last executing test programs: 6.811988024s ago: executing program 3 (id=24): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/netdevsim/new_device\x00', 0x801, 0x0) write(r0, &(0x7f0000000400)='10 2\n', 0x5) (async) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/netdevsim/devices/netdevsim10/sriov_numvfs\x00', 0x801, 0x0) write(r1, &(0x7f0000000600)='120\n', 0x4) (async) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000900)=ANY=[@ANYBLOB="340000001200010001000000000000000000000000000000000000000000000009000300657468310000000008001d0001000000"], 0x34}}, 0x0) 6.387912175s ago: executing program 3 (id=30): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ed) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r0, &(0x7f0000000140)='1\x00', 0x1) r1 = openat(0xffffffffffffff9c, &(0x7f0000000120)='./proc/sys/net/sctp/reconf_enable\x00', 0x1, 0x0) write(r1, &(0x7f0000000140)='1\x00', 0x1) r2 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r2, 0x84, 0x12, &(0x7f0000000180)=0x2, 0x4) setsockopt(r2, 0x84, 0x7d, &(0x7f0000000200)="0000000001000000", 0x8) setsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r2, 0x84, 0x76, &(0x7f0000000240)={0x0, 0x7}, 0x8) r3 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r3, 0x84, 0x12, &(0x7f00000002c0)=0x2, 0x4) setsockopt(r3, 0x84, 0x7d, &(0x7f0000000300)="0000000001000000", 0x8) setsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r3, 0x84, 0x76, &(0x7f0000000340)={0x0, 0x7}, 0x8) setsockopt$inet_sctp_SCTP_MAXSEG(r3, 0x84, 0xd, &(0x7f0000000380)=@assoc_value={0x0, 0x80}, 0x8) bind(r2, &(0x7f00000003c0)=@in={0x2, 0x4e20, @loopback}, 0x10) listen(r2, 0x5) connect(r3, &(0x7f0000000400)=@in={0x2, 0x4e20, @loopback}, 0x10) r4 = accept(r2, 0x0, 0x0) sendmsg$inet_sctp(r3, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000000700)="1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678", 0x4a}], 0x1, 0x0, 0x0, 0x8000}, 0x8000) setsockopt$inet_sctp_SCTP_RESET_ASSOC(r4, 0x84, 0x78, &(0x7f0000000900), 0x4) 6.068508693s ago: executing program 3 (id=36): r0 = socket$inet_sctp(0x2, 0x1, 0x84) bind(r0, &(0x7f0000000000)=@in={0x2, 0x1388, @loopback}, 0x10) listen(r0, 0x5) r1 = socket$inet_sctp(0x2, 0x1, 0x84) connect(r1, &(0x7f0000000100)=@in={0x2, 0x1388, @loopback}, 0x10) accept(r0, 0x0, 0x0) sendmsg$inet_sctp(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)='hello\x00', 0x6}], 0x1}, 0x0) shutdown(r1, 0x2) (async) sendmsg$inet_sctp(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)='moredata\x00', 0x9}], 0x1}, 0x0) setsockopt$inet_sctp_SCTP_AUTH_KEY(r1, 0x84, 0x17, &(0x7f0000000300)={0x0, 0x0, 0x1, 'a'}, 0x14) setsockopt$inet_sctp_SCTP_RESET_STREAMS(r1, 0x84, 0x77, &(0x7f0000000400)={0x0, 0x0, 0x1, [0x2]}, 0x6) 5.826346139s ago: executing program 3 (id=38): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0x1001}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) r2 = socket$inet_sctp(0x2, 0x1, 0x84) bind(r2, &(0x7f0000000080)=@in={0x2, 0x270f, @empty}, 0x10) listen(r2, 0x5) write$tun(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="4500005c000000004084c13c7f0000017f00000104d2270f00000000000000000100003c000030390001a000000a000a000000018002000c010203040506070880040008000100008008000680020000"], 0x5c) 1.622953418s ago: executing program 1 (id=80): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f0000000040)={&(0x7f0000000000), 0x0, &(0x7f0000000080)={&(0x7f00000000c0)={0x28, 0x2, 0x3, 0x0, 0x0, 0x0, {0x2}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1, 0x0, 0x2}}, @NFQA_CFG_PARAMS={0x9, 0x2, {0x1000, 0x2}}]}, 0x28}}, 0x0) 1.519978191s ago: executing program 1 (id=81): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000100000a20000000000a01040000000000000000010080030900010073797a30000000002c000000030a01010000000000000000010000000900010073797a30000000000900030073797a300000000098000000060a010400000000000000000100000008000b400000000070000480340001800b000100657874686472000024000280080001400000000c080006400000000008000440000000220500020007000000380001800c000100626974776973650028000280080003400000000408000140000000140800024000000012040005800800064000000001090001007379"], 0x10c}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r1, &(0x7f0000000100)={&(0x7f0000000300), 0xc, &(0x7f0000000400)={&(0x7f0000000500)=ANY=[], 0xbc}}, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x6) bind$inet(r2, &(0x7f0000000600)={0x2, 0x6bb, @loopback}, 0x10) listen(r2, 0x1) r3 = socket$inet_tcp(0x2, 0x1, 0x6) bind$inet(r3, &(0x7f0000000700)={0x2, 0x3039, @loopback}, 0x10) connect$inet(r3, &(0x7f0000000800)={0x2, 0x6bb, @loopback}, 0x10) r4 = accept$inet(r2, 0x0, 0x0) write(r3, &(0x7f0000000900)="009c00011a2b3c4d00010000010000000000000300000003000000016c6f63616c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006c696e757800"/119, 0x77) write(r4, &(0x7f0000000a00)="009c00011a2b3c4d00020000010001000000000300000003000000016c6f63616c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006c696e757800"/172, 0x9c) write(r3, &(0x7f0000000b00)="00a800011a2b3c4d00070000000100010000012c05f5e1000000000300000003004000"/168, 0xa8) write(r4, &(0x7f0000000c00)="002000011a2b3c4d00080000000200010100000005f5e1000040000000000000", 0x20) 1.388926354s ago: executing program 1 (id=84): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0x1001}) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', 0x1}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f8, &(0x7f0000000100)={'sit0\x00', &(0x7f0000000120)={'sit0\x00', 0x0, 0x0, 0x0, 0x0, 0x0, {{0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x29, 0x0, @loopback, @loopback}}}}) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000080)={'sit0\x00', 0x1}) write$tun(r0, &(0x7f0000000840)=ANY=[@ANYBLOB="4500003c0000000040297c977f0000017f0000016000000000083a40fe800000000000000000000000000001fe8000000000000000000000000000028000000000000000"], 0x3c) 1.178518779s ago: executing program 2 (id=87): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_NEW(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)={0x3c, 0x0, 0x8, 0x105, 0x0, 0x0, {0x2}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}, @CTA_TIMEOUT_L3PROTO={0x6, 0x2, 0x1, 0x0, 0x2}, @CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x11}, @CTA_TIMEOUT_DATA={0xc, 0x4, 0x0, 0x1, @udp=[@CTA_TIMEOUT_UDP_UNREPLIED={0x8, 0x1, 0x1, 0x0, 0x1e}]}]}, 0x3c}}, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="4c000000410007010100000000000000040100000000000020000100060006000800000010000700000000000000000000000d0008000d00000000001400020010000c000900090073797a3000000000"], 0x4c}}, 0x0) 1.15538534s ago: executing program 0 (id=88): r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="0b000200727865300000000008004100727865000a0033006c6f00000000"], 0x1f}}, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$smc(&(0x7f0000000400), r1) sendmsg$SMC_PNETID_ADD(r1, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000700)=ANY=[@ANYBLOB="0800010073797a300a0002006c6f00000000090003007278653000000500040001000000"], 0x24}}, 0x0) r2 = socket$inet_smc(0x2b, 0x1, 0x0) r3 = socket$inet_smc(0x2b, 0x1, 0x0) bind(r2, &(0x7f0000000800)=@in={0x2, 0x1f90, @empty}, 0x10) listen(r2, 0x5) connect(r3, &(0x7f0000000900)=@in={0x2, 0x1f90, @loopback}, 0x10) 1.008058454s ago: executing program 2 (id=89): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x5001}) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000080)=0x1, 0x4) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000080)={'syzkaller1\x00', 0x1}) bind$inet6(r1, &(0x7f0000000100)={0xa, 0x224e, 0x0, @empty}, 0x1c) write$tun(r0, &(0x7f0000000200)={@void, @val={0x1, 0x5, 0x30, 0x14, 0x28, 0x6}, @ipv6=@udp={0x0, 0x6, '\x00', 0x30, 0x11, 0x64, @local, @mcast1, {[], {0x4d2, 0x224e, 0x30, 0x0, @opaque="0102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728"}}}}, 0x62) 1.007905704s ago: executing program 1 (id=90): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=@newsa={0x0, 0x10, 0x5, 0x0, 0x0, {{@in=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2, 0x20, 0x20}, {@in=@loopback, 0x1234, 0x6c}, @in=@loopback, {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}, {}, {}, 0x0, 0x0, 0x2}, [@algo_comp={0x0, 0x81, {{'deflate\x00'}}}]}, 0x138}}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=@newpolicy={0x0, 0x13, 0x5, 0x0, 0x0, {{@in=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2, 0x20, 0x20}, {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}, {}, 0x0, 0x0, 0x1}, [@tmpl={0x0, 0x8c, [{{@in=@loopback, 0x1234, 0x6c}, 0x2, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xffffffff, 0xffffffff}]}]}, 0xfc}}, 0x0) r1 = socket$inet(0x2, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f0000000400)=0x1, 0x4) setsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000000500)={{{@in=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2, 0x20, 0x20}, {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}, {}, 0x0, 0x0, 0x1}, {{@in=@loopback, 0x1234, 0x6c}, 0x2, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xffffffff, 0xffffffff}}, 0xe8) connect$inet(r1, &(0x7f0000000600)={0x2, 0x1234, @loopback}, 0x10) sendmsg$inet(r1, &(0x7f0000000700)={&(0x7f0000000600)={0x2, 0x1234, @loopback}, 0x10, &(0x7f0000000800)=[{&(0x7f0000000900)="12345678901234567890123456789012345678901234567890123456789012345678901234567890", 0x50}], 0x1}, 0x4000000) sendmsg$inet(r1, &(0x7f0000000700)={&(0x7f0000000600)={0x2, 0x1234, @loopback}, 0x10, &(0x7f0000000800)=[{&(0x7f0000000900)="12345678901234567890123456789012345678901234567890123456789012345678901234567890", 0x50}], 0x1}, 0x4000000) 954.744415ms ago: executing program 0 (id=91): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000200000a20000000000a010601000000000000000200000a0900010073797a30000000004c000000030a010602000000000000000200000a0900010073797a30000000000900030073797a30000000000b00070066696c746572000014000580080001400000000308000240000000006c000000060a010603000000000000000200000a0900010073797a30000000000900020073797a3000000000400004803c0001800a00010072616e67650000002c000280080001400000000108000240000000000c00038008000100313233340c0004800800010035363738140000001100010004000000000000000200000a"], 0x100}}, 0x0) r1 = socket$inet(0x2, 0x2, 0x0) sendto$inet(r1, &(0x7f0000000300)="12345678", 0x8, 0x0, &(0x7f0000000400)={0x2, 0x1234, @loopback}, 0x10) 914.513687ms ago: executing program 1 (id=92): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000100000a20000000000a01040000000000000000010080030900010073797a30000000002c000000030a01010000000000000000010000000900010073797a30000000000900030073797a300000000098000000060a010400000000000000000100000008000b400000000070000480340001800b000100657874686472000024000280080001400000000c080006400000000008000440000000220500020007000000380001800c000100626974776973650028000280080003400000000408000140000000140800024000000012040005800800064000000001090001007379"], 0x10c}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r1, &(0x7f0000000100)={&(0x7f0000000300), 0xc, &(0x7f0000000400)={&(0x7f0000000500)=ANY=[], 0xbc}}, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x6) bind$inet(r2, &(0x7f0000000600)={0x2, 0x6bb, @loopback}, 0x10) listen(r2, 0x1) r3 = socket$inet_tcp(0x2, 0x1, 0x6) bind$inet(r3, &(0x7f0000000700)={0x2, 0x3039, @loopback}, 0x10) connect$inet(r3, &(0x7f0000000800)={0x2, 0x6bb, @loopback}, 0x10) r4 = accept$inet(r2, 0x0, 0x0) write(r3, &(0x7f0000000900)="009c00011a2b3c4d00010000010000000000000300000003000000016c6f63616c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006c696e757800"/119, 0x77) write(r4, &(0x7f0000000a00)="009c00011a2b3c4d00020000010001000000000300000003000000016c6f63616c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006c696e757800"/172, 0x9c) write(r3, &(0x7f0000000b00)="00a800011a2b3c4d00070000000100010000012c05f5e1000000000300000003004000"/168, 0xa8) write(r4, &(0x7f0000000c00)="002000011a2b3c4d00080000000200010100000005f5e1000040000000000000", 0x20) 790.87126ms ago: executing program 0 (id=93): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000100000a20000000000a01040000000000000000010080030900010073797a30000000002c000000030a01010000000000000000010000000900010073797a30000000000900030073797a300000000098000000060a010400000000000000000100000008000b400000000070000480340001800b000100657874686472000024000280080001400000000c080006400000000008000440000000220500020007000000380001800c0001006269747769736500280002800800034000000004080001400000001408000240000000120400058008000640000000010900010073797a30"], 0x10c}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r1, &(0x7f0000000100)={&(0x7f0000000300), 0xc, &(0x7f0000000400)={&(0x7f0000000500)=ANY=[@ANYBLOB="bc000000000105060100000000000000020000003400018014000180080001007f000001080002007f0000011c000280050001000600000006000200303900000600030006bb00003400028014000180080001007f000001080002007f0000011c00028005000100060000000600020006bb00000600030030390000080003000000000e08000700000000780d000580090001007070747000000000200004801c0001800500010003000000060004000a0a0000060005000a0a0000"], 0xbc}}, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x6) bind$inet(r2, &(0x7f0000000600)={0x2, 0x6bb, @loopback}, 0x10) listen(r2, 0x1) r3 = socket$inet_tcp(0x2, 0x1, 0x6) bind$inet(r3, &(0x7f0000000700)={0x2, 0x3039, @loopback}, 0x10) connect$inet(r3, &(0x7f0000000800)={0x2, 0x6bb, @loopback}, 0x10) r4 = accept$inet(r2, 0x0, 0x0) write(r3, &(0x7f0000000900)="009c00011a2b3c4d00010000010000000000000300000003000000016c6f63616c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006c696e757800"/162, 0xa2) write(r4, 0x0, 0x0) write(r3, &(0x7f0000000b00)="00a800011a2b3c4d00070000000100010000012c05f5e1000000000300000003004000"/84, 0x54) write(r4, &(0x7f0000000c00)="002000011a2b3c4d00080000000200010100000005f5e1000040000000000000", 0x20) 790.11442ms ago: executing program 1 (id=94): r0 = socket$inet(0x2, 0x1, 0x6) bind$inet(r0, &(0x7f0000000000)={0x2, 0x801, @loopback}, 0x10) listen(r0, 0x5) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount$nfs(&(0x7f0000000080)='127.0.0.1:/export\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000100), 0x0, &(0x7f0000000140)={[{'addr=127.0.0.1,port=2049,nolock,timeo=10,retrans=1\x00'}]}) (async) r1 = accept$inet(r0, 0x0, 0x0) read(r1, &(0x7f0000000300), 0x80) write(r1, &(0x7f0000000400)="80000018000000000000000100"/28, 0x1c) 696.736912ms ago: executing program 2 (id=95): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet(0x2, 0x2, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={&(0x7f0000000100), 0xc, &(0x7f0000000300)={&(0x7f0000000400)=@newlink={0x0, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_IFNAME={0x0, 0x3, 'veth0\x00'}, @IFLA_NUM_TX_QUEUES={0x0, 0x1e, 0x4}, @IFLA_NUM_RX_QUEUES={0x0, 0x1f, 0x4}, @IFLA_LINKINFO={0x0, 0x12, 0x0, 0x1, @veth={{}, {0x0, 0x2, 0x0, 0x1, @void}}}]}, 0x1}}, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'veth0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000200)={&(0x7f0000000100), 0xc, &(0x7f0000000300)={&(0x7f0000000400)=@newqdisc={0x0, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_taprio={{}, {0x0, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x0, 0x1, {0x2, [0x0, 0x1], 0x0, [0x2, 0x2], [0x0, 0x2]}}, @TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x0, 0x2, 0x0, 0x1, [{0x0, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_CMD, @TCA_TAPRIO_SCHED_ENTRY_GATE_MASK={0x0, 0x3, 0x1}, @TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x0, 0x4, 0x989680}]}]}, @TCA_TAPRIO_ATTR_SCHED_BASE_TIME, @TCA_TAPRIO_ATTR_SCHED_CLOCKID={0x0, 0x5, 0x1}]}}]}, 0x1}}, 0x0) nanosleep(&(0x7f0000000500)={0x0, 0x1c9c380}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000200)={&(0x7f0000000100), 0xc, &(0x7f0000000300)={&(0x7f0000000400)=@delqdisc={0x0, 0x25, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}}, 0x1}}, 0x0) 619.122914ms ago: executing program 0 (id=96): r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x9, 0x3, 0x320, 0x150, 0xffffffff, 0xffffffff, 0x168, 0xffffffff, 0x150, 0xffffffff, 0xffffffff, 0x168, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@remote, @rand_addr=' \x01\x00', [], [], 'veth0_to_bridge\x00', 'sit0\x00', {}, {}, 0x6c}, 0x0, 0x108, 0x150, 0x0, {0x0, 0x28e}, [@common=@inet=@ipcomp={{0x30}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@mcast2, 'dvmrp0\x00'}}}, {{@ipv6={@remote, @remote}, 0x0, 0xd0, 0x100, 0x0, {}, [@common=@inet=@set2={{0x28}}]}, @common=@inet=@SET2={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x0, 0xffffffff}}}}, 0x380) sendto$inet6(r0, &(0x7f0000000500)='\x00'/16, 0x10, 0x0, &(0x7f0000000600)={0xa, 0x1234, 0x0, @loopback}, 0x1c) 560.065766ms ago: executing program 2 (id=97): r0 = socket$inet_sctp(0x2, 0x1, 0x84) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e21, @local}, 0x10) listen(r0, 0x5) r1 = socket$packet(0x11, 0x3, 0x300) bind$packet(r1, &(0x7f0000000080)={0x11, 0x800, 0x1}, 0x14) sendto$packet(r1, &(0x7f0000000200)="00000000000100000000000208004500006000010000408434a90c0000010c000001bc314e2100000000000000000a0000300000000000000000000000000000000000000000000000000000000000000000000000000100001400"/102, 0x74, 0x0, &(0x7f0000000080)={0x11, 0x800, 0x1}, 0x14) 531.031926ms ago: executing program 2 (id=98): syz_open_dev$vcsn(&(0x7f0000000040), 0x1, 0x0) 431.374269ms ago: executing program 0 (id=99): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='proc\x00', &(0x7f0000000200)='./proc\x00', &(0x7f0000000300)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./proc/sys/net/sctp/addip_enable\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1\x00', 0x1) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./proc/sys/net/sctp/addip_noauth_enable\x00', 0x1, 0x0) write(r1, &(0x7f0000000700)='1\x00', 0x1) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) bind$inet6(r2, &(0x7f0000000800)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r2, 0x5) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) connect$inet6(r3, &(0x7f0000000900)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) accept(r2, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_SET_PEER_PRIMARY_ADDR(r3, 0x84, 0x5, &(0x7f0000000a00)={0x0, @in6={{0xa, 0x4e23, 0x0, @loopback}}}, 0x20) 384.10342ms ago: executing program 2 (id=100): r0 = socket$inet_sctp(0x2, 0x1, 0x84) r1 = socket$inet_sctp(0x2, 0x1, 0x84) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @loopback}, 0x10) listen(r0, 0x5) connect$inet(r1, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_RTOINFO(r1, 0x84, 0x0, &(0x7f0000000080)={0x0, 0x1, 0x1, 0x1}, 0x10) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000100)={0x0, @in={{0x2, 0x4e20, @loopback}}, 0x1, 0x1, 0x0, 0x0, 0x1}, 0x9c) setsockopt$inet_sctp_SCTP_ASSOCINFO(r1, 0x84, 0x1, &(0x7f0000000180), 0x14) recvfrom(r1, &(0x7f0000000200)=""/100, 0x64, 0x0, 0x0, 0x0) 199.783025ms ago: executing program 3 (id=101): r0 = socket$rxrpc(0x21, 0x2, 0x2) bind$rxrpc(r0, &(0x7f0000000000)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x4e20, @empty}}, 0x24) listen(r0, 0x5) sendmsg(r0, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=[{0x10, 0x110, 0x5}, {0x18, 0x110, 0x1, "0101010101010101"}], 0x28}, 0x0) 143.918057ms ago: executing program 0 (id=102): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind(r0, &(0x7f0000000140)=@in={0x2, 0x801, @loopback}, 0x10) listen(r0, 0x5) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./nfsd/portlist\x00', 0x1, 0x0) write(r1, &(0x7f0000000200)='3\n', 0x2) r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./nfsd/threads\x00', 0x1, 0x0) write(r2, &(0x7f0000000280)='1\n', 0x2) 0s ago: executing program 3 (id=103): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000100000a20000000000a01040000000000000000010080030900010073797a30000000002c000000030a01010000000000000000010000000900010073797a30000000000900030073797a300000000098000000060a010400000000000000000100000008000b400000000070000480340001800b000100657874686472000024000280080001400000000c080006400000000008000440000000220500020007000000380001800c000100626974776973650028000280080003400000000408000140000000140800024000000012040005800800064000000001090001007379"], 0x10c}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r1, &(0x7f0000000100)={&(0x7f0000000300), 0xc, &(0x7f0000000400)={&(0x7f0000000500)=ANY=[], 0xbc}}, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x6) bind$inet(r2, &(0x7f0000000600)={0x2, 0x6bb, @loopback}, 0x10) listen(r2, 0x1) r3 = socket$inet_tcp(0x2, 0x1, 0x6) bind$inet(r3, &(0x7f0000000700)={0x2, 0x3039, @loopback}, 0x10) connect$inet(r3, &(0x7f0000000800)={0x2, 0x6bb, @loopback}, 0x10) r4 = accept$inet(r2, 0x0, 0x0) write(r3, &(0x7f0000000900)="009c00011a2b3c4d00010000010000000000000300000003000000016c6f63616c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006c696e757800"/124, 0x7c) write(r4, &(0x7f0000000a00)="009c00011a2b3c4d00020000010001000000000300000003000000016c6f63616c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006c696e757800"/172, 0x9c) write(r3, &(0x7f0000000b00)="00a800011a2b3c4d00070000000100010000012c05f5e1000000000300000003004000"/168, 0xa8) write(r4, &(0x7f0000000c00)="002000011a2b3c4d00080000000200010100000005f5e1000040000000000000", 0x20) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.125' (ED25519) to the list of known hosts. [ 77.510061][ T5761] cgroup: Unknown subsys name 'net' [ 77.645500][ T5761] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 79.303954][ T5761] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 80.927524][ T5783] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 80.935953][ T5783] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 80.943652][ T5783] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 80.953952][ T5783] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 80.961691][ T5783] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 80.969458][ T5783] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 80.977675][ T5783] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 80.985987][ T5783] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 80.993626][ T5783] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 81.000933][ T5783] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 81.008964][ T5783] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 81.010127][ T5784] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 81.021222][ T5783] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 81.030509][ T5783] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 81.038289][ T5784] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 81.040788][ T5783] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 81.046774][ T5784] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 81.056473][ T5783] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 81.062838][ T5784] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 81.068265][ T5783] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 81.080804][ T5784] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 81.089174][ T5786] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 81.099008][ T5786] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 81.106382][ T5786] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 81.552968][ T5774] chnl_net:caif_netlink_parms(): no params data found [ 81.638918][ T5773] chnl_net:caif_netlink_parms(): no params data found [ 81.754402][ T5776] chnl_net:caif_netlink_parms(): no params data found [ 81.772338][ T5774] bridge0: port 1(bridge_slave_0) entered blocking state [ 81.780548][ T5774] bridge0: port 1(bridge_slave_0) entered disabled state [ 81.788006][ T5774] bridge_slave_0: entered allmulticast mode [ 81.795049][ T5774] bridge_slave_0: entered promiscuous mode [ 81.815724][ T5775] chnl_net:caif_netlink_parms(): no params data found [ 81.850483][ T5774] bridge0: port 2(bridge_slave_1) entered blocking state [ 81.857717][ T5774] bridge0: port 2(bridge_slave_1) entered disabled state [ 81.864883][ T5774] bridge_slave_1: entered allmulticast mode [ 81.872521][ T5774] bridge_slave_1: entered promiscuous mode [ 81.896575][ T5773] bridge0: port 1(bridge_slave_0) entered blocking state [ 81.903987][ T5773] bridge0: port 1(bridge_slave_0) entered disabled state [ 81.911528][ T5773] bridge_slave_0: entered allmulticast mode [ 81.919146][ T5773] bridge_slave_0: entered promiscuous mode [ 81.928258][ T5773] bridge0: port 2(bridge_slave_1) entered blocking state [ 81.935436][ T5773] bridge0: port 2(bridge_slave_1) entered disabled state [ 81.942755][ T5773] bridge_slave_1: entered allmulticast mode [ 81.951235][ T5773] bridge_slave_1: entered promiscuous mode [ 82.075107][ T5774] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 82.091316][ T5773] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 82.119910][ T5774] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 82.134539][ T5773] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 82.164773][ T5776] bridge0: port 1(bridge_slave_0) entered blocking state [ 82.172757][ T5776] bridge0: port 1(bridge_slave_0) entered disabled state [ 82.182984][ T5776] bridge_slave_0: entered allmulticast mode [ 82.190579][ T5776] bridge_slave_0: entered promiscuous mode [ 82.232708][ T5776] bridge0: port 2(bridge_slave_1) entered blocking state [ 82.240072][ T5776] bridge0: port 2(bridge_slave_1) entered disabled state [ 82.247498][ T5776] bridge_slave_1: entered allmulticast mode [ 82.254978][ T5776] bridge_slave_1: entered promiscuous mode [ 82.273959][ T5775] bridge0: port 1(bridge_slave_0) entered blocking state [ 82.281428][ T5775] bridge0: port 1(bridge_slave_0) entered disabled state [ 82.292418][ T5775] bridge_slave_0: entered allmulticast mode [ 82.299611][ T5775] bridge_slave_0: entered promiscuous mode [ 82.308078][ T5775] bridge0: port 2(bridge_slave_1) entered blocking state [ 82.315187][ T5775] bridge0: port 2(bridge_slave_1) entered disabled state [ 82.323026][ T5775] bridge_slave_1: entered allmulticast mode [ 82.331144][ T5775] bridge_slave_1: entered promiscuous mode [ 82.341490][ T5773] team0: Port device team_slave_0 added [ 82.351943][ T5773] team0: Port device team_slave_1 added [ 82.374628][ T5774] team0: Port device team_slave_0 added [ 82.426832][ T5774] team0: Port device team_slave_1 added [ 82.468319][ T5776] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 82.478600][ T5773] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 82.485584][ T5773] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 82.512216][ T5773] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 82.535906][ T5775] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 82.548677][ T5775] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 82.558424][ T5774] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 82.565387][ T5774] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 82.592345][ T5774] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 82.605835][ T5776] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 82.625857][ T5773] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 82.633728][ T5773] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 82.662937][ T5773] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 82.691549][ T5774] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 82.699085][ T5774] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 82.725275][ T5774] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 82.776853][ T5775] team0: Port device team_slave_0 added [ 82.786294][ T5775] team0: Port device team_slave_1 added [ 82.795854][ T5776] team0: Port device team_slave_0 added [ 82.804390][ T5776] team0: Port device team_slave_1 added [ 82.874415][ T5775] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 82.884376][ T5775] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 82.910591][ T5775] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 82.923460][ T5775] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 82.930510][ T5775] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 82.956531][ T5775] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 82.969228][ T5776] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 82.976207][ T5776] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 83.002880][ T5776] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 83.041049][ T5776] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 83.048451][ T5776] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 83.075110][ T5776] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 83.092853][ T5774] hsr_slave_0: entered promiscuous mode [ 83.100943][ T5774] hsr_slave_1: entered promiscuous mode [ 83.113964][ T5773] hsr_slave_0: entered promiscuous mode [ 83.121346][ T5773] hsr_slave_1: entered promiscuous mode [ 83.129139][ T5773] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 83.137290][ T5773] Cannot create hsr debugfs directory [ 83.147983][ T5778] Bluetooth: hci2: command tx timeout [ 83.148010][ T5086] Bluetooth: hci3: command tx timeout [ 83.153656][ T5778] Bluetooth: hci1: command tx timeout [ 83.159944][ T5786] Bluetooth: hci0: command tx timeout [ 83.248333][ T5776] hsr_slave_0: entered promiscuous mode [ 83.255435][ T5776] hsr_slave_1: entered promiscuous mode [ 83.262215][ T5776] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 83.270360][ T5776] Cannot create hsr debugfs directory [ 83.299195][ T5775] hsr_slave_0: entered promiscuous mode [ 83.306214][ T5775] hsr_slave_1: entered promiscuous mode [ 83.315406][ T5775] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 83.323101][ T5775] Cannot create hsr debugfs directory [ 83.767577][ T5774] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 83.784131][ T5774] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 83.798172][ T5774] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 83.810924][ T5774] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 83.867400][ T5773] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 83.892394][ T5773] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 83.903298][ T5773] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 83.913524][ T5773] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 84.005990][ T5775] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 84.032969][ T5775] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 84.055033][ T5775] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 84.065986][ T5775] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 84.162445][ T5776] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 84.197766][ T5776] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 84.209867][ T5776] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 84.232101][ T5776] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 84.264716][ T5774] 8021q: adding VLAN 0 to HW filter on device bond0 [ 84.286072][ T5773] 8021q: adding VLAN 0 to HW filter on device bond0 [ 84.336258][ T5774] 8021q: adding VLAN 0 to HW filter on device team0 [ 84.383273][ T3002] bridge0: port 1(bridge_slave_0) entered blocking state [ 84.390582][ T3002] bridge0: port 1(bridge_slave_0) entered forwarding state [ 84.407990][ T5773] 8021q: adding VLAN 0 to HW filter on device team0 [ 84.433849][ T5775] 8021q: adding VLAN 0 to HW filter on device bond0 [ 84.456528][ T2963] bridge0: port 1(bridge_slave_0) entered blocking state [ 84.463682][ T2963] bridge0: port 1(bridge_slave_0) entered forwarding state [ 84.484981][ T2963] bridge0: port 2(bridge_slave_1) entered blocking state [ 84.492284][ T2963] bridge0: port 2(bridge_slave_1) entered forwarding state [ 84.503795][ T2963] bridge0: port 2(bridge_slave_1) entered blocking state [ 84.511061][ T2963] bridge0: port 2(bridge_slave_1) entered forwarding state [ 84.546637][ T5775] 8021q: adding VLAN 0 to HW filter on device team0 [ 84.572645][ T61] bridge0: port 1(bridge_slave_0) entered blocking state [ 84.579805][ T61] bridge0: port 1(bridge_slave_0) entered forwarding state [ 84.612555][ T2974] bridge0: port 2(bridge_slave_1) entered blocking state [ 84.619818][ T2974] bridge0: port 2(bridge_slave_1) entered forwarding state [ 84.693992][ T5776] 8021q: adding VLAN 0 to HW filter on device bond0 [ 84.764992][ T5776] 8021q: adding VLAN 0 to HW filter on device team0 [ 84.803527][ T2974] bridge0: port 1(bridge_slave_0) entered blocking state [ 84.810747][ T2974] bridge0: port 1(bridge_slave_0) entered forwarding state [ 84.855820][ T2974] bridge0: port 2(bridge_slave_1) entered blocking state [ 84.863067][ T2974] bridge0: port 2(bridge_slave_1) entered forwarding state [ 84.998374][ T5776] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 85.232401][ T5786] Bluetooth: hci1: command tx timeout [ 85.238952][ T5778] Bluetooth: hci0: command tx timeout [ 85.243874][ T5786] Bluetooth: hci3: command tx timeout [ 85.244375][ T5778] Bluetooth: hci2: command tx timeout [ 85.274497][ T5775] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 85.318381][ T5773] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 85.486060][ T5773] veth0_vlan: entered promiscuous mode [ 85.496229][ T5775] veth0_vlan: entered promiscuous mode [ 85.513563][ T5773] veth1_vlan: entered promiscuous mode [ 85.534935][ T5774] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 85.555527][ T5775] veth1_vlan: entered promiscuous mode [ 85.602644][ T5773] veth0_macvtap: entered promiscuous mode [ 85.626517][ T5776] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 85.643151][ T5773] veth1_macvtap: entered promiscuous mode [ 85.670695][ T5775] veth0_macvtap: entered promiscuous mode [ 85.692681][ T5773] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 85.718525][ T5775] veth1_macvtap: entered promiscuous mode [ 85.742158][ T5773] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 85.768789][ T5774] veth0_vlan: entered promiscuous mode [ 85.782655][ T5773] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.800430][ T5773] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.809308][ T5773] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.818588][ T5773] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.853007][ T5774] veth1_vlan: entered promiscuous mode [ 85.875090][ T5775] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 85.888031][ T5775] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 85.909673][ T5775] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 85.986262][ T5775] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 85.999306][ T5775] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 86.011421][ T5775] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 86.040782][ T5775] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.052036][ T5775] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.061825][ T5775] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.071125][ T5775] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.082585][ T5776] veth0_vlan: entered promiscuous mode [ 86.173535][ T5774] veth0_macvtap: entered promiscuous mode [ 86.186292][ T5774] veth1_macvtap: entered promiscuous mode [ 86.202663][ T5776] veth1_vlan: entered promiscuous mode [ 86.248521][ T1081] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 86.256470][ T1081] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 86.285980][ T5774] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 86.299609][ T5774] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 86.310177][ T5774] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 86.321019][ T5774] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 86.332869][ T5774] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 86.357809][ T5774] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 86.372958][ T5774] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 86.385422][ T5774] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 86.396392][ T5774] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 86.409002][ T5774] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 86.445865][ T2974] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 86.461559][ T5774] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.470811][ T2974] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 86.483541][ T5774] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.493612][ T5774] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.502568][ T5774] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.523201][ T1081] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 86.536871][ T5776] veth0_macvtap: entered promiscuous mode [ 86.543111][ T1081] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 86.598106][ T5776] veth1_macvtap: entered promiscuous mode [ 86.607136][ T1081] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 86.616259][ T1081] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 86.684389][ T5776] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 86.695711][ T5776] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 86.707330][ T5776] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 86.726053][ T5776] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 86.736062][ T5776] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 86.749021][ T5776] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 86.761591][ T5776] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 86.782110][ T5776] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 86.793246][ T5776] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 86.804629][ T5776] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 86.819254][ T5776] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 86.833992][ T5776] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 86.855671][ T5776] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 86.874181][ T5776] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 86.906070][ T5776] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.957249][ T5776] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.966034][ T5776] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.994548][ T5776] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.103241][ T5834] bridge0: port 3(syz_tun) entered blocking state [ 87.117243][ T5834] bridge0: port 3(syz_tun) entered disabled state [ 87.138821][ T5834] syz_tun: entered allmulticast mode [ 87.158033][ T5834] syz_tun: entered promiscuous mode [ 87.164143][ T5834] bridge0: port 3(syz_tun) entered blocking state [ 87.171167][ T5834] bridge0: port 3(syz_tun) entered forwarding state [ 87.234706][ T5836] tipc: Started in network mode [ 87.257485][ T5836] tipc: Node identity 1000001, cluster identity 4369 [ 87.287111][ T5836] tipc: Node number set to 16777217 [ 87.293675][ T5836] tipc: Cannot configure node identity twice [ 87.308226][ T5778] Bluetooth: hci2: command tx timeout [ 87.313756][ T5778] Bluetooth: hci3: command tx timeout [ 87.319400][ T5784] Bluetooth: hci0: command tx timeout [ 87.319415][ T5786] Bluetooth: hci1: command tx timeout [ 87.349559][ T2963] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 87.361239][ T2963] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 87.423417][ T5837] bridge0: received packet on syz_tun with own address as source address (addr:aa:aa:aa:aa:aa:aa, vlan:0) [ 87.486436][ T5839] tipc: New replicast peer: 127.0.0.1 [ 87.503019][ T5839] tipc: Enabled bearer , priority 10 [ 87.535656][ T5834] bridge0: received packet on syz_tun with own address as source address (addr:aa:aa:aa:aa:aa:aa, vlan:0) [ 87.675900][ T61] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 87.698607][ T61] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 87.780245][ T60] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 87.828066][ T60] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 88.018808][ T1081] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 88.051754][ T1081] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 88.536306][ T5864] (null): rxe_set_mtu: Set mtu to 4096 [ 88.572422][ T5864] lo speed is unknown, defaulting to 1000 [ 88.610407][ T5869] netlink: 16 bytes leftover after parsing attributes in process `syz.2.7'. [ 88.623568][ T5864] lo speed is unknown, defaulting to 1000 [ 88.635506][ T5864] lo speed is unknown, defaulting to 1000 [ 88.785451][ T5871] svc: failed to register nfsdv3 RPC service (errno 111). [ 88.819674][ T5871] svc: failed to register nfsaclv3 RPC service (errno 111). [ 89.033357][ T5872] svc: failed to register nfsdv3 RPC service (errno 111). [ 89.049104][ T5872] svc: failed to register nfsaclv3 RPC service (errno 111). [ 89.072450][ T5864] infiniband syz1: set active [ 89.079106][ T5832] lo speed is unknown, defaulting to 1000 [ 89.085358][ T5864] infiniband syz1: added lo [ 89.182182][ T5864] RDS/IB: syz1: added [ 89.188532][ T5864] smc: adding ib device syz1 with port count 1 [ 89.195136][ T5864] smc: ib device syz1 port 1 has pnetid [ 89.203233][ T56] lo speed is unknown, defaulting to 1000 [ 89.244014][ T5864] lo speed is unknown, defaulting to 1000 [ 89.391280][ T5086] Bluetooth: hci0: command tx timeout [ 89.391317][ T5778] Bluetooth: hci2: command tx timeout [ 89.399487][ T5086] Bluetooth: hci1: command tx timeout [ 89.410004][ T5786] Bluetooth: hci3: command tx timeout [ 89.737118][ T5884] svc: failed to register nfsdv3 RPC service (errno 111). [ 89.749379][ T5884] svc: failed to register nfsaclv3 RPC service (errno 111). [ 89.799795][ T5864] lo speed is unknown, defaulting to 1000 [ 90.302902][ T5864] lo speed is unknown, defaulting to 1000 [ 90.612335][ T5864] lo speed is unknown, defaulting to 1000 [ 91.054336][ T5923] Zero length message leads to an empty skb [ 91.150754][ T5917] netdevsim netdevsim10 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.191119][ T5917] netdevsim netdevsim10 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.036559][ T789] cfg80211: failed to load regulatory.db [ 92.124510][ T5954] syz.3.38 uses obsolete (PF_INET,SOCK_PACKET) [ 92.895638][ T5975] netlink: 52 bytes leftover after parsing attributes in process `syz.1.48'. [ 94.317206][ T5979] NFSD: attempt to initialize umh client tracking in a container ignored. [ 94.327197][ T5979] NFSD: attempt to initialize legacy client tracking in a container ignored. [ 94.336196][ T5979] NFSD: Unable to initialize client recovery tracking! (-22) [ 94.343964][ T5979] NFSD: starting 90-second grace period (net f00003d9) [ 95.344174][ T6036] netlink: 4 bytes leftover after parsing attributes in process `syz.2.68'. [ 95.362018][ T6036] netlink: 36 bytes leftover after parsing attributes in process `syz.2.68'. [ 95.374920][ T6036] netlink: 16 bytes leftover after parsing attributes in process `syz.2.68'. [ 96.479290][ T6070] netlink: 56 bytes leftover after parsing attributes in process `syz.2.85'. [ 96.610212][ T6074] netlink: 56 bytes leftover after parsing attributes in process `syz.2.87'. [ 96.866064][ T6083] netlink: 'syz.0.91': attribute type 5 has an invalid length. [ 97.706756][ T6110] svc: failed to register nfsdv3 RPC service (errno 111). [ 97.726850][ T6110] svc: failed to register nfsaclv3 RPC service (errno 111). [ 97.737094][ T6112] ================================================================== [ 97.745216][ T6112] BUG: KASAN: slab-use-after-free in nfsd_create_serv+0x116/0x5c0 [ 97.753092][ T6112] Write of size 4 at addr ffff88802ddad850 by task syz.0.102/6112 [ 97.760939][ T6112] [ 97.763323][ T6112] CPU: 1 PID: 6112 Comm: syz.0.102 Not tainted syzkaller #0 [ 97.770665][ T6112] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 97.780811][ T6112] Call Trace: [ 97.784135][ T6112] [ 97.787100][ T6112] dump_stack_lvl+0x18c/0x250 [ 97.791827][ T6112] ? __lock_acquire+0x7d80/0x7d80 [ 97.796901][ T6112] ? show_regs_print_info+0x20/0x20 [ 97.802146][ T6112] ? load_image+0x420/0x420 [ 97.806705][ T6112] ? _raw_spin_lock_irqsave+0xc0/0x100 [ 97.812219][ T6112] ? __virt_addr_valid+0x10c/0x380 [ 97.817380][ T6112] ? __virt_addr_valid+0x10c/0x380 [ 97.822517][ T6112] ? __virt_addr_valid+0x10c/0x380 [ 97.827659][ T6112] ? __virt_addr_valid+0x10c/0x380 [ 97.832798][ T6112] print_report+0xa8/0x210 [ 97.838716][ T6112] ? nfsd_create_serv+0x116/0x5c0 [ 97.843776][ T6112] kasan_report+0x117/0x150 [ 97.848571][ T6112] ? nfsd_create_serv+0x116/0x5c0 [ 97.853624][ T6112] kasan_check_range+0x241/0x290 [ 97.858595][ T6112] nfsd_create_serv+0x116/0x5c0 [ 97.863490][ T6112] ? __mutex_lock+0x4d2/0xc80 [ 97.868200][ T6112] ? nfsd+0x270/0x270 [ 97.872205][ T6112] ? nfsd_svc+0x65/0xab0 [ 97.876486][ T6112] ? mutex_lock_nested+0x20/0x20 [ 97.881452][ T6112] ? net_generic+0x1e/0x240 [ 97.885984][ T6112] ? net_generic+0x1e/0x240 [ 97.890528][ T6112] nfsd_svc+0x183/0xab0 [ 97.894708][ T6112] ? qword_get+0x5a9/0x640 [ 97.899183][ T6112] write_threads+0x393/0x510 [ 97.903797][ T6112] ? write_unlock_fs+0x450/0x450 [ 97.908772][ T6112] ? __might_fault+0xaa/0x120 [ 97.913461][ T6112] ? __might_fault+0xaa/0x120 [ 97.918166][ T6112] ? simple_transaction_get+0x11d/0x140 [ 97.923740][ T6112] nfsctl_transaction_write+0x10c/0x150 [ 97.929317][ T6112] ? nfsctl_transaction_read+0x1b0/0x1b0 [ 97.934991][ T6112] vfs_write+0x299/0x9a0 [ 97.939282][ T6112] ? file_end_write+0x250/0x250 [ 97.944254][ T6112] ? __fget_files+0x28/0x460 [ 97.948918][ T6112] ? __fget_files+0x3fc/0x460 [ 97.953638][ T6112] ? __fdget_pos+0x2a3/0x330 [ 97.958266][ T6112] ? ksys_write+0x74/0x260 [ 97.962813][ T6112] ksys_write+0x151/0x260 [ 97.967189][ T6112] ? __ia32_sys_read+0x90/0x90 [ 97.971991][ T6112] ? lockdep_hardirqs_on+0x98/0x150 [ 97.977226][ T6112] do_syscall_64+0x55/0xb0 [ 97.981685][ T6112] ? clear_bhb_loop+0x40/0x90 [ 97.986414][ T6112] ? clear_bhb_loop+0x40/0x90 [ 97.991562][ T6112] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 97.997695][ T6112] RIP: 0033:0x7fd16d59de99 [ 98.002186][ T6112] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 98.021816][ T6112] RSP: 002b:00007fd16e498028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 98.030257][ T6112] RAX: ffffffffffffffda RBX: 00007fd16d826090 RCX: 00007fd16d59de99 [ 98.038252][ T6112] RDX: 0000000000000002 RSI: 0000200000000280 RDI: 0000000000000005 [ 98.046251][ T6112] RBP: 00007fd16d633eaf R08: 0000000000000000 R09: 0000000000000000 [ 98.054244][ T6112] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 98.062235][ T6112] R13: 00007fd16d826128 R14: 00007fd16d826090 R15: 00007ffeecb20f28 [ 98.070259][ T6112] [ 98.073301][ T6112] [ 98.075644][ T6112] Allocated by task 6110: [ 98.079990][ T6112] kasan_set_track+0x4e/0x70 [ 98.084606][ T6112] __kasan_kmalloc+0x8f/0xa0 [ 98.089222][ T6112] __svc_create+0x60/0xa20 [ 98.093664][ T6112] svc_create_pooled+0x66a/0x7e0 [ 98.098627][ T6112] nfsd_create_serv+0x29f/0x5c0 [ 98.103501][ T6112] write_ports+0x698/0xfa0 [ 98.107944][ T6112] nfsctl_transaction_write+0x10c/0x150 [ 98.113547][ T6112] vfs_write+0x299/0x9a0 [ 98.117821][ T6112] ksys_write+0x151/0x260 [ 98.122181][ T6112] do_syscall_64+0x55/0xb0 [ 98.126624][ T6112] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 98.132553][ T6112] [ 98.134900][ T6112] Freed by task 6110: [ 98.138901][ T6112] kasan_set_track+0x4e/0x70 [ 98.143619][ T6112] kasan_save_free_info+0x28/0x40 [ 98.148678][ T6112] ____kasan_slab_free+0x126/0x1f0 [ 98.153823][ T6112] slab_free_freelist_hook+0x130/0x1a0 [ 98.159315][ T6112] __kmem_cache_free+0xba/0x1f0 [ 98.164198][ T6112] write_ports+0xb1a/0xfa0 [ 98.168668][ T6112] nfsctl_transaction_write+0x10c/0x150 [ 98.174324][ T6112] vfs_write+0x299/0x9a0 [ 98.178598][ T6112] ksys_write+0x151/0x260 [ 98.182952][ T6112] do_syscall_64+0x55/0xb0 [ 98.187400][ T6112] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 98.193352][ T6112] [ 98.195700][ T6112] The buggy address belongs to the object at ffff88802ddad800 [ 98.195700][ T6112] which belongs to the cache kmalloc-512 of size 512 [ 98.209778][ T6112] The buggy address is located 80 bytes inside of [ 98.209778][ T6112] freed 512-byte region [ffff88802ddad800, ffff88802ddada00) [ 98.223509][ T6112] [ 98.225851][ T6112] The buggy address belongs to the physical page: [ 98.232314][ T6112] page:ffffea0000b76b00 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88802ddae000 pfn:0x2ddac [ 98.243807][ T6112] head:ffffea0000b76b00 order:2 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 98.252760][ T6112] flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff) [ 98.260776][ T6112] page_type: 0xffffffff() [ 98.265133][ T6112] raw: 00fff00000000840 ffff888017c41c80 ffffea000179bb10 ffffea00008a1010 [ 98.273928][ T6112] raw: ffff88802ddae000 000000000010000f 00000001ffffffff 0000000000000000 [ 98.282536][ T6112] page dumped because: kasan: bad access detected [ 98.288994][ T6112] page_owner tracks the page as allocated [ 98.294735][ T6112] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 3686, tgid 3686 (kworker/u4:9), ts 25095247253, free_ts 0 [ 98.315270][ T6112] post_alloc_hook+0x1c1/0x200 [ 98.320079][ T6112] get_page_from_freelist+0x2181/0x22a0 [ 98.325670][ T6112] __alloc_pages+0x1f0/0x460 [ 98.330321][ T6112] alloc_slab_page+0x5d/0x180 [ 98.335030][ T6112] new_slab+0x87/0x2d0 [ 98.339131][ T6112] ___slab_alloc+0xc5c/0x12f0 [ 98.343855][ T6112] __kmem_cache_alloc_node+0x11f/0x250 [ 98.349352][ T6112] kmalloc_trace+0x2a/0xe0 [ 98.353801][ T6112] alloc_bprm+0x56/0x9a0 [ 98.358073][ T6112] kernel_execve+0x98/0x980 [ 98.362606][ T6112] call_usermodehelper_exec_async+0x20b/0x350 [ 98.368708][ T6112] ret_from_fork+0x48/0x80 [ 98.373165][ T6112] ret_from_fork_asm+0x11/0x20 [ 98.377957][ T6112] page_owner free stack trace missing [ 98.383337][ T6112] [ 98.385677][ T6112] Memory state around the buggy address: [ 98.391324][ T6112] ffff88802ddad700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 98.399410][ T6112] ffff88802ddad780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 98.407497][ T6112] >ffff88802ddad800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 98.415580][ T6112] ^ [ 98.422275][ T6112] ffff88802ddad880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 98.430366][ T6112] ffff88802ddad900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 98.438455][ T6112] ================================================================== [ 98.470018][ T6112] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 98.477283][ T6112] CPU: 0 PID: 6112 Comm: syz.0.102 Not tainted syzkaller #0 [ 98.484615][ T6112] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 98.494728][ T6112] Call Trace: [ 98.498046][ T6112] [ 98.501014][ T6112] dump_stack_lvl+0x18c/0x250 [ 98.505740][ T6112] ? show_regs_print_info+0x20/0x20 [ 98.510985][ T6112] ? load_image+0x420/0x420 [ 98.515528][ T6112] panic+0x2ca/0x720 [ 98.519452][ T6112] ? bpf_jit_dump+0xd0/0xd0 [ 98.523976][ T6112] ? _raw_spin_unlock_irqrestore+0x111/0x120 [ 98.529991][ T6112] ? _raw_spin_unlock+0x40/0x40 [ 98.534873][ T6112] ? print_memory_metadata+0x314/0x400 [ 98.540361][ T6112] ? nfsd_create_serv+0x116/0x5c0 [ 98.545410][ T6112] check_panic_on_warn+0x84/0xa0 [ 98.550395][ T6112] ? nfsd_create_serv+0x116/0x5c0 [ 98.555631][ T6112] end_report+0x6f/0x130 [ 98.559964][ T6112] kasan_report+0x128/0x150 [ 98.564506][ T6112] ? nfsd_create_serv+0x116/0x5c0 [ 98.569561][ T6112] kasan_check_range+0x241/0x290 [ 98.574535][ T6112] nfsd_create_serv+0x116/0x5c0 [ 98.579411][ T6112] ? __mutex_lock+0x4d2/0xc80 [ 98.584118][ T6112] ? nfsd+0x270/0x270 [ 98.588122][ T6112] ? nfsd_svc+0x65/0xab0 [ 98.592396][ T6112] ? mutex_lock_nested+0x20/0x20 [ 98.597415][ T6112] ? net_generic+0x1e/0x240 [ 98.602226][ T6112] ? net_generic+0x1e/0x240 [ 98.606777][ T6112] nfsd_svc+0x183/0xab0 [ 98.610971][ T6112] ? qword_get+0x5a9/0x640 [ 98.615462][ T6112] write_threads+0x393/0x510 [ 98.620086][ T6112] ? write_unlock_fs+0x450/0x450 [ 98.625229][ T6112] ? __might_fault+0xaa/0x120 [ 98.629937][ T6112] ? __might_fault+0xaa/0x120 [ 98.634642][ T6112] ? simple_transaction_get+0x11d/0x140 [ 98.640217][ T6112] nfsctl_transaction_write+0x10c/0x150 [ 98.645790][ T6112] ? nfsctl_transaction_read+0x1b0/0x1b0 [ 98.651449][ T6112] vfs_write+0x299/0x9a0 [ 98.655737][ T6112] ? file_end_write+0x250/0x250 [ 98.660615][ T6112] ? __fget_files+0x28/0x460 [ 98.665233][ T6112] ? __fget_files+0x3fc/0x460 [ 98.669943][ T6112] ? __fdget_pos+0x2a3/0x330 [ 98.674565][ T6112] ? ksys_write+0x74/0x260 [ 98.679019][ T6112] ksys_write+0x151/0x260 [ 98.683382][ T6112] ? __ia32_sys_read+0x90/0x90 [ 98.688184][ T6112] ? lockdep_hardirqs_on+0x98/0x150 [ 98.693408][ T6112] do_syscall_64+0x55/0xb0 [ 98.697847][ T6112] ? clear_bhb_loop+0x40/0x90 [ 98.702545][ T6112] ? clear_bhb_loop+0x40/0x90 [ 98.707247][ T6112] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 98.713187][ T6112] RIP: 0033:0x7fd16d59de99 [ 98.717644][ T6112] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 98.737296][ T6112] RSP: 002b:00007fd16e498028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 98.745770][ T6112] RAX: ffffffffffffffda RBX: 00007fd16d826090 RCX: 00007fd16d59de99 [ 98.753771][ T6112] RDX: 0000000000000002 RSI: 0000200000000280 RDI: 0000000000000005 [ 98.761852][ T6112] RBP: 00007fd16d633eaf R08: 0000000000000000 R09: 0000000000000000 [ 98.769845][ T6112] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 98.777834][ T6112] R13: 00007fd16d826128 R14: 00007fd16d826090 R15: 00007ffeecb20f28 [ 98.785832][ T6112] [ 98.789433][ T6112] Kernel Offset: disabled [ 98.793805][ T6112] Rebooting in 86400 seconds..