e5d8fad9f3342a15c8b8b97b89f73c897181220af7c527d6153f07ae8c57a769b3a5640a88c19a4740f29090d163cdf74bffcd91fe119b3de72b63e34b2c6a7183b70ceb36c997667b444abce1b9c8de86372e96e46c93e3d9ed4ee9f2b8e3f6bbeb346cf3183bfe8d55a6a543871491fe80dcaaf8e670b3cf4cb2da9378e6aa3f8977a8b8b202a497e57db43180a3770c420f755663b9f7c9010c7cee0abbb89957efb0afe52f955e2974b880e69a01dfa24d8d3caedd3fe2b122cbc1a63d9f94c7f647947507654b4079c3264d2b67f525cc34b14584e44337cad1f6feb8688fbda2b2dc37edaea47b7580a5dfd55f725060f31ba3e05410e41f8f8aa10a1adda39094a6f02a28a1f4e34e11b789e20a9bf3757b2992df816a4c9b5b7a21eade4202133cf24fa58b0efc489d6e13ac2f59366e28c3debcb987e2e3b62109efd467df117b05399e640764e61c5d07019d931a7c8aafa84c76d15f5330f2e37d539722dbbebfa021e36c00ef70015bec55874867d9cd9354f2390d5a03f2287a5f5730d90ea29414c00dae2171bc5efed690e3970217413f5e1d7c2095c635eb8230324cafd5723100490c22677c8e53325a31b3810b89abd8cead14d1e2b04a1cfa71b1c993a86ba9671c84eb28fb6bc6411426fb5bc67958f5ce1a106c6c4c4fabbe5612cfb36fd7fa4f0a75d61ef26501b9d233ace305a08d2480d9d0d66ae662a8f64666e169772e6c48695140277ef426c22d3cc366cdbee2462dbce176f61f6439b37a3cfb32456c0f9256038b0f9d38f6dd3d528fbaee93871189fe947e4597ed62b382b42e7a1682ae839bf977827d24091822b83f93badff91a85edda986d0db1b4c470052f4ce84a6c7b54ff76a219a1e696b561ea1b8c47176a0f91b992d1287414d34682c9debed0e9747a2de92eebaae07c3f23f0fa4ddc2de2b6e37c1961997ebc83a9da5dd95da5bb22b1c617b943b84c1f4f32feda4b73493f67c725cbbc0917007f73f09be574afcbf9a469983a4777b85b41b0fdd2d23bf43eeaccd8fdff5d5ed5aaff9bb3e3788e5f2115b9ccc77d70e3763d14318fb84954b169b86342422f1546a56774d1b50d33efe4a523a6c41b9afa2deea7f1d4ee753cba3834a20fa6468109935824d69bc254157f375e8032fd16630e4abf9349b14f142ecbecf70b2f6e3966e7e870e5df38b290420792984d09a124b99d789d071623153340c3ac22e2cc9783fc9088ce0de937449445db52cba8626b575a970189de0bf08b21c45d33b8fa5bc49a69c728ba940631cd5b296680ffc7c0bedb593e643325484484a30a0c5855ddcb76d06006c909e5f48ee2fc0a50bddbf952458c85d759659bb91f3ea3003637c8d187cfa1f25f10fb500dd977e3c460d406fbd3b30c2d4e0785677db36c5cd0a9cbd7d5ece4193c5e7bdbf53fc6d09e66a9c1acd0ea2cfdc7c67c05debaa385c1137a073274410e1a11dc2a178817bfeeaf7ee5b9784d8f502b371fe556ea12b716029b3715feadfa0575619275ffa573825a1966e532a7357a82088c392c3d2495028483c112d18d8530b048093d52ced28dd67f1972ac7fc1049673f264e01c6dc3c94460d99a0e818f69108878faf2b0ed07c063733fc68b47625dff66f766f8cff7671c5e80451058e54541f9ef43df00b58b6e16bb5f4872ab15039bc13740587e477d55dd87d83f830426dd42b764e3dd11ba8e7aeb24dacb4777cc11da6ff55e2e6b6d0fc686d4ac86bb6a45c8826459f7160633577e1aeb9748cc38da01f02abe5deca98d2a7561ca8f9a3f878c47f0378562d6c0075539cf9d6c8cc1176fd96514a3781c17f97be0292dedc429dba0d3ee7e590f9a85ccc6fdfcc68ae854e87df4bfc548ac6de81cb8282507f500cf7434155c0ccfaf75fc45597834d3a370d232acaf1718f0bf1cbdc8e58679466b3ce6035400a3cbd517bddbf25f02c2727ba3c037c719bb32841ae338cf91aa7e027802e841540398fc68ac4f96b5040386f8c2f471c4a2aa70a8befa401748e3263208558c757e914c2c2a6ad52318b346cd75a953ad5113cfcea1145f3f577c937bbe1989aaba0b1b87236eca8671cd14564ed4553def832d", 0x6c5}], 0x2, &(0x7f0000003340)=ANY=[], 0x180}}], 0x1, 0x4000) 7.806634257s ago: executing program 3 (id=3157): r0 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000240), 0xffffffffffffffff) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f00000002c0)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f00000003c0)=0xffffffffffffffff, 0x12) sendmsg$IEEE802154_START_REQ(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000280)=ANY=[@ANYBLOB="14000000", @ANYRES16=r0, @ANYBLOB="01003469d7fde863b0e066946681cfddce103069"], 0x14}, 0x1, 0x0, 0x0, 0x18005}, 0x0) accept$packet(0xffffffffffffffff, 0x0, &(0x7f0000000000)) r3 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r3, 0x10e, 0xc, &(0x7f00000008c0)={0x1, 0x0, 0x2}, 0x10) r4 = syz_init_net_socket$llc(0x1a, 0x2, 0x0) recvmmsg(r4, &(0x7f0000007980)=[{{0x0, 0x0, 0x0}, 0x9}, {{0x0, 0x0, 0x0}, 0x5}], 0x2, 0x2181, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0x16, 0xc, &(0x7f0000000ac0)=ANY=[@ANYRESDEC=r0, @ANYRESDEC=r2, @ANYBLOB="9d8e9fd2dcf7cf3b08ba15f9a94aa407efa8d4e6e4b9cdbefa21e430a7bd58fe592158b4a9c690f912b0ebb21270cf25dcffb0ae61a625bbd1d1112dcd2cb6f67bd9c7c00218b5edc551a0eeace6752d4d34ff8902f6a2496a865699"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x2c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0xffffff38) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000d80)={0x18, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="1801000021"], 0x0, 0x40, 0x0, 0x0, 0x0, 0xb4a02fe0ce239f93, '\x00', 0x0, 0x2}, 0x94) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000b80)=ANY=[@ANYRES8=r5, @ANYBLOB="c88bc21863aec62b23f553140574aae9e73410ae3d97eb0a3a62959feaa2ac338e8b00fbac9d965ac03a4c5d9cb668b5f1c6316eb539b81839e6559072281159cd61f3cef1c73736748455a0f7e44aea365f5fa20772ab105095b7665d24f3453a9593f20b0c74330cb1f11765e6ed98caaf42c9fabfe6969fd966fbdec60250ca49dc8c7063603222", @ANYRES64=r4, @ANYRES16=r0, @ANYRESOCT=r4, @ANYRES16], 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x1a, 0xf, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000001000000000000000200000018110000", @ANYRES32=r8, @ANYBLOB="0000000000000000b702000014000000b7030000000900000000000055090100000000009500000000000000bf910000000000008a685f8ff0e01df3d1e07af4bab7020000020000008500020084000069ac0000"], &(0x7f0000000180)='GPL\x00', 0x8, 0xff8, &(0x7f0000001e00)=""/4088, 0x0, 0x5a}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xe, 0x0, &(0x7f0000000c40)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000b66ce5630cbfea76614d0000b5d52bf114b5bac6118f4da6390fddeca68947a08938ba655a29b6fdb29a102661d5272ea289123bca24316ddcaa113e567b2c3f8ea4ed343cfb00878470a53f886ed92bc90159dac0fd66efe4a7a35310da555e3cd8e30c26469c34feb01d57d6535dbfbb17c4f3cae2b1dff845e205f63fed8b8b840aa8217a51f153a64cfc", @ANYRES32=r6], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x59, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r7, 0x0, 0x0, 0x0, 0x0}, 0x94) r9 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000d00)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r9, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) r10 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(r11, 0x1, 0x32, &(0x7f0000000180)=r10, 0x4) sendmsg$inet(r12, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x20000000) r13 = bpf$MAP_CREATE(0x0, &(0x7f0000000940)=ANY=[], 0x48) r14 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000780)={0xffffffffffffffff, 0x20, &(0x7f0000000740)={&(0x7f0000000600)=""/204, 0xcc, 0x0, &(0x7f0000000700)=""/21, 0x15}}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f0000000240)=ANY=[@ANYRES32=r14, @ANYRESHEX=r13], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r15, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000800)={0xffffffffffffffff, 0x20, &(0x7f00000007c0)={&(0x7f0000000540)=""/103, 0x67, 0x0, &(0x7f0000000e40)=""/180, 0xb4}}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x28, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r16, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 7.534949995s ago: executing program 4 (id=3278): r0 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newqdisc={0x48, 0x24, 0xf0b, 0x0, 0x25dfdbfe, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}, {0xe, 0x5}}, [@qdisc_kind_options=@q_etf={{0x8}, {0x14, 0x2, @TCA_ETF_PARMS={0x3e, 0x1, {0x0, 0xb, 0x5}}}}, @TCA_RATE={0x6, 0x5, {0x9, 0x6}}]}, 0x48}}, 0x4000010) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x15, 0x1c, &(0x7f0000000d80)=ANY=[@ANYBLOB="18080000e9ff0000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b702000014000000b70300002bb91a0085000000a0000000bc0900000000000045080100002000009500000000000000b7020000000000007b9af8ff00000000b5090000000000007baaf0ff00000000bf2700000000000007080000fffdffffbfa400000000000007040000f0ffffffc40200000800000018220000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7050000080000004608efff76000000bf9800000000000056090000000000008500000000a00000b70000000000000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_reuseport, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) 7.373247457s ago: executing program 4 (id=3279): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000100)=ANY=[@ANYBLOB="ec000000100001002d390d00fedbdf2500000000", @ANYRES32=0x0, @ANYBLOB="8121000000000000140003006e657464657673696d30000000000000b0001680ac00018010000600fa010000060000000900000018000c8014000100930a0000f602000005000000810000000c000700e60000000900000068000c8014000100ffffff7f"], 0xec}}, 0x4000844) (fail_nth: 8) 7.336490826s ago: executing program 4 (id=3280): r0 = socket$l2tp(0x2, 0x2, 0x73) bind$inet(r0, &(0x7f00000002c0)={0x2, 0x4e20, @empty}, 0x10) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @local}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0xc, 0x4, &(0x7f0000000700)=@framed={{0x18, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0xd002}, [@generic={0x91, 0x1, 0x1, 0x37}]}, &(0x7f0000000c40)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x6, '\x00', 0x0, @fallback=0xd, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffeff9}, 0x94) sendmmsg$inet(r0, &(0x7f0000000900)=[{{0x0, 0x0, 0x0}}], 0x40000cf, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=ANY=[@ANYBLOB="1400000042000501"], 0x14}, 0x1, 0x0, 0x0, 0x18050}, 0x44014) recvmmsg(r1, &(0x7f0000004480), 0x40000c2, 0x12, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x2000009, 0x200000006c832, 0xffffffffffffffff, 0x0) sendto(r0, 0x0, 0x0, 0xbf30ccbe67c3e0fc, &(0x7f00000000c0)=@l2tp={0x2, 0x0, @loopback, 0x4}, 0x80) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/ipc\x00') unshare(0x6a040000) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/syz0\x00', 0x200002, 0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000380), 0x12) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="040100001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000240012800b0001006272696467650000140002800800050001200000080001"], 0x104}}, 0x0) 7.119139375s ago: executing program 3 (id=3283): r0 = socket$l2tp6(0xa, 0x2, 0x73) ioctl$sock_inet6_SIOCADDRT(r0, 0x890b, &(0x7f0000000300)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @mcast2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x9, 0x1, 0x10, 0x400, 0x4, 0x40602}) (async) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000680)=@newtaction={0xcc, 0x30, 0xffff, 0x0, 0x0, {}, [{0xb8, 0x1, [@m_police={0x6c, 0x1, 0x0, 0x0, {{0xb}, {0x40, 0x2, 0x0, 0x1, [[@TCA_POLICE_TBF={0x3c, 0x1, {0x0, 0x0, 0x0, 0x0, 0x0, {}, {0x0, 0x1}}}]]}, {0x4}, {0xc}, {0xc}}}, @m_gact={0x48, 0x2, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x1, 0x7069, 0x8, 0x2, 0x1}}]}, {0x4}, {0xc, 0x3, {0x1}}, {0xc}}}]}]}, 0xcc}, 0x1, 0x0, 0x0, 0x4}, 0x0) 6.93836609s ago: executing program 3 (id=3286): socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f00000012c0)=[{0x84, 0x0, 0x0, 0xfffff034}, {0x6, 0x0, 0xc}]}, 0x10) (async) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x6, 0xe, &(0x7f00000008c0)=ANY=[@ANYBLOB="b7020000000d0000bfa30000000000000703000000feffff7a0af0fff8ffff1971a4f0ff00000000b7060000080000006f6400000000000045040400010000001704000001000a00b7040000ff0100006a0a00fe0000000085000000be000000b70000000000000095000000000000009e17f199a68b06d83298a8cdc21ce784909b849d5550ad857d0454d8877a6db61d69f2ffcaa10350e11cb97c8adf1bc9a0c4eeceb9971e43405d621ffbc9ce000000d8ca56b50d0c010d631f6dde53a9a53608c10556e5734eb84049761451ce540c772e2d9f8004e26f7fcc059c062234d5595f6fbaa187b81d1106000000000fd60000fd9ac3d09e29a9d542ca9d85a5c9c88474895d679838def0a83a733dc6a39b63a5ed69d32394c53361d7e43c5cbd80450f859ce8122a79c3e40000b59b0fc46d6cec3c0802882add4e3179bd4a44f231b6d753a7be428ba953df4aece69311687f4122073a236c3a32efa04137d4524847d2638da3261c8162bb7c7824be6195a66d2e17e122040e1100000000928612a29fc691e4f1f7bd053abb885f39381f1759410b1059f05684261f332d606834669b49ec99320ca7712d7e79bd5bf5ed818ecc7640917f6a559a47db608fcf9f6c131b84e41c354c66838f72b9e12d36e996f316f0812ca83efb30c7f6c6d57c4a64590401eec22523dd712c680013e87f649a1ede7142ca9d5d8a8c9f9b440fe4331ad5532c74d9a31a5d737537f7a2caa30581253d14dd3e92af7dc836686365ae01bdec561c0402b67801267a8df97d2f85426a5963d4fa3e26cc05972c162f223f000000d999e80de00fcbcc02d0aed7bb8f7ba337d59c14f39dcd4aad4139ef6425a9367f1bd1467fc6b95a4df7669839771ce9d5788029901e5a79d8b9990ace8f74087f25ad50c46088000000008000"/686], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x3a, 0x10, &(0x7f0000000340), 0xd58495bc, 0x0, 0xffffffffffffffff, 0xffffffffffffff5b}, 0x42) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000c80)={r1, 0x2000012, 0xeff, 0x0, &(0x7f0000000c40)="63eced8e46dc3f2ddf33c9e9b9", 0x0, 0x7ffe, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 6.799318196s ago: executing program 3 (id=3287): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x3, 0x13, &(0x7f0000000400)=@framed={{0x18, 0x2, 0x0, 0x0, 0x10ab6a, 0x0, 0x0, 0x0, 0x4}, [@printk={@x, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xffffffff}, {0x85, 0x0, 0x0, 0x70}}, @printk={@llx, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x5}}]}, &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x8, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x9}, 0x94) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmmsg$inet6(r1, &(0x7f0000000440)=[{{&(0x7f0000000240)={0xa, 0x4e21, 0x2, @private1}, 0x1c, &(0x7f0000000d00)=[{&(0x7f00000002c0)='\n', 0x1}], 0x1}}, {{&(0x7f0000000080)={0xa, 0x4e23, 0x6, @remote, 0x8}, 0x1c, &(0x7f00000001c0)=[{&(0x7f0000000180)="589597c1", 0x4}], 0x1}}], 0x2, 0x40088d4) shutdown(r1, 0x1) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=@newlink={0x50, 0x10, 0x401, 0x70bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, 0x100, 0x46951}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @geneve={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GENEVE_UDP_ZERO_CSUM6_TX={0x5}]}}}, @IFLA_IFNAME={0x14, 0x3, 'geneve1\x00'}]}, 0x50}}, 0x2000000) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x84, &(0x7f00000000c0)={0x0, @in={{0x2, 0x0, @empty}}}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r0, 0x0, 0xe, 0x0, &(0x7f0000000300)="e09f547ed3f02dc1fd3c6487775b", 0x0, 0xa60, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r3 = socket$netlink(0x10, 0x3, 0x9) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)={{0x14, 0x3ec}, [], {0x14, 0x3f8}}, 0x28}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) r4 = socket(0x2, 0x80805, 0x0) r5 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r5, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r4, 0x84, 0x76, &(0x7f00000003c0)={r6, 0x1}, 0x8) getsockopt$inet_sctp6_SCTP_ASSOCINFO(r1, 0x84, 0x1, &(0x7f0000000500)={r6, 0x3, 0x7, 0x86, 0x9, 0x1000}, &(0x7f0000000540)=0x14) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r7, &(0x7f0000000a80)={0x0, 0x0, &(0x7f0000000a40)={&(0x7f0000000980)=ANY=[@ANYBLOB="840000", @ANYRES16=r8, @ANYBLOB="010000ff1f00fbdbdf250100000008000200000000000500050000000000080003000100000048000180050002"], 0x84}}, 0x0) sendmsg$MPTCP_PM_CMD_SET_LIMITS(r3, &(0x7f00000004c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000200)={&(0x7f0000000040)={0x2c, r8, 0x2, 0x70bd26, 0x25dfdbfc, {}, [@MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0xcf}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x6}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0xfffffffd}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000000}, 0x40000) 6.603213004s ago: executing program 3 (id=3289): unshare(0x6a040000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r0, &(0x7f0000000080)={0x0, 0x8408, &(0x7f0000000680)=[{&(0x7f0000000180)="5c00000014006b03c84e21008bf32c19021800f80200000044000200ac14143705251e6182949a36c23d3b48dfd8cdbf9367b498fa51f60a64c9f4d4938037e786a6d0bdd77f6f60c1504bb9189d9193e9bd1c1b780000f8ffffffff", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) 5.341818341s ago: executing program 1 (id=3295): unshare(0x6a040000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r0, &(0x7f0000000080)={0x0, 0x8408, &(0x7f0000000680)=[{&(0x7f0000000180)="5c00000014006b03c84e21008bf32c19021800f80200000044000200ac14143705251e6182949a36c23d3b48dfd8cdbf9367b498fa51f60a64c9f4d4938037e786a6d0bdd77f6f60c1504bb9189d9193e9bd1c1b78000000f8ff0000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) 3.301123742s ago: executing program 2 (id=3305): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x0, 0x12, r0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x3, 0x5, &(0x7f0000000140)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2007}, [@printk={@i, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x5}, {0x85, 0x0, 0x0, 0x62}}]}, &(0x7f0000000000)='syzkaller\x00', 0x5, 0xfd7, &(0x7f0000001e00)=""/4055, 0x40f00}, 0x94) 3.24367283s ago: executing program 2 (id=3306): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000880)=ANY=[@ANYBLOB="12000000010000000800000008"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xd, &(0x7f0000000f80)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005800000085000000a000000095"], &(0x7f0000000340)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r1 = socket(0xa, 0x3, 0xff) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000700)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000010000030900010073797a310000000054000000030a010400000000000000000100ffff0900030073797a31000000022800048008000240000000000800014000000005140003006e7230000000000000000000000000000900010073797a31000000004c000000050a01020000000000000000010020000c00024000000000000000010900010073797a310000000014000480080001400000000408000140000000050b00070066696c746572"], 0xe8}}, 0x0) sendmsg$inet6(r1, &(0x7f0000000080)={&(0x7f0000000000)={0xa, 0xa, 0x5, @mcast2, 0x6}, 0x1c, 0x0, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="280000000000000029000000390000003a020201"], 0x28}, 0x922bac8576bdadce) 3.184108796s ago: executing program 2 (id=3307): clock_gettime(0x0, &(0x7f0000000140)={0x0, 0x0}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x11, 0xa, &(0x7f0000000080)=ANY=[@ANYBLOB="18080000d0ff00000000000000000100851000000600000018470000fcffffff00000000000000006508faff0000000018000000040000000000000000000000950000000000000095"], &(0x7f0000000000)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x8}, 0x94) pselect6(0x40, &(0x7f0000000040)={0x2, 0x1, 0x2, 0x4, 0xff, 0x6, 0x5, 0xfffffffffffffff3}, &(0x7f0000000080)={0x6, 0x1, 0x4, 0xffffffffffffff19, 0x5, 0x1, 0x2, 0x10000}, 0x0, &(0x7f00000001c0)={r0, r1+60000000}, 0x0) 3.085664011s ago: executing program 2 (id=3308): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'lrw(serpent)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="85e39a2f2cd6b8ccc7658ddf897accc136b7", 0x12) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5910fae9d6dcd3292ea54c7b6", 0x10) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x42000, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'pim6reg1\x00', 0x2}) ioctl$TUNSETLINK(r1, 0x400454cd, 0x303) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000006000000000000000000000085000000bc000000850000002a0000"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000200)={r3, 0x0, 0xe, 0x0, &(0x7f0000000100)="54ae1f8219560625baa794a469ce", 0x0, 0x1008, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000140)={'pim6reg1\x00', @multicast}) r4 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'veth0\x00', 0x0}) r6 = socket$igmp(0x2, 0x3, 0x2) setsockopt$inet_IP_XFRM_POLICY(r6, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@remote, @in=@loopback, 0x4e21, 0x0, 0x4e20, 0x0, 0xa, 0x80, 0x60, 0x11}, {0x9, 0x9642, 0x1, 0x401, 0x9, 0x1000, 0x6, 0xfffffffffffffffb}, {0x1, 0x500000000, 0x3, 0x5}, 0xfff, 0x0, 0x2, 0x1}, {{@in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x4d3, 0x3c}, 0x2, @in=@local, 0x0, 0x1, 0x3, 0x1, 0x3, 0x2}}, 0xe8) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=@ipv4_deladdr={0x2c, 0x15, 0x1, 0xfffffffd, 0x0, {0x2, 0x18, 0x0, 0x0, r5}, [@IFA_LABEL={0x14, 0x3, 'veth0\x00'}]}, 0x2c}}, 0x0) close(0x3) 2.707860216s ago: executing program 2 (id=3309): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x3, 0x13, &(0x7f0000000400)=@framed={{0x18, 0x2, 0x0, 0x0, 0x10ab6a, 0x0, 0x0, 0x0, 0x4}, [@printk={@x, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xffffffff}, {0x85, 0x0, 0x0, 0x70}}, @printk={@llx, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x5}}]}, &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x8, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x9}, 0x94) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmmsg$inet6(r1, &(0x7f0000000440)=[{{&(0x7f0000000240)={0xa, 0x4e21, 0x2, @private1}, 0x1c, &(0x7f0000000d00)=[{&(0x7f00000002c0)='\n', 0x1}], 0x1}}, {{&(0x7f0000000080)={0xa, 0x4e23, 0x6, @remote, 0x8}, 0x1c, &(0x7f00000001c0)=[{&(0x7f0000000180)="589597c1", 0x4}], 0x1}}], 0x2, 0x40088d4) shutdown(r1, 0x1) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=@newlink={0x50, 0x10, 0x401, 0x70bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, 0x100, 0x46951}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @geneve={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GENEVE_UDP_ZERO_CSUM6_TX={0x5}]}}}, @IFLA_IFNAME={0x14, 0x3, 'geneve1\x00'}]}, 0x50}}, 0x2000000) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x84, &(0x7f00000000c0)={0x0, @in={{0x2, 0x0, @empty}}}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r0, 0x0, 0xe, 0x0, &(0x7f0000000300)="e09f547ed3f02dc1fd3c6487775b", 0x0, 0xa60, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r3 = socket$netlink(0x10, 0x3, 0x9) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)={{0x14, 0x3ec}, [], {0x14, 0x3f8}}, 0x28}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) r4 = socket(0x2, 0x80805, 0x0) r5 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r5, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r4, 0x84, 0x76, &(0x7f00000003c0)={r6, 0x1}, 0x8) getsockopt$inet_sctp6_SCTP_ASSOCINFO(r1, 0x84, 0x1, &(0x7f0000000500)={r6, 0x3, 0x7, 0x86, 0x9, 0x1000}, &(0x7f0000000540)=0x14) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r7, &(0x7f0000000a80)={0x0, 0x0, &(0x7f0000000a40)={&(0x7f0000000980)=ANY=[@ANYBLOB="84000000", @ANYRES16=r8, @ANYBLOB="010000ff1f00fbdbdf250100000008000200000000000500050000000000080003000100000048000180050002"], 0x84}}, 0x0) sendmsg$MPTCP_PM_CMD_SET_LIMITS(r3, 0x0, 0x40000) 2.489718459s ago: executing program 2 (id=3310): bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x5, 0x4, 0x8, 0xc}, 0x50) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x50) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r0, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0x12, 0x4, 0x4, 0x12}, 0x50) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000a80)={r1, &(0x7f0000000940), &(0x7f0000000a40)=@tcp6=r0}, 0x20) recvmmsg(r0, &(0x7f00000003c0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000000180)=""/52, 0x34}], 0x1}, 0xe}], 0x2, 0x0, 0x0) shutdown(r0, 0x1) bpf$MAP_CREATE(0x0, &(0x7f0000000dc0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) sendmsg$inet(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r3, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r2, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)=[@rights={{0x10}}, @cred={{0x1c}}, @rights={{0x10}}, @rights={{0x10}}], 0x50}, 0x40000002) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x5, 0x3032, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x13, 0x13, &(0x7f0000000080)=ANY=[@ANYBLOB="18080000fa0000000000000000010000851000000600000018000000", @ANYRES32, @ANYBLOB="00000000000000006608000000000000180000000000000000000000000000009500000000000000360a020000000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b50a00000000000085000000060000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0x2, 0xff5c, &(0x7f00000001c0)=""/222, 0x41100, 0x8, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffff97}, 0x78) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xd, &(0x7f0000000040)=ANY=[@ANYBLOB="180100001700000000000000ff00000085000000a800000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000002007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008002010b70400000000000085000000c300000095"], &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x36, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000340)={r5}, 0xc) r6 = socket$inet6(0xa, 0x2, 0x0) close(r6) r7 = socket$l2tp6(0xa, 0x2, 0x73) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r7, 0x29, 0x20, &(0x7f0000000080)={@remote, 0x800, 0x0, 0x3, 0x1, 0x8}, 0x20) setsockopt$inet6_int(r6, 0x29, 0x1000000000021, &(0x7f0000000040)=0x2005, 0x4) sendmsg$inet6(r6, &(0x7f00000000c0)={&(0x7f0000000100)={0xa, 0x4e20, 0x80000, @dev={0xfe, 0x80, '\x00', 0x30}, 0xfffffffb}, 0x1c, 0x0, 0x0, &(0x7f0000000300)=ANY=[], 0x18}, 0x1400c0c0) unshare(0x6a040000) 2.12919631s ago: executing program 4 (id=3311): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000001180)=@mangle={'mangle\x00', 0x64, 0x6, 0x4e0, 0xd0, 0xd0, 0x340, 0x340, 0x270, 0x410, 0x410, 0x410, 0x410, 0x410, 0x6, 0x0, {[{{@ipv6={@dev={0xfe, 0x80, '\x00', 0x44}, @private1, [], [], 'ipvlan1\x00', 'veth1_vlan\x00'}, 0x0, 0xa8, 0xd0, 0x0, {0x0, 0x3a010000}}, @HL={0x28}}, {{@ipv6={@local, @loopback, [0x0, 0x0, 0xff000000], [0x0, 0xffffffff, 0xff], 'tunl0\x00', 'geneve1\x00', {0xff}}, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0x340}}, {{@ipv6={@private0, @remote, [], [], 'veth0_to_team\x00', 'veth1\x00', {}, {}, 0x11, 0x0, 0x3, 0x44}, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@ipv4={'\x00', '\xff\xff', @loopback}, @private1, [0xffffffff, 0xffffffff, 0xffffffff, 0xff000000], [0xff000000, 0xff000000, 0xff, 0xffffff00], 'veth0_to_bridge\x00', 'team_slave_1\x00', {0xff}, {}, 0x2f, 0x6b, 0x5}, 0x0, 0xa8, 0xd0}, @common=@inet=@SYNPROXY={0x28}}, {{@ipv6={@loopback, @private2, [0x0, 0xffffff00], [], 'syzkaller1\x00', 'veth0_to_batadv\x00', {}, {}, 0x0, 0x0, 0x0, 0x17}, 0x0, 0xa8, 0xd0}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0x4, 0x5, 0x4}, {0xffffffffffffffff, 0x1, 0x1}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x540) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$devlink(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_SB_PORT_POOL_GET(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000380)={0x14, r3, 0x313, 0x70bd2a, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x20040800}, 0x8000) r4 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000100), r0) sendmsg$NLBL_CIPSOV4_C_ADD(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000240)={0xbc, r4, 0x1, 0x70bd2a, 0x1, {}, [@NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x1}, @NLBL_CIPSOV4_A_MLSLVLLST={0x98, 0x8, 0x0, 0x1, [{0x4c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x43692762}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x70e2777c}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x4}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x68174e53}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xc0}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x94}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7837d029}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x5f}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xc6}]}, {0x14, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x676ba6dc}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xaa}]}, {0x34, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x53c3289f}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7227d925}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x3d}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x9f119cb}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x100061}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x2134d15d}]}]}, @NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x1}]}, 0xbc}, 0x1, 0x0, 0x0, 0x1}, 0x24004080) sendmsg$NLBL_MGMT_C_PROTOCOLS(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x58, 0x0, 0x300, 0x70bd25, 0x25dfdbff, {}, [@NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @multicast1}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x7}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @mcast2}, @NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x2b}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x5}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @private=0xa010102}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x5}]}, 0x58}, 0x1, 0x0, 0x0, 0x10}, 0x801) 1.973144944s ago: executing program 4 (id=3312): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20, 0x52f, @mcast1, 0x4}, 0x1c) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x34, 0x34, 0x6, [@var={0x4, 0x0, 0x0, 0xe, 0x4}, @func_proto, @typedef={0x0, 0x0, 0x0, 0x10, 0x4}, @volatile={0x0, 0x0, 0x0, 0x9, 0x3}]}, {0x0, [0x0, 0x0, 0x0, 0x61]}}, 0x0, 0x52}, 0x20) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000003c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16, @ANYBLOB="010025bd7000000000000200000008000300", @ANYRES32=r2, @ANYBLOB="08009f000600000008002600b409000005005201"], 0x3c}, 0x1, 0x0, 0x0, 0x4c854}, 0x4040000) sendmsg$NL80211_CMD_GET_WOWLAN(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000180), 0xc, &(0x7f00000003c0)={&(0x7f0000000200)={0x1c, 0x0, 0x2, 0x70bd25, 0x25dfdbff, {{}, {@val={0x8, 0x1, 0x14}, @void, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0xc092}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=@delchain={0x24, 0x65, 0x400, 0x70bd29, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0x509d884560ba1ba6, 0x3}, {}, {0x8, 0x10}}}, 0x24}}, 0x10) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000004bc0)={0x0, 0x0, &(0x7f0000004b80)={&(0x7f0000000100)=ANY=[@ANYBLOB="60b80000", @ANYRES16, @ANYBLOB="050427bd7000fedbdf250100000008000100", @ANYRES32, @ANYBLOB="4400028040000100240001006d6f6465000000000000000000000000000000000000000000000000000000000500030005"], 0x60}, 0x1, 0x0, 0x0, 0x4000401}, 0x4040084) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=@newqdisc={0x44, 0x24, 0x4, 0xc0000001, 0x0, {0x0, 0x0, 0x0, 0x0, {0x3, 0x8}, {0xe, 0xe}, {0x0, 0x9}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0x14, 0x8002, [@TCA_FQ_PIE_LIMIT={0x8, 0x1, 0xfff}, @TCA_FQ_PIE_FLOWS={0x8, 0x2, 0xe305}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x800}, 0x20004015) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000600)=@newlink={0x48, 0x10, 0x1, 0x70bd2b, 0x25dfdbf9, {0x0, 0x0, 0x0, 0x0, 0x1439a}, [@IFLA_VFINFO_LIST={0x14, 0x16, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, [@IFLA_VF_RSS_QUERY_EN={0xc, 0x7, {0xffffffff, 0x2}}]}]}, @IFLA_IFNAME={0x14, 0x3, 'wlan0\x00'}]}, 0x48}, 0x1, 0x0, 0x0, 0x4000880}, 0x40) sendmmsg(r3, &(0x7f00000002c0), 0x40000000000009f, 0x0) pipe(&(0x7f00000001c0)={0xffffffffffffffff}) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket(0x2, 0x80805, 0x0) getsockopt$bt_hci(r8, 0x84, 0x80, 0x0, &(0x7f0000001080)) write(r7, &(0x7f0000000380)='f', 0x1) socket(0x21, 0x2, 0x3) tee(r6, r5, 0x1, 0x2) setsockopt$inet6_tcp_int(r0, 0x6, 0x1e, 0x0, 0x0) 1.967301413s ago: executing program 1 (id=3313): bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xc, 0x4, &(0x7f00000004c0)=ANY=[@ANYBLOB="180000000100040000000000091931007b115b000000000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x34, '\x00', 0x0, @fallback=0xb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x40000}, 0x16) r0 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'gre0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="480000001000010400"/20, @ANYRES32=r1, @ANYBLOB="00000000000000002800128008000100677265001c00028006000f52000000000500130001000000060011"], 0x48}}, 0x0) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[], 0x68}, 0x1, 0x0, 0x0, 0x1}, 0x8000002) sendmmsg(r2, &(0x7f0000000000), 0x4000000000001f2, 0xfc) 753.125962ms ago: executing program 4 (id=3314): r0 = socket$kcm(0x21, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x4, 0x16, &(0x7f0000000140)=ANY=[@ANYBLOB="61126800000000006113b80000000000bf2000000000000007000000180000003d030100000000009500f000000000006926000000000000bf67000000000000140600000fff07006706000020000000350200000ee60000bf25000000000000bd350000000000006507000002000000070700004c0000001f75000000000000bf54000000000000070400000400f9ffad53010000000000840400000000000014000000000000009500000000000000db13d5d8b740f2cdaabc8383c8f56b8c2b84a800ea6553f3ef4392b3815dcf00c3eebc52267b042d19d6e31e25e589d5f2692c75a547d6f186641ae8c557ccff3878a93b51a0389749df734f49ed5078b10f1e7f2b37626a3ace1ea89f7d2c570720a86853e26168761f0a53358f7ee2baa0e6a67a98a0d57ac09f36cfefbbc7492bbe7cdf64971a57fd64efd46c26"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x6, 0x10, 0x0, 0x57}, 0x48) sendmsg$inet(r0, &(0x7f0000002780)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000340)=[@ip_retopts={{0x14, 0x110, 0xd, {[@timestamp_addr={0x44, 0x4}]}}}], 0x18}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000000080)=ANY=[@ANYBLOB="140000001000010000000000000000000700000a14000000060a0104000000000000000002000000140000001100010000000000000000000000000a638608ffa896a24d3465a3faea41f8a178323170e9d5f605b7c1fdfb5791b8e435405fbfd4ebb51eb0d8bcee53bee92fa1783d5d66b54c06b5e2ade259fc8a3e46761f930d9981fd24fce42ac9960cb39a2a216051cd3c87046195908bc058b0b25336d813b4e8e503614256a6f13b6af27957e3e6cd0b3b0a669f9368a10b502c"], 0x3c}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) recvmmsg(r2, &(0x7f0000009000)=[{{&(0x7f0000000180)=@generic, 0x80, &(0x7f0000002540)=[{&(0x7f0000000200)=""/149, 0x95}, {&(0x7f00000002c0)=""/4096, 0x1000}, {&(0x7f00000012c0)=""/4096, 0x1000}, {&(0x7f00000022c0)=""/14, 0xe}, {&(0x7f0000002300)=""/79, 0x4f}, {&(0x7f0000002380)=""/48, 0x30}, {&(0x7f00000023c0)=""/132, 0x84}, {0x0}], 0x8}, 0x2}, {{&(0x7f00000025c0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80, &(0x7f0000002a40)=[{0x0}, {&(0x7f00000026c0)=""/167, 0xa7}, {&(0x7f0000002780)=""/217, 0xd9}, {&(0x7f0000002880)=""/78, 0x4e}, {&(0x7f0000002900)=""/220, 0xdc}, {0x0}], 0x6, &(0x7f0000002ac0)=""/104, 0x68}}, {{&(0x7f0000002b40)=@caif=@util, 0x80, &(0x7f0000002c40)=[{&(0x7f0000002bc0)=""/40, 0x28}, {&(0x7f0000002c00)=""/51, 0x33}], 0x2}, 0x9}, {{&(0x7f0000002c80)=@rc={0x1f, @fixed}, 0x80, &(0x7f0000004180)=[{&(0x7f0000002d00)=""/195, 0xc3}, {&(0x7f0000002e00)=""/4096, 0x1000}, {&(0x7f0000003e00)=""/43, 0x2b}, {&(0x7f0000003e40)=""/195, 0xc3}, {&(0x7f0000003f40)=""/125, 0x7d}, {&(0x7f0000003fc0)=""/2, 0x2}, {&(0x7f0000004000)=""/179, 0xb3}, {&(0x7f00000040c0)=""/130, 0x82}], 0x8, &(0x7f0000004200)=""/227, 0xe3}, 0xc5}, {{&(0x7f0000004300)=@generic, 0x80, &(0x7f0000005800)=[{&(0x7f0000004440)=""/75, 0x4b}, {&(0x7f00000044c0)=""/139, 0x8b}, {&(0x7f0000004580)=""/4096, 0x1000}, {&(0x7f0000005580)=""/31, 0x1f}, {&(0x7f00000055c0)=""/26, 0x1a}, {&(0x7f0000005600)=""/147, 0x93}, {&(0x7f00000056c0)=""/71, 0x47}, {&(0x7f0000005740)=""/160, 0xa0}], 0x8, &(0x7f00000058c0)=""/4096, 0x1000}, 0x1000}, {{&(0x7f00000068c0)=@in, 0x80, &(0x7f0000006ac0)=[{&(0x7f0000006940)=""/171, 0xab}, {&(0x7f0000006a00)=""/166, 0xa6}], 0x2, &(0x7f0000009280)=""/112, 0x70}}, {{&(0x7f0000006b80)=@l2tp={0x2, 0x0, @remote}, 0x80, &(0x7f0000008c00)=[{&(0x7f0000006c00)=""/4096, 0x1000}, {&(0x7f0000007c00)=""/4096, 0x1000}], 0x2, &(0x7f0000008c40)=""/177, 0xb1}, 0x2}, {{&(0x7f0000008d00)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x0, @broadcast}}, 0x80, 0x0, 0x0, &(0x7f0000008f80)=""/67, 0x43}, 0x3}], 0x8, 0x10000, &(0x7f0000009200)={0x0, 0x3938700}) r4 = socket$inet_sctp(0x2, 0x1, 0x84) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000011c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x43, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000003c0)={r7, 0x2000300, 0xe, 0x0, &(0x7f0000000600)="63e4ed8e46080000003389f7f986", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xcd}, 0x50) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r5, 0x84, 0x6f, &(0x7f00000003c0)={0x0, 0x10, &(0x7f0000000000)=[@in={0x2, 0x4e21, @private=0xa010101}]}, &(0x7f0000000240)=0x10) getsockopt$inet_sctp6_SCTP_MAX_BURST(r5, 0x84, 0x83, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f00000004c0)=0x8) ioctl$XFS_IOC_OPEN_BY_HANDLE(r4, 0xc038586b, &(0x7f0000009380)={r5, &(0x7f0000006b00)='/dev/ppp\x00', 0x10d003, &(0x7f0000006b40)={@align=0x1000, {0x7777, 0x2, 0x4, 0x3}}, 0xe1, &(0x7f0000009300), &(0x7f0000009340)=0x94aa}) setsockopt$inet_sctp_SCTP_MAX_BURST(r4, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={r8, 0x5}, 0x8) setsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(r3, 0x84, 0x18, &(0x7f0000009240)={r8, 0x3}, 0x8) setsockopt$inet_udp_encap(r3, 0x11, 0x64, &(0x7f0000002a00)=0x1, 0x4) r9 = syz_genetlink_get_family_id$fou(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$FOU_CMD_GET(r3, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x28, r9, 0x200, 0x70bd25, 0x25dfdbfe, {}, [@FOU_ATTR_AF={0x5, 0x2, 0xa}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_PEER_PORT={0x6, 0xa, 0x4e24}]}, 0x28}, 0x1, 0x0, 0x0, 0x24000000}, 0x0) 752.423657ms ago: executing program 1 (id=3315): r0 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'wg2\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r1, {0x0, 0xfff3}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x4c840) (async) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="01000000030000"], 0x50) (async) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0xf, 0x13, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000000004b180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8bfffffb702000008000000b7030000000000008500000007000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b7030000000000008500000070000000"], &(0x7f0000000180)='syzkaller\x00', 0xd, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000580)=@base={0x5, 0x4, 0x4, 0x4, 0x0, 0xffffffffffffffff, 0x8}, 0x50) (async, rerun: 32) r4 = socket(0x1e, 0x4, 0x0) (rerun: 32) setsockopt$packet_tx_ring(r4, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x3, 0x2, 0x81, 0x1fd, 0x1, 0x1}, 0x1c) r5 = socket$rxrpc(0x21, 0x2, 0xa) bind$rxrpc(r5, &(0x7f00000000c0)=@in6={0x21, 0x300, 0x2, 0x1c, {0xa, 0x1b59, 0x20007, @empty, 0x200}}, 0x24) (async) recvmsg$unix(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)=""/254, 0xfe}], 0x1}, 0x20) ioctl$sock_SIOCGIFBR(r5, 0x8940, &(0x7f0000001000)=@add_del={0x2, &(0x7f0000000fc0)='team_slave_0\x00'}) sendmmsg(r4, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x101d0}], 0x1}}], 0x400000000000181, 0x9200000000000000) (async) read$alg(r4, &(0x7f0000000300)=""/74, 0x4a) (async) r6 = socket(0x1e, 0x4, 0x0) getsockopt$EBT_SO_GET_ENTRIES(r6, 0x0, 0x81, &(0x7f00000011c0)={'nat\x00', 0x0, 0x3, 0xb8, [0x4, 0x288a910a, 0xe5, 0xfffffffffffffff1, 0x8, 0x5], 0x6, &(0x7f0000001040)=[{}, {}, {}, {}, {}, {}], &(0x7f0000001100)=""/184}, &(0x7f0000001240)=0x78) (async) setsockopt$packet_tx_ring(r6, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x3, 0x0, 0x81, 0x1ff, 0x1, 0x1}, 0x1c) sendmmsg(r6, &(0x7f00000030c0)=[{{0x0, 0x0, &(0x7f0000000480)}}], 0x1, 0x9200000004004010) (async) read$alg(r6, &(0x7f0000000000)=""/106, 0x6a) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x10, 0x4, 0x0, 0x0, 0x5, 0x0, 0x0, 0x41100, 0x66, '\x00', 0x0, @fallback=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async, rerun: 32) sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000006180)={0x0, 0x0, &(0x7f0000006140)={&(0x7f0000000000)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16, @ANYBLOB="110026bd7000fddbdf2507002600"/25, @ANYRES32, @ANYBLOB="0c009900fb"], 0x4c}, 0x1, 0x0, 0x0, 0x4}, 0x20004014) (async, rerun: 32) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r7, &(0x7f0000000000)=ANY=[], 0x32600) (async) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r7, 0x0) (async) r8 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r8, 0x0, 0x60, &(0x7f0000000000)={'filter\x00', 0x7, 0x4, 0x3e0, 0x110, 0x110, 0x210, 0x2f8, 0x2f8, 0x2f8, 0x4, 0x0, {[{{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac, @mac=@remote, @loopback, @local, 0x1, 0x1}}}, {{@uncond, 0xc0, 0x100}, @unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "716ebd2e1aa0cc683e62f312359594df00da56317f76121697127951fdba"}}, {{@uncond, 0xc0, 0xe8}, @unspec=@NFQUEUE0={0x28}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x430) (async) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x11, 0xd, &(0x7f00000010c0)=ANY=[@ANYBLOB="1a000000003e920a04d01b6bf9bf6bf8be4a00000000000000000000000f00000018110000e15a685dbb0f454411565f2557dcee55", @ANYRES32=r2, @ANYRES8=r3], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000680)={r9}, 0xc) sendmsg$nl_route_sched(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000f80)={&(0x7f0000000880)=@newtfilter={0x5c, 0x2c, 0xf3f, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r1, {0xb, 0x1}, {0x0, 0x6}, {0xe, 0x300}}, [@filter_kind_options=@f_flower={{0xb}, {0x2c, 0x2, [@TCA_FLOWER_KEY_ENC_IPV6_SRC_MASK={0x14, 0x20, [0x0, 0xffffffff]}, @TCA_FLOWER_KEY_ENC_IPV6_SRC={0x14, 0x1f, @private0}]}}]}, 0x5c}, 0x1, 0x0, 0x0, 0x20041090}, 0x0) (async, rerun: 32) syz_emit_ethernet(0x56, &(0x7f0000000280)=ANY=[@ANYBLOB="bbbbbbbbbbbbaaaaaaaaaaaa86dd611cc82500203cfffe81000000000000000000000000000ffe8000000000000000000000000000aa020300000000000004043be5c637c910000000000000000000ff"], 0x0) (rerun: 32) 395.177996ms ago: executing program 1 (id=3316): r0 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r0, &(0x7f0000000140)={0x28, 0x0, 0x2710, @local}, 0x10) (async) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$sock_int(r1, 0x1, 0x7, &(0x7f00000000c0)=0x773, 0x4) (async) setsockopt$SO_VM_SOCKETS_BUFFER_MAX_SIZE(r0, 0x28, 0x2, &(0x7f00000000c0)=0x33, 0x8) (async) listen(r0, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r2, &(0x7f0000000080)={0x28, 0x0, 0x2710}, 0x10) (async) r3 = accept4(r0, 0x0, 0x0, 0x0) sendto(r3, &(0x7f0000000000), 0xfeb5, 0x0, 0x0, 0x0) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) recvfrom(r2, &(0x7f00000001c0)=""/62, 0xfeb5, 0x10120, 0x0, 0x0) (async) r4 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r4, &(0x7f0000002c80)={0xa, 0x14e24}, 0x1c) (async) connect$inet6(r4, &(0x7f00000002c0)={0xa, 0x4e24}, 0x1c) (async) recvmmsg(r4, &(0x7f00000004c0)=[{{0x0, 0x0, &(0x7f0000000300)}, 0x2}], 0x1, 0x1, 0x0) (async) sendmmsg(r4, &(0x7f00000092c0), 0x4ff, 0x0) (async) r5 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x1, 0xf, &(0x7f0000000d80)=ANY=[@ANYBLOB="1808000000000000000000003f00000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b707000014000480b7060000ffffff908500000005000000bf0900000000000035090100000000009500000000000000bf9100000000000056070000010000008500000007000000b70000000000000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x68, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) recvmsg$can_bcm(r3, &(0x7f0000005b40)={0x0, 0x0, 0x0}, 0x40000100) accept$unix(r3, &(0x7f0000000000), 0x0) (async) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r3, 0x89f2, &(0x7f0000001a40)={'tunl0\x00', 0x0}) (async) socket$netlink(0x10, 0x3, 0x0) 221.116976ms ago: executing program 1 (id=3317): r0 = bpf$TOKEN_CREATE(0x24, &(0x7f0000000100), 0x8) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000380)={&(0x7f0000000200)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x30, 0x30, 0xc, [@const={0x0, 0x0, 0x0, 0xa, 0x5}, @float={0xa, 0x0, 0x0, 0x10, 0xc}, @fwd={0x6}, @ptr={0x4, 0x0, 0x0, 0x2, 0x1}]}, {0x0, [0x2e, 0x5f, 0x5f, 0x30, 0x30, 0x61, 0x30, 0x61, 0x5f, 0x5f]}}, &(0x7f0000000280)=""/237, 0x54, 0xed, 0x1, 0xd}, 0x28) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f00000003c0)={0x6, 0x3, &(0x7f00000003c0)=ANY=[], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, r1}, 0xc6) ioctl$XFS_IOC_COMMIT_RANGE(r1, 0x40585883, &(0x7f0000000140)={r0, 0x0, 0x9, 0x3, 0xe5, 0x8, [0x2, 0x34c0, 0x9, 0x7, 0x36bd, 0xa1]}) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r2, 0x5, 0xe, 0x0, &(0x7f0000000000)="259a53f271a76d2608004c6588a8", 0x0, 0xd11, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x40}, 0x50) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000480), 0xffffffffffffffff) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000040)={'tunl0\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=@newlink={0x40, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r6, 0x22b7b6683ba65fec, 0x11}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @ipip={{0x9}, {0x10, 0x2, 0x0, 0x1, [@IFLA_IPTUN_FWMARK={0x8, 0x14, 0x6}, @IFLA_IPTUN_COLLECT_METADATA={0x4}]}}}]}, 0x40}}, 0x0) sendmsg$ETHTOOL_MSG_LINKMODES_SET(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000540)={&(0x7f00000004c0)={0x70, r3, 0x200, 0x70bd25, 0x25dfdbfb, {}, [@ETHTOOL_A_LINKMODES_DUPLEX={0x5, 0x6, 0x7}, @ETHTOOL_A_LINKMODES_HEADER={0x44, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_hsr\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip_vti0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0xd417df383de2180f}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}, @ETHTOOL_A_LINKMODES_SPEED={0x8, 0x5, 0xffff}, @ETHTOOL_A_LINKMODES_MASTER_SLAVE_CFG={0x5}]}, 0x70}, 0x1, 0x0, 0x0, 0x20000080}, 0x840) 165.792684ms ago: executing program 3 (id=3318): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'lrw(serpent)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="85e39a2f2cd6b8ccc7658ddf897accc136b7", 0x12) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5910fae9d6dcd3292ea54c7b6", 0x10) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x42000, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'pim6reg1\x00', 0x2}) ioctl$TUNSETLINK(r1, 0x400454cd, 0x303) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000006000000000000000000000085000000bc000000850000002a0000"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000200)={r3, 0x0, 0xe, 0x0, &(0x7f0000000100)="54ae1f8219560625baa794a469ce", 0x0, 0x1008, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000140)={'pim6reg1\x00', @multicast}) r4 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'veth0\x00', 0x0}) r6 = socket$igmp(0x2, 0x3, 0x2) setsockopt$inet_IP_XFRM_POLICY(r6, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@remote, @in=@loopback, 0x4e21, 0x0, 0x4e20, 0x0, 0xa, 0x80, 0x60, 0x11}, {0x9, 0x9642, 0x1, 0x401, 0x9, 0x1000, 0x6, 0xfffffffffffffffb}, {0x1, 0x500000000, 0x3, 0x5}, 0xfff, 0x0, 0x2, 0x1}, {{@in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x4d3, 0x3c}, 0x2, @in=@local, 0x0, 0x1, 0x3, 0x1, 0x3, 0x2}}, 0xe8) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=@ipv4_deladdr={0x2c, 0x15, 0x1, 0xfffffffd, 0x0, {0x2, 0x18, 0x0, 0x0, r5}, [@IFA_LABEL={0x14, 0x3, 'veth0\x00'}]}, 0x2c}}, 0x0) close(0x3) 0s ago: executing program 1 (id=3319): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x3, 0x13, &(0x7f0000000400)=@framed={{0x18, 0x2, 0x0, 0x0, 0x10ab6a, 0x0, 0x0, 0x0, 0x4}, [@printk={@x, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xffffffff}, {0x85, 0x0, 0x0, 0x70}}, @printk={@llx, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x5}}]}, &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x8, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x9}, 0x94) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmmsg$inet6(r1, &(0x7f0000000440)=[{{&(0x7f0000000240)={0xa, 0x4e21, 0x2, @private1}, 0x1c, &(0x7f0000000d00)=[{&(0x7f00000002c0)='\n', 0x1}], 0x1}}, {{&(0x7f0000000080)={0xa, 0x4e23, 0x6, @remote, 0x8}, 0x1c, &(0x7f00000001c0)=[{&(0x7f0000000180)="589597c1", 0x4}], 0x1}}], 0x2, 0x40088d4) shutdown(r1, 0x1) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=@newlink={0x50, 0x10, 0x401, 0x70bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, 0x100, 0x46951}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @geneve={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GENEVE_UDP_ZERO_CSUM6_TX={0x5}]}}}, @IFLA_IFNAME={0x14, 0x3, 'geneve1\x00'}]}, 0x50}}, 0x2000000) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x84, &(0x7f00000000c0)={0x0, @in={{0x2, 0x0, @empty}}}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r0, 0x0, 0xe, 0x0, &(0x7f0000000300)="e09f547ed3f02dc1fd3c6487775b", 0x0, 0xa60, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r3 = socket$netlink(0x10, 0x3, 0x9) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)={{0x14, 0x3ec}, [], {0x14, 0x3f8}}, 0x28}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) r4 = socket(0x2, 0x80805, 0x0) r5 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r5, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r4, 0x84, 0x76, &(0x7f00000003c0)={r6, 0x1}, 0x8) getsockopt$inet_sctp6_SCTP_ASSOCINFO(r1, 0x84, 0x1, &(0x7f0000000500)={r6, 0x3, 0x7, 0x86, 0x9, 0x1000}, &(0x7f0000000540)=0x14) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r7, &(0x7f0000000a80)={0x0, 0x0, &(0x7f0000000a40)={&(0x7f0000000980)=ANY=[@ANYBLOB="84000000", @ANYRES16=r8, @ANYBLOB="010000ff1f00fbdbdf250100000008000200000000000500050000000000080003000100000048000180050002"], 0x84}}, 0x0) sendmsg$MPTCP_PM_CMD_SET_LIMITS(r3, 0x0, 0x40000) kernel console output (not intermixed with test programs): _parse: 5 callbacks suppressed [ 367.052186][T15563] netlink: 224 bytes leftover after parsing attributes in process `syz.4.2601'. [ 367.053963][T15564] netlink: 224 bytes leftover after parsing attributes in process `syz.4.2601'. [ 367.235969][T15573] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2604'. [ 367.394171][T15577] can: request_module (can-proto-0) failed. [ 367.528729][T15586] netlink: 68 bytes leftover after parsing attributes in process `syz.1.2606'. [ 367.766479][T15593] bridge0: port 1(vlan4) entered blocking state [ 367.783302][T15593] bridge0: port 1(vlan4) entered disabled state [ 367.805169][T15593] vlan4: entered allmulticast mode [ 367.819805][T15593] geneve0: entered allmulticast mode [ 367.833998][T15597] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2610'. [ 367.835179][T15593] vlan4: entered promiscuous mode [ 367.849458][T15593] geneve0: entered promiscuous mode [ 367.860345][T15597] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 367.879997][T15597] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 367.914531][T15597] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 367.930735][T15597] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 367.943827][T15600] netlink: 49 bytes leftover after parsing attributes in process `syz.4.2609'. [ 367.955407][ C0] vxcan1: j1939_tp_rxtimer: 0xffff888068424400: rx timeout, send abort [ 367.977848][T15600] netlink: 140 bytes leftover after parsing attributes in process `syz.4.2609'. [ 368.007473][T15599] bridge0: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 368.085724][T15605] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2609'. [ 368.100045][T15596] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2609'. [ 368.110421][T15605] netlink: 32 bytes leftover after parsing attributes in process `syz.4.2609'. [ 368.463812][ C0] vxcan1: j1939_tp_rxtimer: 0xffff888068424400: abort rx timeout. Force session deactivation [ 368.519497][T15625] tipc: Enabled bearer , priority 0 [ 368.550079][T15625] syzkaller0: entered promiscuous mode [ 368.572868][T15625] syzkaller0: entered allmulticast mode [ 368.914216][T15640] FAULT_INJECTION: forcing a failure. [ 368.914216][T15640] name failslab, interval 1, probability 0, space 0, times 0 [ 368.960730][T15640] CPU: 1 UID: 0 PID: 15640 Comm: syz.2.2619 Not tainted syzkaller #0 PREEMPT(full) [ 368.960760][T15640] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 368.960774][T15640] Call Trace: [ 368.960785][T15640] [ 368.960793][T15640] dump_stack_lvl+0xe8/0x150 [ 368.960909][T15640] should_fail_ex+0x40c/0x560 [ 368.961067][T15640] should_failslab+0xa8/0x100 [ 368.961150][T15640] __kvmalloc_node_noprof+0x16e/0x890 [ 368.961181][T15640] ? __nf_register_net_hook+0x232/0x930 [ 368.961268][T15640] ? nf_hook_entries_grow+0x287/0x740 [ 368.961298][T15640] nf_hook_entries_grow+0x287/0x740 [ 368.961335][T15640] __nf_register_net_hook+0x2c9/0x930 [ 368.961369][T15640] nf_register_net_hook+0xb2/0x190 [ 368.961394][T15640] nf_register_net_hooks+0x44/0x1b0 [ 368.961422][T15640] nf_defrag_ipv6_enable+0x87/0x120 [ 368.961532][T15640] nf_ct_netns_do_get+0x1e7/0x5c0 [ 368.961589][T15640] ? __pfx_nf_ct_netns_do_get+0x10/0x10 [ 368.961625][T15640] nf_ct_netns_get+0xc7/0x320 [ 368.961650][T15640] nft_connlimit_do_init+0x1de/0x2e0 [ 368.961713][T15640] nft_set_elem_expr_alloc+0x213/0x5f0 [ 368.961767][T15640] ? __pfx_nft_set_elem_expr_alloc+0x10/0x10 [ 368.961802][T15640] ? nft_rhash_init+0x2c0/0x3b0 [ 368.961849][T15640] ? __pfx_nft_rhash_init+0x10/0x10 [ 368.961865][T15640] ? kasan_quarantine_put+0xbb/0x1f0 [ 368.961887][T15640] ? __pfx_nft_rhash_key+0x10/0x10 [ 368.961903][T15640] ? __pfx_nft_rhash_obj+0x10/0x10 [ 368.961919][T15640] ? __pfx_nft_rhash_cmp+0x10/0x10 [ 368.961941][T15640] nft_set_expr_alloc+0x68/0x760 [ 368.961982][T15640] ? nf_tables_newset+0x13b5/0x2570 [ 368.962010][T15640] nf_tables_newset+0x1c5f/0x2570 [ 368.962044][T15640] ? __pfx_nf_tables_newset+0x10/0x10 [ 368.962087][T15640] ? __nla_parse+0x40/0x60 [ 368.962143][T15640] nfnetlink_rcv+0x1288/0x28c0 [ 368.962227][T15640] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 368.962267][T15640] ? ref_tracker_free+0x689/0x830 [ 368.962324][T15640] ? skb_clone+0x246/0x3a0 [ 368.962385][T15640] ? __netlink_deliver_tap+0x811/0x860 [ 368.962440][T15640] ? netlink_deliver_tap+0x2e/0x1b0 [ 368.962457][T15640] ? netlink_deliver_tap+0x2e/0x1b0 [ 368.962480][T15640] netlink_unicast+0x7bb/0x940 [ 368.962516][T15640] netlink_sendmsg+0x813/0xb40 [ 368.962572][T15640] ? __pfx_netlink_sendmsg+0x10/0x10 [ 368.962594][T15640] ? aa_sock_msg_perm+0xf1/0x1b0 [ 368.962669][T15640] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 368.962706][T15640] ? __pfx_netlink_sendmsg+0x10/0x10 [ 368.962724][T15640] ____sys_sendmsg+0x9b9/0xa20 [ 368.962787][T15640] ? __might_fault+0xaf/0x130 [ 368.962819][T15640] ? __pfx_____sys_sendmsg+0x10/0x10 [ 368.962844][T15640] ? import_iovec+0x73/0xa0 [ 368.962897][T15640] ___sys_sendmsg+0x2a5/0x360 [ 368.962912][T15640] ? __lock_acquire+0x683/0x2cd0 [ 368.962951][T15640] ? __pfx____sys_sendmsg+0x10/0x10 [ 368.963005][T15640] ? __fget_files+0x2a/0x420 [ 368.963038][T15640] ? __fget_files+0x3a2/0x420 [ 368.963067][T15640] __x64_sys_sendmsg+0x1bd/0x2a0 [ 368.963088][T15640] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 368.963121][T15640] ? __pfx_ksys_write+0x10/0x10 [ 368.963157][T15640] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 368.963223][T15640] do_syscall_64+0x174/0x580 [ 368.963326][T15640] ? trace_irq_disable+0x3b/0x140 [ 368.963364][T15640] ? clear_bhb_loop+0x40/0x90 [ 368.963384][T15640] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 368.963399][T15640] RIP: 0033:0x7f7da119ce59 [ 368.963417][T15640] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 368.963431][T15640] RSP: 002b:00007f7da1fae028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 368.963449][T15640] RAX: ffffffffffffffda RBX: 00007f7da1415fa0 RCX: 00007f7da119ce59 [ 368.963461][T15640] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000004 [ 368.963471][T15640] RBP: 00007f7da1fae090 R08: 0000000000000000 R09: 0000000000000000 [ 368.963482][T15640] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 368.963492][T15640] R13: 00007f7da1416038 R14: 00007f7da1415fa0 R15: 00007ffd56742738 [ 368.963525][T15640] [ 369.668069][ C0] vxcan1: j1939_xtp_rx_rts_session_active: 0xffff88806c01c000: connection exists (00 02). last cmd: 14 [ 369.754901][T15624] tipc: Resetting bearer [ 369.803922][T15624] tipc: Disabling bearer [ 369.838922][T15649] netlink: 'syz.2.2621': attribute type 1 has an invalid length. [ 370.153099][T15663] tc_dump_action: action bad kind [ 370.403898][T15678] FAULT_INJECTION: forcing a failure. [ 370.403898][T15678] name failslab, interval 1, probability 0, space 0, times 0 [ 370.461170][T15678] CPU: 1 UID: 0 PID: 15678 Comm: syz.3.2631 Not tainted syzkaller #0 PREEMPT(full) [ 370.461195][T15678] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 370.461206][T15678] Call Trace: [ 370.461213][T15678] [ 370.461222][T15678] dump_stack_lvl+0xe8/0x150 [ 370.461250][T15678] should_fail_ex+0x40c/0x560 [ 370.461284][T15678] should_failslab+0xa8/0x100 [ 370.461303][T15678] __kvmalloc_node_noprof+0x16e/0x890 [ 370.461328][T15678] ? __nf_register_net_hook+0x232/0x930 [ 370.461350][T15678] ? nf_hook_entries_grow+0x287/0x740 [ 370.461380][T15678] nf_hook_entries_grow+0x287/0x740 [ 370.461417][T15678] __nf_register_net_hook+0x2c9/0x930 [ 370.461450][T15678] nf_register_net_hook+0xb2/0x190 [ 370.461475][T15678] nf_register_net_hooks+0x44/0x1b0 [ 370.461500][T15678] nf_defrag_ipv6_enable+0x87/0x120 [ 370.461528][T15678] nf_ct_netns_do_get+0x1e7/0x5c0 [ 370.461555][T15678] ? __pfx_nf_ct_netns_do_get+0x10/0x10 [ 370.461602][T15678] nf_ct_netns_get+0xc7/0x320 [ 370.461627][T15678] nft_connlimit_do_init+0x1de/0x2e0 [ 370.461654][T15678] nft_set_elem_expr_alloc+0x213/0x5f0 [ 370.461678][T15678] ? __pfx_nft_set_elem_expr_alloc+0x10/0x10 [ 370.461713][T15678] ? nft_rhash_init+0x2c0/0x3b0 [ 370.461736][T15678] ? __pfx_nft_rhash_init+0x10/0x10 [ 370.461754][T15678] ? kasan_quarantine_put+0xbb/0x1f0 [ 370.461776][T15678] ? __pfx_nft_rhash_key+0x10/0x10 [ 370.461794][T15678] ? __pfx_nft_rhash_obj+0x10/0x10 [ 370.461812][T15678] ? __pfx_nft_rhash_cmp+0x10/0x10 [ 370.461837][T15678] nft_set_expr_alloc+0x68/0x760 [ 370.461856][T15678] ? nf_tables_newset+0x13b5/0x2570 [ 370.461885][T15678] nf_tables_newset+0x1c5f/0x2570 [ 370.461924][T15678] ? __pfx_nf_tables_newset+0x10/0x10 [ 370.461972][T15678] ? __nla_parse+0x40/0x60 [ 370.461997][T15678] nfnetlink_rcv+0x1288/0x28c0 [ 370.462062][T15678] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 370.462108][T15678] ? ref_tracker_free+0x689/0x830 [ 370.462155][T15678] ? skb_clone+0x246/0x3a0 [ 370.462179][T15678] ? __netlink_deliver_tap+0x811/0x860 [ 370.462209][T15678] ? netlink_deliver_tap+0x2e/0x1b0 [ 370.462227][T15678] ? netlink_deliver_tap+0x2e/0x1b0 [ 370.462253][T15678] netlink_unicast+0x7bb/0x940 [ 370.462290][T15678] netlink_sendmsg+0x813/0xb40 [ 370.462321][T15678] ? __pfx_netlink_sendmsg+0x10/0x10 [ 370.462345][T15678] ? aa_sock_msg_perm+0xf1/0x1b0 [ 370.462370][T15678] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 370.462391][T15678] ? __pfx_netlink_sendmsg+0x10/0x10 [ 370.462412][T15678] ____sys_sendmsg+0x9b9/0xa20 [ 370.462432][T15678] ? __might_fault+0xaf/0x130 [ 370.462461][T15678] ? __pfx_____sys_sendmsg+0x10/0x10 [ 370.462491][T15678] ? import_iovec+0x73/0xa0 [ 370.462516][T15678] ___sys_sendmsg+0x2a5/0x360 [ 370.462534][T15678] ? __lock_acquire+0x683/0x2cd0 [ 370.462559][T15678] ? __pfx____sys_sendmsg+0x10/0x10 [ 370.462631][T15678] ? __fget_files+0x2a/0x420 [ 370.462652][T15678] ? __fget_files+0x3a2/0x420 [ 370.462685][T15678] __x64_sys_sendmsg+0x1bd/0x2a0 [ 370.462708][T15678] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 370.462738][T15678] ? __pfx_ksys_write+0x10/0x10 [ 370.462774][T15678] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 370.462793][T15678] do_syscall_64+0x174/0x580 [ 370.462813][T15678] ? trace_irq_disable+0x3b/0x140 [ 370.462839][T15678] ? clear_bhb_loop+0x40/0x90 [ 370.462861][T15678] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 370.462880][T15678] RIP: 0033:0x7f2cba99ce59 [ 370.462898][T15678] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 370.462912][T15678] RSP: 002b:00007f2cb8bee028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 370.462931][T15678] RAX: ffffffffffffffda RBX: 00007f2cbac15fa0 RCX: 00007f2cba99ce59 [ 370.462944][T15678] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000004 [ 370.462955][T15678] RBP: 00007f2cb8bee090 R08: 0000000000000000 R09: 0000000000000000 [ 370.462966][T15678] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 370.462976][T15678] R13: 00007f2cbac16038 R14: 00007f2cbac15fa0 R15: 00007ffcc9830858 [ 370.463009][T15678] [ 370.906821][ C1] vxcan1: j1939_xtp_rx_rts_session_active: 0xffff888035189c00: connection exists (00 00). last cmd: 10 [ 371.691918][T15725] IPVS: set_ctl: invalid protocol: 0 10.1.1.0:20001 [ 371.728149][T15724] IPVS: set_ctl: invalid protocol: 0 172.20.20.170:20001 [ 371.829480][T15731] FAULT_INJECTION: forcing a failure. [ 371.829480][T15731] name failslab, interval 1, probability 0, space 0, times 0 [ 371.871583][T15731] CPU: 0 UID: 0 PID: 15731 Comm: syz.0.2647 Not tainted syzkaller #0 PREEMPT(full) [ 371.871608][T15731] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 371.871618][T15731] Call Trace: [ 371.871625][T15731] [ 371.871632][T15731] dump_stack_lvl+0xe8/0x150 [ 371.871659][T15731] should_fail_ex+0x40c/0x560 [ 371.871693][T15731] should_failslab+0xa8/0x100 [ 371.871713][T15731] __kvmalloc_node_noprof+0x16e/0x890 [ 371.871740][T15731] ? nf_hook_entries_grow+0x287/0x740 [ 371.871766][T15731] ? __pfx___mutex_lock+0x10/0x10 [ 371.871893][T15731] nf_hook_entries_grow+0x287/0x740 [ 371.871930][T15731] __nf_register_net_hook+0x2c9/0x930 [ 371.871963][T15731] nf_register_net_hook+0xb2/0x190 [ 371.871986][T15731] nf_register_net_hooks+0x44/0x1b0 [ 371.872011][T15731] nf_ct_netns_do_get+0x3bf/0x5c0 [ 371.872035][T15731] ? __pfx_nf_ct_netns_do_get+0x10/0x10 [ 371.872070][T15731] nf_ct_netns_get+0xa7/0x320 [ 371.872094][T15731] nft_connlimit_do_init+0x1de/0x2e0 [ 371.872119][T15731] nft_set_elem_expr_alloc+0x213/0x5f0 [ 371.872142][T15731] ? __pfx_nft_set_elem_expr_alloc+0x10/0x10 [ 371.872175][T15731] ? nft_rhash_init+0x2c0/0x3b0 [ 371.872198][T15731] ? __pfx_nft_rhash_init+0x10/0x10 [ 371.872216][T15731] ? kasan_quarantine_put+0xbb/0x1f0 [ 371.872239][T15731] ? __pfx_nft_rhash_key+0x10/0x10 [ 371.872257][T15731] ? __pfx_nft_rhash_obj+0x10/0x10 [ 371.872273][T15731] ? __pfx_nft_rhash_cmp+0x10/0x10 [ 371.872297][T15731] nft_set_expr_alloc+0x68/0x760 [ 371.872314][T15731] ? nf_tables_newset+0x13b5/0x2570 [ 371.872343][T15731] nf_tables_newset+0x1c5f/0x2570 [ 371.872388][T15731] ? __pfx_nf_tables_newset+0x10/0x10 [ 371.872435][T15731] ? __nla_parse+0x40/0x60 [ 371.872459][T15731] nfnetlink_rcv+0x1288/0x28c0 [ 371.872518][T15731] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 371.872560][T15731] ? ref_tracker_free+0x689/0x830 [ 371.872605][T15731] ? skb_clone+0x246/0x3a0 [ 371.872629][T15731] ? __netlink_deliver_tap+0x811/0x860 [ 371.872658][T15731] ? netlink_deliver_tap+0x2e/0x1b0 [ 371.872676][T15731] ? netlink_deliver_tap+0x2e/0x1b0 [ 371.872702][T15731] netlink_unicast+0x7bb/0x940 [ 371.872739][T15731] netlink_sendmsg+0x813/0xb40 [ 371.872769][T15731] ? __pfx_netlink_sendmsg+0x10/0x10 [ 371.872793][T15731] ? aa_sock_msg_perm+0xf1/0x1b0 [ 371.872821][T15731] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 371.872843][T15731] ? __pfx_netlink_sendmsg+0x10/0x10 [ 371.872863][T15731] ____sys_sendmsg+0x9b9/0xa20 [ 371.872882][T15731] ? __might_fault+0xaf/0x130 [ 371.872912][T15731] ? __pfx_____sys_sendmsg+0x10/0x10 [ 371.872942][T15731] ? import_iovec+0x73/0xa0 [ 371.872967][T15731] ___sys_sendmsg+0x2a5/0x360 [ 371.872985][T15731] ? __lock_acquire+0x683/0x2cd0 [ 371.873009][T15731] ? __pfx____sys_sendmsg+0x10/0x10 [ 371.873068][T15731] ? __fget_files+0x2a/0x420 [ 371.873088][T15731] ? __fget_files+0x3a2/0x420 [ 371.873120][T15731] __x64_sys_sendmsg+0x1bd/0x2a0 [ 371.873142][T15731] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 371.873170][T15731] ? __pfx_ksys_write+0x10/0x10 [ 371.873197][T15731] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 371.873212][T15731] do_syscall_64+0x174/0x580 [ 371.873227][T15731] ? trace_irq_disable+0x3b/0x140 [ 371.873246][T15731] ? clear_bhb_loop+0x40/0x90 [ 371.873262][T15731] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 371.873275][T15731] RIP: 0033:0x7fb05dd9ce59 [ 371.873289][T15731] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 371.873300][T15731] RSP: 002b:00007fb05ec68028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 371.873315][T15731] RAX: ffffffffffffffda RBX: 00007fb05e015fa0 RCX: 00007fb05dd9ce59 [ 371.873324][T15731] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000004 [ 371.873332][T15731] RBP: 00007fb05ec68090 R08: 0000000000000000 R09: 0000000000000000 [ 371.873340][T15731] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 371.873348][T15731] R13: 00007fb05e016038 R14: 00007fb05e015fa0 R15: 00007ffc25bd5b48 [ 371.873378][T15731] [ 371.878312][T15735] xt_time: invalid argument - start or stop time greater than 23:59:59 [ 372.528262][T15744] bond10: entered promiscuous mode [ 372.540793][T15744] bond10: entered allmulticast mode [ 372.567371][T15744] 8021q: adding VLAN 0 to HW filter on device bond10 [ 372.810545][T15766] __nla_validate_parse: 6 callbacks suppressed [ 372.810562][T15766] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2660'. [ 372.909162][T15771] FAULT_INJECTION: forcing a failure. [ 372.909162][T15771] name failslab, interval 1, probability 0, space 0, times 0 [ 372.924863][T15771] CPU: 1 UID: 0 PID: 15771 Comm: syz.2.2662 Not tainted syzkaller #0 PREEMPT(full) [ 372.924888][T15771] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 372.924899][T15771] Call Trace: [ 372.924906][T15771] [ 372.924914][T15771] dump_stack_lvl+0xe8/0x150 [ 372.924940][T15771] should_fail_ex+0x40c/0x560 [ 372.924974][T15771] should_failslab+0xa8/0x100 [ 372.924994][T15771] __kvmalloc_node_noprof+0x16e/0x890 [ 372.925021][T15771] ? nf_hook_entries_grow+0x287/0x740 [ 372.925044][T15771] ? __pfx___mutex_lock+0x10/0x10 [ 372.925068][T15771] nf_hook_entries_grow+0x287/0x740 [ 372.925104][T15771] __nf_register_net_hook+0x2c9/0x930 [ 372.925138][T15771] nf_register_net_hook+0xb2/0x190 [ 372.925162][T15771] nf_register_net_hooks+0x44/0x1b0 [ 372.925187][T15771] nf_ct_netns_do_get+0x212/0x5c0 [ 372.925214][T15771] ? __pfx_nf_ct_netns_do_get+0x10/0x10 [ 372.925254][T15771] nf_ct_netns_get+0xc7/0x320 [ 372.925279][T15771] nft_connlimit_do_init+0x1de/0x2e0 [ 372.925304][T15771] nft_set_elem_expr_alloc+0x213/0x5f0 [ 372.925328][T15771] ? __pfx_nft_set_elem_expr_alloc+0x10/0x10 [ 372.925363][T15771] ? nft_rhash_init+0x2c0/0x3b0 [ 372.925386][T15771] ? __pfx_nft_rhash_init+0x10/0x10 [ 372.925404][T15771] ? kasan_quarantine_put+0xbb/0x1f0 [ 372.925427][T15771] ? __pfx_nft_rhash_key+0x10/0x10 [ 372.925445][T15771] ? __pfx_nft_rhash_obj+0x10/0x10 [ 372.925464][T15771] ? __pfx_nft_rhash_cmp+0x10/0x10 [ 372.925491][T15771] nft_set_expr_alloc+0x68/0x760 [ 372.925509][T15771] ? nf_tables_newset+0x13b5/0x2570 [ 372.925540][T15771] nf_tables_newset+0x1c5f/0x2570 [ 372.925577][T15771] ? __pfx_nf_tables_newset+0x10/0x10 [ 372.925626][T15771] ? __nla_parse+0x40/0x60 [ 372.925651][T15771] nfnetlink_rcv+0x1288/0x28c0 [ 372.925715][T15771] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 372.925765][T15771] ? ref_tracker_free+0x689/0x830 [ 372.925810][T15771] ? skb_clone+0x246/0x3a0 [ 372.925834][T15771] ? __netlink_deliver_tap+0x811/0x860 [ 372.925863][T15771] ? netlink_deliver_tap+0x2e/0x1b0 [ 372.925882][T15771] ? netlink_deliver_tap+0x2e/0x1b0 [ 372.925905][T15771] netlink_unicast+0x7bb/0x940 [ 372.925942][T15771] netlink_sendmsg+0x813/0xb40 [ 372.925972][T15771] ? __pfx_netlink_sendmsg+0x10/0x10 [ 372.925996][T15771] ? aa_sock_msg_perm+0xf1/0x1b0 [ 372.926023][T15771] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 372.926043][T15771] ? __pfx_netlink_sendmsg+0x10/0x10 [ 372.926063][T15771] ____sys_sendmsg+0x9b9/0xa20 [ 372.926081][T15771] ? __might_fault+0xaf/0x130 [ 372.926108][T15771] ? __pfx_____sys_sendmsg+0x10/0x10 [ 372.926134][T15771] ? import_iovec+0x73/0xa0 [ 372.926156][T15771] ___sys_sendmsg+0x2a5/0x360 [ 372.926171][T15771] ? __lock_acquire+0x683/0x2cd0 [ 372.926193][T15771] ? __pfx____sys_sendmsg+0x10/0x10 [ 372.926245][T15771] ? __fget_files+0x2a/0x420 [ 372.926265][T15771] ? __fget_files+0x3a2/0x420 [ 372.926296][T15771] __x64_sys_sendmsg+0x1bd/0x2a0 [ 372.926330][T15771] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 372.926357][T15771] ? __pfx_ksys_write+0x10/0x10 [ 372.926389][T15771] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 372.926408][T15771] do_syscall_64+0x174/0x580 [ 372.926426][T15771] ? trace_irq_disable+0x3b/0x140 [ 372.926451][T15771] ? clear_bhb_loop+0x40/0x90 [ 372.926473][T15771] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 372.926490][T15771] RIP: 0033:0x7f7da119ce59 [ 372.926508][T15771] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 372.926523][T15771] RSP: 002b:00007f7da1fae028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 372.926541][T15771] RAX: ffffffffffffffda RBX: 00007f7da1415fa0 RCX: 00007f7da119ce59 [ 372.926554][T15771] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000004 [ 372.926564][T15771] RBP: 00007f7da1fae090 R08: 0000000000000000 R09: 0000000000000000 [ 372.926573][T15771] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 372.926582][T15771] R13: 00007f7da1416038 R14: 00007f7da1415fa0 R15: 00007ffd56742738 [ 372.926611][T15771] [ 373.359494][T15775] netlink: 'syz.3.2664': attribute type 1 has an invalid length. [ 373.380697][T15775] netlink: 'syz.3.2664': attribute type 3 has an invalid length. [ 373.391953][T15775] netlink: 224 bytes leftover after parsing attributes in process `syz.3.2664'. [ 373.444538][T15776] netlink: 'syz.1.2661': attribute type 4 has an invalid length. [ 373.481005][T15772] netlink: 'syz.1.2661': attribute type 4 has an invalid length. [ 373.494760][T15777] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2663'. [ 374.092554][T15811] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2674'. [ 374.132272][T15811] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2674'. [ 374.161493][T15813] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2673'. [ 374.190001][T15814] netlink: 'syz.4.2674': attribute type 4 has an invalid length. [ 377.292887][ T4996] udevd[4996]: worker [5629] /devices/virtual/block/nbd1 timeout; kill it [ 377.305793][ T4996] udevd[4996]: seq 12730 '/devices/virtual/block/nbd1' killed [ 377.794372][T15820] lo speed is unknown, defaulting to 1000 [ 377.849350][T15828] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2677'. [ 377.915681][T15833] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2680'. [ 377.941051][T15834] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2679'. [ 377.963418][T15833] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2680'. [ 377.967173][T15834] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2679'. [ 378.103010][T15834] bond11: ARP target 9.0.0.0 is already present [ 378.109487][T15834] bond11: option arp_ip_target: invalid value (9) [ 378.119140][T15834] bond11 (unregistering): Released all slaves [ 378.274789][T15843] tipc: Enabled bearer , priority 0 [ 378.455602][T15843] tipc: Disabling bearer [ 378.455835][T15858] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2683'. [ 378.570163][T15858] 8021q: adding VLAN 0 to HW filter on device bond8 [ 378.591269][T15868] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2686'. [ 378.665162][T15861] bond0: (slave team_slave_1): Releasing backup interface [ 378.676849][T15861] team_slave_1: left allmulticast mode [ 378.693884][T15861] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 378.712616][T15869] team0: No ports can be present during mode change [ 378.735120][ T36] team0: Failed to send port change of device bond0 via netlink (err -105) [ 378.747187][T15820] lo speed is unknown, defaulting to 1000 [ 378.998869][T15877] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 379.200604][T15885] lo speed is unknown, defaulting to 1000 [ 379.518679][T15902] xt_HMARK: spi-set and port-set can't be combined [ 379.692877][T15913] netlink: 212408 bytes leftover after parsing attributes in process `syz.0.2698'. [ 379.703016][T15888] netlink: 'syz.2.2690': attribute type 2 has an invalid length. [ 379.878673][T15885] lo speed is unknown, defaulting to 1000 [ 380.022422][T15921] netlink: 'syz.0.2701': attribute type 2 has an invalid length. [ 380.033523][T15920] lo speed is unknown, defaulting to 1000 [ 380.542160][T15920] lo speed is unknown, defaulting to 1000 [ 381.036584][T15940] ipt_rpfilter: unknown options [ 381.347589][T15942] bond13: option tlb_dynamic_lb: mode dependency failed, not supported in mode balance-rr(0) [ 381.520035][T15942] bond13 (unregistering): Released all slaves [ 381.793291][T15952] bond9 (unregistering): Released all slaves [ 382.014801][T15969] sctp: [Deprecated]: syz.4.2713 (pid 15969) Use of int in max_burst socket option deprecated. [ 382.014801][T15969] Use struct sctp_assoc_value instead [ 382.425509][T15982] netlink: 44 bytes leftover after parsing attributes in process `syz.4.2718'. [ 382.553243][T15986] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2721'. [ 382.584221][T15986] ip6tnl0: Caught tx_queue_len zero misconfig [ 382.869597][T16004] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2724'. [ 382.975158][T16011] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2728'. [ 383.021032][T16012] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2728'. [ 383.209254][T16025] netlink: 'syz.0.2731': attribute type 1 has an invalid length. [ 383.218422][T16026] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2733'. [ 383.372403][T16031] bond11: (slave ip6gretap4): Enslaving as a backup interface with an up link [ 383.383940][T16028] workqueue: Failed to create a rescuer kthread for wq "bond9": -EINTR [ 383.393674][T16039] netlink: 56 bytes leftover after parsing attributes in process `syz.3.2735'. [ 383.442543][T16035] veth13: entered promiscuous mode [ 383.470209][T16035] bond11: (slave veth13): Enslaving as a backup interface with a down link [ 383.555180][T16022] lo speed is unknown, defaulting to 1000 [ 383.609070][T16044] netlink: 'syz.4.2737': attribute type 1 has an invalid length. [ 383.664220][T16047] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2739'. [ 383.708672][T16044] 8021q: adding VLAN 0 to HW filter on device bond9 [ 384.005543][T16068] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2741'. [ 384.160803][T16029] netlink: 'syz.1.2732': attribute type 2 has an invalid length. [ 384.597191][T16022] lo speed is unknown, defaulting to 1000 [ 385.629352][T16132] netlink: 164 bytes leftover after parsing attributes in process `syz.0.2762'. [ 385.665843][T16132] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2762'. [ 385.984861][T16151] vlan2: entered promiscuous mode [ 385.990803][T16151] bridge0: entered promiscuous mode [ 386.062624][T16155] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2766'. [ 386.986940][T16175] netlink: 'syz.3.2772': attribute type 1 has an invalid length. [ 387.314246][T16187] openvswitch: netlink: Flow actions attr not present in new flow. [ 387.858944][T16204] netlink: 'syz.1.2779': attribute type 1 has an invalid length. [ 387.913628][T16204] Bluetooth: hci0: Opcode 0x0401 failed: -22 [ 387.966280][T16204] netlink: 'syz.1.2779': attribute type 12 has an invalid length. [ 388.056773][T16216] __nla_validate_parse: 2 callbacks suppressed [ 388.056790][T16216] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2784'. [ 388.096217][T16181] bond10: entered promiscuous mode [ 388.369111][T16230] netlink: 240 bytes leftover after parsing attributes in process `syz.3.2787'. [ 388.415501][T16230] netlink: 56 bytes leftover after parsing attributes in process `syz.3.2787'. [ 388.509976][T16236] FAULT_INJECTION: forcing a failure. [ 388.509976][T16236] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 388.543946][T16238] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2790'. [ 388.570548][T16236] CPU: 1 UID: 0 PID: 16236 Comm: syz.0.2789 Not tainted syzkaller #0 PREEMPT(full) [ 388.570573][T16236] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 388.570583][T16236] Call Trace: [ 388.570590][T16236] [ 388.570598][T16236] dump_stack_lvl+0xe8/0x150 [ 388.570624][T16236] should_fail_ex+0x40c/0x560 [ 388.570658][T16236] _copy_from_user+0x2d/0xb0 [ 388.570774][T16236] ___sys_sendmsg+0x1c6/0x360 [ 388.570792][T16236] ? __lock_acquire+0x683/0x2cd0 [ 388.570816][T16236] ? __pfx____sys_sendmsg+0x10/0x10 [ 388.570871][T16236] ? __fget_files+0x2a/0x420 [ 388.570892][T16236] ? __fget_files+0x3a2/0x420 [ 388.570922][T16236] __x64_sys_sendmsg+0x1bd/0x2a0 [ 388.570943][T16236] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 388.570971][T16236] ? __pfx_ksys_write+0x10/0x10 [ 388.571004][T16236] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 388.571023][T16236] do_syscall_64+0x174/0x580 [ 388.571042][T16236] ? trace_irq_disable+0x3b/0x140 [ 388.571066][T16236] ? clear_bhb_loop+0x40/0x90 [ 388.571087][T16236] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 388.571104][T16236] RIP: 0033:0x7fb05dd9ce59 [ 388.571122][T16236] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 388.571136][T16236] RSP: 002b:00007fb05ec68028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 388.571155][T16236] RAX: ffffffffffffffda RBX: 00007fb05e015fa0 RCX: 00007fb05dd9ce59 [ 388.571168][T16236] RDX: 0000000000040040 RSI: 00002000000000c0 RDI: 0000000000000003 [ 388.571180][T16236] RBP: 00007fb05ec68090 R08: 0000000000000000 R09: 0000000000000000 [ 388.571191][T16236] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 388.571201][T16236] R13: 00007fb05e016038 R14: 00007fb05e015fa0 R15: 00007ffc25bd5b48 [ 388.571232][T16236] [ 388.952978][T16247] syzkaller1: entered promiscuous mode [ 388.996697][T16247] syzkaller1: entered allmulticast mode [ 389.036406][T16252] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2794'. [ 389.079106][T16252] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2794'. [ 389.122290][T16251] netlink: 88 bytes leftover after parsing attributes in process `syz.4.2794'. [ 389.154202][T16252] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2794'. [ 389.188197][T16251] gre0: entered promiscuous mode [ 389.193589][T16252] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2794'. [ 389.203480][T16251] gre0: entered allmulticast mode [ 389.279712][T16266] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2798'. [ 389.459831][T16266] syzkaller0: entered promiscuous mode [ 389.465911][T16266] syzkaller0: entered allmulticast mode [ 390.234183][ T4946] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 390.247554][ T4946] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 390.256317][ T4946] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 390.285256][ T4946] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 390.295478][ T4946] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 390.353350][ T50] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 390.365534][ T50] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 390.373178][ T50] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 390.383025][ T50] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 390.393987][ T50] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 391.487121][ C1] vxcan1: j1939_tp_rxtimer: 0xffff88804843d800: rx timeout, send abort [ 392.003888][ C1] vxcan1: j1939_tp_rxtimer: 0xffff88804843d800: abort rx timeout. Force session deactivation [ 392.458125][ T50] Bluetooth: hci5: command tx timeout [ 393.746709][T16291] workqueue: Failed to create a rescuer kthread for wq "bond11": -EINTR [ 393.965755][T16328] FAULT_INJECTION: forcing a failure. [ 393.965755][T16328] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 393.992338][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:1c, vlan:0) [ 394.010644][T16328] CPU: 1 UID: 0 PID: 16328 Comm: syz.4.2814 Not tainted syzkaller #0 PREEMPT(full) [ 394.010683][T16328] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 394.010701][T16328] Call Trace: [ 394.010709][T16328] [ 394.010715][T16328] dump_stack_lvl+0xe8/0x150 [ 394.010745][T16328] should_fail_ex+0x40c/0x560 [ 394.010781][T16328] _copy_from_iter+0x1d3/0x1660 [ 394.010804][T16328] ? rcu_is_watching+0x15/0xb0 [ 394.010884][T16328] ? __pfx__copy_from_iter+0x10/0x10 [ 394.010900][T16328] ? kmem_cache_alloc_node_noprof+0x3ca/0x680 [ 394.010928][T16328] ? netlink_sendmsg+0x650/0xb40 [ 394.010946][T16328] ? skb_put+0x112/0x210 [ 394.010966][T16328] netlink_sendmsg+0x6c0/0xb40 [ 394.010991][T16328] ? __pfx_netlink_sendmsg+0x10/0x10 [ 394.011011][T16328] ? aa_sock_msg_perm+0xf1/0x1b0 [ 394.011038][T16328] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 394.011059][T16328] ? __pfx_netlink_sendmsg+0x10/0x10 [ 394.011079][T16328] ____sys_sendmsg+0x9b9/0xa20 [ 394.011097][T16328] ? __might_fault+0xaf/0x130 [ 394.011124][T16328] ? __pfx_____sys_sendmsg+0x10/0x10 [ 394.011151][T16328] ? import_iovec+0x73/0xa0 [ 394.011175][T16328] ___sys_sendmsg+0x2a5/0x360 [ 394.011192][T16328] ? __lock_acquire+0x683/0x2cd0 [ 394.011215][T16328] ? __pfx____sys_sendmsg+0x10/0x10 [ 394.011262][T16328] ? __fget_files+0x2a/0x420 [ 394.011281][T16328] ? __fget_files+0x3a2/0x420 [ 394.011309][T16328] __x64_sys_sendmsg+0x1bd/0x2a0 [ 394.011330][T16328] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 394.011356][T16328] ? __pfx_ksys_write+0x10/0x10 [ 394.011385][T16328] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 394.011404][T16328] do_syscall_64+0x174/0x580 [ 394.011425][T16328] ? trace_irq_disable+0x3b/0x140 [ 394.011449][T16328] ? clear_bhb_loop+0x40/0x90 [ 394.011469][T16328] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 394.011485][T16328] RIP: 0033:0x7f755f79ce59 [ 394.011501][T16328] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 394.011515][T16328] RSP: 002b:00007f75606d4028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 394.011531][T16328] RAX: ffffffffffffffda RBX: 00007f755fa15fa0 RCX: 00007f755f79ce59 [ 394.011543][T16328] RDX: 0000000000040040 RSI: 00002000000000c0 RDI: 0000000000000003 [ 394.011554][T16328] RBP: 00007f75606d4090 R08: 0000000000000000 R09: 0000000000000000 [ 394.011564][T16328] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 394.011574][T16328] R13: 00007f755fa16038 R14: 00007f755fa15fa0 R15: 00007ffeb1f74a78 [ 394.011604][T16328] [ 394.531745][ T50] Bluetooth: hci5: command tx timeout [ 394.858488][T16365] netlink: 36 bytes leftover after parsing attributes in process `syz.2.2822'. [ 394.876016][T16285] lo speed is unknown, defaulting to 1000 [ 395.008241][T16369] netlink: 'syz.3.2823': attribute type 3 has an invalid length. [ 395.104871][T16372] netlink: 212368 bytes leftover after parsing attributes in process `syz.2.2824'. [ 395.252449][ T11] block nbd1: Possible stuck request ffff888026fd5080: control (read@0,4096B). Runtime 270 seconds [ 395.328409][T16389] netlink: 12700 bytes leftover after parsing attributes in process `syz.2.2824'. [ 395.484906][T16285] lo speed is unknown, defaulting to 1000 [ 395.603141][ C1] vxcan1: j1939_xtp_rx_rts_session_active: 0xffff888078f24400: connection exists (00 00). last cmd: 10 [ 396.146231][T16422] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 396.239594][T16431] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2838'. [ 396.280388][T16285] bridge0: port 1(bridge_slave_0) entered blocking state [ 396.309478][T16285] bridge0: port 1(bridge_slave_0) entered disabled state [ 396.341528][T16285] bridge_slave_0: entered allmulticast mode [ 396.363184][T16285] bridge_slave_0: entered promiscuous mode [ 396.377856][T16285] bridge0: port 2(bridge_slave_1) entered blocking state [ 396.402687][T16285] bridge0: port 2(bridge_slave_1) entered disabled state [ 396.407956][T16436] FAULT_INJECTION: forcing a failure. [ 396.407956][T16436] name failslab, interval 1, probability 0, space 0, times 0 [ 396.415345][T16285] bridge_slave_1: entered allmulticast mode [ 396.432104][T16436] CPU: 0 UID: 0 PID: 16436 Comm: syz.2.2840 Not tainted syzkaller #0 PREEMPT(full) [ 396.432130][T16436] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 396.432140][T16436] Call Trace: [ 396.432148][T16436] [ 396.432156][T16436] dump_stack_lvl+0xe8/0x150 [ 396.432183][T16436] should_fail_ex+0x40c/0x560 [ 396.432217][T16436] should_failslab+0xa8/0x100 [ 396.432236][T16436] ? skb_clone+0x212/0x3a0 [ 396.432255][T16436] kmem_cache_alloc_noprof+0x87/0x650 [ 396.432286][T16436] skb_clone+0x212/0x3a0 [ 396.432309][T16436] __netlink_deliver_tap+0x413/0x860 [ 396.432341][T16436] ? netlink_deliver_tap+0x2e/0x1b0 [ 396.432362][T16436] netlink_deliver_tap+0x19c/0x1b0 [ 396.432402][T16436] netlink_unicast+0x77f/0x940 [ 396.432440][T16436] netlink_sendmsg+0x813/0xb40 [ 396.432469][T16436] ? __pfx_netlink_sendmsg+0x10/0x10 [ 396.432492][T16436] ? aa_sock_msg_perm+0xf1/0x1b0 [ 396.432519][T16436] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 396.432541][T16436] ? __pfx_netlink_sendmsg+0x10/0x10 [ 396.432563][T16436] ____sys_sendmsg+0x9b9/0xa20 [ 396.432583][T16436] ? __might_fault+0xaf/0x130 [ 396.432610][T16436] ? __pfx_____sys_sendmsg+0x10/0x10 [ 396.432639][T16436] ? import_iovec+0x73/0xa0 [ 396.432664][T16436] ___sys_sendmsg+0x2a5/0x360 [ 396.432684][T16436] ? __lock_acquire+0x683/0x2cd0 [ 396.432709][T16436] ? __pfx____sys_sendmsg+0x10/0x10 [ 396.432765][T16436] ? __fget_files+0x2a/0x420 [ 396.432793][T16436] ? __fget_files+0x3a2/0x420 [ 396.432821][T16436] __x64_sys_sendmsg+0x1bd/0x2a0 [ 396.432842][T16436] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 396.432871][T16436] ? __pfx_ksys_write+0x10/0x10 [ 396.432905][T16436] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 396.432924][T16436] do_syscall_64+0x174/0x580 [ 396.432945][T16436] ? trace_irq_disable+0x3b/0x140 [ 396.432969][T16436] ? clear_bhb_loop+0x40/0x90 [ 396.432991][T16436] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 396.433009][T16436] RIP: 0033:0x7f7da119ce59 [ 396.433026][T16436] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 396.433041][T16436] RSP: 002b:00007f7da1fae028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 396.433061][T16436] RAX: ffffffffffffffda RBX: 00007f7da1415fa0 RCX: 00007f7da119ce59 [ 396.433074][T16436] RDX: 0000000000040040 RSI: 00002000000000c0 RDI: 0000000000000003 [ 396.433085][T16436] RBP: 00007f7da1fae090 R08: 0000000000000000 R09: 0000000000000000 [ 396.433097][T16436] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 396.433107][T16436] R13: 00007f7da1416038 R14: 00007f7da1415fa0 R15: 00007ffd56742738 [ 396.433139][T16436] [ 396.437614][T16433] xt_CT: You must specify a L4 protocol and not use inversions on it [ 396.542589][T16285] bridge_slave_1: entered promiscuous mode [ 396.570993][ T30] audit: type=1107 audit(1781651061.965:7): pid=16439 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg=' ӓ [ 396.936460][T16448] dump_stack_lvl+0xe8/0x150 [ 396.936486][T16448] should_fail_ex+0x40c/0x560 [ 396.936519][T16448] should_failslab+0xa8/0x100 [ 396.936537][T16448] ? dst_alloc+0x105/0x170 [ 396.936675][T16448] kmem_cache_alloc_noprof+0x87/0x650 [ 396.936703][T16448] dst_alloc+0x105/0x170 [ 396.936727][T16448] ip_route_output_key_hash_rcu+0x14ac/0x2720 [ 396.936833][T16448] ? ip_route_output_key_hash+0xd8/0x2a0 [ 396.936859][T16448] ip_route_output_key_hash+0x18d/0x2a0 [ 396.936883][T16448] ? ns_capable+0x89/0xe0 [ 396.936915][T16448] ? __pfx_ip_route_output_key_hash+0x10/0x10 [ 396.936956][T16448] ip_route_output_flow+0x2a/0x150 [ 396.936976][T16448] ? security_sk_classify_flow+0x6d/0x150 [ 396.937031][T16448] udp_sendmsg+0x144a/0x2140 [ 396.937138][T16448] ? __pfx_udp_sendmsg+0x10/0x10 [ 396.937167][T16448] ? format_decode+0x5a1/0xe20 [ 396.937224][T16448] ? look_up_lock_class+0x57/0x110 [ 396.937250][T16448] ? __lock_acquire+0x683/0x2cd0 [ 396.937277][T16448] ? get_random_u32+0x497/0x8b0 [ 396.937371][T16448] ? lockdep_hardirqs_on+0x7a/0x110 [ 396.937387][T16448] ? get_random_u32+0x13a/0x8b0 [ 396.937407][T16448] ? get_random_u32+0x4ce/0x8b0 [ 396.937436][T16448] udpv6_sendmsg+0x915/0x2610 [ 396.937537][T16448] ? __pfx_udpv6_sendmsg+0x10/0x10 [ 396.937559][T16448] ? udp_lib_get_port+0x177b/0x1c60 [ 396.937611][T16448] ? inet_send_prepare+0x1b4/0x260 [ 396.937662][T16448] ? inet_send_prepare+0x1b4/0x260 [ 396.937688][T16448] ? inet_send_prepare+0x1b4/0x260 [ 396.937709][T16448] ? __local_bh_enable_ip+0xd0/0x130 [ 396.937727][T16448] ? inet_send_prepare+0x1b4/0x260 [ 396.937759][T16448] ? inet6_sendmsg+0xe4/0x120 [ 396.937807][T16448] ? __pfx_inet6_sendmsg+0x10/0x10 [ 396.937828][T16448] ____sys_sendmsg+0x61f/0xa20 [ 396.937857][T16448] ? __pfx_____sys_sendmsg+0x10/0x10 [ 396.937885][T16448] ? import_iovec+0x73/0xa0 [ 396.937910][T16448] ___sys_sendmsg+0x2a5/0x360 [ 396.937928][T16448] ? __lock_acquire+0x683/0x2cd0 [ 396.937950][T16448] ? __pfx____sys_sendmsg+0x10/0x10 [ 396.938005][T16448] ? __fget_files+0x2a/0x420 [ 396.938026][T16448] ? __fget_files+0x3a2/0x420 [ 396.938057][T16448] __x64_sys_sendmsg+0x1bd/0x2a0 [ 396.938079][T16448] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 396.938108][T16448] ? __pfx_ksys_write+0x10/0x10 [ 396.938138][T16448] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 396.938154][T16448] do_syscall_64+0x174/0x580 [ 396.938171][T16448] ? trace_irq_disable+0x3b/0x140 [ 396.938192][T16448] ? clear_bhb_loop+0x40/0x90 [ 396.938211][T16448] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 396.938226][T16448] RIP: 0033:0x7f2cba99ce59 [ 396.938242][T16448] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 396.938254][T16448] RSP: 002b:00007f2cb8bee028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 396.938271][T16448] RAX: ffffffffffffffda RBX: 00007f2cbac15fa0 RCX: 00007f2cba99ce59 [ 396.938283][T16448] RDX: 0000000000000000 RSI: 0000200000000400 RDI: 0000000000000003 [ 396.938292][T16448] RBP: 00007f2cb8bee090 R08: 0000000000000000 R09: 0000000000000000 [ 396.938302][T16448] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 396.938310][T16448] R13: 00007f2cbac16038 R14: 00007f2cbac15fa0 R15: 00007ffcc9830858 [ 396.938338][T16448] [ 397.320059][T16285] team0: Port device team_slave_0 added [ 397.382149][T16285] team0: Port device team_slave_1 added [ 397.454585][T16458] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2848'. [ 397.498992][T16285] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 397.513803][T16285] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 397.556471][T16285] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 397.585383][T16285] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 397.602320][T16285] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 397.641802][T16285] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 397.704659][T16285] hsr_slave_0: entered promiscuous mode [ 397.716587][T16285] hsr_slave_1: entered promiscuous mode [ 397.727016][T16285] debugfs: 'hsr0' already exists in 'hsr' [ 397.740627][T16285] Cannot create hsr debugfs directory [ 398.530432][T16285] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 398.545420][T16285] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 398.557516][T16285] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 398.571555][T16285] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 398.580889][T16285] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 398.595308][ C1] vxcan1: j1939_tp_rxtimer: 0xffff88804f86b000: rx timeout, send abort [ 398.597983][T16285] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 398.603994][ C1] vxcan1: j1939_xtp_rx_abort_one: 0xffff88804f86b000: 0x40000: (3) A timeout occurred and this is the connection abort to close the session. [ 398.612095][T16285] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 398.669333][T16285] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 398.780640][ T50] Bluetooth: hci5: command tx timeout [ 398.842557][T16500] netlink: 'syz.2.2860': attribute type 23 has an invalid length. [ 398.946267][T16285] 8021q: adding VLAN 0 to HW filter on device bond0 [ 398.974451][T16504] netlink: 'syz.0.2861': attribute type 4 has an invalid length. [ 398.987221][T16504] netlink: 'syz.0.2861': attribute type 8 has an invalid length. [ 399.003136][T16285] 8021q: adding VLAN 0 to HW filter on device team0 [ 399.003362][T16504] netlink: 'syz.0.2861': attribute type 1 has an invalid length. [ 399.026419][T11980] bridge0: port 1(bridge_slave_0) entered blocking state [ 399.033664][T11980] bridge0: port 1(bridge_slave_0) entered forwarding state [ 399.051546][T11980] bridge0: port 2(bridge_slave_1) entered blocking state [ 399.054942][T16504] netlink: 172 bytes leftover after parsing attributes in process `syz.0.2861'. [ 399.058764][T11980] bridge0: port 2(bridge_slave_1) entered forwarding state [ 399.068425][T16504] NCSI netlink: No device for ifindex 0 [ 399.120023][T16507] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2862'. [ 399.177583][T16507] netdevsim netdevsim2 netdevsim0: entered promiscuous mode [ 399.194052][T16507] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 399.203300][T16507] netlink: 116 bytes leftover after parsing attributes in process `syz.2.2862'. [ 399.318409][T16518] FAULT_INJECTION: forcing a failure. [ 399.318409][T16518] name failslab, interval 1, probability 0, space 0, times 0 [ 399.357711][T16518] CPU: 1 UID: 0 PID: 16518 Comm: syz.2.2865 Not tainted syzkaller #0 PREEMPT(full) [ 399.357736][T16518] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 399.357746][T16518] Call Trace: [ 399.357753][T16518] [ 399.357761][T16518] dump_stack_lvl+0xe8/0x150 [ 399.357787][T16518] should_fail_ex+0x40c/0x560 [ 399.357819][T16518] should_failslab+0xa8/0x100 [ 399.357838][T16518] __kmalloc_cache_noprof+0x88/0x660 [ 399.357863][T16518] ? nfnetlink_rcv+0x1021/0x28c0 [ 399.357893][T16518] nfnetlink_rcv+0x1021/0x28c0 [ 399.357949][T16518] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 399.357988][T16518] ? ref_tracker_free+0x689/0x830 [ 399.358040][T16518] ? skb_clone+0x246/0x3a0 [ 399.358061][T16518] ? __netlink_deliver_tap+0x811/0x860 [ 399.358089][T16518] ? netlink_deliver_tap+0x2e/0x1b0 [ 399.358107][T16518] ? netlink_deliver_tap+0x2e/0x1b0 [ 399.358132][T16518] netlink_unicast+0x7bb/0x940 [ 399.358169][T16518] netlink_sendmsg+0x813/0xb40 [ 399.358197][T16518] ? __pfx_netlink_sendmsg+0x10/0x10 [ 399.358220][T16518] ? aa_sock_msg_perm+0xf1/0x1b0 [ 399.358246][T16518] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 399.358267][T16518] ? __pfx_netlink_sendmsg+0x10/0x10 [ 399.358288][T16518] ____sys_sendmsg+0x9b9/0xa20 [ 399.358306][T16518] ? __might_fault+0xaf/0x130 [ 399.358334][T16518] ? __pfx_____sys_sendmsg+0x10/0x10 [ 399.358362][T16518] ? import_iovec+0x73/0xa0 [ 399.358385][T16518] ___sys_sendmsg+0x2a5/0x360 [ 399.358402][T16518] ? __lock_acquire+0x683/0x2cd0 [ 399.358425][T16518] ? __pfx____sys_sendmsg+0x10/0x10 [ 399.358482][T16518] ? __fget_files+0x2a/0x420 [ 399.358502][T16518] ? __fget_files+0x3a2/0x420 [ 399.358532][T16518] __x64_sys_sendmsg+0x1bd/0x2a0 [ 399.358553][T16518] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 399.358580][T16518] ? __pfx_ksys_write+0x10/0x10 [ 399.358620][T16518] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 399.358640][T16518] do_syscall_64+0x174/0x580 [ 399.358658][T16518] ? trace_irq_disable+0x3b/0x140 [ 399.358680][T16518] ? clear_bhb_loop+0x40/0x90 [ 399.358701][T16518] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 399.358717][T16518] RIP: 0033:0x7f7da119ce59 [ 399.358734][T16518] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 399.358748][T16518] RSP: 002b:00007f7da1fae028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 399.358768][T16518] RAX: ffffffffffffffda RBX: 00007f7da1415fa0 RCX: 00007f7da119ce59 [ 399.358780][T16518] RDX: 0000000000040040 RSI: 00002000000000c0 RDI: 0000000000000003 [ 399.358791][T16518] RBP: 00007f7da1fae090 R08: 0000000000000000 R09: 0000000000000000 [ 399.358802][T16518] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 399.358812][T16518] R13: 00007f7da1416038 R14: 00007f7da1415fa0 R15: 00007ffd56742738 [ 399.358843][T16518] [ 400.001072][T16285] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 400.033559][T16536] netlink: 36 bytes leftover after parsing attributes in process `syz.2.2869'. [ 400.061269][T16511] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 400.144562][T16285] veth0_vlan: entered promiscuous mode [ 400.233814][T16285] veth1_vlan: entered promiscuous mode [ 400.317100][T16543] bond11: option tlb_dynamic_lb: mode dependency failed, not supported in mode balance-rr(0) [ 400.351719][T16543] bond11 (unregistering): Released all slaves [ 400.513045][T16546] geneve4: entered promiscuous mode [ 400.565220][T16285] veth0_macvtap: entered promiscuous mode [ 400.602281][T16551] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2874'. [ 400.604970][T16285] veth1_macvtap: entered promiscuous mode [ 400.650343][T16551] netlink: 116 bytes leftover after parsing attributes in process `syz.2.2874'. [ 400.711040][T16554] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 400.757204][T16285] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 400.786192][T16555] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 400.842188][T16285] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 400.895527][T11980] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 400.925369][T11980] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 400.977408][T11980] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 401.018159][T11980] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 401.187549][ C0] vxcan1: j1939_tp_rxtimer: 0xffff888067014400: rx timeout, send abort [ 401.196283][ C0] vxcan1: j1939_xtp_rx_abort_one: 0xffff888067014400: 0x40000: (3) A timeout occurred and this is the connection abort to close the session. [ 401.354315][ T144] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 401.381621][ T144] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 401.461857][T16578] IPVS: sed: FWM 3 0x00000003 - no destination available [ 401.468146][T11985] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 401.477177][T16578] FAULT_INJECTION: forcing a failure. [ 401.477177][T16578] name failslab, interval 1, probability 0, space 0, times 0 [ 401.478152][T11985] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 401.491896][T16578] CPU: 0 UID: 0 PID: 16578 Comm: syz.3.2884 Not tainted syzkaller #0 PREEMPT(full) [ 401.491921][T16578] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 401.491949][T16578] Call Trace: [ 401.491957][T16578] [ 401.491966][T16578] dump_stack_lvl+0xe8/0x150 [ 401.491993][T16578] should_fail_ex+0x40c/0x560 [ 401.492027][T16578] should_failslab+0xa8/0x100 [ 401.492046][T16578] __kmalloc_cache_noprof+0x88/0x660 [ 401.492071][T16578] ? ip_setup_cork+0x231/0x8f0 [ 401.492095][T16578] ? ipv4_mtu+0x561/0x670 [ 401.492120][T16578] ip_setup_cork+0x231/0x8f0 [ 401.492150][T16578] ip_append_data+0x13a/0x190 [ 401.492174][T16578] ? __pfx_icmp_glue_bits+0x10/0x10 [ 401.492197][T16578] icmp_push_reply+0x87/0x410 [ 401.492217][T16578] ? rcu_is_watching+0x15/0xb0 [ 401.492237][T16578] ? trace_icmp_send+0x82/0x1e0 [ 401.492256][T16578] __icmp_send+0x128e/0x1710 [ 401.492271][T16578] ? __icmp_send+0x230/0x1710 [ 401.492302][T16578] ? __pfx___icmp_send+0x10/0x10 [ 401.492362][T16578] ip_vs_leave+0x467/0xca0 [ 401.492486][T16578] ? __pfx_ip_vs_schedule+0x10/0x10 [ 401.492513][T16578] ? __pfx_ip_vs_leave+0x10/0x10 [ 401.492534][T16578] ? __ip_vs_svc_fwm_find+0x621/0x6b0 [ 401.492563][T16578] ? ip_vs_service_find+0xbc/0x3c0 [ 401.492588][T16578] udp_conn_schedule+0x442/0x7a0 [ 401.492658][T16578] ? __pfx_udp_conn_schedule+0x10/0x10 [ 401.492683][T16578] ? __pfx_ip_vs_fill_iph_skb_off+0x10/0x10 [ 401.492704][T16578] ? ipt_do_table+0x137f/0x15d0 [ 401.492759][T16578] ip_vs_in_hook+0xcaf/0x1c70 [ 401.492788][T16578] ? ip_vs_out_hook+0x997/0x1030 [ 401.492806][T16578] ? __pfx_ip_vs_in_hook+0x10/0x10 [ 401.492853][T16578] ? nf_nat_ipv4_local_fn+0x321/0x570 [ 401.492907][T16578] ? __pfx_ip_vs_in_hook+0x10/0x10 [ 401.492928][T16578] nf_hook_slow+0xc5/0x220 [ 401.492953][T16578] ? __pfx_dst_output+0x10/0x10 [ 401.492975][T16578] nf_hook+0x22a/0x3a0 [ 401.493001][T16578] ? nf_hook+0xa1/0x3a0 [ 401.493022][T16578] ? __pfx_nf_hook+0x10/0x10 [ 401.493046][T16578] ? __pfx_dst_output+0x10/0x10 [ 401.493071][T16578] ? __ip_local_out+0x152/0x6a0 [ 401.493097][T16578] __ip_local_out+0x558/0x6a0 [ 401.493117][T16578] ? __pfx_dst_output+0x10/0x10 [ 401.493144][T16578] ip_local_out+0x2a/0x190 [ 401.493168][T16578] ip_send_skb+0x45/0xc0 [ 401.493193][T16578] udp_send_skb+0x7f7/0xfb0 [ 401.493231][T16578] udp_sendmsg+0x1971/0x2140 [ 401.493274][T16578] ? __pfx_udp_sendmsg+0x10/0x10 [ 401.493307][T16578] ? format_decode+0x5a1/0xe20 [ 401.493331][T16578] ? look_up_lock_class+0x57/0x110 [ 401.493357][T16578] ? __lock_acquire+0x683/0x2cd0 [ 401.493389][T16578] ? get_random_u32+0x4ce/0x8b0 [ 401.493424][T16578] udpv6_sendmsg+0x915/0x2610 [ 401.493462][T16578] ? __pfx_udpv6_sendmsg+0x10/0x10 [ 401.493481][T16578] ? udp_lib_get_port+0x177b/0x1c60 [ 401.493535][T16578] ? inet_send_prepare+0x1b4/0x260 [ 401.493559][T16578] ? inet_send_prepare+0x1b4/0x260 [ 401.493585][T16578] ? inet_send_prepare+0x1b4/0x260 [ 401.493606][T16578] ? __local_bh_enable_ip+0xd0/0x130 [ 401.493624][T16578] ? inet_send_prepare+0x1b4/0x260 [ 401.493650][T16578] ? inet6_sendmsg+0xe4/0x120 [ 401.493667][T16578] ? __pfx_inet6_sendmsg+0x10/0x10 [ 401.493686][T16578] ____sys_sendmsg+0x61f/0xa20 [ 401.493715][T16578] ? __pfx_____sys_sendmsg+0x10/0x10 [ 401.493743][T16578] ? import_iovec+0x73/0xa0 [ 401.493767][T16578] ___sys_sendmsg+0x2a5/0x360 [ 401.493784][T16578] ? __lock_acquire+0x683/0x2cd0 [ 401.493806][T16578] ? __pfx____sys_sendmsg+0x10/0x10 [ 401.493866][T16578] ? __fget_files+0x2a/0x420 [ 401.493886][T16578] ? __fget_files+0x3a2/0x420 [ 401.493916][T16578] __x64_sys_sendmsg+0x1bd/0x2a0 [ 401.493937][T16578] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 401.493966][T16578] ? __pfx_ksys_write+0x10/0x10 [ 401.493999][T16578] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 401.494018][T16578] do_syscall_64+0x174/0x580 [ 401.494037][T16578] ? trace_irq_disable+0x3b/0x140 [ 401.494061][T16578] ? clear_bhb_loop+0x40/0x90 [ 401.494082][T16578] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 401.494099][T16578] RIP: 0033:0x7f2cba99ce59 [ 401.494117][T16578] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 401.494132][T16578] RSP: 002b:00007f2cb8bee028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 401.494151][T16578] RAX: ffffffffffffffda RBX: 00007f2cbac15fa0 RCX: 00007f2cba99ce59 [ 401.494164][T16578] RDX: 0000000000000000 RSI: 0000200000000400 RDI: 0000000000000003 [ 401.494175][T16578] RBP: 00007f2cb8bee090 R08: 0000000000000000 R09: 0000000000000000 [ 401.494186][T16578] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 401.494195][T16578] R13: 00007f2cbac16038 R14: 00007f2cbac15fa0 R15: 00007ffcc9830858 [ 401.494226][T16578] [ 401.599922][T16579] netlink: 'syz.4.2883': attribute type 1 has an invalid length. [ 401.680290][T16581] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2885'. [ 401.684667][T16579] netlink: 'syz.4.2883': attribute type 3 has an invalid length. [ 401.730181][T16581] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2885'. [ 401.905093][T16579] netlink: 224 bytes leftover after parsing attributes in process `syz.4.2883'. [ 402.092223][T16587] IPVS: sed: FWM 3 0x00000003 - no destination available [ 402.101168][T16584] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2886'. [ 402.214340][T16589] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2802'. [ 402.230630][T16589] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2802'. [ 402.243150][T16589] netlink: 'syz.1.2802': attribute type 20 has an invalid length. [ 402.266644][T16595] netlink: 'syz.1.2802': attribute type 9 has an invalid length. [ 402.321717][ C1] vxcan1: j1939_xtp_rx_rts_session_active: 0xffff88806c146000: connection exists (00 00). last cmd: 10 [ 402.448991][T16615] netlink: 'syz.2.2893': attribute type 1 has an invalid length. [ 402.555232][T16615] 8021q: adding VLAN 0 to HW filter on device bond11 [ 402.599643][T16626] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2896'. [ 402.670379][T16619] bond11: (slave veth7): Enslaving as an active interface with a down link [ 402.716616][T16624] bond11: (slave veth9): Enslaving as an active interface with a down link [ 402.726224][T16626] netdevsim netdevsim1 netdevsim0: entered promiscuous mode [ 402.813316][T16615] bond11: (slave bridge13): Enslaving as an active interface with a down link [ 402.919630][T16637] netlink: 'syz.1.2898': attribute type 10 has an invalid length. [ 403.005384][T16646] sctp: [Deprecated]: syz.3.2900 (pid 16646) Use of struct sctp_assoc_value in delayed_ack socket option. [ 403.005384][T16646] Use struct sctp_sack_info instead [ 403.080821][T16646] IPVS: sed: FWM 3 0x00000003 - no destination available [ 403.098552][T16653] netlink: 'syz.1.2903': attribute type 21 has an invalid length. [ 403.166053][T16653] netlink: 'syz.1.2903': attribute type 21 has an invalid length. [ 403.199337][T16653] netlink: 'syz.1.2903': attribute type 21 has an invalid length. [ 403.225148][T16653] netlink: 'syz.1.2903': attribute type 21 has an invalid length. [ 403.452420][T16671] openvswitch: netlink: Message has 1 unknown bytes. [ 403.459336][T16671] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 404.566521][ C1] vxcan1: j1939_tp_rxtimer: 0xffff8880223b5800: rx timeout, send abort [ 404.814927][ C1] vxcan1: j1939_tp_rxtimer: 0xffff888032d16000: rx timeout, send abort [ 404.823816][ C1] vxcan1: j1939_xtp_rx_abort_one: 0xffff888032d16000: 0x40000: (3) A timeout occurred and this is the connection abort to close the session. [ 405.074997][ C1] vxcan1: j1939_tp_rxtimer: 0xffff8880223b5800: abort rx timeout. Force session deactivation [ 405.293214][T16728] __nla_validate_parse: 74 callbacks suppressed [ 405.293231][T16728] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2924'. [ 405.387220][T16730] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 405.462727][T16736] syzkaller1: entered promiscuous mode [ 405.487237][T16736] syzkaller1: entered allmulticast mode [ 405.559945][ C1] vxcan1: j1939_xtp_rx_rts_session_active: 0xffff88803aed6800: connection exists (00 00). last cmd: 10 [ 405.645793][T16746] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2931'. [ 405.688819][T16746] 8021q: adding VLAN 0 to HW filter on device bond12 [ 405.852795][T16762] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2934'. [ 406.032324][T16770] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2939'. [ 406.432659][T16790] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2945'. [ 406.434743][T16786] siw: device registration error -23 [ 406.629922][ T4946] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 406.647970][ T4946] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 406.659636][ T4946] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 406.676456][ T4946] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 406.686897][ T4946] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 406.907299][T16804] netlink: 148 bytes leftover after parsing attributes in process `syz.2.2948'. [ 406.949498][T16804] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2948'. [ 407.343481][T16791] lo speed is unknown, defaulting to 1000 [ 407.888351][T16791] lo speed is unknown, defaulting to 1000 [ 407.930076][T16836] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2957'. [ 408.143671][T16842] netlink: 260 bytes leftover after parsing attributes in process `syz.3.2960'. [ 408.223412][T16844] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2961'. [ 408.596683][T16856] validate_nla: 63 callbacks suppressed [ 408.596703][T16856] netlink: 'syz.2.2963': attribute type 3 has an invalid length. [ 408.771848][ T50] Bluetooth: hci2: command tx timeout [ 408.941912][T16875] bond1: (slave lo): Releasing backup interface [ 408.961109][T16875] bond1: (slave lo): last VLAN challenged slave left bond - VLAN blocking is removed [ 409.018900][T16875] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 409.084230][T16885] macvlan3: entered promiscuous mode [ 409.089850][T16885] macvlan3: entered allmulticast mode [ 409.097430][T16885] bond12: (slave macvlan3): Opening slave failed [ 409.120259][T16884] tap0: tun_chr_ioctl cmd 1074025681 [ 409.619635][T16791] bridge0: port 1(bridge_slave_0) entered blocking state [ 409.639103][T16791] bridge0: port 1(bridge_slave_0) entered disabled state [ 409.652283][T16791] bridge_slave_0: entered allmulticast mode [ 409.672214][T16791] bridge_slave_0: entered promiscuous mode [ 409.687636][T16791] bridge0: port 2(bridge_slave_1) entered blocking state [ 409.695769][T16791] bridge0: port 2(bridge_slave_1) entered disabled state [ 409.703800][T16791] bridge_slave_1: entered allmulticast mode [ 409.712164][T16791] bridge_slave_1: entered promiscuous mode [ 409.738558][T16918] netlink: 'syz.1.2980': attribute type 1 has an invalid length. [ 409.918305][T16791] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 409.963208][T16791] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 410.089489][T16934] netlink: 'syz.3.2984': attribute type 10 has an invalid length. [ 410.214711][T16791] team0: Port device team_slave_0 added [ 410.243734][T16791] team0: Port device team_slave_1 added [ 410.357966][T16791] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 410.389848][T16791] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 410.445536][T16955] netlink: 'syz.2.2988': attribute type 1 has an invalid length. [ 410.487679][T16791] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 410.490391][T16955] __nla_validate_parse: 7 callbacks suppressed [ 410.490412][T16955] netlink: 88 bytes leftover after parsing attributes in process `syz.2.2988'. [ 410.558896][T16955] netlink: 'syz.2.2988': attribute type 1 has an invalid length. [ 410.570150][T16791] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 410.575893][T16955] netlink: 638 bytes leftover after parsing attributes in process `syz.2.2988'. [ 410.587472][T16791] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 410.600529][T16955] netlink: 1 bytes leftover after parsing attributes in process `syz.2.2988'. [ 410.660331][T16791] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 410.749581][T16959] veth1_to_batadv: entered promiscuous mode [ 410.852503][ T50] Bluetooth: hci2: command tx timeout [ 410.890400][T16976] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2997'. [ 410.913745][T16977] netlink: 132 bytes leftover after parsing attributes in process `syz.1.2996'. [ 410.958342][T16980] openvswitch: netlink: IP tunnel dst address not specified [ 410.960898][T16791] hsr_slave_0: entered promiscuous mode [ 410.972921][T16791] hsr_slave_1: entered promiscuous mode [ 410.980151][T16791] debugfs: 'hsr0' already exists in 'hsr' [ 410.986507][T16791] Cannot create hsr debugfs directory [ 410.992357][T16977] netlink: 132 bytes leftover after parsing attributes in process `syz.1.2996'. [ 411.185194][T16995] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3002'. [ 411.199869][T16995] netlink: 'syz.3.3002': attribute type 7 has an invalid length. [ 411.208589][T16995] netlink: 'syz.3.3002': attribute type 8 has an invalid length. [ 411.216987][T16995] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3002'. [ 411.271582][T16995] bond0: entered promiscuous mode [ 411.288619][T16995] netdevsim netdevsim3 netdevsim1: entered promiscuous mode [ 411.352013][T16995] erspan0: entered promiscuous mode [ 411.361728][T16995] debugfs: 'hsr0' already exists in 'hsr' [ 411.367685][T16995] Cannot create hsr debugfs directory [ 411.530372][T16998] veth1_to_hsr: entered promiscuous mode [ 411.568985][T16998] netlink: 76 bytes leftover after parsing attributes in process `syz.2.3001'. [ 411.607142][T16998] A link change request failed with some changes committed already. Interface veth1_to_hsr may have been left with an inconsistent configuration, please check. [ 411.724610][T16791] netdevsim netdevsim4 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 411.793555][T16791] netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 412.054321][T16791] netdevsim netdevsim4 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 412.135599][T16791] netdevsim netdevsim4 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 412.193214][T17030] netlink: 'syz.1.3011': attribute type 1 has an invalid length. [ 412.393146][T17041] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3015'. [ 412.931385][T16791] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 412.941105][ T50] Bluetooth: hci2: command tx timeout [ 412.979504][T16791] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 413.005131][T16791] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 413.041540][T16791] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 413.051912][T16791] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 413.069298][T16791] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 413.087379][T17061] syzkaller1: tun_chr_ioctl cmd 2147767521 [ 413.102650][T16791] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 413.119190][T16791] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 413.374452][T16791] 8021q: adding VLAN 0 to HW filter on device bond0 [ 413.397978][T17086] nbd: socks must be embedded in a SOCK_ITEM attr [ 413.417105][T16608] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 413.442868][T16791] 8021q: adding VLAN 0 to HW filter on device team0 [ 413.448457][T16608] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 413.494277][T16609] bridge0: port 1(bridge_slave_0) entered blocking state [ 413.501530][T16609] bridge0: port 1(bridge_slave_0) entered forwarding state [ 413.599133][T16609] bridge0: port 2(bridge_slave_1) entered blocking state [ 413.606420][T16609] bridge0: port 2(bridge_slave_1) entered forwarding state [ 413.771826][T17091] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 413.792528][T17108] netlink: 'syz.3.3031': attribute type 11 has an invalid length. [ 414.338830][T16791] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 414.588639][T16791] veth0_vlan: entered promiscuous mode [ 414.603423][T16791] veth1_vlan: entered promiscuous mode [ 414.680415][T16791] veth0_macvtap: entered promiscuous mode [ 414.726688][T16791] veth1_macvtap: entered promiscuous mode [ 414.821997][T16791] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 414.850340][T17141] smbdirect: ib_dev[syz2] removed [ 414.875984][T16791] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 414.906424][T16609] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 414.936386][T16609] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 414.969425][T16609] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 415.000851][T16609] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 415.012035][ T50] Bluetooth: hci2: command tx timeout [ 415.267800][ T5884] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 415.296211][ T5884] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 415.479671][ T5884] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 415.488418][ T5884] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 415.705032][T17185] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 416.043877][T17196] FAULT_INJECTION: forcing a failure. [ 416.043877][T17196] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 416.074166][ T4946] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 416.094931][T17196] CPU: 0 UID: 0 PID: 17196 Comm: syz.4.3052 Not tainted syzkaller #0 PREEMPT(full) [ 416.094955][T17196] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 416.094966][T17196] Call Trace: [ 416.094973][T17196] [ 416.094981][T17196] dump_stack_lvl+0xe8/0x150 [ 416.095008][T17196] should_fail_ex+0x40c/0x560 [ 416.095040][T17196] _copy_from_user+0x2d/0xb0 [ 416.095060][T17196] ___sys_sendmsg+0x1c6/0x360 [ 416.095078][T17196] ? __lock_acquire+0x683/0x2cd0 [ 416.095100][T17196] ? __pfx____sys_sendmsg+0x10/0x10 [ 416.095144][T17196] ? __fget_files+0x2a/0x420 [ 416.095163][T17196] ? __fget_files+0x3a2/0x420 [ 416.095188][T17196] __x64_sys_sendmsg+0x1bd/0x2a0 [ 416.095208][T17196] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 416.095232][T17196] ? __pfx_ksys_write+0x10/0x10 [ 416.095260][T17196] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 416.095277][T17196] do_syscall_64+0x174/0x580 [ 416.095298][T17196] ? trace_irq_disable+0x3b/0x140 [ 416.095321][T17196] ? clear_bhb_loop+0x40/0x90 [ 416.095341][T17196] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 416.095358][T17196] RIP: 0033:0x7f39b419ce59 [ 416.095373][T17196] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 416.095392][T17196] RSP: 002b:00007f39b4fc3028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 416.095410][T17196] RAX: ffffffffffffffda RBX: 00007f39b4415fa0 RCX: 00007f39b419ce59 [ 416.095423][T17196] RDX: 0000000024004080 RSI: 0000200000000200 RDI: 0000000000000004 [ 416.095434][T17196] RBP: 00007f39b4fc3090 R08: 0000000000000000 R09: 0000000000000000 [ 416.095445][T17196] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 416.095453][T17196] R13: 00007f39b4416038 R14: 00007f39b4415fa0 R15: 00007ffcdd19ac78 [ 416.095481][T17196] [ 416.099356][ T4946] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 416.306092][ T4946] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 416.321106][ T4946] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 416.336024][ T4946] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 416.882835][ T5635] syz_tun (unregistering): left allmulticast mode [ 416.930020][T17230] __nla_validate_parse: 7 callbacks suppressed [ 416.930039][T17230] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3061'. [ 417.006316][T17224] bridge0: port 2(bridge_slave_1) entered disabled state [ 417.014035][T17224] bridge0: port 1(bridge_slave_0) entered disabled state [ 417.123337][T17224] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 417.135577][T17224] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 417.236321][T17225] netlink: 32 bytes leftover after parsing attributes in process `syz.1.3058'. [ 417.256228][T16606] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 417.276938][T16606] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 417.389764][T16606] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 417.416099][T16606] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 417.435220][T17242] netlink: 64 bytes leftover after parsing attributes in process `syz.4.3063'. [ 417.466467][T17241] netlink: 64 bytes leftover after parsing attributes in process `syz.4.3063'. [ 417.952626][T17261] netlink: 'syz.0.3071': attribute type 8 has an invalid length. [ 418.008408][T17262] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3071'. [ 418.050188][T17233] lo speed is unknown, defaulting to 1000 [ 418.066848][T17261] netlink: 'syz.0.3071': attribute type 14 has an invalid length. [ 418.461502][ T4946] Bluetooth: hci0: command tx timeout [ 418.784303][T17195] lo speed is unknown, defaulting to 1000 [ 418.900810][T17302] netlink: 60 bytes leftover after parsing attributes in process `syz.4.3079'. [ 418.924448][T17302] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3079'. [ 418.947216][T17302] netlink: 60 bytes leftover after parsing attributes in process `syz.4.3079'. [ 419.355202][T17312] netlink: 'syz.1.3081': attribute type 1 has an invalid length. [ 419.706390][T17318] netlink: 64 bytes leftover after parsing attributes in process `syz.1.3081'. [ 419.795284][T17332] FAULT_INJECTION: forcing a failure. [ 419.795284][T17332] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 419.826520][T17332] CPU: 0 UID: 0 PID: 17332 Comm: syz.0.3084 Not tainted syzkaller #0 PREEMPT(full) [ 419.826547][T17332] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 419.826557][T17332] Call Trace: [ 419.826564][T17332] [ 419.826572][T17332] dump_stack_lvl+0xe8/0x150 [ 419.826599][T17332] should_fail_ex+0x40c/0x560 [ 419.826641][T17332] _copy_from_iter+0x1d3/0x1660 [ 419.826664][T17332] ? rcu_is_watching+0x15/0xb0 [ 419.826690][T17332] ? __pfx__copy_from_iter+0x10/0x10 [ 419.826705][T17332] ? kmem_cache_alloc_node_noprof+0x3ca/0x680 [ 419.826738][T17332] ? netlink_sendmsg+0x650/0xb40 [ 419.826757][T17332] ? skb_put+0x112/0x210 [ 419.826777][T17332] netlink_sendmsg+0x6c0/0xb40 [ 419.826804][T17332] ? __pfx_netlink_sendmsg+0x10/0x10 [ 419.826827][T17332] ? aa_sock_msg_perm+0xf1/0x1b0 [ 419.826853][T17332] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 419.826875][T17332] ? __pfx_netlink_sendmsg+0x10/0x10 [ 419.826896][T17332] ____sys_sendmsg+0x9b9/0xa20 [ 419.826915][T17332] ? __might_fault+0xaf/0x130 [ 419.826944][T17332] ? __pfx_____sys_sendmsg+0x10/0x10 [ 419.826971][T17332] ? import_iovec+0x73/0xa0 [ 419.826994][T17332] ___sys_sendmsg+0x2a5/0x360 [ 419.827011][T17332] ? __lock_acquire+0x683/0x2cd0 [ 419.827034][T17332] ? __pfx____sys_sendmsg+0x10/0x10 [ 419.827091][T17332] ? __fget_files+0x2a/0x420 [ 419.827120][T17332] ? __fget_files+0x3a2/0x420 [ 419.827151][T17332] __x64_sys_sendmsg+0x1bd/0x2a0 [ 419.827172][T17332] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 419.827201][T17332] ? __pfx_ksys_write+0x10/0x10 [ 419.827234][T17332] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 419.827254][T17332] do_syscall_64+0x174/0x580 [ 419.827273][T17332] ? trace_irq_disable+0x3b/0x140 [ 419.827297][T17332] ? clear_bhb_loop+0x40/0x90 [ 419.827320][T17332] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 419.827337][T17332] RIP: 0033:0x7fb05dd9ce59 [ 419.827353][T17332] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 419.827368][T17332] RSP: 002b:00007fb05ec68028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 419.827388][T17332] RAX: ffffffffffffffda RBX: 00007fb05e015fa0 RCX: 00007fb05dd9ce59 [ 419.827400][T17332] RDX: 0000000024004080 RSI: 0000200000000200 RDI: 0000000000000004 [ 419.827412][T17332] RBP: 00007fb05ec68090 R08: 0000000000000000 R09: 0000000000000000 [ 419.827422][T17332] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 419.827432][T17332] R13: 00007fb05e016038 R14: 00007fb05e015fa0 R15: 00007ffc25bd5b48 [ 419.827462][T17332] [ 420.531596][ T4946] Bluetooth: hci0: command tx timeout [ 420.652429][T17352] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3089'. [ 420.713372][T17195] bridge0: port 1(bridge_slave_0) entered blocking state [ 420.743067][T17195] bridge0: port 1(bridge_slave_0) entered disabled state [ 420.753070][T17195] bridge_slave_0: entered allmulticast mode [ 420.761669][T17195] bridge_slave_0: entered promiscuous mode [ 420.777078][ T5884] netdevsim netdevsim0 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 420.787314][ T5884] netdevsim netdevsim0 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 420.796293][ T5884] netdevsim netdevsim0 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 420.805648][ T5884] netdevsim netdevsim0 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 420.814309][T17195] bridge0: port 2(bridge_slave_1) entered blocking state [ 420.821780][T17195] bridge0: port 2(bridge_slave_1) entered disabled state [ 420.829009][T17195] bridge_slave_1: entered allmulticast mode [ 420.836632][T17195] bridge_slave_1: entered promiscuous mode [ 420.898736][T17360] netlink: 'syz.1.3092': attribute type 10 has an invalid length. [ 420.911423][T17360] netlink: 'syz.1.3092': attribute type 1 has an invalid length. [ 420.917057][T17195] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 420.942578][T17360] 8021q: adding VLAN 0 to HW filter on device bond2 [ 420.953398][T17195] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 420.974890][T17360] bond2: down delay (1) is not a multiple of miimon (100), value rounded to 0 ms [ 420.984777][T17360] bond2: option ad_user_port_key: mode dependency failed, not supported in mode balance-alb(6) [ 421.017345][T17360] bond2: (slave ip6gretap1): making interface the new active one [ 421.026866][T17360] bond2: (slave ip6gretap1): Enslaving as an active interface with an up link [ 421.038445][T17195] team0: Port device team_slave_0 added [ 421.055765][T17195] team0: Port device team_slave_1 added [ 421.108836][T17195] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 421.116305][T17195] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 421.144066][T17195] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 421.157678][T17195] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 421.175224][T17195] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 421.201919][T17195] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 421.250851][T17195] hsr_slave_0: entered promiscuous mode [ 421.257712][T17195] hsr_slave_1: entered promiscuous mode [ 421.266496][T17195] debugfs: 'hsr0' already exists in 'hsr' [ 421.274565][T17365] netlink: 'syz.1.3093': attribute type 1 has an invalid length. [ 421.281677][T17195] Cannot create hsr debugfs directory [ 421.662107][T17380] FAULT_INJECTION: forcing a failure. [ 421.662107][T17380] name failslab, interval 1, probability 0, space 0, times 0 [ 421.743984][T17380] CPU: 0 UID: 0 PID: 17380 Comm: syz.0.3096 Not tainted syzkaller #0 PREEMPT(full) [ 421.744008][T17380] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 421.744019][T17380] Call Trace: [ 421.744026][T17380] [ 421.744033][T17380] dump_stack_lvl+0xe8/0x150 [ 421.744063][T17380] should_fail_ex+0x40c/0x560 [ 421.744096][T17380] should_failslab+0xa8/0x100 [ 421.744114][T17380] __kmalloc_noprof+0xe8/0x750 [ 421.744137][T17380] ? __pfx___mutex_trylock_common+0x10/0x10 [ 421.744160][T17380] ? genl_family_rcv_msg_attrs_parse+0xd0/0x2f0 [ 421.744191][T17380] genl_family_rcv_msg_attrs_parse+0xd0/0x2f0 [ 421.744223][T17380] genl_family_rcv_msg_doit+0xda/0x340 [ 421.744252][T17380] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 421.744280][T17380] ? apparmor_capable+0x126/0x170 [ 421.744302][T17380] ? bpf_lsm_capable+0x9/0x20 [ 421.744318][T17380] ? security_capable+0x7e/0x2c0 [ 421.744479][T17380] genl_rcv_msg+0x614/0x7a0 [ 421.744509][T17380] ? __pfx_genl_rcv_msg+0x10/0x10 [ 421.744531][T17380] ? __pfx_netlbl_cipsov4_add+0x10/0x10 [ 421.744633][T17380] netlink_rcv_skb+0x226/0x4a0 [ 421.744652][T17380] ? __pfx_genl_rcv_msg+0x10/0x10 [ 421.744675][T17380] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 421.744710][T17380] ? down_read+0x270/0x2e0 [ 421.744731][T17380] ? genl_rcv+0xd/0x40 [ 421.744755][T17380] genl_rcv+0x28/0x40 [ 421.744773][T17380] netlink_unicast+0x7bb/0x940 [ 421.744809][T17380] netlink_sendmsg+0x813/0xb40 [ 421.744836][T17380] ? __pfx_netlink_sendmsg+0x10/0x10 [ 421.744858][T17380] ? aa_sock_msg_perm+0xf1/0x1b0 [ 421.744883][T17380] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 421.744904][T17380] ? __pfx_netlink_sendmsg+0x10/0x10 [ 421.744925][T17380] ____sys_sendmsg+0x9b9/0xa20 [ 421.744944][T17380] ? __might_fault+0xaf/0x130 [ 421.744973][T17380] ? __pfx_____sys_sendmsg+0x10/0x10 [ 421.744998][T17380] ? import_iovec+0x73/0xa0 [ 421.745023][T17380] ___sys_sendmsg+0x2a5/0x360 [ 421.745041][T17380] ? __lock_acquire+0x683/0x2cd0 [ 421.745072][T17380] ? __pfx____sys_sendmsg+0x10/0x10 [ 421.745128][T17380] ? __fget_files+0x2a/0x420 [ 421.745147][T17380] ? __fget_files+0x3a2/0x420 [ 421.745179][T17380] __x64_sys_sendmsg+0x1bd/0x2a0 [ 421.745201][T17380] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 421.745230][T17380] ? __pfx_ksys_write+0x10/0x10 [ 421.745264][T17380] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 421.745284][T17380] do_syscall_64+0x174/0x580 [ 421.745304][T17380] ? trace_irq_disable+0x3b/0x140 [ 421.745327][T17380] ? clear_bhb_loop+0x40/0x90 [ 421.745349][T17380] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 421.745367][T17380] RIP: 0033:0x7fb05dd9ce59 [ 421.745384][T17380] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 421.745399][T17380] RSP: 002b:00007fb05ec68028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 421.745415][T17380] RAX: ffffffffffffffda RBX: 00007fb05e015fa0 RCX: 00007fb05dd9ce59 [ 421.745425][T17380] RDX: 0000000024004080 RSI: 0000200000000200 RDI: 0000000000000004 [ 421.745435][T17380] RBP: 00007fb05ec68090 R08: 0000000000000000 R09: 0000000000000000 [ 421.745445][T17380] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 421.745456][T17380] R13: 00007fb05e016038 R14: 00007fb05e015fa0 R15: 00007ffc25bd5b48 [ 421.745484][T17380] [ 421.780127][T17383] netlink: 'syz.1.3097': attribute type 1 has an invalid length. [ 422.102004][T17395] ip6t_srh: unknown srh match flags 4000 [ 422.108147][T17396] ip6t_srh: unknown srh match flags 4000 [ 422.115715][T17396] __nla_validate_parse: 6 callbacks suppressed [ 422.115733][T17396] netlink: 566 bytes leftover after parsing attributes in process `syz.4.3101'. [ 422.140243][T17397] sctp: [Deprecated]: syz.1.3097 (pid 17397) Use of int in maxseg socket option. [ 422.140243][T17397] Use struct sctp_assoc_value instead [ 422.476268][T17412] netlink: 'syz.1.3104': attribute type 10 has an invalid length. [ 422.556603][T17412] 8021q: adding VLAN 0 to HW filter on device team0 [ 422.567314][T17412] bond0: (slave team0): Enslaving as an active interface with an up link [ 422.612089][ T4946] Bluetooth: hci0: command tx timeout [ 422.809308][T17421] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3107'. [ 422.915292][T17427] FAULT_INJECTION: forcing a failure. [ 422.915292][T17427] name failslab, interval 1, probability 0, space 0, times 0 [ 422.955530][T17427] CPU: 0 UID: 0 PID: 17427 Comm: syz.3.3109 Not tainted syzkaller #0 PREEMPT(full) [ 422.955556][T17427] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 422.955567][T17427] Call Trace: [ 422.955576][T17427] [ 422.955585][T17427] dump_stack_lvl+0xe8/0x150 [ 422.955612][T17427] should_fail_ex+0x40c/0x560 [ 422.955645][T17427] should_failslab+0xa8/0x100 [ 422.955666][T17427] __kmalloc_cache_noprof+0x88/0x660 [ 422.955691][T17427] ? netlbl_cipsov4_add+0x243/0x22b0 [ 422.955721][T17427] netlbl_cipsov4_add+0x243/0x22b0 [ 422.955744][T17427] ? trace_kmalloc+0x2a/0xf0 [ 422.955773][T17427] ? __pfx_netlbl_cipsov4_add+0x10/0x10 [ 422.955800][T17427] ? genl_family_rcv_msg_attrs_parse+0x20b/0x2f0 [ 422.955825][T17427] ? genl_family_rcv_msg_attrs_parse+0x265/0x2f0 [ 422.955857][T17427] genl_family_rcv_msg_doit+0x233/0x340 [ 422.955885][T17427] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 422.955918][T17427] ? bpf_lsm_capable+0x9/0x20 [ 422.955935][T17427] ? security_capable+0x7e/0x2c0 [ 422.955964][T17427] genl_rcv_msg+0x614/0x7a0 [ 422.955991][T17427] ? __pfx_genl_rcv_msg+0x10/0x10 [ 422.956012][T17427] ? __pfx_netlbl_cipsov4_add+0x10/0x10 [ 422.956051][T17427] netlink_rcv_skb+0x226/0x4a0 [ 422.956071][T17427] ? __pfx_genl_rcv_msg+0x10/0x10 [ 422.956096][T17427] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 422.956133][T17427] ? down_read+0x270/0x2e0 [ 422.956154][T17427] ? genl_rcv+0xd/0x40 [ 422.956178][T17427] genl_rcv+0x28/0x40 [ 422.956198][T17427] netlink_unicast+0x7bb/0x940 [ 422.956237][T17427] netlink_sendmsg+0x813/0xb40 [ 422.956267][T17427] ? __pfx_netlink_sendmsg+0x10/0x10 [ 422.956291][T17427] ? aa_sock_msg_perm+0xf1/0x1b0 [ 422.956318][T17427] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 422.956339][T17427] ? __pfx_netlink_sendmsg+0x10/0x10 [ 422.956360][T17427] ____sys_sendmsg+0x9b9/0xa20 [ 422.956380][T17427] ? __might_fault+0xaf/0x130 [ 422.956409][T17427] ? __pfx_____sys_sendmsg+0x10/0x10 [ 422.956439][T17427] ? import_iovec+0x73/0xa0 [ 422.956472][T17427] ___sys_sendmsg+0x2a5/0x360 [ 422.956489][T17427] ? __lock_acquire+0x683/0x2cd0 [ 422.956511][T17427] ? __pfx____sys_sendmsg+0x10/0x10 [ 422.956560][T17427] ? __fget_files+0x2a/0x420 [ 422.956579][T17427] ? __fget_files+0x3a2/0x420 [ 422.956613][T17427] __x64_sys_sendmsg+0x1bd/0x2a0 [ 422.956634][T17427] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 422.956662][T17427] ? __pfx_ksys_write+0x10/0x10 [ 422.956695][T17427] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 422.956715][T17427] do_syscall_64+0x174/0x580 [ 422.956734][T17427] ? trace_irq_disable+0x3b/0x140 [ 422.956758][T17427] ? clear_bhb_loop+0x40/0x90 [ 422.956780][T17427] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 422.956797][T17427] RIP: 0033:0x7f2cba99ce59 [ 422.956814][T17427] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 422.956827][T17427] RSP: 002b:00007f2cb8bee028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 422.956846][T17427] RAX: ffffffffffffffda RBX: 00007f2cbac15fa0 RCX: 00007f2cba99ce59 [ 422.956859][T17427] RDX: 0000000024004080 RSI: 0000200000000200 RDI: 0000000000000004 [ 422.956871][T17427] RBP: 00007f2cb8bee090 R08: 0000000000000000 R09: 0000000000000000 [ 422.956882][T17427] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 422.956891][T17427] R13: 00007f2cbac16038 R14: 00007f2cbac15fa0 R15: 00007ffcc9830858 [ 422.956923][T17427] [ 423.400413][T17430] gre1: entered allmulticast mode [ 423.488083][T17195] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 423.504359][T17195] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 423.515802][T17195] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 423.534689][T17195] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 423.542816][T17195] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 423.561101][T17195] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 423.569148][T17195] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 423.804629][T17195] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 424.116153][T17195] 8021q: adding VLAN 0 to HW filter on device bond0 [ 424.174579][T17481] FAULT_INJECTION: forcing a failure. [ 424.174579][T17481] name failslab, interval 1, probability 0, space 0, times 0 [ 424.177091][T17195] 8021q: adding VLAN 0 to HW filter on device team0 [ 424.223450][T17481] CPU: 0 UID: 0 PID: 17481 Comm: syz.0.3120 Not tainted syzkaller #0 PREEMPT(full) [ 424.223476][T17481] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 424.223486][T17481] Call Trace: [ 424.223493][T17481] [ 424.223501][T17481] dump_stack_lvl+0xe8/0x150 [ 424.223528][T17481] should_fail_ex+0x40c/0x560 [ 424.223560][T17481] should_failslab+0xa8/0x100 [ 424.223580][T17481] kmem_cache_alloc_node_noprof+0x8f/0x680 [ 424.223606][T17481] ? __alloc_skb+0x1d7/0x7a0 [ 424.223629][T17481] ? __local_bh_enable_ip+0xd0/0x130 [ 424.223654][T17481] __alloc_skb+0x1d7/0x7a0 [ 424.223684][T17481] netlink_ack+0x136/0xb30 [ 424.223702][T17481] ? __pfx_genl_rcv_msg+0x10/0x10 [ 424.223742][T17481] netlink_rcv_skb+0x2a4/0x4a0 [ 424.223763][T17481] ? __pfx_genl_rcv_msg+0x10/0x10 [ 424.223788][T17481] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 424.223824][T17481] ? down_read+0x270/0x2e0 [ 424.223844][T17481] ? genl_rcv+0xd/0x40 [ 424.223868][T17481] genl_rcv+0x28/0x40 [ 424.223888][T17481] netlink_unicast+0x7bb/0x940 [ 424.223927][T17481] netlink_sendmsg+0x813/0xb40 [ 424.223956][T17481] ? __pfx_netlink_sendmsg+0x10/0x10 [ 424.223980][T17481] ? aa_sock_msg_perm+0xf1/0x1b0 [ 424.224007][T17481] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 424.224032][T17481] ? __pfx_netlink_sendmsg+0x10/0x10 [ 424.224053][T17481] ____sys_sendmsg+0x9b9/0xa20 [ 424.224072][T17481] ? __might_fault+0xaf/0x130 [ 424.224100][T17481] ? __pfx_____sys_sendmsg+0x10/0x10 [ 424.224129][T17481] ? import_iovec+0x73/0xa0 [ 424.224153][T17481] ___sys_sendmsg+0x2a5/0x360 [ 424.224171][T17481] ? __lock_acquire+0x683/0x2cd0 [ 424.224195][T17481] ? __pfx____sys_sendmsg+0x10/0x10 [ 424.224250][T17481] ? __fget_files+0x2a/0x420 [ 424.224271][T17481] ? __fget_files+0x3a2/0x420 [ 424.224303][T17481] __x64_sys_sendmsg+0x1bd/0x2a0 [ 424.224325][T17481] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 424.224361][T17481] ? __pfx_ksys_write+0x10/0x10 [ 424.224395][T17481] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 424.224415][T17481] do_syscall_64+0x174/0x580 [ 424.224435][T17481] ? trace_irq_disable+0x3b/0x140 [ 424.224459][T17481] ? clear_bhb_loop+0x40/0x90 [ 424.224481][T17481] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 424.224498][T17481] RIP: 0033:0x7fb05dd9ce59 [ 424.224516][T17481] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 424.224530][T17481] RSP: 002b:00007fb05ec68028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 424.224549][T17481] RAX: ffffffffffffffda RBX: 00007fb05e015fa0 RCX: 00007fb05dd9ce59 [ 424.224562][T17481] RDX: 0000000024004080 RSI: 0000200000000200 RDI: 0000000000000004 [ 424.224573][T17481] RBP: 00007fb05ec68090 R08: 0000000000000000 R09: 0000000000000000 [ 424.224582][T17481] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 424.224592][T17481] R13: 00007fb05e016038 R14: 00007fb05e015fa0 R15: 00007ffc25bd5b48 [ 424.224621][T17481] [ 424.245051][ T57] bridge0: port 1(bridge_slave_0) entered blocking state [ 424.377944][T17485] Bluetooth: MGMT ver 1.23 [ 424.381508][ T57] bridge0: port 1(bridge_slave_0) entered forwarding state [ 424.442381][T17483] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3122'. [ 424.555533][ T36] bridge0: port 2(bridge_slave_1) entered blocking state [ 424.562755][ T36] bridge0: port 2(bridge_slave_1) entered forwarding state [ 424.576732][T17490] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3123'. [ 424.592460][T17483] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3122'. [ 424.697622][ T4946] Bluetooth: hci0: command tx timeout [ 424.712208][T17495] netlink: 'syz.4.3124': attribute type 1 has an invalid length. [ 424.729931][T17495] netlink: 'syz.4.3124': attribute type 2 has an invalid length. [ 424.906606][T17504] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3126'. [ 425.035684][T17508] netlink: 'syz.3.3127': attribute type 31 has an invalid length. [ 425.177686][T17517] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3129'. [ 425.206560][T17518] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3129'. [ 425.241632][T17517] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3129'. [ 425.332427][ T11] block nbd1: Possible stuck request ffff888026fd5080: control (read@0,4096B). Runtime 300 seconds [ 425.383374][T17518] team0: Port device team_slave_0 removed [ 425.458672][ T4946] block nbd5: Receive control failed (result -32) [ 425.475245][T17518] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3129'. [ 425.968200][T17557] bond15: option tlb_dynamic_lb: mode dependency failed, not supported in mode balance-rr(0) [ 425.998448][T17557] bond15 (unregistering): Released all slaves [ 426.103306][T17195] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 426.275901][T17195] veth0_vlan: entered promiscuous mode [ 426.327595][T17195] veth1_vlan: entered promiscuous mode [ 426.446225][T17195] veth0_macvtap: entered promiscuous mode [ 426.463183][T17195] veth1_macvtap: entered promiscuous mode [ 426.524670][T17195] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 426.556925][T17586] veth0_to_hsr: Caught tx_queue_len zero misconfig [ 426.584165][T17195] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 426.689870][ T36] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 426.709431][ T36] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 426.728939][ T36] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 426.738313][ T36] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 426.995420][ T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 427.027637][ T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 427.138652][T16608] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 427.163113][T16608] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 427.245977][T17615] =v: renamed from veth0_to_bond [ 427.436279][T17622] : entered promiscuous mode [ 427.476445][T17628] team0: entered allmulticast mode [ 427.543215][T17628] macvlan2: entered allmulticast mode [ 427.565212][T17622] team0: left allmulticast mode [ 427.574428][T17622] macvlan2: left allmulticast mode [ 427.874732][T17641] openvswitch: netlink: IPv4 tun info is not correct [ 428.164719][T17646] netlink: 'syz.1.3161': attribute type 9 has an invalid length. [ 428.254098][ T50] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 428.266516][ T50] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 428.278392][ T50] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 428.288517][ T50] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 428.311330][ T50] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 428.643717][T17663] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 430.462098][ T4946] Bluetooth: hci3: command tx timeout [ 432.153744][T17664] syzkaller1: entered promiscuous mode [ 432.159240][T17664] syzkaller1: entered allmulticast mode [ 432.352451][T17685] __nla_validate_parse: 66 callbacks suppressed [ 432.352472][T17685] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3169'. [ 432.531471][ T4946] Bluetooth: hci3: command tx timeout [ 432.738771][T17704] Cannot find del_set index 0 as target [ 432.775709][T17711] bridge_slave_1: left allmulticast mode [ 432.811143][T17711] bridge_slave_1: left promiscuous mode [ 432.833444][T17711] bridge0: port 2(bridge_slave_1) entered disabled state [ 432.869939][T17713] netlink: 'syz.1.3174': attribute type 1 has an invalid length. [ 432.897690][T17711] bridge_slave_0: left allmulticast mode [ 432.925439][T17711] bridge_slave_0: left promiscuous mode [ 432.957074][T17711] bridge0: port 1(bridge_slave_0) entered disabled state [ 432.969760][T17719] netlink: 'syz.0.3175': attribute type 22 has an invalid length. [ 433.144710][T17719] bond0: option ad_select: unable to set because the bond device is up [ 433.235027][ T30] audit: type=1800 audit(1781651098.645:8): pid=17695 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.3170" name="memory.events" dev="tmpfs" ino=151 res=0 errno=0 [ 433.244654][T17637] lo speed is unknown, defaulting to 1000 [ 433.619247][T17741] netlink: 'syz.2.3180': attribute type 1 has an invalid length. [ 433.644268][T17741] netlink: 15958 bytes leftover after parsing attributes in process `syz.2.3180'. [ 433.644770][ T5291] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 433.818892][T17748] IPVS: set_ctl: invalid protocol: 43 100.1.1.2:20003 [ 434.144472][T17764] xt_hashlimit: size too large, truncated to 1048576 [ 434.181152][T17764] xt_hashlimit: invalid interval [ 434.255593][T17769] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3185'. [ 434.331389][T17773] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3185'. [ 434.366795][T17769] macvtap1: entered promiscuous mode [ 434.393737][T17775] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3185'. [ 434.425110][T17769] erspan0: entered promiscuous mode [ 434.463169][T17769] macvtap1: entered allmulticast mode [ 434.479589][T17769] erspan0: entered allmulticast mode [ 434.607629][T17783] netlink: 'syz.1.3188': attribute type 1 has an invalid length. [ 434.622970][ T4946] Bluetooth: hci3: command tx timeout [ 434.784836][T17791] IPVS: set_ctl: invalid protocol: 0 172.20.20.31:20001 [ 434.796776][T17783] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3188'. [ 434.825492][T17637] bridge0: port 1(bridge_slave_0) entered blocking state [ 434.849473][T17637] bridge0: port 1(bridge_slave_0) entered disabled state [ 434.867526][T17637] bridge_slave_0: entered allmulticast mode [ 434.879326][T17637] bridge_slave_0: entered promiscuous mode [ 434.976785][T17637] bridge0: port 2(bridge_slave_1) entered blocking state [ 435.020249][T17637] bridge0: port 2(bridge_slave_1) entered disabled state [ 435.081000][T17637] bridge_slave_1: entered allmulticast mode [ 435.116608][T17637] bridge_slave_1: entered promiscuous mode [ 435.337591][T17637] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 435.376206][T17637] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 435.504755][T17637] team0: Port device team_slave_0 added [ 435.539939][T17637] team0: Port device team_slave_1 added [ 435.707023][T17841] netlink: 'syz.4.3197': attribute type 1 has an invalid length. [ 435.718828][T17637] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 435.737723][T17637] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 435.768981][T17841] x_tables: ip_tables: recent.0 match: invalid size 216 (kernel) != (user) 4096 [ 435.779995][T17637] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 435.805965][T17842] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3196'. [ 435.818675][T17637] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 435.826421][T17637] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 435.886447][T17637] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 436.220328][T17637] hsr_slave_0: entered promiscuous mode [ 436.245301][T17637] hsr_slave_1: entered promiscuous mode [ 436.253060][T17637] debugfs: 'hsr0' already exists in 'hsr' [ 436.258952][T17637] Cannot create hsr debugfs directory [ 436.265725][T17866] netlink: 40 bytes leftover after parsing attributes in process `syz.4.3201'. [ 436.339714][T17873] openvswitch: netlink: ufid size 20 bytes exceeds the range (1, 16) [ 436.488535][T17880] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 436.583842][T17884] netlink: 5 bytes leftover after parsing attributes in process `syz.4.3206'. [ 436.690998][ T4946] Bluetooth: hci3: command tx timeout [ 436.710221][T17637] netdevsim netdevsim3 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 436.723107][T17637] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 436.777144][T16608] TC_ACT_REPEAT abuse ? [ 437.016676][T17637] netdevsim netdevsim3 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 437.030595][T17637] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 437.140168][T17896] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3210'. [ 437.253465][T17637] bond0: (slave netdevsim1): Releasing backup interface [ 437.266959][T17637] netdevsim netdevsim3 netdevsim1 (unregistering): left promiscuous mode [ 437.288069][T17637] netdevsim netdevsim3 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 437.301494][T17637] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 437.334583][ C1] vxcan1: j1939_tp_rxtimer: 0xffff88806c146000: rx timeout, send abort [ 437.343315][ C1] vxcan1: j1939_xtp_rx_abort_one: 0xffff88806c146000: 0x40000: (3) A timeout occurred and this is the connection abort to close the session. [ 437.468518][T17908] __nla_validate_parse: 4 callbacks suppressed [ 437.468537][T17908] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3214'. [ 437.528209][T17637] netdevsim netdevsim3 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 437.539635][T17637] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 437.581011][T17908] vlan2: entered promiscuous mode [ 437.593670][T17914] netlink: 'syz.2.3217': attribute type 1 has an invalid length. [ 437.618229][T17908] geneve1: entered promiscuous mode [ 437.628866][T17908] vlan2: entered allmulticast mode [ 437.635818][T17908] geneve1: entered allmulticast mode [ 437.665947][T17908] netlink: 84 bytes leftover after parsing attributes in process `syz.4.3214'. [ 437.705530][T17919] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3217'. [ 437.738010][T17919] batadv_slave_1: entered promiscuous mode [ 437.754468][T17919] batadv_slave_1: entered allmulticast mode [ 437.876036][T17923] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3218'. [ 438.105346][T17930] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3222'. [ 438.142880][T17931] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3223'. [ 438.189052][T17927] bond1: Removing last ns target with arp_interval on [ 438.198420][T17637] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 438.221894][T17637] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 438.242764][T17637] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 438.260284][T17637] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 438.290246][T17637] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 438.396725][T17637] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 438.422640][T17637] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 438.456105][T17637] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 438.488208][T17954] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3226'. [ 438.529419][T17951] netlink: 88 bytes leftover after parsing attributes in process `syz.1.3228'. [ 438.544390][T17944] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3226'. [ 438.774639][T17961] bridge0: entered allmulticast mode [ 438.824396][T17964] syzkaller0: entered promiscuous mode [ 438.831091][T17970] block nbd0: Unsupported socket: should be TCP or UNIX. [ 438.840949][T17964] syzkaller0: entered allmulticast mode [ 439.459873][T17982] FAULT_INJECTION: forcing a failure. [ 439.459873][T17982] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 439.490711][T17982] CPU: 0 UID: 0 PID: 17982 Comm: syz.1.3234 Not tainted syzkaller #0 PREEMPT(full) [ 439.490738][T17982] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 439.490748][T17982] Call Trace: [ 439.490755][T17982] [ 439.490763][T17982] dump_stack_lvl+0xe8/0x150 [ 439.490789][T17982] should_fail_ex+0x40c/0x560 [ 439.490821][T17982] _copy_from_iter+0x1d3/0x1660 [ 439.490844][T17982] ? rcu_is_watching+0x15/0xb0 [ 439.490869][T17982] ? __pfx__copy_from_iter+0x10/0x10 [ 439.490884][T17982] ? kmem_cache_alloc_node_noprof+0x3ca/0x680 [ 439.490914][T17982] ? netlink_sendmsg+0x650/0xb40 [ 439.490931][T17982] ? skb_put+0x112/0x210 [ 439.490951][T17982] netlink_sendmsg+0x6c0/0xb40 [ 439.490979][T17982] ? __pfx_netlink_sendmsg+0x10/0x10 [ 439.491002][T17982] ? aa_sock_msg_perm+0xf1/0x1b0 [ 439.491027][T17982] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 439.491049][T17982] ? __pfx_netlink_sendmsg+0x10/0x10 [ 439.491079][T17982] ____sys_sendmsg+0x9b9/0xa20 [ 439.491098][T17982] ? __might_fault+0xaf/0x130 [ 439.491126][T17982] ? __pfx_____sys_sendmsg+0x10/0x10 [ 439.491153][T17982] ? import_iovec+0x73/0xa0 [ 439.491177][T17982] ___sys_sendmsg+0x2a5/0x360 [ 439.491195][T17982] ? __lock_acquire+0x683/0x2cd0 [ 439.491217][T17982] ? __pfx____sys_sendmsg+0x10/0x10 [ 439.491270][T17982] ? __fget_files+0x2a/0x420 [ 439.491290][T17982] ? __fget_files+0x3a2/0x420 [ 439.491320][T17982] __x64_sys_sendmsg+0x1bd/0x2a0 [ 439.491341][T17982] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 439.491370][T17982] ? __pfx_ksys_write+0x10/0x10 [ 439.491402][T17982] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 439.491421][T17982] do_syscall_64+0x174/0x580 [ 439.491441][T17982] ? trace_irq_disable+0x3b/0x140 [ 439.491465][T17982] ? clear_bhb_loop+0x40/0x90 [ 439.491486][T17982] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 439.491503][T17982] RIP: 0033:0x7fdfd1f9ce59 [ 439.491521][T17982] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 439.491536][T17982] RSP: 002b:00007fdfd2d82028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 439.491555][T17982] RAX: ffffffffffffffda RBX: 00007fdfd2215fa0 RCX: 00007fdfd1f9ce59 [ 439.491567][T17982] RDX: 0000000004000844 RSI: 0000200000000280 RDI: 0000000000000003 [ 439.491579][T17982] RBP: 00007fdfd2d82090 R08: 0000000000000000 R09: 0000000000000000 [ 439.491590][T17982] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 439.491600][T17982] R13: 00007fdfd2216038 R14: 00007fdfd2215fa0 R15: 00007ffd4eb67268 [ 439.491629][T17982] [ 440.041815][T17953] lo speed is unknown, defaulting to 1000 [ 440.070619][T17993] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3237'. [ 440.201506][T17637] 8021q: adding VLAN 0 to HW filter on device bond0 [ 440.272827][T17637] 8021q: adding VLAN 0 to HW filter on device team0 [ 440.279336][T17999] netlink: 'syz.1.3240': attribute type 20 has an invalid length. [ 440.313580][T16606] bridge0: port 1(bridge_slave_0) entered blocking state [ 440.320856][T16606] bridge0: port 1(bridge_slave_0) entered forwarding state [ 440.387132][T17999] netlink: 'syz.1.3240': attribute type 20 has an invalid length. [ 440.429226][T17998] bond13: Unable to set down delay as MII monitoring is disabled [ 440.439567][T17998] bond13 (unregistering): Released all slaves [ 440.474999][T16606] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 440.498032][T16606] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 440.519339][T16606] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 440.586820][T16606] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 440.619102][T11982] bridge0: port 2(bridge_slave_1) entered blocking state [ 440.626382][T11982] bridge0: port 2(bridge_slave_1) entered forwarding state [ 440.681244][T17637] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 440.709976][T17637] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 440.750264][T18009] netlink: 'syz.0.3243': attribute type 6 has an invalid length. [ 440.761165][T18009] netlink: 'syz.0.3243': attribute type 7 has an invalid length. [ 440.769657][T18009] netlink: 'syz.0.3243': attribute type 8 has an invalid length. [ 440.879365][T18017] bond0: option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0) [ 441.077132][T18025] FAULT_INJECTION: forcing a failure. [ 441.077132][T18025] name failslab, interval 1, probability 0, space 0, times 0 [ 441.139692][T18025] CPU: 0 UID: 0 PID: 18025 Comm: syz.2.3245 Not tainted syzkaller #0 PREEMPT(full) [ 441.139718][T18025] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 441.139727][T18025] Call Trace: [ 441.139734][T18025] [ 441.139741][T18025] dump_stack_lvl+0xe8/0x150 [ 441.139767][T18025] should_fail_ex+0x40c/0x560 [ 441.139799][T18025] should_failslab+0xa8/0x100 [ 441.139815][T18025] ? skb_clone+0x212/0x3a0 [ 441.139834][T18025] kmem_cache_alloc_noprof+0x87/0x650 [ 441.139865][T18025] skb_clone+0x212/0x3a0 [ 441.139886][T18025] __netlink_deliver_tap+0x413/0x860 [ 441.139917][T18025] ? netlink_deliver_tap+0x2e/0x1b0 [ 441.139937][T18025] netlink_deliver_tap+0x19c/0x1b0 [ 441.139957][T18025] netlink_unicast+0x77f/0x940 [ 441.139994][T18025] netlink_sendmsg+0x813/0xb40 [ 441.140021][T18025] ? __pfx_netlink_sendmsg+0x10/0x10 [ 441.140042][T18025] ? aa_sock_msg_perm+0xf1/0x1b0 [ 441.140068][T18025] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 441.140090][T18025] ? __pfx_netlink_sendmsg+0x10/0x10 [ 441.140111][T18025] ____sys_sendmsg+0x9b9/0xa20 [ 441.140130][T18025] ? __might_fault+0xaf/0x130 [ 441.140159][T18025] ? __pfx_____sys_sendmsg+0x10/0x10 [ 441.140188][T18025] ? import_iovec+0x73/0xa0 [ 441.140212][T18025] ___sys_sendmsg+0x2a5/0x360 [ 441.140230][T18025] ? __lock_acquire+0x683/0x2cd0 [ 441.140253][T18025] ? __pfx____sys_sendmsg+0x10/0x10 [ 441.140316][T18025] ? __fget_files+0x2a/0x420 [ 441.140337][T18025] ? __fget_files+0x3a2/0x420 [ 441.140369][T18025] __x64_sys_sendmsg+0x1bd/0x2a0 [ 441.140392][T18025] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 441.140419][T18025] ? __pfx_ksys_write+0x10/0x10 [ 441.140453][T18025] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 441.140471][T18025] do_syscall_64+0x174/0x580 [ 441.140490][T18025] ? trace_irq_disable+0x3b/0x140 [ 441.140514][T18025] ? clear_bhb_loop+0x40/0x90 [ 441.140534][T18025] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 441.140550][T18025] RIP: 0033:0x7fbd9a39ce59 [ 441.140567][T18025] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 441.140580][T18025] RSP: 002b:00007fbd9b217028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 441.140598][T18025] RAX: ffffffffffffffda RBX: 00007fbd9a615fa0 RCX: 00007fbd9a39ce59 [ 441.140610][T18025] RDX: 0000000004000844 RSI: 0000200000000280 RDI: 0000000000000003 [ 441.140621][T18025] RBP: 00007fbd9b217090 R08: 0000000000000000 R09: 0000000000000000 [ 441.140631][T18025] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 441.140641][T18025] R13: 00007fbd9a616038 R14: 00007fbd9a615fa0 R15: 00007ffeae569868 [ 441.140670][T18025] [ 441.452123][T18025] netdevsim netdevsim2 netdevsim0: entered promiscuous mode [ 441.826534][T18035] vlan2: entered allmulticast mode [ 441.863720][T18035] bond0: entered allmulticast mode [ 441.882661][T18035] bond_slave_0: entered allmulticast mode [ 441.901494][T18035] bond_slave_1: entered allmulticast mode [ 441.970160][T17637] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 442.039385][T18035] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 442.072766][T18035] bond_slave_0: left allmulticast mode [ 442.083001][T18035] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 442.092772][T18035] bond_slave_1: left allmulticast mode [ 442.102403][T18035] bond0 (unregistering): Released all slaves [ 442.129563][ T30] audit: type=1107 audit(1781651107.535:9): pid=18041 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='' [ 442.222784][T17637] veth0_vlan: entered promiscuous mode [ 442.282254][T17637] veth1_vlan: entered promiscuous mode [ 442.396685][T17637] veth0_macvtap: entered promiscuous mode [ 442.438687][T17637] veth1_macvtap: entered promiscuous mode [ 442.503689][T17637] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 442.538976][T18055] syzkaller1: entered promiscuous mode [ 442.551355][T18055] syzkaller1: entered allmulticast mode [ 442.578916][T17637] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 442.624850][T18061] __nla_validate_parse: 7 callbacks suppressed [ 442.624867][T18061] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3255'. [ 442.687016][T18061] netdevsim netdevsim4 netdevsim0: entered promiscuous mode [ 442.697317][T18061] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 442.706821][T18061] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3255'. [ 442.728735][T18062] tipc: Started in network mode [ 442.743280][T18062] tipc: Node identity 362c191a54d9, cluster identity 4711 [ 442.767285][T18062] tipc: Enabled bearer , priority 0 [ 442.837185][T18059] syzkaller0: entered promiscuous mode [ 442.854704][T18059] syzkaller0: entered allmulticast mode [ 442.889868][T18067] A link change request failed with some changes committed already. Interface gre3 may have been left with an inconsistent configuration, please check. [ 442.939984][ T57] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 442.961999][ T57] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 442.985166][ T57] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 443.001775][T18059] tipc: Resetting bearer [ 443.022422][T18076] netlink: 'syz.1.3259': attribute type 1 has an invalid length. [ 443.047731][T18076] netlink: 88 bytes leftover after parsing attributes in process `syz.1.3259'. [ 443.057982][T18076] netlink: 'syz.1.3259': attribute type 1 has an invalid length. [ 443.067300][T18059] tipc: Disabling bearer [ 443.074834][T18076] netlink: 638 bytes leftover after parsing attributes in process `syz.1.3259'. [ 443.086784][T18076] netlink: 1 bytes leftover after parsing attributes in process `syz.1.3259'. [ 443.111162][T18069] pim6reg1: entered promiscuous mode [ 443.129732][T18069] pim6reg1: entered allmulticast mode [ 443.152886][ T57] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 443.199308][T18080] veth1_to_batadv: entered promiscuous mode [ 443.286929][T18086] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3261'. [ 443.337593][T18087] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3261'. [ 443.390910][T18082] tipc: Enabling of bearer rejected, failed to enable media [ 443.631231][T18088] netlink: 52 bytes leftover after parsing attributes in process `syz.2.3260'. [ 443.698415][T16608] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 443.760652][T16608] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 443.933559][T16606] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 443.959568][T16606] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 444.047565][T18112] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3267'. [ 444.057328][T18112] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3267'. [ 444.211923][T18118] veth0_to_bond: entered allmulticast mode [ 444.289364][T18121] veth3: entered promiscuous mode [ 444.324055][T18126] syzkaller0: entered allmulticast mode [ 444.396818][T18131] pim6reg1: entered promiscuous mode [ 444.402650][T18131] pim6reg1: entered allmulticast mode [ 444.985023][T18149] af_packet: tpacket_rcv: packet too big, clamped from 32 to 4294967272. macoff=96 [ 445.002763][T18149] tipc: Enabled bearer , priority 16 [ 445.084690][ C1] vxcan1: j1939_tp_rxtimer: 0xffff88802bba4800: rx timeout, send abort [ 445.204292][T18155] tipc: Enabling of bearer rejected, failed to enable media [ 445.228535][T18159] netlink: 'syz.3.3283': attribute type 3 has an invalid length. [ 445.239806][T18159] netlink: 'syz.3.3283': attribute type 3 has an invalid length. [ 445.250297][T18155] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 445.367056][T18162] pim6reg1: entered promiscuous mode [ 445.373197][T18162] pim6reg1: entered allmulticast mode [ 445.593143][ C1] vxcan1: j1939_tp_rxtimer: 0xffff88802bba4800: abort rx timeout. Force session deactivation [ 446.127295][T18150] lo speed is unknown, defaulting to 1000 [ 446.131525][T10292] tipc: Node number set to 1660229914 [ 446.173809][ T50] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 446.188984][ T50] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 446.204743][ T50] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 446.220739][ T50] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 446.234696][ T50] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 446.946443][T18179] netlink: 'syz.3.3289': attribute type 2 has an invalid length. [ 447.447267][T18207] netlink: 'syz.1.3295': attribute type 2 has an invalid length. [ 447.496352][T18221] pim6reg1: entered promiscuous mode [ 447.510553][T18221] pim6reg1: entered allmulticast mode [ 447.694690][T18223] __nla_validate_parse: 8 callbacks suppressed [ 447.694708][T18223] netlink: 60 bytes leftover after parsing attributes in process `syz.2.3299'. [ 447.710678][T18223] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3299'. [ 447.719963][T18223] netlink: 60 bytes leftover after parsing attributes in process `syz.2.3299'. [ 447.878943][T18181] lo speed is unknown, defaulting to 1000 [ 448.137140][T18204] lo speed is unknown, defaulting to 1000 [ 448.154144][T18235] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3301'. [ 448.371046][ T4946] Bluetooth: hci4: command tx timeout [ 448.792449][T18176] lo speed is unknown, defaulting to 1000 [ 448.995120][T18181] bridge0: port 1(bridge_slave_0) entered blocking state [ 449.011542][T18181] bridge0: port 1(bridge_slave_0) entered disabled state [ 449.032798][T18181] bridge_slave_0: entered allmulticast mode [ 449.059619][T18181] bridge_slave_0: entered promiscuous mode [ 449.082307][T18181] bridge0: port 2(bridge_slave_1) entered blocking state [ 449.117054][T18181] bridge0: port 2(bridge_slave_1) entered disabled state [ 449.132323][T18181] bridge_slave_1: entered allmulticast mode [ 449.152152][T18181] bridge_slave_1: entered promiscuous mode [ 449.354251][T18260] pim6reg1: entered promiscuous mode [ 449.359864][T18260] pim6reg1: entered allmulticast mode [ 449.584822][T18181] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 449.681674][T18181] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 449.697245][T18263] netlink: 60 bytes leftover after parsing attributes in process `syz.2.3309'. [ 449.710056][T18263] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3309'. [ 449.723181][T18263] netlink: 60 bytes leftover after parsing attributes in process `syz.2.3309'. [ 449.945035][T18181] team0: Port device team_slave_0 added [ 449.969201][T18181] team0: Port device team_slave_1 added [ 450.169091][T18181] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 450.194510][T18181] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 450.256089][T18181] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 450.312408][T18181] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 450.330054][T18181] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 450.404589][T18181] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 450.452143][ T4946] Bluetooth: hci4: command tx timeout [ 450.467929][T16611] vlan4: left allmulticast mode [ 450.476730][T18274] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3312'. [ 450.485977][T16611] geneve0: left allmulticast mode [ 450.492361][T16611] vlan4: left promiscuous mode [ 450.499002][T16611] geneve0: left promiscuous mode [ 450.508530][T16611] bridge0: port 1(vlan4) entered disabled state [ 450.626543][T16611] lo: left allmulticast mode [ 450.948197][T16611] bond3 (unregistering): (slave geneve2): Releasing active interface [ 451.008658][T16611] team0: Port device bridge1 removed [ 451.023850][T16611] team0: Port device bridge2 removed [ 451.036814][T16611] bond7 (unregistering): (slave bridge4): Releasing backup interface [ 451.045156][T16611] bridge4 (unregistering): left promiscuous mode [ 451.054110][T16611] bridge4 (unregistering): left allmulticast mode [ 451.146799][T16611] bond0 (unregistering): Released all slaves [ 451.157334][T16611] bond1 (unregistering): Released all slaves [ 451.185755][T16611] bond2 (unregistering): (slave veth5): Releasing active interface [ 451.194879][T16611] bond2 (unregistering): Released all slaves [ 451.209028][T16611] bond3 (unregistering): Released all slaves [ 451.223648][T16611] bond4 (unregistering): (slave veth9): Releasing active interface [ 451.233196][T16611] bond4 (unregistering): Released all slaves [ 451.253169][T16611] bond5 (unregistering): Released all slaves [ 451.268679][T16611] bond6 (unregistering): Released all slaves [ 451.295904][T16611] bond7 (unregistering): Released all slaves [ 451.309789][T16611] bond8 (unregistering): Released all slaves [ 451.322646][T18272] mac80211_hwsim hwsim46 wlan0: entered promiscuous mode [ 451.329743][T18272] mac80211_hwsim hwsim46 wlan0: entered allmulticast mode [ 451.353892][T18274] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3312'. [ 451.372803][T18266] lo speed is unknown, defaulting to 1000 [ 451.381422][T11982] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 451.459722][T11982] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 451.503441][T18181] hsr_slave_0: entered promiscuous mode [ 451.525977][T18181] hsr_slave_1: entered promiscuous mode [ 451.532905][T18181] debugfs: 'hsr0' already exists in 'hsr' [ 451.538836][T18181] Cannot create hsr debugfs directory [ 451.664838][T11982] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 451.674494][T11982] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 451.714034][T16611] hm3): left promiscuous mode [ 451.857985][T16611] : left promiscuous mode [ 452.087342][T16611] tipc: Disabling bearer [ 452.097676][T16611] tipc: Left network mode [ 452.235159][T18295] pim6reg1: entered promiscuous mode [ 452.243090][T18295] pim6reg1: entered allmulticast mode [ 452.331027][T16611] ================================================================== [ 452.337876][T18298] netlink: 60 bytes leftover after parsing attributes in process `syz.1.3319'. [ 452.339139][T16611] BUG: KASAN: slab-use-after-free in fib_rules_lookup+0x15e/0xeb0 [ 452.355865][T16611] Read of size 8 at addr ffff88801ff5e680 by task kworker/u8:32/16611 [ 452.364031][T16611] [ 452.366370][T16611] CPU: 0 UID: 0 PID: 16611 Comm: kworker/u8:32 Not tainted syzkaller #0 PREEMPT(full) [ 452.366387][T16611] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 452.366397][T16611] Workqueue: netns cleanup_net [ 452.366523][T16611] Call Trace: [ 452.366529][T16611] [ 452.366536][T16611] dump_stack_lvl+0xe8/0x150 [ 452.366553][T16611] print_address_description+0x55/0x1e0 [ 452.366575][T16611] ? fib_rules_lookup+0x15e/0xeb0 [ 452.366589][T16611] print_report+0x58/0x70 [ 452.366601][T16611] kasan_report+0x117/0x150 [ 452.366622][T16611] ? fib_rules_lookup+0x15e/0xeb0 [ 452.366638][T16611] ? fib_rules_lookup+0x99/0xeb0 [ 452.366651][T16611] fib_rules_lookup+0x15e/0xeb0 [ 452.366667][T16611] ? fib_rules_lookup+0x99/0xeb0 [ 452.366682][T16611] ? __pfx_fib_rules_lookup+0x10/0x10 [ 452.366697][T16611] ? l3mdev_update_flow+0x26/0x610 [ 452.366748][T16611] ? l3mdev_update_flow+0x4ad/0x610 [ 452.366765][T16611] __fib_lookup+0x106/0x210 [ 452.366828][T16611] ? __pfx___fib_lookup+0x10/0x10 [ 452.366840][T16611] ? trace_hrtimer_start+0x82/0x200 [ 452.366867][T16611] ? fib_lookup+0x49/0x440 [ 452.366883][T16611] ? ip_route_output_key_hash_rcu+0x274/0x2720 [ 452.366904][T16611] ip_route_output_key_hash_rcu+0x294/0x2720 [ 452.366925][T16611] ? ip_route_output_key_hash+0xd8/0x2a0 [ 452.366943][T16611] ? ip_route_output_key_hash+0xd8/0x2a0 [ 452.366962][T16611] ip_route_output_key_hash+0x18d/0x2a0 [ 452.366982][T16611] ? __pfx_ip_route_output_key_hash+0x10/0x10 [ 452.367002][T16611] ? lock_acquire+0x106/0x350 [ 452.367019][T16611] ip_route_output_flow+0x2a/0x150 [ 452.367037][T16611] ip4_datagram_release_cb+0x89d/0xbe0 [ 452.367055][T16611] ? ip4_datagram_release_cb+0xa2/0xbe0 [ 452.367072][T16611] ? __pfx_ip4_datagram_release_cb+0x10/0x10 [ 452.367088][T16611] ? do_raw_spin_lock+0x12b/0x2f0 [ 452.367109][T16611] ? release_sock+0x2f/0x260 [ 452.367128][T16611] release_sock+0x206/0x260 [ 452.367147][T16611] inet_shutdown+0x2b1/0x390 [ 452.367166][T16611] udp_tunnel_sock_release+0x6d/0x80 [ 452.367210][T16611] fou_exit_net+0x17d/0x1f0 [ 452.367226][T16611] ops_undo_list+0x43d/0x8d0 [ 452.367248][T16611] ? __pfx_ops_undo_list+0x10/0x10 [ 452.367267][T16611] ? idr_destroy+0x218/0x290 [ 452.367280][T16611] ? do_raw_spin_unlock+0xf5/0x210 [ 452.367299][T16611] cleanup_net+0x572/0x810 [ 452.367319][T16611] ? __pfx_cleanup_net+0x10/0x10 [ 452.367340][T16611] ? rcu_is_watching+0x15/0xb0 [ 452.367355][T16611] ? process_scheduled_works+0xa20/0x14e0 [ 452.367375][T16611] process_scheduled_works+0xa8e/0x14e0 [ 452.367397][T16611] ? __pfx_process_scheduled_works+0x10/0x10 [ 452.367412][T16611] ? assign_work+0x3cf/0x5d0 [ 452.367426][T16611] worker_thread+0xa47/0xfb0 [ 452.367444][T16611] ? __kthread_parkme+0x71/0x1f0 [ 452.367481][T16611] kthread+0x389/0x470 [ 452.367498][T16611] ? __pfx_worker_thread+0x10/0x10 [ 452.367510][T16611] ? __pfx_kthread+0x10/0x10 [ 452.367526][T16611] ret_from_fork+0x514/0xb70 [ 452.367554][T16611] ? __pfx_ret_from_fork+0x10/0x10 [ 452.367566][T16611] ? __switch_to+0xc89/0x1420 [ 452.367586][T16611] ? __pfx_kthread+0x10/0x10 [ 452.367602][T16611] ret_from_fork_asm+0x1a/0x30 [ 452.367622][T16611] [ 452.367627][T16611] [ 452.673792][T16611] Allocated by task 5630: [ 452.678162][T16611] kasan_save_track+0x3e/0x80 [ 452.682845][T16611] __kasan_kmalloc+0x93/0xb0 [ 452.687513][T16611] __kmalloc_node_track_caller_noprof+0x4d7/0x7b0 [ 452.693923][T16611] kmemdup_noprof+0x2b/0x70 [ 452.698454][T16611] fib_rules_register+0x2f/0x400 [ 452.703380][T16611] fib4_rules_init+0x21/0x160 [ 452.708047][T16611] fib_net_init+0x17a/0x3e0 [ 452.712716][T16611] ops_init+0x35d/0x5d0 [ 452.716867][T16611] setup_net+0x118/0x350 [ 452.721100][T16611] copy_net_ns+0x4f9/0x720 [ 452.725515][T16611] create_new_namespaces+0x3f0/0x6b0 [ 452.730787][T16611] unshare_nsproxy_namespaces+0x149/0x190 [ 452.736546][T16611] ksys_unshare+0x57d/0xa00 [ 452.741042][T16611] __x64_sys_unshare+0x38/0x50 [ 452.745795][T16611] do_syscall_64+0x174/0x580 [ 452.750379][T16611] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 452.756260][T16611] [ 452.758570][T16611] Freed by task 23: [ 452.762358][T16611] kasan_save_track+0x3e/0x80 [ 452.767030][T16611] kasan_save_free_info+0x40/0x50 [ 452.772054][T16611] __kasan_slab_free+0x5c/0x80 [ 452.776830][T16611] __rcu_free_sheaf_prepare+0x12d/0x2a0 [ 452.782367][T16611] rcu_free_sheaf+0x31/0x200 [ 452.786952][T16611] rcu_core+0x78b/0x10a0 [ 452.791189][T16611] handle_softirqs+0x225/0x840 [ 452.795943][T16611] run_ksoftirqd+0x36/0x60 [ 452.800350][T16611] smpboot_thread_fn+0x57c/0xa80 [ 452.805296][T16611] kthread+0x389/0x470 [ 452.809370][T16611] ret_from_fork+0x514/0xb70 [ 452.813955][T16611] ret_from_fork_asm+0x1a/0x30 [ 452.818710][T16611] [ 452.821020][T16611] The buggy address belongs to the object at ffff88801ff5e600 [ 452.821020][T16611] which belongs to the cache kmalloc-192 of size 192 [ 452.835087][T16611] The buggy address is located 128 bytes inside of [ 452.835087][T16611] freed 192-byte region [ffff88801ff5e600, ffff88801ff5e6c0) [ 452.848885][T16611] [ 452.851207][T16611] The buggy address belongs to the physical page: [ 452.857634][T16611] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1ff5e [ 452.866399][T16611] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 452.873555][T16611] page_type: f5(slab) [ 452.877528][T16611] raw: 00fff00000000000 ffff88813fe163c0 dead000000000100 dead000000000122 [ 452.886095][T16611] raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 [ 452.894674][T16611] page dumped because: kasan: bad access detected [ 452.901088][T16611] page_owner tracks the page as allocated [ 452.906792][T16611] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 4188522297, free_ts 4187982443 [ 452.926750][T16611] post_alloc_hook+0x22d/0x280 [ 452.931513][T16611] get_page_from_freelist+0x24ae/0x2530 [ 452.937054][T16611] __alloc_frozen_pages_noprof+0x18d/0x380 [ 452.942853][T16611] allocate_slab+0x77/0x660 [ 452.947342][T16611] refill_objects+0x336/0x3d0 [ 452.952002][T16611] __pcs_replace_empty_main+0x320/0x720 [ 452.957541][T16611] __kmalloc_cache_noprof+0x388/0x660 [ 452.962903][T16611] call_usermodehelper_setup+0x8e/0x270 [ 452.968442][T16611] kobject_uevent_env+0x662/0x9e0 [ 452.973562][T16611] wakeup_sysfs_add+0x46/0x60 [ 452.978291][T16611] device_set_wakeup_capable+0xe8/0x190 [ 452.983916][T16611] acpi_button_probe+0x792/0xe80 [ 452.988930][T16611] platform_probe+0xf9/0x190 [ 452.993599][T16611] really_probe+0x254/0xae0 [ 452.998096][T16611] __driver_probe_device+0x1f5/0x380 [ 453.003370][T16611] driver_probe_device+0x4f/0x240 [ 453.008384][T16611] page last free pid 24 tgid 24 stack trace: [ 453.014354][T16611] __free_frozen_pages+0xc0d/0xd20 [ 453.019476][T16611] vfree+0x1fd/0x330 [ 453.023362][T16611] delayed_vfree_work+0x55/0x80 [ 453.028209][T16611] process_scheduled_works+0xa8e/0x14e0 [ 453.033752][T16611] worker_thread+0xa47/0xfb0 [ 453.038330][T16611] kthread+0x389/0x470 [ 453.042395][T16611] ret_from_fork+0x514/0xb70 [ 453.047097][T16611] ret_from_fork_asm+0x1a/0x30 [ 453.051855][T16611] [ 453.054251][T16611] Memory state around the buggy address: [ 453.059863][T16611] ffff88801ff5e580: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 453.067912][T16611] ffff88801ff5e600: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 453.075966][T16611] >ffff88801ff5e680: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 453.084011][T16611] ^ [ 453.088062][T16611] ffff88801ff5e700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 453.096110][T16611] ffff88801ff5e780: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 453.104157][T16611] ================================================================== [ 453.112402][T16611] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 453.119607][T16611] CPU: 0 UID: 0 PID: 16611 Comm: kworker/u8:32 Not tainted syzkaller #0 PREEMPT(full) [ 453.129312][T16611] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 453.139359][T16611] Workqueue: netns cleanup_net [ 453.144132][T16611] Call Trace: [ 453.147420][T16611] [ 453.150357][T16611] vpanic+0x56c/0xa60 [ 453.154351][T16611] ? rcu_is_watching+0x15/0xb0 [ 453.159110][T16611] ? __pfx_vpanic+0x10/0x10 [ 453.163608][T16611] panic+0xc5/0xd0 [ 453.167319][T16611] ? __pfx_panic+0x10/0x10 [ 453.171727][T16611] ? fib_rules_lookup+0x15e/0xeb0 [ 453.176763][T16611] ? fib_rules_lookup+0x15e/0xeb0 [ 453.181807][T16611] check_panic_on_warn+0x89/0xb0 [ 453.186761][T16611] ? fib_rules_lookup+0x15e/0xeb0 [ 453.191782][T16611] end_report+0x73/0x170 [ 453.196024][T16611] ? fib_rules_lookup+0x15e/0xeb0 [ 453.201040][T16611] kasan_report+0x128/0x150 [ 453.205542][T16611] ? fib_rules_lookup+0x15e/0xeb0 [ 453.210563][T16611] ? fib_rules_lookup+0x99/0xeb0 [ 453.215495][T16611] fib_rules_lookup+0x15e/0xeb0 [ 453.220341][T16611] ? fib_rules_lookup+0x99/0xeb0 [ 453.225359][T16611] ? __pfx_fib_rules_lookup+0x10/0x10 [ 453.230724][T16611] ? l3mdev_update_flow+0x26/0x610 [ 453.235837][T16611] ? l3mdev_update_flow+0x4ad/0x610 [ 453.241028][T16611] __fib_lookup+0x106/0x210 [ 453.245523][T16611] ? __pfx___fib_lookup+0x10/0x10 [ 453.250538][T16611] ? trace_hrtimer_start+0x82/0x200 [ 453.255734][T16611] ? fib_lookup+0x49/0x440 [ 453.260142][T16611] ? ip_route_output_key_hash_rcu+0x274/0x2720 [ 453.266382][T16611] ip_route_output_key_hash_rcu+0x294/0x2720 [ 453.272365][T16611] ? ip_route_output_key_hash+0xd8/0x2a0 [ 453.277997][T16611] ? ip_route_output_key_hash+0xd8/0x2a0 [ 453.283643][T16611] ip_route_output_key_hash+0x18d/0x2a0 [ 453.289209][T16611] ? __pfx_ip_route_output_key_hash+0x10/0x10 [ 453.295310][T16611] ? lock_acquire+0x106/0x350 [ 453.299988][T16611] ip_route_output_flow+0x2a/0x150 [ 453.305098][T16611] ip4_datagram_release_cb+0x89d/0xbe0 [ 453.310640][T16611] ? ip4_datagram_release_cb+0xa2/0xbe0 [ 453.316189][T16611] ? __pfx_ip4_datagram_release_cb+0x10/0x10 [ 453.322161][T16611] ? do_raw_spin_lock+0x12b/0x2f0 [ 453.327195][T16611] ? release_sock+0x2f/0x260 [ 453.331785][T16611] release_sock+0x206/0x260 [ 453.336289][T16611] inet_shutdown+0x2b1/0x390 [ 453.340874][T16611] udp_tunnel_sock_release+0x6d/0x80 [ 453.346159][T16611] fou_exit_net+0x17d/0x1f0 [ 453.350671][T16611] ops_undo_list+0x43d/0x8d0 [ 453.355266][T16611] ? __pfx_ops_undo_list+0x10/0x10 [ 453.360374][T16611] ? idr_destroy+0x218/0x290 [ 453.364954][T16611] ? do_raw_spin_unlock+0xf5/0x210 [ 453.370064][T16611] cleanup_net+0x572/0x810 [ 453.374486][T16611] ? __pfx_cleanup_net+0x10/0x10 [ 453.379519][T16611] ? rcu_is_watching+0x15/0xb0 [ 453.384284][T16611] ? process_scheduled_works+0xa20/0x14e0 [ 453.389994][T16611] process_scheduled_works+0xa8e/0x14e0 [ 453.395547][T16611] ? __pfx_process_scheduled_works+0x10/0x10 [ 453.401522][T16611] ? assign_work+0x3cf/0x5d0 [ 453.406105][T16611] worker_thread+0xa47/0xfb0 [ 453.410695][T16611] ? __kthread_parkme+0x71/0x1f0 [ 453.415643][T16611] kthread+0x389/0x470 [ 453.419714][T16611] ? __pfx_worker_thread+0x10/0x10 [ 453.424815][T16611] ? __pfx_kthread+0x10/0x10 [ 453.429403][T16611] ret_from_fork+0x514/0xb70 [ 453.433985][T16611] ? __pfx_ret_from_fork+0x10/0x10 [ 453.439123][T16611] ? __switch_to+0xc89/0x1420 [ 453.443828][T16611] ? __pfx_kthread+0x10/0x10 [ 453.448427][T16611] ret_from_fork_asm+0x1a/0x30 [ 453.453195][T16611] [ 453.456524][T16611] Kernel Offset: disabled [ 453.460845][T16611] Rebooting in 86400 seconds..