last executing test programs: 3.284304876s ago: executing program 0 (id=21522): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x400448c9, 0x0) socketpair(0x36, 0x2, 0x4, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$TIPC_NL_MON_GET(r1, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f00000001c0)={&(0x7f00000000c0)={0xd8, r2, 0x400, 0x70bd27, 0x25dfdbfd, {}, [@TIPC_NLA_SOCK={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x2}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x3}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x4}]}, @TIPC_NLA_MON={0x4}, @TIPC_NLA_LINK={0x6c, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x40}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x400}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0xc, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}]}, @TIPC_NLA_LINK_PROP={0x1c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xf}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x600}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7fff}]}]}, @TIPC_NLA_NODE={0x20, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x3}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x1}, @TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0xdc}]}, @TIPC_NLA_PUBL={0xc, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x4}]}]}, 0xd8}, 0x1, 0x0, 0x0, 0x4005}, 0x4000) 2.356310205s ago: executing program 0 (id=21540): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x8080}, 0x20004454) sendmsg$NFT_MSG_GETRULE(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000740)=ANY=[@ANYBLOB="38000000070a010100a60006000000000a0040010900010073797a3100000000090002"], 0x38}, 0x1, 0x0, 0x0, 0x20040850}, 0x44054) 2.246288392s ago: executing program 1 (id=21544): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_int(r0, 0x0, 0x15, &(0x7f0000000000)=0x5, 0x4) bind$inet(r0, &(0x7f0000000380)={0x2, 0x4e22, @empty}, 0x10) listen(r0, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000080)={@local, @link_local, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x6, 0x0, @rand_addr=0x64010100, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0xc2, 0x41}}}}}}, 0x0) 2.126037064s ago: executing program 1 (id=21546): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x8031, 0xffffffffffffffff, 0x0) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) getsockopt$inet_int(r1, 0x0, 0x33, 0x0, &(0x7f0000000080)) r2 = openat$cgroup_int(r0, &(0x7f0000000840)='notify_on_release\x00', 0x2, 0x0) pread64(r2, &(0x7f0000000880)=""/4096, 0x1000, 0xf826) r3 = socket$l2tp(0x2, 0x2, 0x73) bind$inet(r3, &(0x7f00000002c0)={0x2, 0x4e20, @multicast2}, 0x10) connect$inet(r3, &(0x7f0000000000)={0x2, 0x1000, @local}, 0x10) sendmmsg$inet(r3, &(0x7f0000000900)=[{{0x0, 0x0, 0x0}}], 0x40000cf, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="1c00000021000f0000f909000080210002"], 0x1c}, 0x1, 0x0, 0x0, 0x4090}, 0x0) 2.097439111s ago: executing program 0 (id=21548): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000140)={0x1f, 0xffff, 0x2}, 0x6) 2.023734631s ago: executing program 4 (id=21550): socket$inet_icmp_raw(0x2, 0x3, 0x1) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) r1 = syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/pid_for_children\x00') unshare(0x6a040000) r2 = socket(0x8, 0x3, 0x0) ioctl$sock_netrom_SIOCADDRT(r2, 0x6180, 0x0) recvmsg(r0, 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r1, 0x40106183, &(0x7f000010d280)) 1.974628134s ago: executing program 0 (id=21552): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000000100)={0x0, 0x7}, 0x8) r1 = socket$l2tp6(0xa, 0x2, 0x73) connect$l2tp6(r1, &(0x7f0000000f40)={0xfd, 0x0, 0x0, @empty}, 0x20) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000000040)={0x0, 0xaf1}, 0x8) bind$inet6(r0, &(0x7f00000002c0)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendmmsg$inet6(r0, &(0x7f0000000200)=[{{&(0x7f00000000c0)={0xa, 0x4e23, 0x1, @loopback, 0x1}, 0x70, &(0x7f0000000580)=[{&(0x7f0000001680)='\t', 0x1}], 0x1}}], 0x1, 0x0) setsockopt$inet_sctp6_SCTP_RESET_ASSOC(r0, 0x84, 0x78, &(0x7f0000000240), 0x4) 1.629517147s ago: executing program 2 (id=21555): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=@newnexthop={0x3c, 0x68, 0x1, 0x3, 0x80000000, {0x0, 0x0, 0x0, 0x0, 0xa00}, [@NHA_GROUP={0xc, 0x2, [{0x1, 0x3}]}, @NHA_GROUP_TYPE={0x6, 0x3, 0x1}, @NHA_FDB={0x4}, @NHA_RES_GROUP={0xc, 0xc, 0x0, 0x1, [@NHA_RES_GROUP_BUCKETS={0x6, 0x1, 0x7f}]}]}, 0x3c}}, 0x4000) 1.48259371s ago: executing program 2 (id=21556): socket$igmp6(0xa, 0x3, 0x2) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_NEW(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB="34000000000805000000000000000000000004000480090001ff3c3fd8310000000005000300000000006fcfce220002000000008428dc368c7d5b293a10cb50165adc69c6377882b79a2e9c68236f2b2feaf4c62fe2bccc"], 0x34}}, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000380)={&(0x7f0000000240)=ANY=[@ANYRESDEC=r0], 0x0, 0x94, 0x0, 0x0, 0xfff}, 0x28) socket$can_raw(0x1d, 0x3, 0x1) socket$pppl2tp(0x18, 0x1, 0x1) socket(0x10, 0x3, 0x0) socket(0x1e, 0xa, 0x1) socket$nl_route(0x10, 0x3, 0x0) socket$inet6(0xa, 0x80002, 0x88) syz_genetlink_get_family_id$netlbl_unlabel(0x0, 0xffffffffffffffff) socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000480)=ANY=[], 0x44}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r2, 0x8933, &(0x7f0000004b00)={'wpan1\x00'}) syz_genetlink_get_family_id$nl802154(&(0x7f0000005040), r2) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(r2, &(0x7f0000005100)={0x0, 0x0, &(0x7f00000050c0)={&(0x7f00000001c0)=ANY=[], 0x1c}, 0x1, 0x0, 0x0, 0x4040805}, 0x40c1) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x84, 0x85, &(0x7f0000000000), 0x4) socket$alg(0x26, 0x5, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000200)={'ip6_vti0\x00'}) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) gettid() 1.297038258s ago: executing program 3 (id=21557): sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[], 0x18}}, 0x20004000) (async) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) (async) r1 = socket(0x1e, 0x4, 0x0) setsockopt$packet_int(r1, 0x107, 0xa, 0x0, 0x0) (async) r2 = socket(0x2a, 0x2, 0x0) getsockname$packet(r2, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) getsockopt$inet_IP_IPSEC_POLICY(r2, 0x0, 0x10, &(0x7f0000000600)={{{@in6=@dev, @in=@initdev}}, {{@in=@empty}, 0x0, @in=@loopback}}, &(0x7f0000000700)=0xe8) (async, rerun: 32) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r2, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000100)={'syztnl2\x00', r3, 0x0, 0x5, 0xff, 0x0, 0x1, @private2, @remote, 0x8, 0x80, 0x1, 0x10000}}) (async, rerun: 32) sendmsg$RDMA_NLDEV_CMD_RES_PD_GET(r2, &(0x7f0000000500)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x18, 0x140e, 0x200, 0x70bd2c, 0x25dfdbfb, "", [@RDMA_NLDEV_ATTR_RES_PDN={0x8, 0x3c, 0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x4080090}, 0x8001) (async) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x42, &(0x7f0000000280)}, &(0x7f0000002100)=0x10) r4 = socket$nl_generic(0x10, 0x3, 0x10) (async) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_SET(r4, &(0x7f0000000400)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x8b00004}, 0xc, &(0x7f00000003c0)={&(0x7f0000000240)={0x20, r5, 0x10, 0x70bd2d, 0x25dfdbfb, {}, [@TIPC_NLA_MON={0xc, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x9}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000000}, 0xe8e37ab2308d9b32) (async, rerun: 64) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@gettaction={0x28, 0x32, 0x20, 0x70bd25, 0x25dfdbfe, {}, [@action_dump_flags=@TCA_ROOT_TIME_DELTA={0x8, 0x4, 0xc}, @action_dump_flags=@TCA_ROOT_FLAGS={0xc, 0x2, {0x1, 0x1}}]}, 0x28}, 0x1, 0x0, 0x0, 0x40000}, 0x4048840) (async, rerun: 64) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000280)={0x11, 0x3, &(0x7f0000000040)=@framed={{0x18, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x7}}, &(0x7f0000000100)='GPL\x00', 0x7, 0x57, &(0x7f0000000140)=""/87, 0x41000, 0x1c, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5}, 0x90) (async) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800000010000d0428bd7000fcdbff2500008000", @ANYRES32=0x0, @ANYBLOB="1000000000000000280012800b0001006272696467650000180002"], 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) (async) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) (async) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r6, &(0x7f0000000000)="fc0000001d000724ab09254ec100070007ab08001b000000f0ffff002100057e0000000000000e000039000000039815fad151ba0101099cecb94b46fe0000000a00020025", 0xffffff0c) (async) pipe(&(0x7f0000000500)={0xffffffffffffffff}) splice(r7, 0x0, r6, 0x0, 0xffffffffffff8000, 0x0) sendmsg$TIPC_NL_LINK_GET(r7, &(0x7f0000000880)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000800)={&(0x7f0000000780)={0x6c, r5, 0x300, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_MEDIA={0x34, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}]}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x10000000}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xfdd}]}]}, @TIPC_NLA_PUBL={0x24, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x9}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x1}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x39a}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x7}]}]}, 0x6c}, 0x1, 0x0, 0x0, 0x40}, 0x9) (async) r8 = socket$netlink(0x10, 0x3, 0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) (async, rerun: 64) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) (rerun: 64) sendmsg$NFT_BATCH(r10, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x1}, [@NFTA_TABLE_HANDLE={0xc, 0x4, 0x1, 0x0, 0x1}]}, @NFT_MSG_NEWCHAIN={0x38, 0x3, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0xfffb}, [@NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x1}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_HOOK={0xc, 0x4, 0x0, 0x1, [@NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x5}]}]}], {0x14}}, 0x80}, 0x1, 0x0, 0x0, 0x44010}, 0x0) (async) sendmsg$NFT_BATCH(r9, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000000)={&(0x7f000000c300)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a3c004000120a09000000000000000000020000000900020073797a310000000008000440040003000900010073797a18000000000800034000000004140000001100010000000000000000000000000a"], 0x64}}, 0x0) (async) sendmmsg(r8, &(0x7f00000000c0), 0x0, 0x0) bpf$OBJ_GET_PROG(0x7, &(0x7f0000000580)=@o_path={&(0x7f0000000540)='./file0\x00', 0x0, 0x4018, r10}, 0x18) 1.27989301s ago: executing program 1 (id=21558): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_MPP(r0, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$wireguard(&(0x7f00000003c0), 0xffffffffffffffff) sendmsg$WG_CMD_SET_DEVICE(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000007c0)={0x164, r2, 0x1, 0x0, 0x0, {}, [@WGDEVICE_A_PEERS={0x118, 0x8, 0x0, 0x1, [{0x80, 0x0, 0x0, 0x1, [@WGPEER_A_ALLOWEDIPS={0x50, 0x9, 0x0, 0x1, [{0x4c, 0x0, 0x0, 0x1, [@ipv4={{0x6}, {0x8, 0x2, @local}, {0x5, 0x3, 0x2}}, @ipv4={{0x6}, {0x8, 0x2, @multicast2}, {0x5, 0x3, 0x1}}, @ipv4={{0x6}, {0x8, 0x2, @multicast1}, {0x5, 0x3, 0x1}}]}]}, @WGPEER_A_PUBLIC_KEY={0x24, 0x1, @a_g}, @WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL={0x6, 0x5, 0x6}]}, {0x28, 0x0, 0x0, 0x1, [@WGPEER_A_PUBLIC_KEY={0x24, 0x1, @neg}]}, {0x6c, 0x0, 0x0, 0x1, [@WGPEER_A_PUBLIC_KEY={0x24, 0x1, @c_g}, @WGPEER_A_ENDPOINT6={0x20, 0x4, {0xa, 0x9, 0x7, @empty, 0x3}}, @WGPEER_A_ALLOWEDIPS={0x24, 0x9, 0x0, 0x1, [{0x1c, 0x0, 0x0, 0x1, [@ipv4={{0x6}, {0x8, 0x2, @loopback}, {0x5, 0x3, 0x3}}]}, {0x4, 0x164}]}]}]}, @WGDEVICE_A_PRIVATE_KEY={0x24, 0x3, @b}, @WGDEVICE_A_IFNAME={0x14, 0x2, 'wg0\x00'}]}, 0x164}, 0x1, 0x0, 0x0, 0x4004840}, 0x40000) 1.134086313s ago: executing program 4 (id=21559): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_GET_SEC_DEVKEY(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)={0x14, r1, 0x301, 0x0, 0x0, {0x2b}}, 0x14}}, 0x0) r2 = socket(0x10, 0x3, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a000000040000009c0000000b"], 0x50) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c300000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000040)='rss_stat\x00', r4, 0x0, 0x40}, 0x18) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000400)=@base={0x10, 0x4, 0x8, 0x8}, 0x50) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xd, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000a000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bca2000000000000a6020000f8ffffffb703000003000000b704000000000400850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r6, 0x5, 0xe, 0x0, &(0x7f00000003c0)="7993ff01190000e5ffa53b00008f", 0x0, 0x400, 0x503, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff80fe}, 0x59) syz_genetlink_get_family_id$tipc2(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000180)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a40000000060a010400000000000000000a0000010900010073797a31000040001400048010"], 0x68}, 0x1, 0x0, 0x0, 0x4008091}, 0x24000000) r7 = socket$inet_udplite(0x2, 0x2, 0x88) r8 = socket(0x40000000015, 0x5, 0x0) setsockopt$RDS_GET_MR(r8, 0x114, 0x2, &(0x7f0000000140)={{0x0}, 0x0, 0x3b}, 0x20) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="700200001300290a000000000000000007000000", @ANYRES32=r9, @ANYBLOB="000000000000000010010c8013000c800ca3488008000000000000000800038064001d80050006000000000014000500714abbd2547de97cbbf6efb226f19bf90d0002003a288e5e5b5b5a40000000006000078014000400293a02149f3b75a67093c28fd6f55a2314000400e48f01e49713f0c2d839f940d9f088d8050006000000003bd00002006272696467655f736c6176655f30000007000200293a00000500060000000000080001000000000018002580140004004d2906d0880fc8acc30fe2020f9849675000028004000500a1085e7df341b9dc3d8008a2fe5bdaad140004009c7e472c916020fe41bcc5aa8f56c9471400050080ab8be51421cfa3c9e5cbfe8217e0af0800010000000000080001000000000060001a"], 0x270}, 0x1, 0x0, 0x0, 0x20008014}, 0x4) 1.13377604s ago: executing program 1 (id=21560): r0 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000140)="89000000120081ae08060cdc016b3f087f03e3520000000000e2ffca1b1f000000000cc00e72f750375ed08a56331dbf9ed7815e381ad6e747033a0093b837dc6cc01e32efaec8c7a6ec00120800030004010000bdad446b9bbc7a46e3988285dcdf12f21308f868fece01955fed0009d78f0a947ee2b49e33538afa8af92347514f0b56a20ff27fff", 0x89}], 0x1}, 0x0) bpf$TOKEN_CREATE(0x24, &(0x7f0000000100)={0x0, r0}, 0x8) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x3, 0x16, &(0x7f0000000e00)=ANY=[@ANYRES64=r0], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8}, 0x94) socket$kcm(0x10, 0x2, 0x4) (async) sendmsg$kcm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000140)="89000000120081ae08060cdc016b3f087f03e3520000000000e2ffca1b1f000000000cc00e72f750375ed08a56331dbf9ed7815e381ad6e747033a0093b837dc6cc01e32efaec8c7a6ec00120800030004010000bdad446b9bbc7a46e3988285dcdf12f21308f868fece01955fed0009d78f0a947ee2b49e33538afa8af92347514f0b56a20ff27fff", 0x89}], 0x1}, 0x0) (async) bpf$TOKEN_CREATE(0x24, &(0x7f0000000100)={0x0, r0}, 0x8) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x3, 0x16, &(0x7f0000000e00)=ANY=[@ANYRES64=r0], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8}, 0x94) (async) 1.133310181s ago: executing program 2 (id=21561): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001080)=ANY=[@ANYBLOB="0a000000050000000200000007"], 0x50) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000029c0)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c00"/16], 0x1c}}, 0x0) sendmsg$inet(r2, &(0x7f00000000c0)={0x0, 0xffffffffffffff3c, &(0x7f00000001c0)=[{&(0x7f0000000080)="1303", 0x2}], 0x1}, 0x4051) recvmsg$unix(r1, &(0x7f0000000440)={0x0, 0x0, 0x0}, 0x2122) pipe(&(0x7f0000000000)={0xffffffffffffffff}) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000fcffffff000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x16, r4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb0100180000000000000018000000180000000400"], 0x0, 0x34}, 0x28) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r6, &(0x7f0000000000)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r6, 0x0) r7 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IPT_SO_SET_REPLACE(r7, 0x0, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x8, 0x3, 0x1e8, 0xb8, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x150, 0xffffffff, 0xffffffff, 0x150, 0xffffffff, 0x7fffffe, 0x0, {[{{@uncond, 0x6, 0x70, 0xb8}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'snmp_trap\x00'}}}, {{@ip={@local, @local, 0xff, 0x0, 'hsr0\x00', 'veth1_virt_wifi\x00'}, 0x0, 0x70, 0x98}, @common=@unspec=@NFQUEUE0={0x28}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x248) r8 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000180)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newqdisc={0x40, 0x24, 0xf0b, 0x0, 0x21dfdbfe, {0x0, 0x0, 0x0, r9, {}, {0xffff, 0xffff}, {0xe, 0x4}}, [@qdisc_kind_options=@q_etf={{0x8}, {0x14, 0x2, @TCA_ETF_PARMS={0x10, 0x1, {0x0, 0xb}}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x800}, 0x4000010) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000280)={&(0x7f00000007c0)='skb_copy_datagram_iovec\x00', r5, 0x0, 0x1}, 0x18) 1.053198473s ago: executing program 3 (id=21562): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000140)={0x1f, 0xffff, 0x2}, 0x6) 985.682261ms ago: executing program 0 (id=21563): bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@func_proto={0x0, 0x0, 0x0, 0x2, 0x2}]}}, 0x0, 0x26}, 0x20) r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x2d, &(0x7f0000000180)=@framed={{0x18, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x7}, [@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x6}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, 0x1}}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x3}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, 0x1}}, @initr0={0x18, 0x0, 0x0, 0x0, 0xd, 0x0, 0x0, 0x0, 0x7}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x5}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, 0x1}}, @generic={0x4, 0x9, 0xe, 0x6, 0x8001}]}, &(0x7f0000000040)='syzkaller\x00', 0x844, 0xdd, &(0x7f0000000340)=""/221, 0x41000, 0x21, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, &(0x7f0000000080)={0x5, 0x5}, 0x8, 0x10, &(0x7f00000000c0)={0x4, 0xd, 0x2, 0xd}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000100)=[0xffffffffffffffff, 0x1, 0x1, 0xffffffffffffffff, 0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff, 0x1], &(0x7f0000000440)=[{0x2, 0x1, 0x7, 0x4}, {0x1, 0x3, 0x1, 0x1}, {0x5, 0x5, 0x5, 0xa}, {0x5, 0x4, 0x10, 0x4}], 0x10, 0x81}, 0x94) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000540)={'batadv_slave_1\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000580)={r0, r1, 0x25, 0x4, @val=@netfilter={0x1, 0x0, 0x6, 0x1}}, 0x20) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_TEST(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000bc0)={0x2c, 0xb, 0x6, 0x801, 0x0, 0x0, {0x6, 0x0, 0x2}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x4}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}]}, 0x2c}}, 0x4800) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r3) 865.687052ms ago: executing program 4 (id=21564): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x1, 0x0, 0x3, 0x2, 0x1, 0x2f}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x90) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x2, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000080)=0x1, 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000140)=@gcm_128={{0x303}, "87ee8ac6c46dad33", "2607080d7f4fcf00fd4ef2dece6c7c58", '\x00', '#\x00'}, 0x28) writev(r0, &(0x7f0000000740)=[{&(0x7f0000000280)="581a17919cc77431510e7fc4ed9fb860505f1495ff92f16a44f8a13d58751d926def1f80b315bdc726cdd8b5d1a91f485854af8fc854b0da7a02522fe7b2c21db7a46c48473099d4a4654cfd97a67c9e79afc0d444e6c78b0216d2201b128df9d4ed5b4dbe676fe56a6354f819d997a6acb8595633cff6f77473b2b3abcc65b51cb3d3a30bf9b0b2ce59d568d3a89b49331904da2a37c89ea236f5d5640c32c3ac74e4bde1a62c560cb63836552f881c8a8305d2a13d838a5160a6c06c63decc865a92e9539f3513af3a1e6f78608890f912f087214dac06387a94d5e1b31c35be117ee540dc4560aa500269b81a0bbc", 0xf0}, {&(0x7f0000000840)="1d4ac370cf8c47025bd7a6", 0xb}], 0x2) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f0000000680)=@gcm_128={{0x303}, "000037d7009400", "c0b6c5b29ca2b838d41ac2fc7ddf972d", "e9be1eae", "bb10000000000001"}, 0x28) readv(r0, &(0x7f0000000040)=[{&(0x7f0000000f40)=""/250, 0xfa}, {&(0x7f0000002040)=""/4094, 0xffe}], 0x2) 829.842964ms ago: executing program 1 (id=21565): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r2) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) close(r4) r5 = socket$unix(0x1, 0x1, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000026c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0xffff}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x18, 0x1, {0x0, '\x00', 0x1, 0x7, 0x100, 0x8}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56441, 0x70b925, 0x80000, {0x0, 0x0, 0x0, r7, {0x0, 0x10}, {0x2, 0xb}, {0x9, 0xb}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0xc, 0x2, [@TCA_FQ_CODEL_MEMORY_LIMIT={0x8, 0x9, 0x50}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x2000c061}, 0x8000) ioctl$SIOCSIFHWADDR(r4, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100054ec6"}) 794.43447ms ago: executing program 3 (id=21566): bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$kcm(0xa, 0x2, 0x0) r0 = socket(0x40000000015, 0x5, 0x0) close(0x3) socket(0x2, 0x80805, 0x0) r1 = epoll_create(0x3ff) unshare(0x28000600) close(0x3) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000040)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, 0xffffffffffffffff, &(0x7f0000000280)={0x2000000}) syz_emit_ethernet(0xbe, &(0x7f0000000100)={@dev={'\xaa\xaa\xaa\xaa\xaa', 0x40}, @broadcast, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0xb0, 0x65, 0x0, 0x0, 0x11, 0x0, @dev, @local}, {0x0, 0x0, 0x9c, 0x0, @wg=@initiation={0x1, 0x0, "f4cb985d86dd6266b5efb88a2c87eda081bac8b2f9a49d564054f1c9218f47b3", "cf8743eb4d9e776f94a6a58d36e006ac614f6f7bce9217cbfea31675d4a860cf6003977b1e4dbb16dc31cc76522bf19d", "5043edd2a8cc8c41345f8feb1a7a8e23043b8a465b1ed5bf8bc91307", {"c7193f7edd1efc4742dc481e6f57f901", "948177bcc5dea4029ba4683a6bdcd7a1"}}}}}}}, 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r2, 0x0) close(0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x1c, &(0x7f0000000080)=[@in6={0xa, 0x4e20, 0x40, @local, 0x9}]}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r2, 0x84, 0x7a, &(0x7f0000000340)={r3, @in6={{0xa, 0x3, 0x3, @mcast1}}}, &(0x7f0000000040)=0x84) sendmmsg$inet_sctp(r0, 0x0, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0, 0x13, r5, 0x0) mmap(&(0x7f0000000000/0x95c000)=nil, 0x95c000, 0x9, 0x8c4b815a5465c2b1, 0xffffffffffffffff, 0xb0260000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000000)={0x1f, 0x2, &(0x7f0000000200)=@raw=[@call={0x85, 0x0, 0x0, 0x6c}, @exit], &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x11}, 0x90) mmap(&(0x7f0000691000/0x4000)=nil, 0x4000, 0x3, 0x28011, r4, 0xc6e9f000) mmap(&(0x7f0000867000/0x2000)=nil, 0x2000, 0x0, 0x11, r4, 0xffffe000) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0xc, 0xe, &(0x7f0000001f80)=ANY=[@ANYRESDEC=r5], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000)={0x0, 0x0, 0x200000}, 0x10}, 0x94) r7 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_tcp_int(r7, 0x6, 0x6, &(0x7f0000000180)=0x1, 0x4) getsockopt$inet6_tcp_int(r7, 0x6, 0x6, 0x0, &(0x7f0000000040)) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000900)={r6, 0x18000000000002a0, 0xe, 0x0, &(0x7f00000006c0)="764b9e147583ddd0569ba56a5cfd", 0x0, 0x7, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) 708.429071ms ago: executing program 0 (id=21567): setsockopt$inet_sctp6_SCTP_EVENTS(0xffffffffffffffff, 0x84, 0xb, &(0x7f0000000000)={0x5, 0x1, 0xfa, 0x5, 0x3f, 0x98, 0x3, 0x7, 0x0, 0x2, 0x1, 0x4, 0x1, 0x7}, 0xe) (async) setsockopt$inet_sctp6_SCTP_EVENTS(0xffffffffffffffff, 0x84, 0xb, &(0x7f0000000000)={0x5, 0x1, 0xfa, 0x5, 0x3f, 0x98, 0x3, 0x7, 0x0, 0x2, 0x1, 0x4, 0x1, 0x7}, 0xe) r0 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_TTY_SET(r0, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x18, 0x3f9, 0x400, 0x70bd2b, 0x25dfdbff, {}, ["", ""]}, 0x18}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000010) (async) sendmsg$AUDIT_TTY_SET(r0, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x18, 0x3f9, 0x400, 0x70bd2b, 0x25dfdbff, {}, ["", ""]}, 0x18}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000010) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000140)={'wlan0\x00'}) (async) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000140)={'wlan0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) (async) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_START_AP(r3, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x30, r4, 0x20, 0x70bd26, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_EXTERNAL_AUTH_SUPPORT={0x4}, @NL80211_ATTR_HE_BSS_COLOR={0x18, 0x11b, 0x0, 0x1, [@NL80211_HE_BSS_COLOR_ATTR_PARTIAL={0x4}, @NL80211_HE_BSS_COLOR_ATTR_DISABLED={0x4}, @NL80211_HE_BSS_COLOR_ATTR_PARTIAL={0x4}, @NL80211_HE_BSS_COLOR_ATTR_COLOR={0x5, 0x1, 0x3e}]}]}, 0x30}, 0x1, 0x0, 0x0, 0x44}, 0x4000000) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000380)={&(0x7f0000000300)={{0x14, 0x10, 0x1, 0x0, 0x0, {0xa}}, [@NFT_MSG_DELSETELEM={0x20, 0xe, 0xa, 0x5, 0x0, 0x0, {0x0, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz2\x00'}]}, @NFT_MSG_DELSETELEM={0x20, 0xe, 0xa, 0x3, 0x0, 0x0, {0xa, 0x0, 0x7}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x5}}}, 0x68}, 0x1, 0x0, 0x0, 0x240080c0}, 0x40000) (async) sendmsg$NFT_BATCH(r5, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000380)={&(0x7f0000000300)={{0x14, 0x10, 0x1, 0x0, 0x0, {0xa}}, [@NFT_MSG_DELSETELEM={0x20, 0xe, 0xa, 0x5, 0x0, 0x0, {0x0, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz2\x00'}]}, @NFT_MSG_DELSETELEM={0x20, 0xe, 0xa, 0x3, 0x0, 0x0, {0xa, 0x0, 0x7}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x5}}}, 0x68}, 0x1, 0x0, 0x0, 0x240080c0}, 0x40000) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000440), r3) sendmsg$NL80211_CMD_START_NAN(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f0000000400), 0xc, &(0x7f0000000500)={&(0x7f0000000480)={0x50, r6, 0x800, 0x70bd28, 0x25dfdbfc, {{}, {@void, @val={0xc, 0x99, {0x5, 0x62}}}}, [@NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x3}, @NL80211_ATTR_BANDS={0x8, 0xef, 0x4}, @NL80211_ATTR_BANDS={0x8, 0xef, 0xa}, @NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x70}, @NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x4}, @NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x8a}]}, 0x50}}, 0x20000005) (async) sendmsg$NL80211_CMD_START_NAN(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f0000000400), 0xc, &(0x7f0000000500)={&(0x7f0000000480)={0x50, r6, 0x800, 0x70bd28, 0x25dfdbfc, {{}, {@void, @val={0xc, 0x99, {0x5, 0x62}}}}, [@NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x3}, @NL80211_ATTR_BANDS={0x8, 0xef, 0x4}, @NL80211_ATTR_BANDS={0x8, 0xef, 0xa}, @NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x70}, @NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x4}, @NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x8a}]}, 0x50}}, 0x20000005) syz_init_net_socket$rose(0xb, 0x5, 0x0) (async) r7 = syz_init_net_socket$rose(0xb, 0x5, 0x0) connect$rose(r7, &(0x7f0000000580)=@full={0xb, @dev={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, 0x2, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x40) (async) connect$rose(r7, &(0x7f0000000580)=@full={0xb, @dev={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, 0x2, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x40) syz_genetlink_get_family_id$nl80211(&(0x7f0000000600), r3) (async) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000600), r3) sendmsg$NL80211_CMD_RADAR_DETECT(r5, &(0x7f0000000700)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000006c0)={&(0x7f0000000640)={0x48, r8, 0x400, 0x70bd2d, 0xd8b, {{}, {@val={0x8, 0x3, r1}, @val={0xc, 0x99, {0x3, 0x3c}}}}, [@NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x2}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x14b}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x14}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x3}]}, 0x48}, 0x1, 0x0, 0x0, 0x8000}, 0x20048870) r9 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000780), r3) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r3, &(0x7f0000000840)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000800)={&(0x7f00000007c0)={0x1c, r9, 0x300, 0x0, 0x25dfdbfc, {}, [@ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0xdb}]}, 0x1c}}, 0xc0) connect$rose(r7, &(0x7f0000000880)=@short={0xb, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0x1, @default}, 0x1c) r10 = socket$nl_generic(0x10, 0x3, 0x10) r11 = syz_genetlink_get_family_id$devlink(&(0x7f0000000900), r3) sendmsg$DEVLINK_CMD_SB_PORT_POOL_GET(r10, &(0x7f0000000a00)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000940)={0x48, r11, 0x20, 0x70bd2d, 0x25dfdbff, {}, [{{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x2}}, {0x8, 0xb, 0x4b5e}, {0x6, 0x11, 0x8}}]}, 0x48}, 0x1, 0x0, 0x0, 0x4014}, 0x44010) sendmsg$nl_route(r2, &(0x7f0000000b00)={&(0x7f0000000a40)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000ac0)={&(0x7f0000000a80)=@ipv4_getnexthop={0x20, 0x6a, 0x200, 0x70bd2c, 0x25dfdbfd, {}, [@NHA_MASTER={0x8}]}, 0x20}, 0x1, 0x0, 0x0, 0x880}, 0x4008050) r12 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000b80), r10) sendmsg$TIPC_NL_BEARER_ENABLE(r3, &(0x7f0000000f00)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000ec0)={&(0x7f0000000bc0)={0x2fc, r12, 0x300, 0x70bd2b, 0x25dfdbfc, {}, [@TIPC_NLA_NODE={0x110, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_KEY={0x49, 0x4, {'gcm(aes)\x00', 0x21, "d57499af9793b7069cb2f05ffb6e1a42287aec54c29f29766bf0181acc7280e62a"}}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0xb}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x2}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0xffffffff}, @TIPC_NLA_NODE_ID={0x93, 0x3, "902a66b433520912c3c18cb34357cf0acb4dbf7315b98d9eb359db09a51e350346336f880595324ce6a7e6b72007cc17e70fcf757a51fadb7051a9021ad9ba83161b63262d437d0365e32fe1546055ab325163fd619c7c80d185c534f62eef804ff095a4977e17c8ad9b82634a9df34b0c2a29c2bc453dee847d4d61e8297822043d3df7c8bcfa13d2990e58c9d194"}, @TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_REKEYING={0x8}]}, @TIPC_NLA_NET={0x44, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0xc800000000000000}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x4}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x3}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x1}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x6}, @TIPC_NLA_NET_ID={0x8, 0x1, 0xe26}]}, @TIPC_NLA_MON={0x34, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x8000}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x4}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x7ff}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xffff6377}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x3}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x8}]}, @TIPC_NLA_NODE={0x154, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ID={0xb9, 0x3, "05e1dadd08f3706be08788d71973563e63940f8d084ccf9a8785cb77ab5403420e88aeaf800d96d210f3aaa3cae304a10d043adafe15f03b5a207814b8f50dfa6b9b3d28fee2dad3c32e33808f5c37e49f3b8d7c8449b32e827282df66ed0b86c09d5dc00a3e5e0899670bc12c990e46ca8f30605166ca30e7d2c8fb1ff707b73c67a2e9e52d6247d55eb791215f8066d5e6396fa4fc3ff859ab03a684bba840425b3fbcd504cb51129a464311ea6f54c95066321a"}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_KEY={0x3c, 0x4, {'gcm(aes)\x00', 0x14, "15ffc97f34d5dd6807eca773bc3e2bee0621c993"}}, @TIPC_NLA_NODE_KEY={0x44, 0x4, {'gcm(aes)\x00', 0x1c, "e53bc29555d744e49e752ad0f2fa2198be24269a99c5f581d8fb5652"}}, @TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x6}]}, @TIPC_NLA_NET={0xc, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x80000000}]}]}, 0x2fc}, 0x1, 0x0, 0x0, 0x40018}, 0x4) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, &(0x7f0000000f40)) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, &(0x7f0000000f40)={'batadv0\x00', 0x0}) socketpair(0x3, 0x1, 0x8, &(0x7f0000000f80)={0xffffffffffffffff, 0xffffffffffffffff}) bind$xdp(0xffffffffffffffff, &(0x7f0000000fc0)={0x2c, 0xe, r13, 0x19, r15}, 0x10) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r14, 0x89f3, &(0x7f0000001040)={'syztnl1\x00', &(0x7f0000001000)={'ip_vti0\x00', r13, 0x20, 0x8000, 0x0, 0x9, {{0x7, 0x4, 0x1, 0x23, 0x1c, 0x67, 0x0, 0x9, 0x29, 0x0, @private=0xa010101, @remote, {[@rr={0x7, 0x7, 0x32, [@empty]}]}}}}}) bind$xdp(r14, &(0x7f0000001080)={0x2c, 0x472950a25b21b7e, r16, 0x14, r14}, 0x10) 686.438353ms ago: executing program 4 (id=21568): socket(0x2, 0x80805, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'wlan1\x00'}) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.events\x00', 0x26e1, 0x0) close(r1) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000000c0)) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000000880)=[{{&(0x7f0000000080)={0x2, 0x0, @remote}, 0x10, 0x0}, 0x20000000}, {{0x0, 0x0, 0x0}}], 0x2, 0x68840) ioctl$SIOCSIFHWADDR(r1, 0x8b06, &(0x7f0000000000)={'wlan1\x00', @random="060000000010"}) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="300000001000010000003a194618d96d6d2e8553", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=0x0, @ANYBLOB="08001b"], 0x30}}, 0x0) r2 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="2e00000010008188e6b62aa73772cc9f1ba1f848480000005e140602000000000e000a000f000000028000001294", 0x2e}], 0x1, 0x0, 0x0, 0x700}, 0x0) 504.71454ms ago: executing program 3 (id=21569): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_TRAP_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r1, 0x1, 0x0, 0x25dfdbfe, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}, {0x5}}]}, 0x58}, 0x1, 0x0, 0x0, 0x810}, 0x110) (fail_nth: 3) 361.980427ms ago: executing program 3 (id=21570): r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmmsg$inet6(r0, &(0x7f0000005fc0)=[{{&(0x7f0000000180)={0xa, 0x4e23, 0x4, @dev={0xfe, 0x80, '\x00', 0xd}, 0x9}, 0x1c, 0x0, 0x0, &(0x7f0000001a40)=ANY=[@ANYBLOB="600100000001000029000000360000002c2800000000000004010700fd3a1d102cea2583067108ec5b9b496e23b94d951553f09cf5ed5dd4234e0d9601faa65ab02d7c10c59963ec1928b5b14874af65ccbd4ec1a8498cd3ede8d92b0def952d14e2d608289917358a6417ad5365ae8e2c4627de6dc532215bc3ac2444018fa419806ff9075d8866aa927279a2c404968d178374f12158900546d49f7414b9caf7f5b0139a2517cc9d7355ee6ab2006cd2511e075453a6afabc43da40a4b2ae244123cd0e45892a25b11aef22c70b0a471f6a168ee5fc82f80ccda083126b6850896e0e8dfaa44650eb75b150242d38498dd1a6b33c9bff6c57c94bf3e9a6bb1cee563e715b285f6c8e28435e517046f82eb5b94eb06472722960738000000020cfdb300726100000000000009000000000000000600000000000000df0000000000000001000000000000000800000000000000010100c20400000003000000400000000000000029000000370000002104000000000000040109c20400001000c2040000009b040105c910fe8000000000000000000000000000aa0000000014"], 0x1b8}}, {{&(0x7f0000000140)={0xa, 0x4e21, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x100}, 0x1c, 0x0}}], 0x2, 0x4080) 361.455026ms ago: executing program 4 (id=21571): bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x18, 0xe, &(0x7f0000000200)=ANY=[@ANYBLOB="d700000001000000bf"], 0x0, 0x7}, 0x94) r0 = socket$inet6_udp(0xa, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000300)={@mcast2, 0x0, 0x0, 0xff, 0x3, 0x600}, 0x21) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000010000000900010073797a300000000058000000030a0102000000000000000001000000090003803d2175fbe782c2002c00048008000240172af2e40800014000000003080002401c791e7108000240423930ce08000140000000030900010073797a300000000088000000060a010400000000000000000100000008000b400000000014000480100001800b0001006e756d67656e00000900010073797a30000000004c0004804800018008000100666962003c000280080003400000000c0800014000000002080001400000003008000240000000030800014000000012080003"], 0x122}}, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x8, &(0x7f0000000940)=@framed={{0x18, 0x9}, [@tail_call={{}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xa000000}}]}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r3 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000340)=@base={0x2, 0x10000, 0x81, 0x81, 0x10000, r3, 0x101, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x0, 0x4}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000001c0)={{r4, 0xffffffffffffffff}, &(0x7f0000000140), &(0x7f0000000180)=r2}, 0xd) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x6, 0x14, &(0x7f0000001740)=@ringbuf={{0x18, 0x8}, {{0x18, 0x1, 0x1, 0x0, r3}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x1ab92b}, {0x85, 0x0, 0x0, 0x8}, {0x4}}, {{0x5, 0x0, 0x4, 0x9, 0x0, 0x1, 0x2000}}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r5}}], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x9}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @xdp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 288.443309ms ago: executing program 4 (id=21572): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) r3 = syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/pid_for_children\x00') unshare(0x6a040000) r4 = socket(0x8, 0x3, 0x0) ioctl$sock_netrom_SIOCADDRT(r4, 0x6180, 0x0) recvmsg(r2, 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r3, 0x81f8943c, &(0x7f000010d280)) bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x3, 0x1c, &(0x7f0000001840)=@ringbuf={{0x18, 0x6}, {{0x18, 0x1, 0x1, 0x0, r1}, {}, {}, {0x85, 0x0, 0x0, 0xa0}}, {}, [@snprintf={{}, {0x5, 0x3, 0x3, 0xa, 0x9}, {0x5}, {0x3, 0x3, 0x3, 0xa, 0xa}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r0}, {}, {0x15, 0x0, 0x0, 0x76}}], {{}, {0x5}, {0x28}}}, &(0x7f00000003c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) 287.244486ms ago: executing program 1 (id=21573): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$team(&(0x7f00000001c0), r1) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000fc0)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f0000001d40)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01002dbd7000fddbdf250100000008000100", @ANYRES32=r3, @ANYBLOB="3c000280380001"], 0x58}, 0x1, 0x0, 0x0, 0x20040881}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f00000009c0)=ANY=[@ANYBLOB="540000001400080028bd7000fddbdf2502381000", @ANYRES32=r3, @ANYBLOB="1400060000f8ffff080000000200000001010000080009002206000008000a00030000000800080080000000080012007f0000010800080014000000"], 0x54}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000007c0)=ANY=[@ANYBLOB="340000001800dd8d00000000000000000200000000000005000000000600150006000000100016800c00088008000180040004003c592c1292a09601a009f2723a8c1c391d6136393c4fdb4e3db9b3a91e9dd9e9010235b2bce68e285f22601ee782b8a0579144593e8ae150532a5b6ca05cef5ae8b60a5f71bbc47145b23e8e7dc6b003cb2106fc824d3e0602478abb34bb67"], 0x34}}, 0x0) syz_genetlink_get_family_id$netlbl_cipso(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[@ANYBLOB="140000001000009006000000000000000000000a44000000090a050600000000000000000100000008000a40000000000900020073797a31000000000900010073797a3000000000080005400000001405000d40460000001400000011"], 0x6c}}, 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(r1, 0x8933, &(0x7f0000000540)={'wg1\x00'}) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000580)={'team0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000600)={'batadv0\x00', 0x0}) sendmsg$TEAM_CMD_PORT_LIST_GET(r1, &(0x7f00000006c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000640)={&(0x7f0000001400)=ANY=[@ANYBLOB="28060000", @ANYRES16=r2, @ANYBLOB="000427bd7000ffdbdf250300000008000100", @ANYRES32=r3, @ANYBLOB="dc0102803c00010024000100757365725f6c696e6b757000000000000000000000000000000000000000000005000300060000000400040008000600", @ANYRES32=r3, @ANYBLOB="38000100240001006e6f746966795f70656572735f636f756e7400000000000000000000000000000500030003000000080004000600000038000100240001006c625f73746174735f726566726573685f696e74657276616c000000000000000500030003000000080004002f00000040000100240001006c625f74785f686173685f746f5f706f72745f6d617070696e67000000000000050003000300000008000400", @ANYRES32=r3, @ANYBLOB="0800070000000000400001002400010071756575655f6964000000000000000000000000000000000000000000000000050003000300000008000400ff01000008000600", @ANYRES32=r3, @ANYBLOB="3800010024000100616374697665706f727400000000000000000000000000000000000000000000050003000300000008000400", @ANYRES32=r4, @ANYBLOB="38000100240001006d636173745f72656a6f696e5f636f756e740000000000000000000000000000050003000300000008000400050000003c00010024000100757365725f6c696e6b75705f656e61626c65640000000000000000000000000005000300060000000400040008000600", @ANYRESOCT=r4, @ANYBLOB="08000100", @ANYRES32=r3, @ANYBLOB="a401028038000100240001006c625f73746174735f726566726573685f696e74657276616c000000000000000500030003000000080004000500000038000100240001006e6f746966795f70656572735f636f756e740000000000000000000000000000050003000300000008000400820800003800010024000100616374697665706f727400000000000000000000000000000000000000000000050003000300000008000400", @ANYRES32=r3, @ANYBLOB="40000100240001006c625f686173685f737461747300000000000000000000000000000000000000050003000b00000008000400c8000000080007000000000038000100240001006e6f746966795f70656572735f696e74657276616c00000000000000000000000500030003000000080004000700000040000100240001006c625f686173685f737461747300000000000000000000000000000000000000050003000b00000008000400090000000800070000000000400001002400010071756575655f6964000000000000000000000000000000000000000000000000050003000300000008000400671d000008000600", @ANYRES32=r3, @ANYRESDEC=r0, @ANYRES32=r3, @ANYBLOB="38010280400001002400010071756575655f6964000000000000000000000000000000000000000000000000050003000300000008000400ad00000008000600", @ANYRES32=r3, @ANYBLOB="38000100240001006e6f746966795f70656572735f636f756e740000000000000000000000000000050003000300000008000400030000007c000100240001006270665f686173685f66756e6300000000000000000000000000000000000000050003000b0000004c000400020007d9040000000800ff0807000000cbba40c4090000000100008b05000000cae306ff04000000000200d6060000005403fa07050000000d0007070000010008270f090000000040000100240001006d6f64650000000000000000000000000000000000000000000000000000000005000300050000000f000400726f756e64726f62696e000008000100", @ANYRES32=r5, @ANYBLOB="3c0102803c00010024000100757365725f6c696e6b757000000000000000000000000000000000000000000005000300060000000400040008000600", @ANYRES32=r3, @ANYBLOB="40000100240001006c625f74785f686173685f746f5f706f72745f6d617070696e67000000000000050003000300000008000400", @ANYRES32=r6, @ANYBLOB="080007000000000044000100240001006270665f686173685f66756e630000000d000000000000000000000000000000050003000b000000140004009959031000080000f6678f00090000003c00010024000100656e61626c65640000000000000000000000000000000000000000000000000005000300060000000400040008000600", @ANYRES32=r3, @ANYBLOB="3c00010024000100757365725f6c696e6b75705f656e61626c65640000000000000000000000000005000300060000000400040008000600", @ANYRES32=r3, @ANYBLOB], 0x628}, 0x1, 0x0, 0x0, 0x2800}, 0x810) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[], 0x7c}}, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) writev(r8, &(0x7f0000000640)=[{&(0x7f0000000100)="afa63660", 0x4}], 0x1) recvmsg$unix(r8, &(0x7f00000006c0)={0x0, 0x0, 0x0}, 0x0) close(r9) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r10 = socket$alg(0x26, 0x5, 0x0) bind$alg(r10, &(0x7f0000000700)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_pr_hmac_sha512\x00'}, 0x58) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000340)={&(0x7f0000000400)='virtio_transport_alloc_pkt\x00'}, 0x18) setsockopt$ALG_SET_KEY(r10, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r11 = accept4(r10, 0x0, 0x0, 0x800) sendmmsg$alg(r11, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r11, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r12 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r7, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000680)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r12, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r13, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0) 279.783703ms ago: executing program 3 (id=21574): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet(0x2, 0x6, 0x8001) ioctl$SIOCGETSGCNT(r1, 0x89e1, &(0x7f0000000200)={@dev={0xac, 0x14, 0x14, 0x3b}, @local}) sendmsg$nl_route(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000080)={&(0x7f0000000180)=@ipv4_newrule={0x64, 0x20, 0x1, 0x70bd28, 0x25dfdbfc, {0x2, 0x80, 0x0, 0x2, 0xc0, 0x0, 0x0, 0x59e74b56c2705e37, 0x10008}, [@FRA_DST={0x8, 0x1, @private=0xa010100}, @FRA_GENERIC_POLICY=@FRA_FWMARK={0x8, 0xa, 0x6}, @FRA_DST={0x8, 0x1, @multicast1}, @FRA_TUN_ID={0xc, 0xc, 0x1, 0x0, 0x85}, @FRA_TUN_ID={0xc, 0xc, 0x1, 0x0, 0xfffffffffffffff8}, @FRA_FLOW={0x8, 0xb, 0x1}, @FRA_DST={0x8, 0x1, @local}, @FRA_GENERIC_POLICY=@FRA_IP_PROTO={0x5, 0x16, 0x5c}]}, 0x64}, 0x1, 0x0, 0x0, 0x20008000}, 0x4000080) socket(0x2b, 0x3, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), 0xffffffffffffffff) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000940)='hugetlb.2MB.usage_in_bytes\x00', 0x26e1, 0x0) close(r4) ioctl$SIOCSIFHWADDR(r4, 0x8b34, &(0x7f0000000000)={'wlan1\x00', @random="000500000020"}) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0b00000007000000080000000800000005"], 0x48) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b70800000000ebff7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r6}, 0x10) r7 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r7, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000100)=ANY=[@ANYBLOB="020300030c00000000000000000000000100090000000000030006006c0000000200000000000000000000000000800002000100000000000002060b00000000030005000000000002000000000000000000000000000000010018"], 0x60}, 0x1, 0x7}, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000240)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x64, 0x64, 0x3, [@volatile={0xa, 0x0, 0x0, 0x9, 0x4}, @float={0x6, 0x0, 0x0, 0x10, 0x8}, @var={0x10, 0x0, 0x0, 0xe, 0x5, 0x1}, @enum64={0xb, 0x2, 0x0, 0x13, 0x0, 0x8, [{0x1, 0x80000000, 0x9}, {0x6, 0x1e, 0x6}]}, @restrict={0x87, 0x0, 0x0, 0xb, 0x1}, @restrict={0x3, 0x0, 0x0, 0xb, 0x4}]}, {0x0, [0x61]}}, &(0x7f00000002c0)=""/198, 0x7f, 0xc6, 0x1, 0x291653ad, 0x10000, @value=r4}, 0x28) sendmsg$TIPC_NL_BEARER_SET(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)={0x34, r3, 0x1, 0x70bd2c, 0x25dfdbfb, {}, [@TIPC_NLA_BEARER={0x20, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xd2}]}]}]}, 0x34}, 0x1, 0x0, 0x0, 0x4cc04}, 0x4040140) 150.164124ms ago: executing program 2 (id=21575): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CALIPSO_C_REMOVE(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x1c, 0x0, 0x8, 0x70bd2c, 0x25dfdbff, {}, [@NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x80) (async) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000140)=ANY=[@ANYBLOB="28010000160001000000000000000000ff020000000000000000000000000001ff020000000000000000000000000001000000004e2000"/64, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ac141421000000000000000000000000000000006c000000ac1414aa000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000066ff0f00000000000000000000000000000000000000000000000000000000000000000000000000002200000000000000000000003210"], 0x128}}, 0x70080) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000480), r2) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000700)={'wlan1\x00'}) (async) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="fc9e0666", @ANYRES16=r3, @ANYBLOB="01002cbd7000000000003900000008005a8004000480"], 0x1c}}, 0x2400c090) (async) syz_init_net_socket$ax25(0x3, 0x5, 0xcf) 124.597888ms ago: executing program 2 (id=21576): r0 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_int(r0, 0x6, 0x19, &(0x7f00000001c0)=0x1, 0x4) bind$inet(r0, &(0x7f0000000100)={0x2, 0x4e24, @loopback}, 0x10) sendmmsg$inet(r0, &(0x7f0000004980)=[{{&(0x7f0000000000)={0x2, 0x4e24, @loopback}, 0x10, &(0x7f0000000080)=[{&(0x7f0000000280)="5338a3848b25e258a25f9dae13edecbd5949e59be176d378767821df88e0ab00d48f37bc79", 0x25}], 0x1}}], 0x1, 0x20008000) recvmsg(r0, &(0x7f0000001480)={0x0, 0x0, &(0x7f0000001380)=[{&(0x7f0000000200)=""/112, 0x70}, {0x0}], 0x2}, 0x123) shutdown(r0, 0x1) sendmmsg(r0, &(0x7f000000ba40)=[{{&(0x7f0000000040)=@in={0x2, 0xfff5, @loopback}, 0x80, &(0x7f0000000e40)=[{&(0x7f00000000c0)="95ae982944265c1255c27fbf65eef1cdbb69e5ad2620167c91c0a0554a970540fb7a78b22da20f00943df8f9daf10c669a779c101e475951228c66f7e0e0bcd1ec890b750e6aa24c0ec8212e58990896f7a4dafa26c470104c3a8ac66773652c43cb01265022952b8753827ddc2f15bdd8b54b73b86692a1", 0x78}, {&(0x7f0000000c80)="065f209d1b138015e822ea9b881241f2fb0842a6d7f6c4176398602c5e9b9f0b5127cdf0c5722ed8fb58453dc47ed14a8ca1e32814e2ea9cc090576f05e163b37d7c294b20961b9339a4ef8a745b882ad0af1cd9df6fd930c6a414cc514f7f6c5737e39b675f5cb115430b778fb2fdc3a9d1c852f89476833c4cfa7de7a1d739a960f0dcea302e2f600c02a9c763f1f3fb0ae4f6cdf0885c822bb6daf078f5ab21f1c0363657d5dabd19fd6fb5b71551251f720b17ca47", 0xb7}, {&(0x7f0000000180)="4812417badf664236f19804ffa369f2eb66331be376d58767077074621072ed2527c169f1a00f6b22b88718869e86d646945113391ab145d6046111b20cf82a5f27fc8dc605bab", 0x47}, {0x0}], 0x4, &(0x7f0000000ec0)=[{0x48, 0x6, 0x9, "4a2bbec34bf931964cd210cb561e4fa700ee0c1633e8ba315544f49fce3be08e5ac88e86675218c997d8dd2b422c47d0cf5c23"}, {0xc0, 0x10b, 0x4, "4d51500cfca81598ad8875621b9d5c987b6d58211a0e7044be385cd6d245ea27bfb55d8c89b728ef2eb2ee92062e971a8b9a4e67f605ed0940a739e88f3fec4584107eafd2f192242408a04584544572346ae4b135db5dd59cb5230af3f3689b044c6c9321ef524bca2c1405d59cd73384c92fcf388475d4fd6033904552ee8e33dd9eb9acc4125910eb7f79f58557bd04aaf5fe2cbb5c77cf80fa253df23028f4658895a0c04a5c5167d968"}, {0xa0, 0x107, 0x855, "da2433cbff5672c61b8813f2ff0400f1ae5c7dfab851a806c3da57ec5e4d21f97c04ac3133de6c5cddb57d08b7a945f7a0dac11713667529ddeaf84b12aeedc34f25ff15aaa88441f499fb2ad5d771736343cde911d32206d21a64afef4b18defdec2d72bdeb9961e43f42f420b5dae4cf3ef5317b5158572f09a2e2b43ba5b22025f53f69cf72e82d0a8bf75aa2c1"}, {0x48, 0x6, 0xf, "f591b1945bc0c42da97ad618d562b84d5a8767732b3e5f474144cc830958b0c4264d1fd292a3c5a8f4fbf00e23f5b2f043760a51"}, {0x58, 0x110, 0xffff96e3, "0e5a076be0e21fb7f19f9ce960907c37d8d82b4b26ace47e61df0b346164784909c982f05da25df50d8783df753e6739f2576e21c8c47b64efc4d59b389a28c597"}, {0xe8, 0x10f, 0x7, "902dfd8232cd015be0138c507247c5d15cf9277ef6b25977d07c6e2df16402aa8b06eb6260fd0f229c32278fc71aa720f4169e7082fe964b06ea141f162def41dd56840d7dd5ae10a37356a6474a44e830345a4cce29850b01d6d474f23ed55e0a0992d45ba2c6bc393546f486f2312e9ddcd3c8c96af3cc32b7593f9b019bf02746a77685b65e3ab816651ffd9fd1553b3247de7615df260029be51434263e61410fff3987c5f9a905e39cc996a2eb79e7dc1a3f30924f60ec2ac453f1aff249c51c8f5f73165fb5e487d23035d32bed9b3db4664"}, {0x50, 0x107, 0x2f11, "75aa3d59c7424b3090d3ac4130a38898782572d164a72082800fe4c302569511f74691f2edd2355e03c59ba0d896db8a4eea0c362707697f19"}, {0x10, 0x117, 0x492}, {0x78, 0x112, 0x2, "d2ca1fe5ccfd869afdd566889c973b91420af70b979b4ff7288545d42993b2ba9246261efdba12b44c141e9bf64e3a3ec8323794dbf1ca5ff5f2b9bfb635a49e80b6d2f055c01533d587559e237c5fa49039be90be67cfe13c168a77029383bf70a4ad"}, {0x10, 0x111, 0x6}], 0x418}}, {{0x0, 0x0, &(0x7f00000016c0)=[{&(0x7f00000013c0)}, {&(0x7f0000001400)="c1b1274c072d4d0d35d087c6c54b5d9fe61db3fb480c9505577eae24c5d76caa508bca2a7a1c15055ac682fbb93dcfa7b5807f1c68ee992358b7f4e7c5c854c74e20454d1e3e0565bab955b06c470bca4aad7a0a4e9f29c3804e6089bdde3efbf9ecc8775359740571464c35b6609e53e1e037285ce091a35319bdbc681a9a113c9070be55a6f2f79914f677fd792b1ace22f9fdd2c58288212971d03710118b575c055a1b2fcc24d9da995da69fdd8e5e39251d6e5e69ee1873a9c099", 0xbd}, {0x0}, {&(0x7f0000001600)="fc440c00a1be4a06a3aa97a8e2202ef6488219ac0b7cbf8f1137e92c47ecfa1076bced0087b96a1279e204d73be0a9d806e6faeed94f75c32faeec47a1fd", 0x3e}, {&(0x7f0000002880)="ddacdea6155129e1380653d9f34cc60268c01e557f5fba5effcbf2dfeeeea899ded7c889fe2eb8192e18d5fbda6aad3435a93da9aca1d304f2061759157ebd8af3e6dc165e906e0a81c99d4a6c8969dbc476c9c191af11fb81d9a06b31e4052934f267257d7933541d8cf91b5060bed963ccbcfac853ef22f73b69b5e5ac8095521a5f60a4d00f1fece99d808ac55c1b6337352af8f731db515b608de6bcd93cb2aeab7997e5651ee511d3688d6c6bd65d37cb0d72ee398786362153b52ba70fcb90b8972ea94775cb7e8df636c9d7e7fa5bc31f0501b0e835819cc714014690de21c6596b", 0xe5}], 0x5}}, {{&(0x7f0000002980)=@nfc={0x27, 0x0, 0x1, 0x3}, 0x80, 0x0, 0x0, &(0x7f0000003a40)=ANY=[@ANYBLOB="28000000000000000000000001800000f5dd7ee002b2168f03bbf8c346407f9ced9f9f0000000000100001f0ffff000011010000ff030000280000000000000013010000ff0700eb2e4cc21eecdf2212be3c2f55922ac5aee5364147c9000000"], 0x60}}, {{&(0x7f0000003b40)=@sco={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x12}}, 0x80, &(0x7f0000004bc0)=[{&(0x7f0000003bc0)="998cb4a2aeddc764bdc61a03c8e498e38c3cbd437b1dad2f7a0bcb0cd92928ba238a05f5b1326f7982e06487719a9c7c01901f5f9a2b77e5ce57048eca29c234b6adfd35166bcc41b718517de0e7faf7d6287bb3f11b4db47176b033578d9748d40797d3c52a505e17443e7b56ebd7023a8fc39e521578d5057f8dbb315e133a81435d774266f44b456e4a66cf133532760724936aabe5892f34a6e0fa779e8077dc2a1dbc592dc1dab189bf8887c165056690eee611058afd89422e20768fcf3b7037524a8aeea6fd1fe57d578fa0aadc74c5c540e867bf0bbec0b83d7978cfad0479efedcf098e91c7ed5f257a3c2192c0ed7b96472c756ed5d18b0b88baa0", 0x100}], 0x1, &(0x7f0000004c00)=[{0x10, 0x6, 0x8}, {0x10, 0x1, 0xd0e4}], 0x20}}, {{&(0x7f0000004e40)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e24, @loopback}, 0x4, 0x0, 0x0, 0x4}}, 0x80, 0x0, 0x0, &(0x7f0000006580)=ANY=[@ANYBLOB="100000000000000003010000f0000000"], 0x10}}, {{&(0x7f00000075c0)=@pptp={0x18, 0x2, {0x3, @multicast2}}, 0x80, &(0x7f00000088c0)=[{&(0x7f0000007640)="15fc210872edeb686f2aa19db83897cab91b54e462f0fa68134553d4b3118885252e77809c53d40e30fb5046b063e3c93bc4f6f390397afc8408ff88555f9e3c98e6a5a0d47e765526e24a1147b8bae0b14939ddb9dbd4f763d5cc4bc3478c1bf92516dfe75af8640c53adccce588e2b2f18705277ee408d03e53f50a66eeb7a44c25780db1c441ad14eb723cf20440f05cfd83d19d4162d28af31058885e02366cc44d7e613866b62f67ca9e8", 0xad}, {0x0}, {0x0}, {&(0x7f00000087c0)="dd59c6cee5cf7793438a46c945978716b449d4993bf606dd3f1c5cf773afd1711daed7fd5826b35c08595e23c4aa33309787ea6ed91c185d5bba8414be5f259804d58f0b8f91900cef4a2aadb2be059dd9384f13f3a965e941400ebf85bf660a879400fb112ee4e9a28d3fa326a7f6c85738e07a58ce00eb932d6084578a7e672b7eb0bebb9a64d49253db10d0578f8527ffd6145351ff1bb35472a2e56c21cb3a79bec3589c161fbb49b7b270edb54994b66bf5da", 0xb5}], 0x4, &(0x7f0000008940)}}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f000000a080)=[{&(0x7f0000009f80)}], 0x1, &(0x7f000000a0c0)=[{0x30, 0x10c, 0x4, "4c14f40cf67952c76e7de304ff328493fca2bcc6a308597a44efbae81b45e8"}, {0x68, 0x115, 0x6, "16112d42b16bdb73a86f88e2ad8735db9745137ef53c240eae9d10bef7418c4399b31261196e9f4ee832797b92deeb6faa0d4bab1c67170596a45f1746a070e3d2cb71334f0aa071379bbaee97dff75bd87e7a"}], 0x98}}, {{&(0x7f000000a300)=@nfc_llcp={0x27, 0x0, 0x1, 0x2, 0x7, 0x5, "02f82425361de9b2b949cb49774ffbed1af77f0308656526117d0772d43855b0cc74eba8d4dbce2bff2273301e5ee14279b07d6f35b55c41f5413861c2e292", 0x7}, 0x80, &(0x7f000000b8c0)=[{&(0x7f000000a380)}, {&(0x7f000000b380)}, {0x0}, {&(0x7f000000b700)="4c161be02ba3b08a2c54fb354a1633c3e84b4a1e4267c91706557c780109bbda7bdfb9d0c6012ef68f0fb61e5b7f9f7290ed1899779d646fae54d10376", 0x3d}, {&(0x7f000000b740)}, {&(0x7f000000b7c0)="69c4881fa796227ac21c173cc8fe9f204eb70433eacb09df1530b64ded67894827c491bf331dbce3efd55a3bf8d9683e8eaffe56274a15814d0cba83eff7", 0x3e}, {0x0}, {&(0x7f000000b880)="453502", 0x3}], 0x8, &(0x7f000000b980)=[{0x98, 0x102, 0x7, "13e254d1a8e90aa3c9daf5674fa8fb7fbbf5b1dbda75de445589f3a615e3a49ec2afe2714208043a4b200ed449928a26652c3e3637897d33caeb4958214459c3d16e68aaeb59a83ca072dc0976f96a2c71bcf81112587115b47d8d5afd040ac55a189b86b695b39a8421693327d996a3495b1c470e5b3c2b0ebf66bc184c31ed7ebb"}], 0x98}}], 0x9, 0x20000000) 0s ago: executing program 2 (id=21577): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) bind$xdp(0xffffffffffffffff, &(0x7f0000000100)={0x2c, 0x2, 0x0, 0xa}, 0x10) sendmsg$NFT_BATCH(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="140000001000040000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000058000000160a01000000000000000000010000000900010073797a30000000000900020073797a30000000002c0003800800014000000000080002400000000010000380140001007465616d3000000000000000000000005c000000160a0101000b000000000000010000000900020073797a30000000000900010073797a3000000000300003802c00038014"], 0xfc}}, 0x0) write$tun(r0, &(0x7f0000000140)=ANY=[@ANYBLOB="080008000600000000281404907864010102ffffff"], 0x36) kernel console output (not intermixed with test programs): invalid length. [ 1298.793917][T26005] openvswitch: netlink: Message has 1 unknown bytes. [ 1298.801108][T26005] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1298.896415][T26007] x_tables: duplicate underflow at hook 1 [ 1299.143433][T26016] netlink: 212368 bytes leftover after parsing attributes in process `syz.2.20499'. [ 1299.178929][T26026] xt_SECMARK: mode already set to 1 cannot mix with rules for mode 0 [ 1299.284604][T26033] netlink: 28 bytes leftover after parsing attributes in process `syz.4.20505'. [ 1299.683922][T26046] syzkaller0: entered promiscuous mode [ 1299.691398][T26046] syzkaller0: entered allmulticast mode [ 1299.813054][T26057] netlink: 16 bytes leftover after parsing attributes in process `syz.1.20512'. [ 1300.361323][T26082] syzkaller1: entered promiscuous mode [ 1300.374214][T26082] syzkaller1: entered allmulticast mode [ 1300.974537][T26099] netlink: 4 bytes leftover after parsing attributes in process `syz.1.20526'. [ 1300.985070][T26100] netlink: 4 bytes leftover after parsing attributes in process `syz.1.20526'. [ 1301.009331][T26099] netlink: 175008 bytes leftover after parsing attributes in process `syz.1.20526'. [ 1301.206179][T26109] netlink: 36 bytes leftover after parsing attributes in process `syz.3.20530'. [ 1301.994626][T26131] netlink: 56 bytes leftover after parsing attributes in process `syz.1.20537'. [ 1302.294595][T26142] netlink: 104 bytes leftover after parsing attributes in process `syz.1.20541'. [ 1302.307990][ T3036] Bluetooth: hci0: command 0x0406 tx timeout [ 1302.333262][T26144] netlink: 104 bytes leftover after parsing attributes in process `syz.0.20542'. [ 1302.673442][T26157] syzkaller0: entered promiscuous mode [ 1302.681673][T26157] syzkaller0: entered allmulticast mode [ 1303.102179][T26179] netdevsim netdevsim0 netdevsim0: entered promiscuous mode [ 1303.229997][T26179] sctp: [Deprecated]: syz.0.20552 (pid 26179) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1303.229997][T26179] Use struct sctp_sack_info instead [ 1303.285273][T26189] netlink: 'syz.1.20556': attribute type 1 has an invalid length. [ 1303.450003][T26189] 8021q: adding VLAN 0 to HW filter on device bond6 [ 1303.455225][T26198] netlink: 'syz.0.20559': attribute type 1 has an invalid length. [ 1303.492552][T26192] bond6: (slave geneve3): making interface the new active one [ 1303.503950][T26192] bond6: (slave geneve3): Enslaving as an active interface with an up link [ 1303.604691][T26198] 8021q: adding VLAN 0 to HW filter on device bond5 [ 1303.640944][T26199] FAULT_INJECTION: forcing a failure. [ 1303.640944][T26199] name failslab, interval 1, probability 0, space 0, times 0 [ 1303.674246][T26199] CPU: 0 UID: 0 PID: 26199 Comm: syz.0.20559 Not tainted syzkaller #0 PREEMPT(full) [ 1303.674275][T26199] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1303.674288][T26199] Call Trace: [ 1303.674297][T26199] [ 1303.674309][T26199] dump_stack_lvl+0xe8/0x150 [ 1303.674340][T26199] should_fail_ex+0x414/0x560 [ 1303.674378][T26199] should_failslab+0xa8/0x100 [ 1303.674404][T26199] __kvmalloc_node_noprof+0x175/0x920 [ 1303.674428][T26199] ? alloc_netdev_mqs+0xa4b/0x11b0 [ 1303.674463][T26199] alloc_netdev_mqs+0xa4b/0x11b0 [ 1303.674498][T26199] rtnl_create_link+0x31f/0xcf0 [ 1303.674533][T26199] rtnl_newlink_create+0x25c/0xb00 [ 1303.674563][T26199] ? __mutex_lock+0x5bb/0x1350 [ 1303.674591][T26199] ? __pfx_rtnl_newlink_create+0x10/0x10 [ 1303.674619][T26199] ? __pfx___mutex_lock+0x10/0x10 [ 1303.674651][T26199] ? ns_capable+0x8a/0xf0 [ 1303.674674][T26199] rtnl_newlink+0x16e7/0x1c90 [ 1303.674713][T26199] ? __pfx_rtnl_newlink+0x10/0x10 [ 1303.674732][T26199] ? do_syscall_64+0xec/0xf80 [ 1303.674751][T26199] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1303.674809][T26199] ? kasan_quarantine_put+0xbb/0x1f0 [ 1303.674829][T26199] ? lockdep_hardirqs_on+0x7b/0x110 [ 1303.674854][T26199] ? kmem_cache_free+0x197/0x620 [ 1303.674874][T26199] ? nlmon_xmit+0xb0/0x100 [ 1303.674910][T26199] ? __lock_acquire+0x6b6/0x2cf0 [ 1303.674941][T26199] ? __local_bh_enable_ip+0xd0/0x130 [ 1303.674963][T26199] ? lockdep_hardirqs_on+0x7b/0x110 [ 1303.674982][T26199] ? __dev_queue_xmit+0x289/0x31c0 [ 1303.675012][T26199] ? __local_bh_enable_ip+0xd0/0x130 [ 1303.675031][T26199] ? __dev_queue_xmit+0x289/0x31c0 [ 1303.675064][T26199] ? rtnetlink_rcv_msg+0x1ab/0xb70 [ 1303.675101][T26199] ? __pfx_rtnl_newlink+0x10/0x10 [ 1303.675122][T26199] rtnetlink_rcv_msg+0x7cf/0xb70 [ 1303.675148][T26199] ? rtnetlink_rcv_msg+0x1ab/0xb70 [ 1303.675168][T26199] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1303.675187][T26199] ? ref_tracker_free+0x63a/0x7d0 [ 1303.675208][T26199] ? __asan_memcpy+0x40/0x70 [ 1303.675236][T26199] ? __pfx_ref_tracker_free+0x10/0x10 [ 1303.675268][T26199] netlink_rcv_skb+0x208/0x470 [ 1303.675294][T26199] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1303.675318][T26199] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1303.675355][T26199] ? netlink_deliver_tap+0x2e/0x1b0 [ 1303.675388][T26199] netlink_unicast+0x82f/0x9e0 [ 1303.675420][T26199] ? __pfx_netlink_unicast+0x10/0x10 [ 1303.675441][T26199] ? __alloc_skb+0x198/0x3a0 [ 1303.675462][T26199] ? netlink_sendmsg+0x642/0xb30 [ 1303.675485][T26199] ? skb_put+0x11b/0x210 [ 1303.675510][T26199] netlink_sendmsg+0x805/0xb30 [ 1303.675545][T26199] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1303.675575][T26199] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1303.675603][T26199] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1303.675621][T26199] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1303.675648][T26199] __sock_sendmsg+0x21c/0x270 [ 1303.675680][T26199] ____sys_sendmsg+0x505/0x820 [ 1303.675710][T26199] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1303.675744][T26199] ? import_iovec+0x74/0xa0 [ 1303.675773][T26199] ___sys_sendmsg+0x21f/0x2a0 [ 1303.675799][T26199] ? __pfx____sys_sendmsg+0x10/0x10 [ 1303.675861][T26199] ? __fget_files+0x2a/0x420 [ 1303.675885][T26199] ? __fget_files+0x3a0/0x420 [ 1303.675922][T26199] __x64_sys_sendmsg+0x19b/0x260 [ 1303.675949][T26199] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1303.675984][T26199] ? __pfx_ksys_write+0x10/0x10 [ 1303.676021][T26199] do_syscall_64+0xec/0xf80 [ 1303.676041][T26199] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1303.676060][T26199] ? trace_irq_disable+0x37/0x100 [ 1303.676085][T26199] ? clear_bhb_loop+0x60/0xb0 [ 1303.676110][T26199] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1303.676130][T26199] RIP: 0033:0x7fc2c998f749 [ 1303.676148][T26199] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1303.676165][T26199] RSP: 002b:00007fc2ca88e038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1303.676187][T26199] RAX: ffffffffffffffda RBX: 00007fc2c9be6090 RCX: 00007fc2c998f749 [ 1303.676203][T26199] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 1303.676216][T26199] RBP: 00007fc2ca88e090 R08: 0000000000000000 R09: 0000000000000000 [ 1303.676229][T26199] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1303.676241][T26199] R13: 00007fc2c9be6128 R14: 00007fc2c9be6090 R15: 00007fffe3730368 [ 1303.676275][T26199] [ 1304.428249][T26213] __nla_validate_parse: 3 callbacks suppressed [ 1304.428267][T26213] netlink: 36 bytes leftover after parsing attributes in process `syz.4.20565'. [ 1304.770351][T26233] netlink: 20 bytes leftover after parsing attributes in process `syz.4.20569'. [ 1304.802702][T26235] netlink: 'syz.1.20571': attribute type 64 has an invalid length. [ 1304.828101][T26235] netlink: 5 bytes leftover after parsing attributes in process `syz.1.20571'. [ 1304.859335][T26235] syzkaller0: entered promiscuous mode [ 1304.864877][T26235] syzkaller0: entered allmulticast mode [ 1305.318173][T26255] netlink: 8 bytes leftover after parsing attributes in process `syz.3.20578'. [ 1305.336631][T26253] speed is unknown, defaulting to 1000 [ 1305.539255][T26260] netlink: 36 bytes leftover after parsing attributes in process `syz.3.20579'. [ 1305.886622][T26274] netlink: 20 bytes leftover after parsing attributes in process `syz.1.20584'. [ 1305.914944][T26279] netlink: 'syz.3.20585': attribute type 1 has an invalid length. [ 1305.976344][T26279] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1305.986835][T26253] wlan0 speed is unknown, defaulting to 1000 [ 1305.998981][T26279] xfrm1: entered allmulticast mode [ 1306.095924][T26288] netlink: 4 bytes leftover after parsing attributes in process `syz.0.20586'. [ 1306.249052][T26295] netlink: 28 bytes leftover after parsing attributes in process `syz.0.20586'. [ 1306.326030][T26302] netlink: 36 bytes leftover after parsing attributes in process `syz.1.20590'. [ 1306.390859][T26304] netlink: 8 bytes leftover after parsing attributes in process `syz.3.20589'. [ 1306.730556][T26316] lo: MTU too low for tipc bearer [ 1306.749830][T26316] tipc: Enabling of bearer rejected, failed to enable media [ 1306.774946][T25370] IPVS: starting estimator thread 0... [ 1306.868786][T26319] IPVS: using max 26 ests per chain, 62400 per kthread [ 1307.202004][T26338] netlink: 'syz.2.20601': attribute type 4 has an invalid length. [ 1307.695455][T26362] bridge0: port 2(bridge_slave_1) entered disabled state [ 1307.702871][T26362] bridge0: port 1(bridge_slave_0) entered disabled state [ 1307.905847][T26372] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1308.306700][T26403] netlink: 'syz.0.20622': attribute type 1 has an invalid length. [ 1308.660234][T26426] netlink: 'syz.4.20630': attribute type 1 has an invalid length. [ 1308.749319][T26426] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1308.768997][T26431] FAULT_INJECTION: forcing a failure. [ 1308.768997][T26431] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1308.797463][T26431] CPU: 1 UID: 0 PID: 26431 Comm: syz.3.20633 Not tainted syzkaller #0 PREEMPT(full) [ 1308.797491][T26431] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1308.797503][T26431] Call Trace: [ 1308.797511][T26431] [ 1308.797526][T26431] dump_stack_lvl+0xe8/0x150 [ 1308.797556][T26431] should_fail_ex+0x414/0x560 [ 1308.797590][T26431] _copy_from_iter+0x1cd/0x1630 [ 1308.797624][T26431] ? __pfx__copy_from_iter+0x10/0x10 [ 1308.797646][T26431] ? __build_skb_around+0x22d/0x3c0 [ 1308.797670][T26431] ? __alloc_skb+0x198/0x3a0 [ 1308.797690][T26431] ? netlink_sendmsg+0x642/0xb30 [ 1308.797712][T26431] ? skb_put+0x11b/0x210 [ 1308.797735][T26431] netlink_sendmsg+0x6b2/0xb30 [ 1308.797770][T26431] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1308.797804][T26431] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1308.797831][T26431] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1308.797849][T26431] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1308.797874][T26431] __sock_sendmsg+0x21c/0x270 [ 1308.797904][T26431] ____sys_sendmsg+0x52d/0x820 [ 1308.797933][T26431] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1308.797969][T26431] ? import_iovec+0x74/0xa0 [ 1308.797996][T26431] ___sys_sendmsg+0x21f/0x2a0 [ 1308.798022][T26431] ? __pfx____sys_sendmsg+0x10/0x10 [ 1308.798042][T26431] ? __lock_acquire+0x6b6/0x2cf0 [ 1308.798068][T26431] ? kstrtouint+0x6e/0xe0 [ 1308.798137][T26431] __sys_sendmmsg+0x227/0x430 [ 1308.798166][T26431] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1308.798187][T26431] ? __mutex_unlock_slowpath+0x1a1/0x730 [ 1308.798235][T26431] ? ksys_write+0x22a/0x250 [ 1308.798258][T26431] ? __pfx_ksys_write+0x10/0x10 [ 1308.798284][T26431] __x64_sys_sendmmsg+0xa0/0xc0 [ 1308.798310][T26431] do_syscall_64+0xec/0xf80 [ 1308.798331][T26431] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1308.798350][T26431] ? trace_irq_disable+0x37/0x100 [ 1308.798375][T26431] ? clear_bhb_loop+0x60/0xb0 [ 1308.798398][T26431] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1308.798415][T26431] RIP: 0033:0x7f7ce898f749 [ 1308.798433][T26431] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1308.798451][T26431] RSP: 002b:00007f7ce9840038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1308.798472][T26431] RAX: ffffffffffffffda RBX: 00007f7ce8be5fa0 RCX: 00007f7ce898f749 [ 1308.798488][T26431] RDX: 04000000000001f2 RSI: 0000200000000000 RDI: 000000000000000c [ 1308.798502][T26431] RBP: 00007f7ce9840090 R08: 0000000000000000 R09: 0000000000000000 [ 1308.798514][T26431] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1308.798525][T26431] R13: 00007f7ce8be6038 R14: 00007f7ce8be5fa0 R15: 00007ffc4e30afe8 [ 1308.798557][T26431] [ 1309.087572][T26428] bond1: (slave veth5): Enslaving as an active interface with a down link [ 1309.113945][T26426] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 1309.121253][T26426] bond1: (slave batadv1): dev_set_mac_address on slave failed! ALB mode requires that the base driver support setting the hw address also when the network device's interface is open [ 1309.383659][T26452] syzkaller1: entered promiscuous mode [ 1309.389438][T26452] syzkaller1: entered allmulticast mode [ 1309.414938][T26450] ip6tnl0: entered promiscuous mode [ 1309.727023][T26477] __nla_validate_parse: 13 callbacks suppressed [ 1309.727045][T26477] netlink: 56 bytes leftover after parsing attributes in process `syz.4.20649'. [ 1309.845800][T26480] netlink: 312 bytes leftover after parsing attributes in process `syz.2.20650'. [ 1309.872154][T26485] netlink: 20 bytes leftover after parsing attributes in process `syz.0.20653'. [ 1310.047936][T26493] netlink: 4 bytes leftover after parsing attributes in process `syz.4.20658'. [ 1310.160052][ T30] audit: type=1800 audit(1768243231.845:10): pid=26502 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.20662" name="memory.events" dev="tmpfs" ino=1683 res=0 errno=0 [ 1310.206274][T26505] netlink: 24 bytes leftover after parsing attributes in process `syz.2.20660'. [ 1310.317307][T26510] syzkaller0: entered promiscuous mode [ 1310.326037][T26510] syzkaller0: entered allmulticast mode [ 1310.335050][T26512] netlink: 'syz.0.20665': attribute type 1 has an invalid length. [ 1310.337539][T26510] tipc: Started in network mode [ 1310.348572][T26510] tipc: Node identity 46fdf587a6b4, cluster identity 4711 [ 1310.356600][T26510] tipc: Enabled bearer , priority 0 [ 1310.415293][T26512] bond6 (unregistering): Released all slaves [ 1310.428230][T26522] netlink: 48 bytes leftover after parsing attributes in process `syz.0.20665'. [ 1310.447142][T26514] netlink: 'syz.4.20666': attribute type 3 has an invalid length. [ 1310.497225][T26519] netlink: 8 bytes leftover after parsing attributes in process `syz.3.20668'. [ 1310.532185][T26509] tipc: Resetting bearer [ 1310.566153][T26530] netlink: 24 bytes leftover after parsing attributes in process `syz.0.20670'. [ 1310.612558][T26531] netlink: 20 bytes leftover after parsing attributes in process `syz.2.20669'. [ 1310.622478][T26534] xt_SECMARK: mode already set to 1 cannot mix with rules for mode 0 [ 1310.659343][T26509] tipc: Disabling bearer [ 1310.689737][T26524] tipc: Enabled bearer , priority 0 [ 1310.745707][T26521] tipc: Disabling bearer [ 1311.445924][T26561] v: renamed from ipvlan1 [ 1311.647971][T26564] speed is unknown, defaulting to 1000 [ 1311.770622][T26578] FAULT_INJECTION: forcing a failure. [ 1311.770622][T26578] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1311.784134][T26578] CPU: 0 UID: 0 PID: 26578 Comm: syz.1.20682 Not tainted syzkaller #0 PREEMPT(full) [ 1311.784162][T26578] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1311.784174][T26578] Call Trace: [ 1311.784182][T26578] [ 1311.784191][T26578] dump_stack_lvl+0xe8/0x150 [ 1311.784221][T26578] should_fail_ex+0x414/0x560 [ 1311.784255][T26578] _copy_from_user+0x2d/0xb0 [ 1311.784280][T26578] get_timespec64+0x8e/0x1a0 [ 1311.784303][T26578] ? __pfx_get_timespec64+0x10/0x10 [ 1311.784335][T26578] __x64_sys_recvmmsg+0x143/0x240 [ 1311.784364][T26578] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 1311.784401][T26578] do_syscall_64+0xec/0xf80 [ 1311.784429][T26578] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1311.784448][T26578] ? trace_irq_disable+0x37/0x100 [ 1311.784473][T26578] ? clear_bhb_loop+0x60/0xb0 [ 1311.784497][T26578] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1311.784516][T26578] RIP: 0033:0x7fb7b918f749 [ 1311.784535][T26578] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1311.784552][T26578] RSP: 002b:00007fb7ba02b038 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 1311.784575][T26578] RAX: ffffffffffffffda RBX: 00007fb7b93e5fa0 RCX: 00007fb7b918f749 [ 1311.784590][T26578] RDX: 04000000000003b4 RSI: 00002000000037c0 RDI: 0000000000000003 [ 1311.784604][T26578] RBP: 00007fb7ba02b090 R08: 0000200000003700 R09: 0000000000000000 [ 1311.784618][T26578] R10: 0000000002040000 R11: 0000000000000246 R12: 0000000000000001 [ 1311.784631][T26578] R13: 00007fb7b93e6038 R14: 00007fb7b93e5fa0 R15: 00007ffd371df488 [ 1311.784665][T26578] [ 1311.904672][T26564] wlan0 speed is unknown, defaulting to 1000 [ 1312.096694][T26580] netlink: 28 bytes leftover after parsing attributes in process `syz.3.20683'. [ 1312.106202][T26589] FAULT_INJECTION: forcing a failure. [ 1312.106202][T26589] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1312.106236][T26589] CPU: 1 UID: 0 PID: 26589 Comm: syz.2.20687 Not tainted syzkaller #0 PREEMPT(full) [ 1312.106260][T26589] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1312.106273][T26589] Call Trace: [ 1312.106282][T26589] [ 1312.106290][T26589] dump_stack_lvl+0xe8/0x150 [ 1312.106320][T26589] should_fail_ex+0x414/0x560 [ 1312.106356][T26589] _copy_from_user+0x2d/0xb0 [ 1312.106382][T26589] ___sys_sendmsg+0x158/0x2a0 [ 1312.106408][T26589] ? __pfx____sys_sendmsg+0x10/0x10 [ 1312.106430][T26589] ? __lock_acquire+0x6b6/0x2cf0 [ 1312.106454][T26589] ? kstrtouint+0x6e/0xe0 [ 1312.106530][T26589] __sys_sendmmsg+0x227/0x430 [ 1312.106558][T26589] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1312.106577][T26589] ? __mutex_unlock_slowpath+0x1a1/0x730 [ 1312.106624][T26589] ? ksys_write+0x22a/0x250 [ 1312.106645][T26589] ? __pfx_ksys_write+0x10/0x10 [ 1312.106670][T26589] __x64_sys_sendmmsg+0xa0/0xc0 [ 1312.106696][T26589] do_syscall_64+0xec/0xf80 [ 1312.106716][T26589] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1312.106735][T26589] ? trace_irq_disable+0x37/0x100 [ 1312.106760][T26589] ? clear_bhb_loop+0x60/0xb0 [ 1312.106784][T26589] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1312.106803][T26589] RIP: 0033:0x7fa72e78f749 [ 1312.106820][T26589] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1312.106838][T26589] RSP: 002b:00007fa72f5a9038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1312.106859][T26589] RAX: ffffffffffffffda RBX: 00007fa72e9e5fa0 RCX: 00007fa72e78f749 [ 1312.106874][T26589] RDX: 04000000000001f2 RSI: 0000200000000000 RDI: 0000000000000003 [ 1312.106888][T26589] RBP: 00007fa72f5a9090 R08: 0000000000000000 R09: 0000000000000000 [ 1312.106899][T26589] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1312.106910][T26589] R13: 00007fa72e9e6038 R14: 00007fa72e9e5fa0 R15: 00007fff7e9d2868 [ 1312.106937][T26589] [ 1312.728851][T26608] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1312.977198][T26618] Cannot find del_set index 49151 as target [ 1313.002624][T26620] xt_connbytes: Forcing CT accounting to be enabled [ 1313.474637][T26636] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 1313.523753][T26636] netlink: 'syz.4.20706': attribute type 10 has an invalid length. [ 1313.609221][T26647] macvtap1: entered allmulticast mode [ 1313.614649][T26647] veth0_macvtap: entered allmulticast mode [ 1313.850061][T26665] netdevsim netdevsim2 netdevsim0: entered promiscuous mode [ 1314.073440][T26679] openvswitch: netlink: IP tunnel dst address not specified [ 1314.212530][T26679] bond0: (slave wlan1): Releasing backup interface [ 1314.595723][T26707] syzkaller1: entered promiscuous mode [ 1314.630324][T26707] syzkaller1: entered allmulticast mode [ 1314.946970][T26722] 8021q: adding VLAN 0 to HW filter on device bond6 [ 1315.044579][T26722] 8021q: adding VLAN 0 to HW filter on device bond7 [ 1315.160991][T26722] 8021q: adding VLAN 0 to HW filter on device bond8 [ 1315.237325][T26750] __nla_validate_parse: 9 callbacks suppressed [ 1315.251439][T26722] 8021q: adding VLAN 0 to HW filter on device bond9 [ 1315.262176][T26750] netlink: 4 bytes leftover after parsing attributes in process `syz.4.20744'. [ 1315.351983][T26722] 8021q: adding VLAN 0 to HW filter on device bond10 [ 1315.502953][T26722] 8021q: adding VLAN 0 to HW filter on device bond11 [ 1315.561844][T26722] 8021q: adding VLAN 0 to HW filter on device bond12 [ 1315.571080][T26765] tipc: Can't bind to reserved service type 2 [ 1315.625870][T26722] 8021q: adding VLAN 0 to HW filter on device bond13 [ 1315.720820][T26722] 8021q: adding VLAN 0 to HW filter on device bond14 [ 1315.848194][T26778] netlink: 40 bytes leftover after parsing attributes in process `syz.0.20748'. [ 1316.067004][T26793] FAULT_INJECTION: forcing a failure. [ 1316.067004][T26793] name failslab, interval 1, probability 0, space 0, times 0 [ 1316.093344][T26791] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 1316.112944][T26793] CPU: 0 UID: 0 PID: 26793 Comm: syz.1.20750 Not tainted syzkaller #0 PREEMPT(full) [ 1316.112974][T26793] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1316.112986][T26793] Call Trace: [ 1316.112995][T26793] [ 1316.113004][T26793] dump_stack_lvl+0xe8/0x150 [ 1316.113034][T26793] should_fail_ex+0x414/0x560 [ 1316.113071][T26793] should_failslab+0xa8/0x100 [ 1316.113096][T26793] kmem_cache_alloc_noprof+0x88/0x710 [ 1316.113124][T26793] ? __netlink_lookup+0xbd/0x8a0 [ 1316.113148][T26793] ? skb_clone+0x212/0x3a0 [ 1316.113175][T26793] skb_clone+0x212/0x3a0 [ 1316.113201][T26793] __netlink_deliver_tap+0x404/0x850 [ 1316.113236][T26793] ? netlink_deliver_tap+0x2e/0x1b0 [ 1316.113262][T26793] netlink_deliver_tap+0x19c/0x1b0 [ 1316.113287][T26793] netlink_unicast+0x7fa/0x9e0 [ 1316.113314][T26793] ? __pfx_netlink_unicast+0x10/0x10 [ 1316.113333][T26793] ? __alloc_skb+0x198/0x3a0 [ 1316.113351][T26793] ? netlink_sendmsg+0x642/0xb30 [ 1316.113371][T26793] ? skb_put+0x11b/0x210 [ 1316.113393][T26793] netlink_sendmsg+0x805/0xb30 [ 1316.113423][T26793] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1316.113448][T26793] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1316.113474][T26793] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1316.113492][T26793] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1316.113514][T26793] __sock_sendmsg+0x21c/0x270 [ 1316.113542][T26793] ____sys_sendmsg+0x52d/0x820 [ 1316.113570][T26793] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1316.113603][T26793] ? import_iovec+0x74/0xa0 [ 1316.113631][T26793] ___sys_sendmsg+0x21f/0x2a0 [ 1316.113654][T26793] ? __pfx____sys_sendmsg+0x10/0x10 [ 1316.113682][T26793] ? kstrtouint+0x6e/0xe0 [ 1316.113731][T26793] ? __fget_files+0x2a/0x420 [ 1316.113752][T26793] ? __fget_files+0x3a0/0x420 [ 1316.113782][T26793] __sys_sendmmsg+0x227/0x430 [ 1316.113810][T26793] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1316.113830][T26793] ? __mutex_unlock_slowpath+0x1a1/0x730 [ 1316.113884][T26793] ? ksys_write+0x22a/0x250 [ 1316.113905][T26793] ? __pfx_ksys_write+0x10/0x10 [ 1316.113930][T26793] __x64_sys_sendmmsg+0xa0/0xc0 [ 1316.113954][T26793] do_syscall_64+0xec/0xf80 [ 1316.113973][T26793] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1316.113992][T26793] ? trace_irq_disable+0x37/0x100 [ 1316.114018][T26793] ? clear_bhb_loop+0x60/0xb0 [ 1316.114039][T26793] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1316.114058][T26793] RIP: 0033:0x7fb7b918f749 [ 1316.114075][T26793] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1316.114092][T26793] RSP: 002b:00007fb7ba02b038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1316.114112][T26793] RAX: ffffffffffffffda RBX: 00007fb7b93e5fa0 RCX: 00007fb7b918f749 [ 1316.114126][T26793] RDX: 04000000000001f2 RSI: 0000200000000000 RDI: 0000000000000003 [ 1316.114138][T26793] RBP: 00007fb7ba02b090 R08: 0000000000000000 R09: 0000000000000000 [ 1316.114148][T26793] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1316.114159][T26793] R13: 00007fb7b93e6038 R14: 00007fb7b93e5fa0 R15: 00007ffd371df488 [ 1316.114189][T26793] [ 1316.437009][T26791] netlink: 'syz.4.20751': attribute type 10 has an invalid length. [ 1316.498571][T26802] netlink: zone id is out of range [ 1316.504416][T26802] netlink: zone id is out of range [ 1316.510211][T26802] netlink: zone id is out of range [ 1316.515421][T26802] netlink: get zone limit has 4 unknown bytes [ 1316.659209][T26809] netlink: 12 bytes leftover after parsing attributes in process `syz.3.20757'. [ 1316.724620][T26791] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 1316.771765][T26808] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1316.799015][T26820] netlink: 24 bytes leftover after parsing attributes in process `syz.1.20758'. [ 1316.841560][T26821] 8021q: VLANs not supported on vcan0 [ 1317.160161][T26831] netlink: 8 bytes leftover after parsing attributes in process `syz.1.20764'. [ 1317.207829][T26833] syzkaller1: entered promiscuous mode [ 1317.219023][T26833] syzkaller1: entered allmulticast mode [ 1317.544059][T26863] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1317.563483][T26864] batadv_slave_0: entered promiscuous mode [ 1317.565588][T26863] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1317.599915][T26864] netlink: 'syz.4.20771': attribute type 1 has an invalid length. [ 1317.612170][T26864] netlink: 224 bytes leftover after parsing attributes in process `syz.4.20771'. [ 1317.634891][T26866] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1317.646434][T26864] netlink: 'syz.4.20771': attribute type 16 has an invalid length. [ 1317.654737][T26864] netlink: 8 bytes leftover after parsing attributes in process `syz.4.20771'. [ 1317.681116][T20093] Bluetooth: hci5: command 0x0406 tx timeout [ 1317.688322][T26860] batadv_slave_0: left promiscuous mode [ 1317.688474][T26868] xt_hashlimit: invalid rate [ 1317.720757][T26868] netdevsim netdevsim2: Direct firmware load for r failed with error -2 [ 1317.743304][T26868] netdevsim netdevsim2: Falling back to sysfs fallback for: r [ 1317.754268][T26866] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1317.794608][T26863] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1317.810504][T26863] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1317.863025][T26878] netlink: 12 bytes leftover after parsing attributes in process `syz.0.20777'. [ 1317.893331][T26866] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1318.178470][T26894] syzkaller1: entered promiscuous mode [ 1318.184353][T26894] syzkaller1: entered allmulticast mode [ 1318.730694][T26921] speed is unknown, defaulting to 1000 [ 1318.933443][T26921] wlan0 speed is unknown, defaulting to 1000 [ 1318.936616][T26930] netlink: 'syz.4.20793': attribute type 10 has an invalid length. [ 1319.079586][T26935] netlink: 8 bytes leftover after parsing attributes in process `syz.1.20796'. [ 1319.185606][T26930] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 1319.193169][T26944] netlink: 8 bytes leftover after parsing attributes in process `syz.1.20800'. [ 1319.208328][T26944] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1319.417880][T26945] syzkaller1: entered promiscuous mode [ 1319.423719][T26952] netlink: 'syz.1.20802': attribute type 1 has an invalid length. [ 1319.443608][T26945] syzkaller1: entered allmulticast mode [ 1319.553957][T26952] syz_tun: entered allmulticast mode [ 1319.565168][T26950] syz_tun: left allmulticast mode [ 1319.873860][T26981] netlink: 'syz.2.20812': attribute type 5 has an invalid length. [ 1319.890484][T26981] geneve3: entered promiscuous mode [ 1319.895736][T26981] geneve3: entered allmulticast mode [ 1319.939457][ T6629] netdevsim netdevsim2 netdevsim0: set [1, 1] type 2 family 0 port 256 - 0 [ 1319.958067][ T6629] netdevsim netdevsim2 netdevsim1: set [1, 1] type 2 family 0 port 256 - 0 [ 1319.966770][ T6629] netdevsim netdevsim2 netdevsim2: set [1, 1] type 2 family 0 port 256 - 0 [ 1320.006516][T26980] speed is unknown, defaulting to 1000 [ 1320.018307][ T6629] netdevsim netdevsim2 netdevsim3: set [1, 1] type 2 family 0 port 256 - 0 [ 1320.039208][T26983] tipc: Enabling of bearer rejected, failed to enable media [ 1320.278643][T26997] bond3: entered promiscuous mode [ 1320.285395][T26997] bond3: entered allmulticast mode [ 1320.292562][T26997] 8021q: adding VLAN 0 to HW filter on device bond3 [ 1320.432868][T26980] wlan0 speed is unknown, defaulting to 1000 [ 1320.439616][T27011] __nla_validate_parse: 7 callbacks suppressed [ 1320.439635][T27011] netlink: 8 bytes leftover after parsing attributes in process `syz.4.20823'. [ 1320.620117][T27018] IPVS: length: 24 != 179400887064 [ 1320.760274][T27028] netlink: 'syz.1.20828': attribute type 12 has an invalid length. [ 1320.768783][T27028] netlink: 'syz.1.20828': attribute type 29 has an invalid length. [ 1320.776946][T27028] netlink: 148 bytes leftover after parsing attributes in process `syz.1.20828'. [ 1320.788728][T27020] smc: net device team0 applied user defined pnetid SYZ2 [ 1320.790996][T27031] netlink: 8 bytes leftover after parsing attributes in process `syz.0.20826'. [ 1321.115625][T27043] netlink: 12 bytes leftover after parsing attributes in process `syz.3.20834'. [ 1321.186282][T27043] netlink: 12 bytes leftover after parsing attributes in process `syz.3.20834'. [ 1321.232244][T27046] syzkaller0: entered promiscuous mode [ 1321.238326][T27046] syzkaller0: entered allmulticast mode [ 1321.379286][T27055] speed is unknown, defaulting to 1000 [ 1321.649450][T27069] netlink: 8 bytes leftover after parsing attributes in process `syz.2.20842'. [ 1321.670185][T27055] wlan0 speed is unknown, defaulting to 1000 [ 1322.207831][ T3036] Bluetooth: hci4: link tx timeout [ 1322.213728][ T3036] Bluetooth: hci4: killing stalled connection 10:aa:aa:aa:aa:aa [ 1322.224437][ T3036] Bluetooth: hci4: link tx timeout [ 1322.230534][ T3036] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 1322.319702][T27092] FAULT_INJECTION: forcing a failure. [ 1322.319702][T27092] name failslab, interval 1, probability 0, space 0, times 0 [ 1322.411653][T27092] CPU: 0 UID: 0 PID: 27092 Comm: syz.2.20849 Not tainted syzkaller #0 PREEMPT(full) [ 1322.411682][T27092] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1322.411695][T27092] Call Trace: [ 1322.411704][T27092] [ 1322.411713][T27092] dump_stack_lvl+0xe8/0x150 [ 1322.411743][T27092] should_fail_ex+0x414/0x560 [ 1322.411779][T27092] should_failslab+0xa8/0x100 [ 1322.411802][T27092] __kmalloc_noprof+0xdf/0x800 [ 1322.411820][T27092] ? nft_set_elem_init+0xa8/0x7e0 [ 1322.411846][T27092] nft_set_elem_init+0xa8/0x7e0 [ 1322.411875][T27092] nf_tables_newsetelem+0x2117/0x4050 [ 1322.411928][T27092] ? __pfx_nf_tables_newsetelem+0x10/0x10 [ 1322.411957][T27092] ? nla_validate_array+0xfc/0x260 [ 1322.412006][T27092] ? __pfx___nla_validate_parse+0x10/0x10 [ 1322.412032][T27092] ? __pfx_nf_tables_newset+0x10/0x10 [ 1322.412064][T27092] ? nfnl_pernet+0x23/0x240 [ 1322.412084][T27092] ? nfnl_pernet+0x23/0x240 [ 1322.412114][T27092] ? __nla_parse+0x40/0x60 [ 1322.412140][T27092] nfnetlink_rcv+0x11d9/0x2590 [ 1322.412194][T27092] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 1322.412230][T27092] ? ref_tracker_free+0x63a/0x7d0 [ 1322.412283][T27092] ? __netlink_deliver_tap+0x807/0x850 [ 1322.412307][T27092] ? netlink_deliver_tap+0x2e/0x1b0 [ 1322.412347][T27092] netlink_unicast+0x82f/0x9e0 [ 1322.412376][T27092] ? __pfx_netlink_unicast+0x10/0x10 [ 1322.412397][T27092] ? __alloc_skb+0x198/0x3a0 [ 1322.412417][T27092] ? netlink_sendmsg+0x642/0xb30 [ 1322.412437][T27092] ? skb_put+0x11b/0x210 [ 1322.412461][T27092] netlink_sendmsg+0x805/0xb30 [ 1322.412493][T27092] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1322.412529][T27092] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1322.412557][T27092] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1322.412577][T27092] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1322.412602][T27092] __sock_sendmsg+0x21c/0x270 [ 1322.412631][T27092] ____sys_sendmsg+0x505/0x820 [ 1322.412664][T27092] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1322.412696][T27092] ? import_iovec+0x74/0xa0 [ 1322.412722][T27092] ___sys_sendmsg+0x21f/0x2a0 [ 1322.412747][T27092] ? __pfx____sys_sendmsg+0x10/0x10 [ 1322.412807][T27092] ? __fget_files+0x2a/0x420 [ 1322.412829][T27092] ? __fget_files+0x3a0/0x420 [ 1322.412860][T27092] __x64_sys_sendmsg+0x19b/0x260 [ 1322.412884][T27092] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1322.412917][T27092] ? __pfx_ksys_write+0x10/0x10 [ 1322.412949][T27092] do_syscall_64+0xec/0xf80 [ 1322.412970][T27092] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1322.412989][T27092] ? trace_irq_disable+0x37/0x100 [ 1322.413013][T27092] ? clear_bhb_loop+0x60/0xb0 [ 1322.413036][T27092] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1322.413054][T27092] RIP: 0033:0x7fa72e78f749 [ 1322.413071][T27092] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1322.413089][T27092] RSP: 002b:00007fa72f5a9038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1322.413110][T27092] RAX: ffffffffffffffda RBX: 00007fa72e9e5fa0 RCX: 00007fa72e78f749 [ 1322.413123][T27092] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 1322.413135][T27092] RBP: 00007fa72f5a9090 R08: 0000000000000000 R09: 0000000000000000 [ 1322.413148][T27092] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1322.413159][T27092] R13: 00007fa72e9e6038 R14: 00007fa72e9e5fa0 R15: 00007fff7e9d2868 [ 1322.413192][T27092] [ 1322.890152][T27105] netlink: 8 bytes leftover after parsing attributes in process `syz.3.20854'. [ 1322.984726][T27108] speed is unknown, defaulting to 1000 [ 1323.354265][T27108] wlan0 speed is unknown, defaulting to 1000 [ 1323.380658][T27134] FAULT_INJECTION: forcing a failure. [ 1323.380658][T27134] name failslab, interval 1, probability 0, space 0, times 0 [ 1323.411732][T27134] CPU: 0 UID: 0 PID: 27134 Comm: syz.1.20864 Not tainted syzkaller #0 PREEMPT(full) [ 1323.411762][T27134] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1323.411775][T27134] Call Trace: [ 1323.411783][T27134] [ 1323.411793][T27134] dump_stack_lvl+0xe8/0x150 [ 1323.411824][T27134] should_fail_ex+0x414/0x560 [ 1323.411861][T27134] should_failslab+0xa8/0x100 [ 1323.411886][T27134] kmem_cache_alloc_noprof+0x88/0x710 [ 1323.411914][T27134] ? __netlink_lookup+0xbd/0x8a0 [ 1323.411941][T27134] ? skb_clone+0x212/0x3a0 [ 1323.411970][T27134] skb_clone+0x212/0x3a0 [ 1323.411998][T27134] __netlink_deliver_tap+0x404/0x850 [ 1323.412034][T27134] ? netlink_deliver_tap+0x2e/0x1b0 [ 1323.412060][T27134] netlink_deliver_tap+0x19c/0x1b0 [ 1323.412086][T27134] netlink_unicast+0x7fa/0x9e0 [ 1323.412117][T27134] ? __pfx_netlink_unicast+0x10/0x10 [ 1323.412137][T27134] ? __alloc_skb+0x198/0x3a0 [ 1323.412156][T27134] ? netlink_sendmsg+0x642/0xb30 [ 1323.412178][T27134] ? skb_put+0x11b/0x210 [ 1323.412203][T27134] netlink_sendmsg+0x805/0xb30 [ 1323.412238][T27134] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1323.412267][T27134] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1323.412294][T27134] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1323.412313][T27134] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1323.412340][T27134] __sock_sendmsg+0x21c/0x270 [ 1323.412371][T27134] ____sys_sendmsg+0x52d/0x820 [ 1323.412407][T27134] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1323.412440][T27134] ? import_iovec+0x74/0xa0 [ 1323.412469][T27134] ___sys_sendmsg+0x21f/0x2a0 [ 1323.412494][T27134] ? __pfx____sys_sendmsg+0x10/0x10 [ 1323.412524][T27134] ? kstrtouint+0x6e/0xe0 [ 1323.412582][T27134] ? __fget_files+0x2a/0x420 [ 1323.412607][T27134] ? __fget_files+0x3a0/0x420 [ 1323.412641][T27134] __sys_sendmmsg+0x227/0x430 [ 1323.412671][T27134] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1323.412697][T27134] ? __mutex_unlock_slowpath+0x1a1/0x730 [ 1323.412747][T27134] ? ksys_write+0x22a/0x250 [ 1323.412769][T27134] ? __pfx_ksys_write+0x10/0x10 [ 1323.412796][T27134] __x64_sys_sendmmsg+0xa0/0xc0 [ 1323.412822][T27134] do_syscall_64+0xec/0xf80 [ 1323.412842][T27134] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1323.412860][T27134] ? trace_irq_disable+0x37/0x100 [ 1323.412883][T27134] ? clear_bhb_loop+0x60/0xb0 [ 1323.412906][T27134] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1323.412923][T27134] RIP: 0033:0x7fb7b918f749 [ 1323.412941][T27134] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1323.412959][T27134] RSP: 002b:00007fb7ba02b038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1323.412980][T27134] RAX: ffffffffffffffda RBX: 00007fb7b93e5fa0 RCX: 00007fb7b918f749 [ 1323.412996][T27134] RDX: 04000000000001f2 RSI: 0000200000000000 RDI: 0000000000000006 [ 1323.413011][T27134] RBP: 00007fb7ba02b090 R08: 0000000000000000 R09: 0000000000000000 [ 1323.413023][T27134] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1323.413034][T27134] R13: 00007fb7b93e6038 R14: 00007fb7b93e5fa0 R15: 00007ffd371df488 [ 1323.413067][T27134] [ 1323.874174][T27142] team_slave_0: entered promiscuous mode [ 1323.880386][T27142] team_slave_1: entered promiscuous mode [ 1323.930457][T27142] 8021q: adding VLAN 0 to HW filter on device macvtap1 [ 1323.969691][T27142] team0: Device macvtap1 is already an upper device of the team interface [ 1324.005310][T27152] netlink: 8 bytes leftover after parsing attributes in process `syz.3.20870'. [ 1324.023600][T27142] team_slave_0: left promiscuous mode [ 1324.029123][T27142] team_slave_1: left promiscuous mode [ 1324.084828][T27149] speed is unknown, defaulting to 1000 [ 1324.309971][ T3036] Bluetooth: hci4: command 0x0405 tx timeout [ 1324.441966][T27165] netlink: 'syz.0.20874': attribute type 9 has an invalid length. [ 1324.481622][T27165] netlink: 'syz.0.20874': attribute type 7 has an invalid length. [ 1324.510816][T27165] netlink: 'syz.0.20874': attribute type 8 has an invalid length. [ 1324.671951][T27174] syzkaller0: entered promiscuous mode [ 1324.678242][T27174] syzkaller0: entered allmulticast mode [ 1326.398590][ T3036] Bluetooth: hci4: command 0x0405 tx timeout [ 1326.712452][T27149] wlan0 speed is unknown, defaulting to 1000 [ 1326.870864][T27205] netlink: 8 bytes leftover after parsing attributes in process `syz.2.20885'. [ 1327.334041][T27211] netdevsim netdevsim3 netdevsim0: entered promiscuous mode [ 1327.355862][T27211] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 1327.863862][T27251] SET target dimension over the limit! [ 1327.960341][T27255] netlink: 8 bytes leftover after parsing attributes in process `syz.4.20900'. [ 1327.998168][T27261] netlink: 12 bytes leftover after parsing attributes in process `syz.3.20901'. [ 1328.010734][T27261] netlink: 4 bytes leftover after parsing attributes in process `syz.3.20901'. [ 1328.034218][T27261] netlink: 12 bytes leftover after parsing attributes in process `syz.3.20901'. [ 1328.044862][T27261] netlink: 4 bytes leftover after parsing attributes in process `syz.3.20901'. [ 1328.085001][T27264] netlink: 8 bytes leftover after parsing attributes in process `syz.1.20904'. [ 1328.293485][T27280] netlink: 4 bytes leftover after parsing attributes in process `syz.3.20906'. [ 1328.358426][T27280] netlink: 8 bytes leftover after parsing attributes in process `syz.3.20906'. [ 1328.481929][T27288] netlink: 'syz.1.20908': attribute type 3 has an invalid length. [ 1328.611619][T27292] bond0: entered promiscuous mode [ 1328.633322][T27292] bond_slave_0: entered promiscuous mode [ 1328.652936][T27292] bond_slave_1: entered promiscuous mode [ 1328.671755][T27301] FAULT_INJECTION: forcing a failure. [ 1328.671755][T27301] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1328.682523][T27303] syzkaller0: entered promiscuous mode [ 1328.708349][T27303] syzkaller0: entered allmulticast mode [ 1328.712684][T27301] CPU: 0 UID: 0 PID: 27301 Comm: syz.1.20913 Not tainted syzkaller #0 PREEMPT(full) [ 1328.712712][T27301] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1328.712724][T27301] Call Trace: [ 1328.712732][T27301] [ 1328.712740][T27301] dump_stack_lvl+0xe8/0x150 [ 1328.712771][T27301] should_fail_ex+0x414/0x560 [ 1328.712804][T27301] _copy_from_user+0x2d/0xb0 [ 1328.712829][T27301] ___sys_recvmsg+0x12e/0x510 [ 1328.712853][T27301] ? ktime_get_ts64+0xa9/0x3d0 [ 1328.712884][T27301] ? __pfx____sys_recvmsg+0x10/0x10 [ 1328.712913][T27301] ? __fget_files+0x2a/0x420 [ 1328.712954][T27301] ? __fget_files+0x3a0/0x420 [ 1328.712986][T27301] do_recvmmsg+0x307/0x770 [ 1328.713018][T27301] ? __pfx_do_recvmmsg+0x10/0x10 [ 1328.713052][T27301] ? _copy_from_user+0x94/0xb0 [ 1328.713090][T27301] __x64_sys_recvmmsg+0x1af/0x240 [ 1328.713122][T27301] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 1328.713155][T27301] do_syscall_64+0xec/0xf80 [ 1328.713175][T27301] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1328.713193][T27301] ? trace_irq_disable+0x37/0x100 [ 1328.713217][T27301] ? clear_bhb_loop+0x60/0xb0 [ 1328.713237][T27301] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1328.713253][T27301] RIP: 0033:0x7fb7b918f749 [ 1328.713270][T27301] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1328.713287][T27301] RSP: 002b:00007fb7ba02b038 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 1328.713309][T27301] RAX: ffffffffffffffda RBX: 00007fb7b93e5fa0 RCX: 00007fb7b918f749 [ 1328.713323][T27301] RDX: 04000000000003b4 RSI: 00002000000037c0 RDI: 0000000000000003 [ 1328.713337][T27301] RBP: 00007fb7ba02b090 R08: 0000200000003700 R09: 0000000000000000 [ 1328.713350][T27301] R10: 0000000002040000 R11: 0000000000000246 R12: 0000000000000001 [ 1328.713362][T27301] R13: 00007fb7b93e6038 R14: 00007fb7b93e5fa0 R15: 00007ffd371df488 [ 1328.713395][T27301] [ 1329.030474][T27314] IPVS: set_ctl: invalid protocol: 94 172.20.20.170:20004 [ 1329.042873][T27316] netlink: 64 bytes leftover after parsing attributes in process `syz.1.20919'. [ 1329.406729][T27338] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1329.433560][T27345] netlink: 'syz.1.20928': attribute type 83 has an invalid length. [ 1329.808045][T27368] syzkaller0: entered promiscuous mode [ 1329.817091][T27368] syzkaller0: entered allmulticast mode [ 1329.900236][T27376] IPv6: NLM_F_CREATE should be specified when creating new route [ 1329.909311][T27376] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1329.916573][T27376] IPv6: NLM_F_CREATE should be set when creating new route [ 1330.076730][T27377] syzkaller0: entered promiscuous mode [ 1330.082534][T27377] syzkaller0: entered allmulticast mode [ 1330.621295][T27406] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1332.319335][T10941] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1332.357667][T10941] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1332.366465][T10941] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1332.396521][T10941] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1332.538679][T27423] __nla_validate_parse: 4 callbacks suppressed [ 1332.538696][T27423] netlink: 64 bytes leftover after parsing attributes in process `syz.3.20957'. [ 1332.542948][T27429] netlink: 7064 bytes leftover after parsing attributes in process `syz.4.20958'. [ 1332.608991][T27433] netlink: 104 bytes leftover after parsing attributes in process `syz.4.20958'. [ 1332.629821][T27432] syzkaller1: entered promiscuous mode [ 1332.635330][T27432] syzkaller1: entered allmulticast mode [ 1332.646934][T27429] openvswitch: netlink: Missing key (keys=40, expected=2000) [ 1332.756091][T27440] netlink: 'syz.3.20961': attribute type 1 has an invalid length. [ 1332.893703][T27440] 8021q: adding VLAN 0 to HW filter on device bond3 [ 1332.935723][T27443] bond3: (slave geneve2): making interface the new active one [ 1332.945658][T27443] bond3: (slave geneve2): Enslaving as an active interface with an up link [ 1333.024170][T10941] netdevsim netdevsim3 netdevsim0: set [1, 1] type 2 family 0 port 20000 - 0 [ 1333.035603][T27459] syz_tun: entered allmulticast mode [ 1333.043415][T10941] netdevsim netdevsim3 netdevsim1: set [1, 1] type 2 family 0 port 20000 - 0 [ 1333.074716][T10941] netdevsim netdevsim3 netdevsim2: set [1, 1] type 2 family 0 port 20000 - 0 [ 1333.104643][T10941] netdevsim netdevsim3 netdevsim3: set [1, 1] type 2 family 0 port 20000 - 0 [ 1333.135742][T27450] syz_tun: left allmulticast mode [ 1333.137886][T27466] netlink: 'syz.0.20970': attribute type 1 has an invalid length. [ 1333.190733][T27466] netlink: 16 bytes leftover after parsing attributes in process `syz.0.20970'. [ 1333.201453][T27466] netlink: 4 bytes leftover after parsing attributes in process `syz.0.20970'. [ 1333.245122][T27471] netlink: 44 bytes leftover after parsing attributes in process `syz.4.20973'. [ 1333.317337][T27475] FAULT_INJECTION: forcing a failure. [ 1333.317337][T27475] name failslab, interval 1, probability 0, space 0, times 0 [ 1333.320224][T27474] syzkaller1: entered promiscuous mode [ 1333.339408][T27475] CPU: 1 UID: 0 PID: 27475 Comm: syz.2.20974 Not tainted syzkaller #0 PREEMPT(full) [ 1333.339435][T27475] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1333.339446][T27475] Call Trace: [ 1333.339454][T27475] [ 1333.339463][T27475] dump_stack_lvl+0xe8/0x150 [ 1333.339494][T27475] should_fail_ex+0x414/0x560 [ 1333.339532][T27475] should_failslab+0xa8/0x100 [ 1333.339559][T27475] kmem_cache_alloc_noprof+0x88/0x710 [ 1333.339590][T27475] ? skb_clone+0x212/0x3a0 [ 1333.339620][T27475] skb_clone+0x212/0x3a0 [ 1333.339649][T27475] __netlink_deliver_tap+0x404/0x850 [ 1333.339689][T27475] ? netlink_deliver_tap+0x2e/0x1b0 [ 1333.339716][T27475] netlink_deliver_tap+0x19c/0x1b0 [ 1333.339744][T27475] netlink_sendskb+0x68/0x140 [ 1333.339770][T27475] netlink_unicast+0x397/0x9e0 [ 1333.339790][T27475] ? __asan_memcpy+0x40/0x70 [ 1333.339828][T27475] ? __pfx_netlink_unicast+0x10/0x10 [ 1333.339863][T27475] netlink_rcv_skb+0x28c/0x470 [ 1333.339889][T27475] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1333.339921][T27475] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1333.339944][T27475] ? genl_rcv+0x19/0x40 [ 1333.339991][T27475] ? down_read+0x274/0x2e0 [ 1333.340012][T27475] ? genl_rcv+0xd/0x40 [ 1333.340044][T27475] genl_rcv+0x28/0x40 [ 1333.340071][T27475] netlink_unicast+0x82f/0x9e0 [ 1333.340103][T27475] ? __pfx_netlink_unicast+0x10/0x10 [ 1333.340124][T27475] ? __alloc_skb+0x198/0x3a0 [ 1333.340145][T27475] ? netlink_sendmsg+0x642/0xb30 [ 1333.340169][T27475] ? skb_put+0x11b/0x210 [ 1333.340195][T27475] netlink_sendmsg+0x805/0xb30 [ 1333.340231][T27475] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1333.340260][T27475] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1333.340288][T27475] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1333.340307][T27475] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1333.340334][T27475] __sock_sendmsg+0x21c/0x270 [ 1333.340372][T27475] __sys_sendto+0x3bd/0x520 [ 1333.340397][T27475] ? __pfx___sys_sendto+0x10/0x10 [ 1333.340448][T27475] ? exc_page_fault+0x71/0xd0 [ 1333.340472][T27475] ? do_user_addr_fault+0xc85/0x1380 [ 1333.340497][T27475] __x64_sys_sendto+0xde/0x100 [ 1333.340523][T27475] do_syscall_64+0xec/0xf80 [ 1333.340544][T27475] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1333.340563][T27475] ? trace_irq_disable+0x37/0x100 [ 1333.340588][T27475] ? clear_bhb_loop+0x60/0xb0 [ 1333.340614][T27475] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1333.340633][T27475] RIP: 0033:0x7fa72e7915dc [ 1333.340653][T27475] Code: 2a 5f 02 00 44 8b 4c 24 2c 4c 8b 44 24 20 89 c5 44 8b 54 24 28 48 8b 54 24 18 b8 2c 00 00 00 48 8b 74 24 10 8b 7c 24 08 0f 05 <48> 3d 00 f0 ff ff 77 34 89 ef 48 89 44 24 08 e8 70 5f 02 00 48 8b [ 1333.340671][T27475] RSP: 002b:00007fa72f5a7ec0 EFLAGS: 00000293 ORIG_RAX: 000000000000002c [ 1333.340693][T27475] RAX: ffffffffffffffda RBX: 00007fa72f5a7fc0 RCX: 00007fa72e7915dc [ 1333.340709][T27475] RDX: 0000000000000020 RSI: 00007fa72f5a8010 RDI: 0000000000000006 [ 1333.340722][T27475] RBP: 0000000000000000 R08: 00007fa72f5a7f14 R09: 000000000000000c [ 1333.340735][T27475] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000006 [ 1333.340748][T27475] R13: 00007fa72f5a7f68 R14: 00007fa72f5a8010 R15: 0000000000000000 [ 1333.340783][T27475] [ 1333.655871][T27474] syzkaller1: entered allmulticast mode [ 1334.004062][T27504] netlink: 'syz.2.20982': attribute type 1 has an invalid length. [ 1334.055322][T27504] 8021q: adding VLAN 0 to HW filter on device bond4 [ 1334.068536][T27500] netlink: 152 bytes leftover after parsing attributes in process `syz.2.20982'. [ 1334.109570][T27512] netlink: 'syz.4.20985': attribute type 1 has an invalid length. [ 1334.138435][T27512] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1334.146561][T27512] FAULT_INJECTION: forcing a failure. [ 1334.146561][T27512] name failslab, interval 1, probability 0, space 0, times 0 [ 1334.170720][T27512] CPU: 1 UID: 0 PID: 27512 Comm: syz.4.20985 Not tainted syzkaller #0 PREEMPT(full) [ 1334.170750][T27512] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1334.170763][T27512] Call Trace: [ 1334.170770][T27512] [ 1334.170779][T27512] dump_stack_lvl+0xe8/0x150 [ 1334.170809][T27512] should_fail_ex+0x414/0x560 [ 1334.170841][T27512] should_failslab+0xa8/0x100 [ 1334.170864][T27512] __kmalloc_cache_noprof+0x84/0x700 [ 1334.170883][T27512] ? alloc_netdev_mqs+0xbf8/0x11b0 [ 1334.170913][T27512] alloc_netdev_mqs+0xbf8/0x11b0 [ 1334.170941][T27512] rtnl_create_link+0x31f/0xcf0 [ 1334.170973][T27512] rtnl_newlink_create+0x25c/0xb00 [ 1334.171004][T27512] ? __pfx_rtnl_newlink_create+0x10/0x10 [ 1334.171039][T27512] ? __pfx___mutex_lock+0x10/0x10 [ 1334.171071][T27512] ? ns_capable+0x8a/0xf0 [ 1334.171092][T27512] rtnl_newlink+0x16e7/0x1c90 [ 1334.171125][T27512] ? __pfx_rtnl_newlink+0x10/0x10 [ 1334.171143][T27512] ? do_syscall_64+0xec/0xf80 [ 1334.171159][T27512] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1334.171210][T27512] ? kasan_quarantine_put+0xbb/0x1f0 [ 1334.171228][T27512] ? lockdep_hardirqs_on+0x7b/0x110 [ 1334.171251][T27512] ? kmem_cache_free+0x197/0x620 [ 1334.171269][T27512] ? nlmon_xmit+0xb0/0x100 [ 1334.171303][T27512] ? __lock_acquire+0x6b6/0x2cf0 [ 1334.171331][T27512] ? __local_bh_enable_ip+0xd0/0x130 [ 1334.171351][T27512] ? lockdep_hardirqs_on+0x7b/0x110 [ 1334.171369][T27512] ? __dev_queue_xmit+0x289/0x31c0 [ 1334.171391][T27512] ? __local_bh_enable_ip+0xd0/0x130 [ 1334.171407][T27512] ? __dev_queue_xmit+0x289/0x31c0 [ 1334.171436][T27512] ? rtnetlink_rcv_msg+0x1ab/0xb70 [ 1334.171470][T27512] ? __pfx_rtnl_newlink+0x10/0x10 [ 1334.171489][T27512] rtnetlink_rcv_msg+0x7cf/0xb70 [ 1334.171512][T27512] ? rtnetlink_rcv_msg+0x1ab/0xb70 [ 1334.171530][T27512] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1334.171547][T27512] ? ref_tracker_free+0x63a/0x7d0 [ 1334.171567][T27512] ? __asan_memcpy+0x40/0x70 [ 1334.171593][T27512] ? __pfx_ref_tracker_free+0x10/0x10 [ 1334.171624][T27512] netlink_rcv_skb+0x208/0x470 [ 1334.171649][T27512] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1334.171670][T27512] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1334.171706][T27512] ? netlink_deliver_tap+0x2e/0x1b0 [ 1334.171739][T27512] netlink_unicast+0x82f/0x9e0 [ 1334.171769][T27512] ? __pfx_netlink_unicast+0x10/0x10 [ 1334.171788][T27512] ? __alloc_skb+0x198/0x3a0 [ 1334.171807][T27512] ? netlink_sendmsg+0x642/0xb30 [ 1334.171827][T27512] ? skb_put+0x11b/0x210 [ 1334.171851][T27512] netlink_sendmsg+0x805/0xb30 [ 1334.171886][T27512] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1334.171915][T27512] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1334.171942][T27512] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1334.171960][T27512] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1334.171984][T27512] __sock_sendmsg+0x21c/0x270 [ 1334.172024][T27512] ____sys_sendmsg+0x505/0x820 [ 1334.172051][T27512] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1334.172082][T27512] ? import_iovec+0x74/0xa0 [ 1334.172109][T27512] ___sys_sendmsg+0x21f/0x2a0 [ 1334.172134][T27512] ? __pfx____sys_sendmsg+0x10/0x10 [ 1334.172196][T27512] ? __fget_files+0x2a/0x420 [ 1334.172219][T27512] ? __fget_files+0x3a0/0x420 [ 1334.172253][T27512] __x64_sys_sendmsg+0x19b/0x260 [ 1334.172278][T27512] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1334.172309][T27512] ? __pfx_ksys_write+0x10/0x10 [ 1334.172340][T27512] do_syscall_64+0xec/0xf80 [ 1334.172357][T27512] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1334.172374][T27512] ? trace_irq_disable+0x37/0x100 [ 1334.172396][T27512] ? clear_bhb_loop+0x60/0xb0 [ 1334.172418][T27512] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1334.172436][T27512] RIP: 0033:0x7f824eb8f749 [ 1334.172454][T27512] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1334.172472][T27512] RSP: 002b:00007f824fa6a038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1334.172492][T27512] RAX: ffffffffffffffda RBX: 00007f824ede5fa0 RCX: 00007f824eb8f749 [ 1334.172508][T27512] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 1334.172520][T27512] RBP: 00007f824fa6a090 R08: 0000000000000000 R09: 0000000000000000 [ 1334.172533][T27512] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1334.172545][T27512] R13: 00007f824ede6038 R14: 00007f824ede5fa0 R15: 00007ffdef634ce8 [ 1334.172577][T27512] [ 1334.723739][T27517] syzkaller1: entered promiscuous mode [ 1334.729916][T27517] syzkaller1: entered allmulticast mode [ 1334.924685][T27530] netlink: 8 bytes leftover after parsing attributes in process `syz.1.20991'. [ 1335.071234][T27523] FAULT_INJECTION: forcing a failure. [ 1335.071234][T27523] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1335.086786][T27523] CPU: 0 UID: 0 PID: 27523 Comm: syz.3.20987 Not tainted syzkaller #0 PREEMPT(full) [ 1335.086816][T27523] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1335.086828][T27523] Call Trace: [ 1335.086836][T27523] [ 1335.086845][T27523] dump_stack_lvl+0xe8/0x150 [ 1335.086874][T27523] should_fail_ex+0x414/0x560 [ 1335.086906][T27523] _copy_from_iter+0x1cd/0x1630 [ 1335.086935][T27523] ? __pfx__copy_from_iter+0x10/0x10 [ 1335.086954][T27523] ? __build_skb_around+0x22d/0x3c0 [ 1335.086974][T27523] ? __alloc_skb+0x198/0x3a0 [ 1335.086990][T27523] ? netlink_sendmsg+0x642/0xb30 [ 1335.087060][T27523] ? skb_put+0x11b/0x210 [ 1335.087080][T27523] netlink_sendmsg+0x6b2/0xb30 [ 1335.087108][T27523] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1335.087131][T27523] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1335.087155][T27523] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1335.087172][T27523] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1335.087195][T27523] __sock_sendmsg+0x21c/0x270 [ 1335.087226][T27523] ____sys_sendmsg+0x505/0x820 [ 1335.087253][T27523] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1335.087282][T27523] ? import_iovec+0x74/0xa0 [ 1335.087307][T27523] ___sys_sendmsg+0x21f/0x2a0 [ 1335.087331][T27523] ? __pfx____sys_sendmsg+0x10/0x10 [ 1335.087397][T27523] ? __fget_files+0x2a/0x420 [ 1335.087420][T27523] ? __fget_files+0x3a0/0x420 [ 1335.087452][T27523] __x64_sys_sendmsg+0x19b/0x260 [ 1335.087477][T27523] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1335.087508][T27523] ? __pfx_ksys_write+0x10/0x10 [ 1335.087543][T27523] do_syscall_64+0xec/0xf80 [ 1335.087563][T27523] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1335.087581][T27523] ? trace_irq_disable+0x37/0x100 [ 1335.087605][T27523] ? clear_bhb_loop+0x60/0xb0 [ 1335.087627][T27523] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1335.087646][T27523] RIP: 0033:0x7f7ce898f749 [ 1335.087663][T27523] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1335.087680][T27523] RSP: 002b:00007f7ce9840038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1335.087700][T27523] RAX: ffffffffffffffda RBX: 00007f7ce8be5fa0 RCX: 00007f7ce898f749 [ 1335.087713][T27523] RDX: 0000000000000000 RSI: 0000200000002240 RDI: 0000000000000005 [ 1335.087722][T27523] RBP: 00007f7ce9840090 R08: 0000000000000000 R09: 0000000000000000 [ 1335.087732][T27523] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1335.087742][T27523] R13: 00007f7ce8be6038 R14: 00007f7ce8be5fa0 R15: 00007ffc4e30afe8 [ 1335.087770][T27523] [ 1335.567106][T27553] netlink: 24 bytes leftover after parsing attributes in process `syz.2.20995'. [ 1335.720467][T27566] netlink: 'syz.3.20998': attribute type 9 has an invalid length. [ 1335.729007][T27566] netlink: 8 bytes leftover after parsing attributes in process `syz.3.20998'. [ 1336.352286][T27607] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1336.410129][T27607] netlink: 'syz.2.21012': attribute type 2 has an invalid length. [ 1336.445562][T27615] veth0: entered promiscuous mode [ 1336.696215][T27623] tipc: New replicast peer: 255.255.255.255 [ 1336.705668][T27623] tipc: Enabled bearer , priority 10 [ 1336.794047][T27632] netlink: 'syz.4.21019': attribute type 10 has an invalid length. [ 1337.214335][T27657] netlink: 'syz.1.21026': attribute type 4 has an invalid length. [ 1337.285808][T27666] FAULT_INJECTION: forcing a failure. [ 1337.285808][T27666] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1337.300511][T27666] CPU: 1 UID: 0 PID: 27666 Comm: syz.4.21029 Not tainted syzkaller #0 PREEMPT(full) [ 1337.300538][T27666] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1337.300549][T27666] Call Trace: [ 1337.300554][T27666] [ 1337.300578][T27666] dump_stack_lvl+0xe8/0x150 [ 1337.300597][T27666] should_fail_ex+0x414/0x560 [ 1337.300617][T27666] _copy_to_iter+0x404/0x1790 [ 1337.300630][T27666] ? do_raw_spin_lock+0x121/0x290 [ 1337.300650][T27666] ? __pfx__copy_to_iter+0x10/0x10 [ 1337.300661][T27666] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 1337.300717][T27666] ? lockdep_hardirqs_on+0x7b/0x110 [ 1337.300728][T27666] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 1337.300744][T27666] ? __skb_try_recv_datagram+0x3d5/0x4d0 [ 1337.300762][T27666] __skb_datagram_iter+0xf8/0x990 [ 1337.300776][T27666] ? __pfx_simple_copy_to_iter+0x10/0x10 [ 1337.300794][T27666] skb_copy_datagram_iter+0xb5/0x210 [ 1337.300810][T27666] netlink_recvmsg+0x2ab/0xa30 [ 1337.300829][T27666] ? __pfx_netlink_recvmsg+0x10/0x10 [ 1337.300844][T27666] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1337.300859][T27666] ? bpf_lsm_socket_recvmsg+0x9/0x20 [ 1337.300868][T27666] ? security_socket_recvmsg+0x7e/0x2e0 [ 1337.300884][T27666] ? __pfx_netlink_recvmsg+0x10/0x10 [ 1337.300897][T27666] sock_recvmsg+0x22c/0x270 [ 1337.300915][T27666] ____sys_recvmsg+0x1c9/0x460 [ 1337.300935][T27666] ? __pfx_____sys_recvmsg+0x10/0x10 [ 1337.300956][T27666] ? import_iovec+0x74/0xa0 [ 1337.300971][T27666] ___sys_recvmsg+0x1b5/0x510 [ 1337.300987][T27666] ? __pfx____sys_recvmsg+0x10/0x10 [ 1337.301002][T27666] ? __fget_files+0x2a/0x420 [ 1337.301024][T27666] ? __fget_files+0x3a0/0x420 [ 1337.301042][T27666] do_recvmmsg+0x307/0x770 [ 1337.301060][T27666] ? __pfx_do_recvmmsg+0x10/0x10 [ 1337.301079][T27666] ? _copy_from_user+0x94/0xb0 [ 1337.301100][T27666] __x64_sys_recvmmsg+0x1af/0x240 [ 1337.301114][T27666] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 1337.301134][T27666] do_syscall_64+0xec/0xf80 [ 1337.301144][T27666] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1337.301154][T27666] ? trace_irq_disable+0x37/0x100 [ 1337.301168][T27666] ? clear_bhb_loop+0x60/0xb0 [ 1337.301180][T27666] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1337.301191][T27666] RIP: 0033:0x7f824eb8f749 [ 1337.301201][T27666] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1337.301212][T27666] RSP: 002b:00007f824fa6a038 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 1337.301225][T27666] RAX: ffffffffffffffda RBX: 00007f824ede5fa0 RCX: 00007f824eb8f749 [ 1337.301234][T27666] RDX: 04000000000003b4 RSI: 00002000000037c0 RDI: 0000000000000003 [ 1337.301241][T27666] RBP: 00007f824fa6a090 R08: 0000200000003700 R09: 0000000000000000 [ 1337.301248][T27666] R10: 0000000000002000 R11: 0000000000000246 R12: 0000000000000001 [ 1337.301255][T27666] R13: 00007f824ede6038 R14: 00007f824ede5fa0 R15: 00007ffdef634ce8 [ 1337.301272][T27666] [ 1337.682332][T25369] IPVS: starting estimator thread 0... [ 1337.777852][T27675] IPVS: using max 53 ests per chain, 127200 per kthread [ 1337.818163][T13021] tipc: Node number set to 3762943367 [ 1337.984356][T27668] __nla_validate_parse: 4 callbacks suppressed [ 1337.985142][T27668] netlink: 12 bytes leftover after parsing attributes in process `syz.2.21030'. [ 1338.061582][T27679] netlink: 8 bytes leftover after parsing attributes in process `syz.1.21034'. [ 1338.114740][T27681] syz_tun: entered allmulticast mode [ 1338.316781][T27697] FAULT_INJECTION: forcing a failure. [ 1338.316781][T27697] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1338.336116][T27697] CPU: 0 UID: 0 PID: 27697 Comm: syz.1.21040 Not tainted syzkaller #0 PREEMPT(full) [ 1338.336145][T27697] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1338.336158][T27697] Call Trace: [ 1338.336166][T27697] [ 1338.336176][T27697] dump_stack_lvl+0xe8/0x150 [ 1338.336207][T27697] should_fail_ex+0x414/0x560 [ 1338.336242][T27697] _copy_from_user+0x2d/0xb0 [ 1338.336267][T27697] ___sys_sendmsg+0x158/0x2a0 [ 1338.336294][T27697] ? __pfx____sys_sendmsg+0x10/0x10 [ 1338.336354][T27697] ? __fget_files+0x2a/0x420 [ 1338.336379][T27697] ? __fget_files+0x3a0/0x420 [ 1338.336413][T27697] __x64_sys_sendmsg+0x19b/0x260 [ 1338.336440][T27697] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1338.336473][T27697] ? __pfx_ksys_write+0x10/0x10 [ 1338.336505][T27697] do_syscall_64+0xec/0xf80 [ 1338.336525][T27697] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1338.336544][T27697] ? trace_irq_disable+0x37/0x100 [ 1338.336568][T27697] ? clear_bhb_loop+0x60/0xb0 [ 1338.336593][T27697] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1338.336612][T27697] RIP: 0033:0x7fb7b918f749 [ 1338.336630][T27697] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1338.336647][T27697] RSP: 002b:00007fb7ba02b038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1338.336668][T27697] RAX: ffffffffffffffda RBX: 00007fb7b93e5fa0 RCX: 00007fb7b918f749 [ 1338.336683][T27697] RDX: 0000000000000000 RSI: 0000200000000200 RDI: 0000000000000003 [ 1338.336697][T27697] RBP: 00007fb7ba02b090 R08: 0000000000000000 R09: 0000000000000000 [ 1338.336709][T27697] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1338.336722][T27697] R13: 00007fb7b93e6038 R14: 00007fb7b93e5fa0 R15: 00007ffd371df488 [ 1338.336755][T27697] [ 1338.944298][T27680] syz_tun: left allmulticast mode [ 1338.982103][T27732] netlink: 8 bytes leftover after parsing attributes in process `syz.0.21050'. [ 1339.153812][T27744] Cannot find set identified by id 3 to match [ 1339.194839][T27744] netlink: 207952 bytes leftover after parsing attributes in process `syz.4.21054'. [ 1339.392274][T27759] netlink: 14 bytes leftover after parsing attributes in process `syz.4.21058'. [ 1339.436657][T27759] bond0: entered promiscuous mode [ 1339.466693][T27759] mac80211_hwsim hwsim66 wlan1: entered promiscuous mode [ 1339.545819][T27768] FAULT_INJECTION: forcing a failure. [ 1339.545819][T27768] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1339.567203][T27768] CPU: 1 UID: 0 PID: 27768 Comm: syz.3.21060 Not tainted syzkaller #0 PREEMPT(full) [ 1339.567231][T27768] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1339.567243][T27768] Call Trace: [ 1339.567251][T27768] [ 1339.567260][T27768] dump_stack_lvl+0xe8/0x150 [ 1339.567289][T27768] should_fail_ex+0x414/0x560 [ 1339.567323][T27768] _copy_from_user+0x2d/0xb0 [ 1339.567351][T27768] ___sys_recvmsg+0x12e/0x510 [ 1339.567370][T27768] ? get_pid_task+0x20/0x1f0 [ 1339.567391][T27768] ? get_pid_task+0x20/0x1f0 [ 1339.567417][T27768] ? __pfx____sys_recvmsg+0x10/0x10 [ 1339.567483][T27768] ? __fget_files+0x2a/0x420 [ 1339.567525][T27768] ? __fget_files+0x3a0/0x420 [ 1339.567558][T27768] __x64_sys_recvmsg+0x198/0x260 [ 1339.567584][T27768] ? __pfx___x64_sys_recvmsg+0x10/0x10 [ 1339.567618][T27768] ? __pfx_ksys_write+0x10/0x10 [ 1339.567648][T27768] do_syscall_64+0xec/0xf80 [ 1339.567669][T27768] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1339.567688][T27768] ? trace_irq_disable+0x37/0x100 [ 1339.567714][T27768] ? clear_bhb_loop+0x60/0xb0 [ 1339.567736][T27768] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1339.567755][T27768] RIP: 0033:0x7f7ce898f749 [ 1339.567772][T27768] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1339.567790][T27768] RSP: 002b:00007f7ce9840038 EFLAGS: 00000246 ORIG_RAX: 000000000000002f [ 1339.567812][T27768] RAX: ffffffffffffffda RBX: 00007f7ce8be5fa0 RCX: 00007f7ce898f749 [ 1339.567827][T27768] RDX: 0000000000002122 RSI: 0000200000000440 RDI: 0000000000000004 [ 1339.567839][T27768] RBP: 00007f7ce9840090 R08: 0000000000000000 R09: 0000000000000000 [ 1339.567851][T27768] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1339.567864][T27768] R13: 00007f7ce8be6038 R14: 00007f7ce8be5fa0 R15: 00007ffc4e30afe8 [ 1339.567896][T27768] [ 1339.824563][T27776] FAULT_INJECTION: forcing a failure. [ 1339.824563][T27776] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1339.922540][T27776] CPU: 0 UID: 0 PID: 27776 Comm: syz.3.21063 Not tainted syzkaller #0 PREEMPT(full) [ 1339.922570][T27776] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1339.922583][T27776] Call Trace: [ 1339.922591][T27776] [ 1339.922600][T27776] dump_stack_lvl+0xe8/0x150 [ 1339.922631][T27776] should_fail_ex+0x414/0x560 [ 1339.922667][T27776] _copy_from_user+0x2d/0xb0 [ 1339.922693][T27776] ___sys_recvmsg+0x12e/0x510 [ 1339.922724][T27776] ? __pfx____sys_recvmsg+0x10/0x10 [ 1339.922753][T27776] ? __fget_files+0x2a/0x420 [ 1339.922804][T27776] do_recvmmsg+0x307/0x770 [ 1339.922835][T27776] ? __pfx_do_recvmmsg+0x10/0x10 [ 1339.922867][T27776] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1339.922903][T27776] __x64_sys_recvmmsg+0x190/0x240 [ 1339.922930][T27776] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 1339.922968][T27776] do_syscall_64+0xec/0xf80 [ 1339.922988][T27776] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1339.923006][T27776] ? trace_irq_disable+0x37/0x100 [ 1339.923031][T27776] ? clear_bhb_loop+0x60/0xb0 [ 1339.923055][T27776] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1339.923074][T27776] RIP: 0033:0x7f7ce898f749 [ 1339.923090][T27776] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1339.923108][T27776] RSP: 002b:00007f7ce9840038 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 1339.923129][T27776] RAX: ffffffffffffffda RBX: 00007f7ce8be5fa0 RCX: 00007f7ce898f749 [ 1339.923144][T27776] RDX: 0000000000000002 RSI: 000020000001ef40 RDI: 0000000000000003 [ 1339.923157][T27776] RBP: 00007f7ce9840090 R08: 0000000000000000 R09: 0000000000000000 [ 1339.923170][T27776] R10: 0000000000000020 R11: 0000000000000246 R12: 0000000000000001 [ 1339.923182][T27776] R13: 00007f7ce8be6038 R14: 00007f7ce8be5fa0 R15: 00007ffc4e30afe8 [ 1339.923214][T27776] [ 1339.923452][T27782] netlink: 8 bytes leftover after parsing attributes in process `syz.1.21066'. [ 1340.370047][T27807] syzkaller1: entered promiscuous mode [ 1340.375669][T27807] syzkaller1: entered allmulticast mode [ 1340.542002][T27813] vlan2: entered promiscuous mode [ 1340.547057][T27813] geneve1: entered promiscuous mode [ 1340.559595][T27813] vlan2: entered allmulticast mode [ 1340.566410][T27813] geneve1: entered allmulticast mode [ 1340.574258][T27821] netlink: 'syz.4.21078': attribute type 21 has an invalid length. [ 1340.582618][T27821] netlink: 128 bytes leftover after parsing attributes in process `syz.4.21078'. [ 1340.592586][T27821] netlink: 3 bytes leftover after parsing attributes in process `syz.4.21078'. [ 1340.702209][T27828] openvswitch: netlink: IP tunnel dst address not specified [ 1340.712713][T27829] netlink: 212348 bytes leftover after parsing attributes in process `syz.3.21082'. [ 1340.718159][T27832] tipc: Enabled bearer , priority 0 [ 1340.726974][T27829] netlink: Conntrack attr type has unexpected length (type=2, length=0, expected=2) [ 1340.731702][T27832] syzkaller0: entered promiscuous mode [ 1340.768372][T27832] syzkaller0: entered allmulticast mode [ 1340.785422][T27832] tipc: Resetting bearer [ 1340.904571][T27832] sch_tbf: burst 555 is lower than device syzkaller0 mtu (1514) ! [ 1341.000671][T27850] netlink: 24 bytes leftover after parsing attributes in process `syz.1.21086'. [ 1341.077218][T27850] FAULT_INJECTION: forcing a failure. [ 1341.077218][T27850] name failslab, interval 1, probability 0, space 0, times 0 [ 1341.092056][T27850] CPU: 1 UID: 0 PID: 27850 Comm: syz.1.21086 Not tainted syzkaller #0 PREEMPT(full) [ 1341.092085][T27850] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1341.092098][T27850] Call Trace: [ 1341.092106][T27850] [ 1341.092116][T27850] dump_stack_lvl+0xe8/0x150 [ 1341.092146][T27850] should_fail_ex+0x414/0x560 [ 1341.092181][T27850] should_failslab+0xa8/0x100 [ 1341.092206][T27850] kmem_cache_alloc_node_noprof+0x8c/0x720 [ 1341.092236][T27850] ? __alloc_skb+0x1dc/0x3a0 [ 1341.092256][T27850] ? __local_bh_enable_ip+0xd0/0x130 [ 1341.092278][T27850] ? __alloc_skb+0x198/0x3a0 [ 1341.092299][T27850] __alloc_skb+0x1dc/0x3a0 [ 1341.092323][T27850] __ip_append_data+0x2dae/0x40c0 [ 1341.092344][T27850] ? __lock_acquire+0x6b6/0x2cf0 [ 1341.092369][T27850] ? rt_is_expired+0x1c/0x2d0 [ 1341.092401][T27850] ? __pfx_raw_getfrag+0x10/0x10 [ 1341.092426][T27850] ? ipv4_mtu+0x23/0x650 [ 1341.092456][T27850] ? ipv4_mtu+0x23/0x650 [ 1341.092476][T27850] ? __pfx___ip_append_data+0x10/0x10 [ 1341.092498][T27850] ? ipv4_mtu+0x53b/0x650 [ 1341.092515][T27850] ? ipv4_mtu+0x23/0x650 [ 1341.092534][T27850] ? __pfx_ipv4_mtu+0x10/0x10 [ 1341.092553][T27850] ? ip_setup_cork+0x577/0x9a0 [ 1341.092572][T27850] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 1341.092602][T27850] ip_append_data+0x10e/0x190 [ 1341.092641][T27850] ? __pfx_raw_getfrag+0x10/0x10 [ 1341.092669][T27850] raw_sendmsg+0x13d8/0x18b0 [ 1341.092706][T27850] ? __pfx_raw_sendmsg+0x10/0x10 [ 1341.092723][T27850] ? handle_mm_fault+0xdb/0x32b0 [ 1341.092766][T27850] ? aa_sk_perm+0x7ee/0x920 [ 1341.092792][T27850] ? __pfx_aa_sk_perm+0x10/0x10 [ 1341.092812][T27850] ? tomoyo_socket_sendmsg_permission+0x1e1/0x300 [ 1341.092842][T27850] ? sock_rps_record_flow+0x19/0x410 [ 1341.092868][T27850] ? inet_sendmsg+0x2f4/0x370 [ 1341.092890][T27850] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1341.092911][T27850] __sock_sendmsg+0x19c/0x270 [ 1341.092940][T27850] ____sys_sendmsg+0x52d/0x820 [ 1341.092968][T27850] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1341.093000][T27850] ? import_iovec+0x74/0xa0 [ 1341.093026][T27850] ___sys_sendmsg+0x21f/0x2a0 [ 1341.093049][T27850] ? __pfx____sys_sendmsg+0x10/0x10 [ 1341.093075][T27850] ? kstrtouint+0x6e/0xe0 [ 1341.093130][T27850] ? __fget_files+0x2a/0x420 [ 1341.093150][T27850] ? __fget_files+0x3a0/0x420 [ 1341.093182][T27850] __sys_sendmmsg+0x227/0x430 [ 1341.093209][T27850] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1341.093227][T27850] ? __mutex_unlock_slowpath+0x1a1/0x730 [ 1341.093275][T27850] ? ksys_write+0x22a/0x250 [ 1341.093294][T27850] ? __pfx_ksys_write+0x10/0x10 [ 1341.093320][T27850] __x64_sys_sendmmsg+0xa0/0xc0 [ 1341.093344][T27850] do_syscall_64+0xec/0xf80 [ 1341.093364][T27850] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1341.093380][T27850] ? trace_irq_disable+0x37/0x100 [ 1341.093402][T27850] ? clear_bhb_loop+0x60/0xb0 [ 1341.093424][T27850] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1341.093441][T27850] RIP: 0033:0x7fb7b918f749 [ 1341.093458][T27850] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1341.093474][T27850] RSP: 002b:00007fb7ba02b038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1341.093494][T27850] RAX: ffffffffffffffda RBX: 00007fb7b93e5fa0 RCX: 00007fb7b918f749 [ 1341.093509][T27850] RDX: 0000000004000095 RSI: 0000200000005240 RDI: 0000000000000006 [ 1341.093522][T27850] RBP: 00007fb7ba02b090 R08: 0000000000000000 R09: 0000000000000000 [ 1341.093534][T27850] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1341.093545][T27850] R13: 00007fb7b93e6038 R14: 00007fb7b93e5fa0 R15: 00007ffd371df488 [ 1341.093577][T27850] [ 1341.094584][T27850] netlink: 'syz.1.21086': attribute type 4 has an invalid length. [ 1341.103102][T27832] netlink: 'syz.2.21081': attribute type 6 has an invalid length. [ 1341.506566][ T4431] tipc: Resetting bearer [ 1341.514729][T27849] tipc: Resetting bearer [ 1341.578294][T27827] tipc: Resetting bearer [ 1341.675131][T27827] tipc: Disabling bearer [ 1341.762563][T27872] speed is unknown, defaulting to 1000 [ 1342.169879][T27872] wlan0 speed is unknown, defaulting to 1000 [ 1342.437083][T27908] speed is unknown, defaulting to 1000 [ 1342.821167][T27908] wlan0 speed is unknown, defaulting to 1000 [ 1343.314504][T27949] FAULT_INJECTION: forcing a failure. [ 1343.314504][T27949] name failslab, interval 1, probability 0, space 0, times 0 [ 1343.337991][T27949] CPU: 0 UID: 0 PID: 27949 Comm: syz.4.21114 Not tainted syzkaller #0 PREEMPT(full) [ 1343.338020][T27949] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1343.338033][T27949] Call Trace: [ 1343.338042][T27949] [ 1343.338050][T27949] dump_stack_lvl+0xe8/0x150 [ 1343.338081][T27949] should_fail_ex+0x414/0x560 [ 1343.338116][T27949] should_failslab+0xa8/0x100 [ 1343.338142][T27949] __kmalloc_cache_noprof+0x84/0x700 [ 1343.338164][T27949] ? nft_trans_rule_add+0x59/0x440 [ 1343.338184][T27949] ? rcu_is_watching+0x15/0xb0 [ 1343.338213][T27949] nft_trans_rule_add+0x59/0x440 [ 1343.338232][T27949] ? nft_parse_register_store+0x2f0/0x370 [ 1343.338262][T27949] nf_tables_newrule+0x1b63/0x28a0 [ 1343.338308][T27949] ? __pfx_nf_tables_newrule+0x10/0x10 [ 1343.338336][T27949] ? nfnl_pernet+0x23/0x240 [ 1343.338364][T27949] ? nfnl_pernet+0x23/0x240 [ 1343.338399][T27949] ? __nla_parse+0x40/0x60 [ 1343.338426][T27949] nfnetlink_rcv+0x11d9/0x2590 [ 1343.338485][T27949] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 1343.338525][T27949] ? ref_tracker_free+0x63a/0x7d0 [ 1343.338575][T27949] ? __netlink_deliver_tap+0x807/0x850 [ 1343.338600][T27949] ? netlink_deliver_tap+0x2e/0x1b0 [ 1343.338643][T27949] netlink_unicast+0x82f/0x9e0 [ 1343.338674][T27949] ? __pfx_netlink_unicast+0x10/0x10 [ 1343.338695][T27949] ? __alloc_skb+0x198/0x3a0 [ 1343.338716][T27949] ? netlink_sendmsg+0x642/0xb30 [ 1343.338739][T27949] ? skb_put+0x11b/0x210 [ 1343.338763][T27949] netlink_sendmsg+0x805/0xb30 [ 1343.338795][T27949] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1343.338822][T27949] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1343.338850][T27949] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1343.338867][T27949] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1343.338893][T27949] __sock_sendmsg+0x21c/0x270 [ 1343.338924][T27949] ____sys_sendmsg+0x505/0x820 [ 1343.338953][T27949] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1343.338986][T27949] ? import_iovec+0x74/0xa0 [ 1343.339015][T27949] ___sys_sendmsg+0x21f/0x2a0 [ 1343.339041][T27949] ? __pfx____sys_sendmsg+0x10/0x10 [ 1343.339101][T27949] ? __fget_files+0x2a/0x420 [ 1343.339125][T27949] ? __fget_files+0x3a0/0x420 [ 1343.339160][T27949] __x64_sys_sendmsg+0x19b/0x260 [ 1343.339185][T27949] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1343.339217][T27949] ? __pfx_ksys_write+0x10/0x10 [ 1343.339250][T27949] do_syscall_64+0xec/0xf80 [ 1343.339271][T27949] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1343.339290][T27949] ? trace_irq_disable+0x37/0x100 [ 1343.339315][T27949] ? clear_bhb_loop+0x60/0xb0 [ 1343.339340][T27949] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1343.339364][T27949] RIP: 0033:0x7f824eb8f749 [ 1343.339390][T27949] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1343.339408][T27949] RSP: 002b:00007f824fa6a038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1343.339433][T27949] RAX: ffffffffffffffda RBX: 00007f824ede5fa0 RCX: 00007f824eb8f749 [ 1343.339466][T27949] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 1343.339481][T27949] RBP: 00007f824fa6a090 R08: 0000000000000000 R09: 0000000000000000 [ 1343.339497][T27949] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1343.339508][T27949] R13: 00007f824ede6038 R14: 00007f824ede5fa0 R15: 00007ffdef634ce8 [ 1343.339556][T27949] [ 1343.741228][T27953] netlink: 'syz.4.21117': attribute type 1 has an invalid length. [ 1343.754023][T27953] __nla_validate_parse: 6 callbacks suppressed [ 1343.754043][T27953] netlink: 224 bytes leftover after parsing attributes in process `syz.4.21117'. [ 1343.915286][T27955] netlink: 8 bytes leftover after parsing attributes in process `syz.2.21116'. [ 1344.024655][T27960] netlink: 28 bytes leftover after parsing attributes in process `syz.3.21119'. [ 1344.140646][T27972] netlink: 12 bytes leftover after parsing attributes in process `syz.2.21123'. [ 1344.407518][T27985] netlink: 20 bytes leftover after parsing attributes in process `syz.0.21127'. [ 1344.463832][T27984] x_tables: duplicate underflow at hook 1 [ 1344.486526][T27990] speed is unknown, defaulting to 1000 [ 1344.614561][T27999] veth0_to_bond: entered allmulticast mode [ 1344.715460][T27990] wlan0 speed is unknown, defaulting to 1000 [ 1345.245337][T28039] netlink: 20 bytes leftover after parsing attributes in process `syz.0.21141'. [ 1345.631944][T28058] syzkaller1: entered promiscuous mode [ 1345.638325][T28058] syzkaller1: entered allmulticast mode [ 1345.875480][T28073] netlink: 20 bytes leftover after parsing attributes in process `syz.2.21154'. [ 1345.999580][T28081] netlink: 52 bytes leftover after parsing attributes in process `syz.3.21157'. [ 1346.078219][T28078] speed is unknown, defaulting to 1000 [ 1346.455908][T28078] wlan0 speed is unknown, defaulting to 1000 [ 1346.613308][T28118] netlink: 8 bytes leftover after parsing attributes in process `syz.4.21169'. [ 1346.613668][T28119] netlink: 'syz.1.21168': attribute type 12 has an invalid length. [ 1346.647595][T28119] netlink: 'syz.1.21168': attribute type 29 has an invalid length. [ 1346.662487][T28119] netlink: 148 bytes leftover after parsing attributes in process `syz.1.21168'. [ 1347.469167][T28148] mac80211_hwsim hwsim61 syzkaller0: entered promiscuous mode [ 1347.477013][T28148] mac80211_hwsim hwsim61 syzkaller0: entered allmulticast mode [ 1347.594854][T28157] FAULT_INJECTION: forcing a failure. [ 1347.594854][T28157] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1347.629447][T28157] CPU: 0 UID: 0 PID: 28157 Comm: syz.2.21181 Not tainted syzkaller #0 PREEMPT(full) [ 1347.629473][T28157] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1347.629486][T28157] Call Trace: [ 1347.629493][T28157] [ 1347.629501][T28157] dump_stack_lvl+0xe8/0x150 [ 1347.629530][T28157] should_fail_ex+0x414/0x560 [ 1347.629564][T28157] _copy_to_iter+0x589/0x1790 [ 1347.629599][T28157] ? __pfx__copy_to_iter+0x10/0x10 [ 1347.629618][T28157] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 1347.629647][T28157] ? lockdep_hardirqs_on+0x7b/0x110 [ 1347.629665][T28157] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 1347.629690][T28157] ? __skb_try_recv_datagram+0x3d5/0x4d0 [ 1347.629720][T28157] __skb_datagram_iter+0xf8/0x990 [ 1347.629746][T28157] ? __pfx_simple_copy_to_iter+0x10/0x10 [ 1347.629777][T28157] skb_copy_datagram_iter+0xb5/0x210 [ 1347.629806][T28157] netlink_recvmsg+0x2ab/0xa30 [ 1347.629839][T28157] ? __pfx_netlink_recvmsg+0x10/0x10 [ 1347.629866][T28157] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1347.629889][T28157] ? bpf_lsm_socket_recvmsg+0x9/0x20 [ 1347.629906][T28157] ? security_socket_recvmsg+0x7e/0x2e0 [ 1347.629932][T28157] ? __pfx_netlink_recvmsg+0x10/0x10 [ 1347.629954][T28157] sock_recvmsg+0x22c/0x270 [ 1347.629983][T28157] ____sys_recvmsg+0x1c9/0x460 [ 1347.630013][T28157] ? __pfx_____sys_recvmsg+0x10/0x10 [ 1347.630057][T28157] ? import_iovec+0x74/0xa0 [ 1347.630084][T28157] ___sys_recvmsg+0x1b5/0x510 [ 1347.630114][T28157] ? __pfx____sys_recvmsg+0x10/0x10 [ 1347.630141][T28157] ? __fget_files+0x2a/0x420 [ 1347.630182][T28157] ? __fget_files+0x3a0/0x420 [ 1347.630216][T28157] do_recvmmsg+0x307/0x770 [ 1347.630251][T28157] ? __pfx_do_recvmmsg+0x10/0x10 [ 1347.630287][T28157] ? _copy_from_user+0x94/0xb0 [ 1347.630324][T28157] __x64_sys_recvmmsg+0x1af/0x240 [ 1347.630351][T28157] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 1347.630384][T28157] do_syscall_64+0xec/0xf80 [ 1347.630404][T28157] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1347.630424][T28157] ? trace_irq_disable+0x37/0x100 [ 1347.630447][T28157] ? clear_bhb_loop+0x60/0xb0 [ 1347.630469][T28157] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1347.630488][T28157] RIP: 0033:0x7fa72e78f749 [ 1347.630506][T28157] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1347.630522][T28157] RSP: 002b:00007fa72f5a9038 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 1347.630542][T28157] RAX: ffffffffffffffda RBX: 00007fa72e9e5fa0 RCX: 00007fa72e78f749 [ 1347.630555][T28157] RDX: 04000000000003b4 RSI: 00002000000037c0 RDI: 0000000000000003 [ 1347.630567][T28157] RBP: 00007fa72f5a9090 R08: 0000200000003700 R09: 0000000000000000 [ 1347.630579][T28157] R10: 0000000002040000 R11: 0000000000000246 R12: 0000000000000001 [ 1347.630591][T28157] R13: 00007fa72e9e6038 R14: 00007fa72e9e5fa0 R15: 00007fff7e9d2868 [ 1347.630622][T28157] [ 1348.154517][T28174] netlink: 'syz.0.21187': attribute type 3 has an invalid length. [ 1348.265727][T28179] tipc: Started in network mode [ 1348.283965][T28179] tipc: Node identity 6e310fd37ed5, cluster identity 3 [ 1348.329584][T28179] tipc: Enabled bearer , priority 0 [ 1348.343801][T28178] syzkaller0: entered promiscuous mode [ 1348.351094][T28178] syzkaller0: entered allmulticast mode [ 1348.363371][T28179] syzkaller0: mtu greater than device maximum [ 1348.387767][T20093] Bluetooth: hci1: command 0x0406 tx timeout [ 1348.549253][T28199] netlink: 'syz.0.21195': attribute type 3 has an invalid length. [ 1348.559659][T28175] tipc: Disabling bearer [ 1348.590453][T28203] netlink: 'syz.1.21197': attribute type 10 has an invalid length. [ 1348.773493][T28210] Cannot find set identified by id 3 to match [ 1349.196326][T28237] __nla_validate_parse: 6 callbacks suppressed [ 1349.196346][T28237] netlink: 12 bytes leftover after parsing attributes in process `syz.4.21210'. [ 1351.668749][ T4446] bond1 (unregistering): (slave geneve2): Releasing backup interface [ 1351.869072][ T4446] bond0 (unregistering): (slave wlan1): Releasing backup interface [ 1351.878080][ T4446] bond0 (unregistering): Released all slaves [ 1351.890344][ T4446] bond1 (unregistering): Released all slaves [ 1352.027900][ T4446] bond2 (unregistering): Released all slaves [ 1352.159465][ T4446] bond3 (unregistering): Released all slaves [ 1352.285355][ T4446] bond4 (unregistering): Released all slaves [ 1352.420766][ T4446] bond5 (unregistering): (slave veth5): Releasing active interface [ 1352.431115][ T4446] bond5 (unregistering): Released all slaves [ 1352.560262][ T4446] bond6 (unregistering): (slave veth7): Releasing active interface [ 1352.569553][ T4446] bond6 (unregistering): Released all slaves [ 1352.689004][ T4446] bond7 (unregistering): (slave veth9): Releasing active interface [ 1352.698338][ T4446] bond7 (unregistering): Released all slaves [ 1352.818118][ T4446] bond8 (unregistering): Released all slaves [ 1352.939953][ T4446] bond9 (unregistering): Released all slaves [ 1353.059096][ T4446] bond10 (unregistering): (slave veth11): Releasing active interface [ 1353.068343][ T4446] bond10 (unregistering): Released all slaves [ 1353.199485][ T4446] bond11 (unregistering): Released all slaves [ 1353.359452][ T4446] tipc: Left network mode [ 1353.587109][ T4446] hsr_slave_0: left promiscuous mode [ 1353.593559][ T4446] hsr_slave_1: left promiscuous mode [ 1353.713096][ T4446] pim6reg (unregistering): left allmulticast mode [ 1354.706055][ T4446] IPVS: stop unused estimator thread 0... [ 1366.989130][T23056] batman_adv: batadv0: Removing interface: gretap1 [ 1367.035878][T23056] bond5 (unregistering): (slave geneve3): Releasing active interface [ 1367.284359][T23056] bond0 (unregistering): (slave wlan1): Releasing backup interface [ 1367.293272][T23056] bond0 (unregistering): Released all slaves [ 1367.407123][T23056] bond1 (unregistering): Released all slaves [ 1367.521893][T23056] bond2 (unregistering): Released all slaves [ 1367.636680][T23056] bond3 (unregistering): Released all slaves [ 1367.761587][T23056] bond4 (unregistering): Released all slaves [ 1367.886269][T23056] bond5 (unregistering): Released all slaves [ 1368.019597][T23056] bond6 (unregistering): (slave veth3): Releasing active interface [ 1368.029887][T23056] bond6 (unregistering): Released all slaves [ 1368.157939][T23056] bond7 (unregistering): (slave veth5): Releasing active interface [ 1368.168183][T23056] bond7 (unregistering): Released all slaves [ 1368.290830][T23056] bond8 (unregistering): (slave veth7): Releasing active interface [ 1368.300689][T23056] bond8 (unregistering): Released all slaves [ 1368.422742][T23056] bond9 (unregistering): Released all slaves [ 1368.546258][T23056] bond10 (unregistering): Released all slaves [ 1368.664850][T23056] bond11 (unregistering): Released all slaves [ 1368.808744][T23056] bond12 (unregistering): Released all slaves [ 1368.937791][T23056] bond13 (unregistering): Released all slaves [ 1369.093015][T23056] tipc: Left network mode [ 1369.363171][T23056] hsr_slave_0: left promiscuous mode [ 1369.370045][T23056] hsr_slave_1: left promiscuous mode [ 1369.444769][T23056] pim6reg (unregistering): left allmulticast mode [ 1420.978547][T28268] netlink: 4 bytes leftover after parsing attributes in process `syz.3.21218'. [ 1421.441661][T28308] netlink: 'syz.2.21227': attribute type 2 has an invalid length. [ 1421.454605][T28307] netlink: 52 bytes leftover after parsing attributes in process `syz.3.21229'. [ 1421.465200][T28302] netlink: 'syz.2.21227': attribute type 2 has an invalid length. [ 1421.504355][T28302] 9: entered promiscuous mode [ 1421.641169][T28318] sctp: [Deprecated]: syz.1.21232 (pid 28318) Use of int in max_burst socket option. [ 1421.641169][T28318] Use struct sctp_assoc_value instead [ 1421.690588][T28321] netlink: 'syz.2.21234': attribute type 1 has an invalid length. [ 1421.714944][T28321] netlink: 'syz.2.21234': attribute type 1 has an invalid length. [ 1421.727493][T28321] netlink: 'syz.2.21234': attribute type 2 has an invalid length. [ 1421.735511][T28321] netlink: 'syz.2.21234': attribute type 1 has an invalid length. [ 1421.743792][T28321] netlink: 'syz.2.21234': attribute type 3 has an invalid length. [ 1421.752192][T28321] netlink: 4 bytes leftover after parsing attributes in process `syz.2.21234'. [ 1422.043570][T28340] xt_ipcomp: unknown flags 1D [ 1422.070613][T28339] delete_channel: no stack [ 1422.145629][T28346] Cannot find add_set index 0 as target [ 1422.238891][T28352] netlink: 20 bytes leftover after parsing attributes in process `syz.4.21246'. [ 1422.297169][T28349] netlink: 20 bytes leftover after parsing attributes in process `syz.4.21246'. [ 1422.348044][T28352] netlink: 224 bytes leftover after parsing attributes in process `syz.4.21246'. [ 1422.378056][T28349] netlink: 224 bytes leftover after parsing attributes in process `syz.4.21246'. [ 1422.444894][T28362] syzkaller0: entered promiscuous mode [ 1422.451559][T28362] syzkaller0: entered allmulticast mode [ 1422.599066][T28376] FAULT_INJECTION: forcing a failure. [ 1422.599066][T28376] name failslab, interval 1, probability 0, space 0, times 0 [ 1422.600398][T28374] netlink: 8 bytes leftover after parsing attributes in process `syz.3.21252'. [ 1422.612025][T28376] CPU: 1 UID: 0 PID: 28376 Comm: syz.4.21255 Not tainted syzkaller #0 PREEMPT(full) [ 1422.612055][T28376] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1422.612068][T28376] Call Trace: [ 1422.612079][T28376] [ 1422.612090][T28376] dump_stack_lvl+0xe8/0x150 [ 1422.612122][T28376] should_fail_ex+0x414/0x560 [ 1422.612159][T28376] should_failslab+0xa8/0x100 [ 1422.612186][T28376] __kmalloc_cache_noprof+0x84/0x700 [ 1422.612208][T28376] ? sctp_add_bind_addr+0x8c/0x370 [ 1422.612234][T28376] ? __pfx_sctp_get_port_local+0x10/0x10 [ 1422.612259][T28376] sctp_add_bind_addr+0x8c/0x370 [ 1422.612284][T28376] ? sctp_auto_asconf_init+0x15c/0x1e0 [ 1422.612309][T28376] sctp_do_bind+0x5b0/0x9d0 [ 1422.612342][T28376] sctp_connect_new_asoc+0x25c/0x690 [ 1422.612366][T28376] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 1422.612389][T28376] ? __local_bh_enable_ip+0xd0/0x130 [ 1422.612407][T28376] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 1422.612424][T28376] ? security_sctp_bind_connect+0x7e/0x2e0 [ 1422.612445][T28376] sctp_sendmsg+0x155c/0x2840 [ 1422.612473][T28376] ? __pfx_sctp_sendmsg+0x10/0x10 [ 1422.612487][T28376] ? aa_sk_perm+0x15f/0x920 [ 1422.612510][T28376] ? aa_sk_perm+0x7ee/0x920 [ 1422.612538][T28376] ? __pfx_aa_sk_perm+0x10/0x10 [ 1422.612565][T28376] ? sock_rps_record_flow+0x19/0x410 [ 1422.612593][T28376] ? inet_sendmsg+0x2f4/0x370 [ 1422.612619][T28376] __sock_sendmsg+0x19c/0x270 [ 1422.612676][T28376] __sys_sendto+0x3bd/0x520 [ 1422.612699][T28376] ? __pfx___sys_sendto+0x10/0x10 [ 1422.612717][T28376] ? __mutex_unlock_slowpath+0x1a1/0x730 [ 1422.612752][T28376] ? __fget_files+0x3a0/0x420 [ 1422.612787][T28376] ? ksys_write+0x22a/0x250 [ 1422.612808][T28376] ? __pfx_ksys_write+0x10/0x10 [ 1422.612832][T28376] __x64_sys_sendto+0xde/0x100 [ 1422.612856][T28376] do_syscall_64+0xec/0xf80 [ 1422.612876][T28376] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1422.612894][T28376] ? trace_irq_disable+0x37/0x100 [ 1422.612918][T28376] ? clear_bhb_loop+0x60/0xb0 [ 1422.612941][T28376] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1422.612960][T28376] RIP: 0033:0x7f824eb8f749 [ 1422.612979][T28376] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1422.612995][T28376] RSP: 002b:00007f824fa6a038 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 1422.613016][T28376] RAX: ffffffffffffffda RBX: 00007f824ede5fa0 RCX: 00007f824eb8f749 [ 1422.613032][T28376] RDX: 0000000000000001 RSI: 0000200000000240 RDI: 0000000000000003 [ 1422.613045][T28376] RBP: 00007f824fa6a090 R08: 0000200000000080 R09: 000000000000001c [ 1422.613058][T28376] R10: 0000000000000051 R11: 0000000000000246 R12: 0000000000000001 [ 1422.613070][T28376] R13: 00007f824ede6038 R14: 00007f824ede5fa0 R15: 00007ffdef634ce8 [ 1422.613104][T28376] [ 1422.924287][T28374] netlink: 24 bytes leftover after parsing attributes in process `syz.3.21252'. [ 1423.037816][T28392] netlink: 12 bytes leftover after parsing attributes in process `syz.1.21259'. [ 1423.148546][T28397] ip6gre2: entered promiscuous mode [ 1423.153931][T28397] ip6gre2: entered allmulticast mode [ 1423.298810][T28406] xt_cgroup: xt_cgroup: no path or classid specified [ 1423.614769][T28424] syzkaller0: entered promiscuous mode [ 1423.627981][T28424] syzkaller0: entered allmulticast mode [ 1423.781171][T28406] bond15: entered promiscuous mode [ 1423.786341][T28406] bond15: entered allmulticast mode [ 1423.814421][T28406] 8021q: adding VLAN 0 to HW filter on device bond15 [ 1423.891603][T28438] netlink: 'syz.4.21275': attribute type 3 has an invalid length. [ 1423.899562][T28426] macvlan0: entered promiscuous mode [ 1423.899586][T28426] macvlan0: entered allmulticast mode [ 1423.901359][T28426] 8021q: adding VLAN 0 to HW filter on device macvlan0 [ 1424.165073][T28451] syzkaller0: entered promiscuous mode [ 1424.171243][T28451] syzkaller0: entered allmulticast mode [ 1424.939762][T28475] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1424.947023][T28475] IPv6: NLM_F_CREATE should be set when creating new route [ 1424.954323][T28475] IPv6: NLM_F_CREATE should be set when creating new route [ 1424.961682][T28475] IPv6: NLM_F_CREATE should be set when creating new route [ 1425.089258][T28481] xt_addrtype: ipv6 does not support BROADCAST matching [ 1425.109661][T28485] sctp: [Deprecated]: syz.2.21285 (pid 28485) Use of int in maxseg socket option. [ 1425.109661][T28485] Use struct sctp_assoc_value instead [ 1425.147788][T28484] sctp: [Deprecated]: syz.2.21285 (pid 28484) Use of int in maxseg socket option. [ 1425.147788][T28484] Use struct sctp_assoc_value instead [ 1426.482380][T28468] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1426.498395][T28469] syz_tun: entered allmulticast mode [ 1426.505774][T28478] __nla_validate_parse: 5 callbacks suppressed [ 1426.505793][T28478] netlink: 4 bytes leftover after parsing attributes in process `syz.1.21284'. [ 1426.524606][T28481] workqueue: Failed to create a rescuer kthread for wq "bond7": -EINTR [ 1426.701325][T28511] netlink: 56 bytes leftover after parsing attributes in process `syz.1.21292'. [ 1428.530993][T28511] workqueue: Failed to create a rescuer kthread for wq "bond7": -EINTR [ 1428.788131][T28534] speed is unknown, defaulting to 1000 [ 1429.024329][T28553] netlink: 1 bytes leftover after parsing attributes in process `syz.0.21300'. [ 1429.036173][T28553] syzkaller1: entered promiscuous mode [ 1429.042929][T28553] syzkaller1: entered allmulticast mode [ 1429.056855][T28552] netlink: 44 bytes leftover after parsing attributes in process `syz.1.21302'. [ 1429.147951][T28534] wlan0 speed is unknown, defaulting to 1000 [ 1429.148173][T28548] speed is unknown, defaulting to 1000 [ 1429.165079][T28556] ip6t_REJECT: TCP_RESET illegal for non-tcp [ 1429.201774][T28556] netlink: 'syz.4.21303': attribute type 6 has an invalid length. [ 1429.442549][T28565] syzkaller1: entered promiscuous mode [ 1429.450527][T28568] netlink: 256 bytes leftover after parsing attributes in process `syz.4.21307'. [ 1429.459959][T28565] syzkaller1: entered allmulticast mode [ 1429.576725][T28572] syzkaller1: entered promiscuous mode [ 1429.584598][T28572] syzkaller1: entered allmulticast mode [ 1429.645346][T28548] wlan0 speed is unknown, defaulting to 1000 [ 1429.970745][T28583] netlink: 16 bytes leftover after parsing attributes in process `syz.4.21312'. [ 1430.035917][T28589] dvmrp6: entered allmulticast mode [ 1430.045023][T28589] netlink: 24 bytes leftover after parsing attributes in process `syz.1.21314'. [ 1430.315238][T28602] netlink: 'syz.1.21318': attribute type 1 has an invalid length. [ 1430.459965][T28602] 8021q: adding VLAN 0 to HW filter on device bond7 [ 1430.579612][T28608] veth9: entered promiscuous mode [ 1430.595259][T28608] bond7: (slave veth9): Enslaving as an active interface with a down link [ 1430.625905][T28612] vlan0: entered allmulticast mode [ 1430.641249][T28612] bond7: entered allmulticast mode [ 1430.647963][T28612] bond7: (slave vlan0): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 1430.690514][T28619] netlink: 8 bytes leftover after parsing attributes in process `syz.3.21323'. [ 1430.746695][T28623] : entered promiscuous mode [ 1430.946358][T28636] FAULT_INJECTION: forcing a failure. [ 1430.946358][T28636] name failslab, interval 1, probability 0, space 0, times 0 [ 1430.997507][T28636] CPU: 1 UID: 0 PID: 28636 Comm: syz.0.21329 Not tainted syzkaller #0 PREEMPT(full) [ 1430.997543][T28636] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1430.997557][T28636] Call Trace: [ 1430.997576][T28636] [ 1430.997585][T28636] dump_stack_lvl+0xe8/0x150 [ 1430.997617][T28636] should_fail_ex+0x414/0x560 [ 1430.997653][T28636] should_failslab+0xa8/0x100 [ 1430.997680][T28636] kmem_cache_alloc_node_noprof+0x8c/0x720 [ 1430.997710][T28636] ? __alloc_skb+0x198/0x3a0 [ 1430.997730][T28636] ? __alloc_skb+0x1dc/0x3a0 [ 1430.997748][T28636] ? __local_bh_enable_ip+0xd0/0x130 [ 1430.997772][T28636] ? __alloc_skb+0x198/0x3a0 [ 1430.997793][T28636] __alloc_skb+0x1dc/0x3a0 [ 1430.997817][T28636] netlink_sendmsg+0x5c6/0xb30 [ 1430.997853][T28636] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1430.997880][T28636] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1430.997908][T28636] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1430.997927][T28636] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1430.997951][T28636] __sock_sendmsg+0x21c/0x270 [ 1430.997981][T28636] ____sys_sendmsg+0x505/0x820 [ 1430.998008][T28636] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1430.998037][T28636] ? import_iovec+0x74/0xa0 [ 1430.998063][T28636] ___sys_sendmsg+0x21f/0x2a0 [ 1430.998083][T28636] ? __pfx____sys_sendmsg+0x10/0x10 [ 1430.998134][T28636] ? __fget_files+0x2a/0x420 [ 1430.998156][T28636] ? __fget_files+0x3a0/0x420 [ 1430.998188][T28636] __x64_sys_sendmsg+0x19b/0x260 [ 1430.998213][T28636] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1430.998246][T28636] ? __pfx_ksys_write+0x10/0x10 [ 1430.998278][T28636] do_syscall_64+0xec/0xf80 [ 1430.998300][T28636] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1430.998320][T28636] ? trace_irq_disable+0x37/0x100 [ 1430.998345][T28636] ? clear_bhb_loop+0x60/0xb0 [ 1430.998370][T28636] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1430.998390][T28636] RIP: 0033:0x7fc2c998f749 [ 1430.998408][T28636] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1430.998426][T28636] RSP: 002b:00007fc2ca8af038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1430.998448][T28636] RAX: ffffffffffffffda RBX: 00007fc2c9be5fa0 RCX: 00007fc2c998f749 [ 1430.998482][T28636] RDX: 0000000000008000 RSI: 0000200000000100 RDI: 0000000000000003 [ 1430.998495][T28636] RBP: 00007fc2ca8af090 R08: 0000000000000000 R09: 0000000000000000 [ 1430.998509][T28636] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1430.998544][T28636] R13: 00007fc2c9be6038 R14: 00007fc2c9be5fa0 R15: 00007fffe3730368 [ 1430.998583][T28636] [ 1431.419486][T28653] netlink: 'syz.2.21336': attribute type 142 has an invalid length. [ 1431.652979][ T7113] IPVS: starting estimator thread 0... [ 1431.721139][T28670] IPVS: set_ctl: invalid protocol: 10 0.0.0.0:0 [ 1431.736289][T28670] IPVS: set_ctl: invalid protocol: 10 0.0.0.0:0 [ 1431.759723][T28663] IPVS: using max 27 ests per chain, 64800 per kthread [ 1432.456372][T28712] netlink: 48 bytes leftover after parsing attributes in process `syz.4.21356'. [ 1432.466857][T28712] netlink: 36 bytes leftover after parsing attributes in process `syz.4.21356'. [ 1432.639408][T20093] Bluetooth: hci4: command 0x0405 tx timeout [ 1432.698453][T28729] netlink: 'syz.2.21364': attribute type 12 has an invalid length. [ 1432.706401][T28729] netlink: 132 bytes leftover after parsing attributes in process `syz.2.21364'. [ 1432.747159][T28732] netlink: 24 bytes leftover after parsing attributes in process `syz.1.21365'. [ 1433.178476][T28763] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1433.185785][T28763] IPv6: NLM_F_CREATE should be set when creating new route [ 1433.234691][T28763] syzkaller1: entered promiscuous mode [ 1433.247486][T28763] syzkaller1: entered allmulticast mode [ 1433.268304][T28763] netlink: 16 bytes leftover after parsing attributes in process `syz.0.21374'. [ 1433.303709][T28763] netlink: 92 bytes leftover after parsing attributes in process `syz.0.21374'. [ 1433.335008][T28774] Cannot find add_set index 0 as target [ 1433.542192][T28793] xt_SECMARK: mode already set to 1 cannot mix with rules for mode 0 [ 1433.739546][T28801] netlink: 24 bytes leftover after parsing attributes in process `syz.0.21384'. [ 1433.785208][T28805] mac80211_hwsim hwsim61 syzkaller0: Caught tx_queue_len zero misconfig [ 1433.896767][T28811] netlink: 'syz.0.21384': attribute type 4 has an invalid length. [ 1434.084699][T28818] FAULT_INJECTION: forcing a failure. [ 1434.084699][T28818] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1434.107531][T28818] CPU: 1 UID: 0 PID: 28818 Comm: syz.2.21388 Not tainted syzkaller #0 PREEMPT(full) [ 1434.107557][T28818] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1434.107568][T28818] Call Trace: [ 1434.107575][T28818] [ 1434.107583][T28818] dump_stack_lvl+0xe8/0x150 [ 1434.107611][T28818] should_fail_ex+0x414/0x560 [ 1434.107642][T28818] _copy_from_user+0x2d/0xb0 [ 1434.107665][T28818] kstrtouint_from_user+0xc4/0x170 [ 1434.107686][T28818] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 1434.107722][T28818] proc_fail_nth_write+0x88/0x200 [ 1434.107741][T28818] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 1434.107765][T28818] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 1434.107784][T28818] vfs_write+0x27e/0xb30 [ 1434.107812][T28818] ? __pfx_vfs_write+0x10/0x10 [ 1434.107831][T28818] ? __fget_files+0x2a/0x420 [ 1434.107858][T28818] ? __fget_files+0x3a0/0x420 [ 1434.107879][T28818] ? __fget_files+0x2a/0x420 [ 1434.107909][T28818] ksys_write+0x145/0x250 [ 1434.107929][T28818] ? __pfx_ksys_write+0x10/0x10 [ 1434.107960][T28818] do_syscall_64+0xec/0xf80 [ 1434.107981][T28818] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1434.108000][T28818] ? trace_irq_disable+0x37/0x100 [ 1434.108025][T28818] ? clear_bhb_loop+0x60/0xb0 [ 1434.108050][T28818] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1434.108070][T28818] RIP: 0033:0x7fa72e78e1ff [ 1434.108089][T28818] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48 [ 1434.108108][T28818] RSP: 002b:00007fa72f5a9030 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 1434.108130][T28818] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fa72e78e1ff [ 1434.108145][T28818] RDX: 0000000000000001 RSI: 00007fa72f5a90a0 RDI: 0000000000000008 [ 1434.108158][T28818] RBP: 00007fa72f5a9090 R08: 0000000000000000 R09: 0000000000000000 [ 1434.108172][T28818] R10: 000000000000004e R11: 0000000000000293 R12: 0000000000000001 [ 1434.108189][T28818] R13: 00007fa72e9e6038 R14: 00007fa72e9e5fa0 R15: 00007fff7e9d2868 [ 1434.108234][T28818] [ 1434.352837][T28822] netlink: 1752 bytes leftover after parsing attributes in process `syz.2.21391'. [ 1434.536450][T28835] netlink: 12 bytes leftover after parsing attributes in process `syz.2.21396'. [ 1434.556883][T28835] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 1434.572314][T28835] team0: Port device batadv1 added [ 1434.736795][T28847] netlink: 12 bytes leftover after parsing attributes in process `syz.2.21401'. [ 1434.753357][T28845] syzkaller0: entered promiscuous mode [ 1434.793893][T28845] syzkaller0: entered allmulticast mode [ 1434.888272][T28857] Dead loop on virtual device ip6_vti0, fix it urgently! [ 1434.950054][T28862] ip6gre0: Master is either lo or non-ether device [ 1435.474937][T28895] bond5: option packets_per_slave: mode dependency failed, not supported in mode active-backup(1) [ 1435.491676][T28895] bond5 (unregistering): Released all slaves [ 1435.508785][ T3036] Bluetooth: hci4: command 0x0405 tx timeout [ 1435.713637][T28910] delete_channel: no stack [ 1436.336111][T28932] tipc: Enabled bearer , priority 0 [ 1436.366985][T28932] syzkaller0: mtu greater than device maximum [ 1436.402594][T28931] tipc: Disabling bearer [ 1436.531619][T28945] bridge_slave_0: left allmulticast mode [ 1436.539112][T28945] bridge_slave_0: left promiscuous mode [ 1436.545128][T28945] bridge0: port 1(bridge_slave_0) entered disabled state [ 1436.566000][T28945] bridge_slave_1: left allmulticast mode [ 1436.573035][T28945] bridge_slave_1: left promiscuous mode [ 1436.579783][T28945] bridge0: port 2(bridge_slave_1) entered disabled state [ 1436.593860][T28945] bond0: (slave bond_slave_0): Releasing backup interface [ 1436.609025][T28945] bond_slave_0: left promiscuous mode [ 1436.619956][T28945] bond0: (slave bond_slave_1): Releasing backup interface [ 1436.628585][T28945] bond_slave_1: left promiscuous mode [ 1436.641539][T28945] team0: Port device team_slave_0 removed [ 1436.656723][T28945] team0: Port device team_slave_1 removed [ 1436.664578][T28945] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1436.684546][T28945] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1436.705508][T28945] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1436.717165][T28945] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1436.731985][T28945] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 1436.913541][T28961] syz_tun: entered allmulticast mode [ 1436.931475][T28959] syz_tun: left allmulticast mode [ 1437.051539][T28964] FAULT_INJECTION: forcing a failure. [ 1437.051539][T28964] name failslab, interval 1, probability 0, space 0, times 0 [ 1437.074022][T28964] CPU: 0 UID: 0 PID: 28964 Comm: syz.1.21439 Not tainted syzkaller #0 PREEMPT(full) [ 1437.074051][T28964] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1437.074064][T28964] Call Trace: [ 1437.074072][T28964] [ 1437.074081][T28964] dump_stack_lvl+0xe8/0x150 [ 1437.074112][T28964] should_fail_ex+0x414/0x560 [ 1437.074148][T28964] should_failslab+0xa8/0x100 [ 1437.074174][T28964] kmem_cache_alloc_noprof+0x88/0x710 [ 1437.074205][T28964] ? security_file_alloc+0x34/0x330 [ 1437.074230][T28964] security_file_alloc+0x34/0x330 [ 1437.074250][T28964] init_file+0x93/0x2f0 [ 1437.074278][T28964] alloc_empty_file+0x6e/0x1d0 [ 1437.074305][T28964] alloc_file_pseudo+0x13d/0x210 [ 1437.074333][T28964] ? __pfx_alloc_file_pseudo+0x10/0x10 [ 1437.074359][T28964] ? __pfx_hugetlb_reserve_pages+0x10/0x10 [ 1437.074382][T28964] ? rcu_is_watching+0x15/0xb0 [ 1437.074407][T28964] ? hugetlbfs_get_inode+0x448/0x640 [ 1437.074438][T28964] hugetlb_file_setup+0x3ee/0x630 [ 1437.074467][T28964] ksys_mmap_pgoff+0x22f/0x760 [ 1437.074497][T28964] do_syscall_64+0xec/0xf80 [ 1437.074515][T28964] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1437.074530][T28964] ? trace_irq_disable+0x37/0x100 [ 1437.074551][T28964] ? clear_bhb_loop+0x60/0xb0 [ 1437.074571][T28964] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1437.074588][T28964] RIP: 0033:0x7fb7b918f749 [ 1437.074604][T28964] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1437.074619][T28964] RSP: 002b:00007fb7ba02b038 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 1437.074637][T28964] RAX: ffffffffffffffda RBX: 00007fb7b93e5fa0 RCX: 00007fb7b918f749 [ 1437.074650][T28964] RDX: 0000000005000004 RSI: 0000000000800000 RDI: 0000200000800000 [ 1437.074662][T28964] RBP: 00007fb7ba02b090 R08: 0000000000000008 R09: 0000000000000000 [ 1437.074673][T28964] R10: 000000000006e073 R11: 0000000000000246 R12: 0000000000000001 [ 1437.074683][T28964] R13: 00007fb7b93e6038 R14: 00007fb7b93e5fa0 R15: 00007ffd371df488 [ 1437.074711][T28964] [ 1437.614744][T28989] netlink: 'syz.2.21449': attribute type 1 has an invalid length. [ 1437.665167][T28989] 8021q: adding VLAN 0 to HW filter on device bond5 [ 1437.676068][T28994] netlink: 'syz.3.21451': attribute type 5 has an invalid length. [ 1438.026607][T29009] __nla_validate_parse: 9 callbacks suppressed [ 1438.026625][T29009] netlink: 4 bytes leftover after parsing attributes in process `syz.3.21454'. [ 1438.461487][T29032] netlink: 24 bytes leftover after parsing attributes in process `syz.1.21462'. [ 1438.493229][T29032] netlink: 'syz.1.21462': attribute type 4 has an invalid length. [ 1438.598595][T29036] netlink: 12 bytes leftover after parsing attributes in process `syz.4.21464'. [ 1438.811902][T29045] netlink: 20 bytes leftover after parsing attributes in process `syz.1.21467'. [ 1438.833812][T29045] x_tables: (null)_tables: SNAT target: only valid in nat table, not syz0 [ 1438.871317][T29045] syzkaller1: entered promiscuous mode [ 1438.890313][T29045] syzkaller1: entered allmulticast mode [ 1438.909323][T29043] speed is unknown, defaulting to 1000 [ 1439.000393][T29052] netlink: 'syz.0.21470': attribute type 1 has an invalid length. [ 1439.048906][T29052] netlink: 'syz.0.21470': attribute type 1 has an invalid length. [ 1439.130619][T29043] wlan0 speed is unknown, defaulting to 1000 [ 1439.150991][T29055] syz_tun: entered allmulticast mode [ 1439.310320][T29064] netlink: 4 bytes leftover after parsing attributes in process `syz.0.21473'. [ 1439.324087][T29064] netlink: 'syz.0.21473': attribute type 17 has an invalid length. [ 1439.433175][T29054] syz_tun: left allmulticast mode [ 1439.556006][T29077] netlink: 'syz.1.21479': attribute type 1 has an invalid length. [ 1439.652650][T29081] FAULT_INJECTION: forcing a failure. [ 1439.652650][T29081] name failslab, interval 1, probability 0, space 0, times 0 [ 1439.665921][T29081] CPU: 0 UID: 0 PID: 29081 Comm: syz.3.21480 Not tainted syzkaller #0 PREEMPT(full) [ 1439.665949][T29081] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1439.665971][T29081] Call Trace: [ 1439.665980][T29081] [ 1439.665989][T29081] dump_stack_lvl+0xe8/0x150 [ 1439.666021][T29081] should_fail_ex+0x414/0x560 [ 1439.666059][T29081] should_failslab+0xa8/0x100 [ 1439.666085][T29081] __kmalloc_noprof+0xdf/0x800 [ 1439.666106][T29081] ? nla_strdup+0x9d/0x140 [ 1439.666127][T29081] ? __kmalloc_cache_noprof+0x3e2/0x700 [ 1439.666151][T29081] nla_strdup+0x9d/0x140 [ 1439.666175][T29081] nf_tables_newflowtable+0xa0d/0x2390 [ 1439.666214][T29081] ? __pfx_nf_tables_newflowtable+0x10/0x10 [ 1439.666237][T29081] ? nfnl_pernet+0x23/0x240 [ 1439.666273][T29081] ? __nla_parse+0x40/0x60 [ 1439.666301][T29081] nfnetlink_rcv+0x11d9/0x2590 [ 1439.666360][T29081] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 1439.666401][T29081] ? ref_tracker_free+0x63a/0x7d0 [ 1439.666451][T29081] ? __netlink_deliver_tap+0x807/0x850 [ 1439.666477][T29081] ? netlink_deliver_tap+0x2e/0x1b0 [ 1439.666521][T29081] netlink_unicast+0x82f/0x9e0 [ 1439.666553][T29081] ? __pfx_netlink_unicast+0x10/0x10 [ 1439.666574][T29081] ? __alloc_skb+0x198/0x3a0 [ 1439.666596][T29081] ? netlink_sendmsg+0x642/0xb30 [ 1439.666620][T29081] ? skb_put+0x11b/0x210 [ 1439.666645][T29081] netlink_sendmsg+0x805/0xb30 [ 1439.666677][T29081] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1439.666703][T29081] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1439.666731][T29081] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1439.666749][T29081] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1439.666777][T29081] __sock_sendmsg+0x21c/0x270 [ 1439.666813][T29081] ____sys_sendmsg+0x505/0x820 [ 1439.666843][T29081] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1439.666877][T29081] ? import_iovec+0x74/0xa0 [ 1439.666906][T29081] ___sys_sendmsg+0x21f/0x2a0 [ 1439.666932][T29081] ? __pfx____sys_sendmsg+0x10/0x10 [ 1439.667001][T29081] ? __fget_files+0x2a/0x420 [ 1439.667025][T29081] ? __fget_files+0x3a0/0x420 [ 1439.667061][T29081] __x64_sys_sendmsg+0x19b/0x260 [ 1439.667088][T29081] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1439.667123][T29081] ? __pfx_ksys_write+0x10/0x10 [ 1439.667156][T29081] do_syscall_64+0xec/0xf80 [ 1439.667178][T29081] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1439.667197][T29081] ? trace_irq_disable+0x37/0x100 [ 1439.667223][T29081] ? clear_bhb_loop+0x60/0xb0 [ 1439.667247][T29081] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1439.667267][T29081] RIP: 0033:0x7f7ce898f749 [ 1439.667285][T29081] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1439.667304][T29081] RSP: 002b:00007f7ce9840038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1439.667325][T29081] RAX: ffffffffffffffda RBX: 00007f7ce8be5fa0 RCX: 00007f7ce898f749 [ 1439.667340][T29081] RDX: 0000000000000000 RSI: 0000200000000200 RDI: 0000000000000003 [ 1439.667351][T29081] RBP: 00007f7ce9840090 R08: 0000000000000000 R09: 0000000000000000 [ 1439.667362][T29081] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1439.667373][T29081] R13: 00007f7ce8be6038 R14: 00007f7ce8be5fa0 R15: 00007ffc4e30afe8 [ 1439.667404][T29081] [ 1439.685178][T29077] 8021q: adding VLAN 0 to HW filter on device bond8 [ 1440.025629][T29085] netlink: 80 bytes leftover after parsing attributes in process `syz.4.21482'. [ 1440.150946][T29091] netlink: 8 bytes leftover after parsing attributes in process `syz.3.21484'. [ 1440.239851][T29094] netlink: 12 bytes leftover after parsing attributes in process `syz.1.21486'. [ 1440.316553][T29103] FAULT_INJECTION: forcing a failure. [ 1440.316553][T29103] name failslab, interval 1, probability 0, space 0, times 0 [ 1440.363029][T29103] CPU: 0 UID: 0 PID: 29103 Comm: syz.3.21490 Not tainted syzkaller #0 PREEMPT(full) [ 1440.363058][T29103] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1440.363071][T29103] Call Trace: [ 1440.363079][T29103] [ 1440.363088][T29103] dump_stack_lvl+0xe8/0x150 [ 1440.363119][T29103] should_fail_ex+0x414/0x560 [ 1440.363156][T29103] should_failslab+0xa8/0x100 [ 1440.363182][T29103] kmem_cache_alloc_noprof+0x88/0x710 [ 1440.363210][T29103] ? sk_filter_trim_cap+0x1e1/0xd60 [ 1440.363238][T29103] ? skb_clone+0x212/0x3a0 [ 1440.363267][T29103] skb_clone+0x212/0x3a0 [ 1440.363296][T29103] __netlink_deliver_tap+0x404/0x850 [ 1440.363334][T29103] ? netlink_deliver_tap+0x2e/0x1b0 [ 1440.363361][T29103] netlink_deliver_tap+0x19c/0x1b0 [ 1440.363387][T29103] netlink_dump+0x92b/0xe90 [ 1440.363423][T29103] ? __pfx_netlink_dump+0x10/0x10 [ 1440.363444][T29103] ? __netlink_lookup+0x7db/0x8a0 [ 1440.363486][T29103] ? netlink_lookup+0x30/0x200 [ 1440.363509][T29103] ? netlink_lookup+0x30/0x200 [ 1440.363530][T29103] ? netlink_lookup+0x30/0x200 [ 1440.363559][T29103] __netlink_dump_start+0x5cb/0x7e0 [ 1440.363592][T29103] rtnetlink_rcv_msg+0x9eb/0xb70 [ 1440.363616][T29103] ? __pfx_br_vlan_rtm_dump+0x10/0x10 [ 1440.363640][T29103] ? rtnetlink_rcv_msg+0x1ab/0xb70 [ 1440.363661][T29103] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1440.363680][T29103] ? ref_tracker_free+0x63a/0x7d0 [ 1440.363709][T29103] ? __pfx_rtnl_dumpit+0x10/0x10 [ 1440.363730][T29103] ? __pfx_br_vlan_rtm_dump+0x10/0x10 [ 1440.363766][T29103] netlink_rcv_skb+0x208/0x470 [ 1440.363792][T29103] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1440.363816][T29103] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1440.363853][T29103] ? netlink_deliver_tap+0x2e/0x1b0 [ 1440.363887][T29103] netlink_unicast+0x82f/0x9e0 [ 1440.363920][T29103] ? __pfx_netlink_unicast+0x10/0x10 [ 1440.363941][T29103] ? __alloc_skb+0x198/0x3a0 [ 1440.363962][T29103] ? netlink_sendmsg+0x642/0xb30 [ 1440.363985][T29103] ? skb_put+0x11b/0x210 [ 1440.364010][T29103] netlink_sendmsg+0x805/0xb30 [ 1440.364046][T29103] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1440.364076][T29103] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1440.364104][T29103] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1440.364123][T29103] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1440.364150][T29103] __sock_sendmsg+0x21c/0x270 [ 1440.364183][T29103] ____sys_sendmsg+0x505/0x820 [ 1440.364213][T29103] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1440.364248][T29103] ? import_iovec+0x74/0xa0 [ 1440.364277][T29103] ___sys_sendmsg+0x21f/0x2a0 [ 1440.364303][T29103] ? __pfx____sys_sendmsg+0x10/0x10 [ 1440.364366][T29103] ? __fget_files+0x2a/0x420 [ 1440.364390][T29103] ? __fget_files+0x3a0/0x420 [ 1440.364427][T29103] __x64_sys_sendmsg+0x19b/0x260 [ 1440.364453][T29103] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1440.364488][T29103] ? __pfx_ksys_write+0x10/0x10 [ 1440.364521][T29103] do_syscall_64+0xec/0xf80 [ 1440.364542][T29103] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1440.364562][T29103] ? trace_irq_disable+0x37/0x100 [ 1440.364588][T29103] ? clear_bhb_loop+0x60/0xb0 [ 1440.364613][T29103] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1440.364633][T29103] RIP: 0033:0x7f7ce898f749 [ 1440.364651][T29103] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1440.364670][T29103] RSP: 002b:00007f7ce9840038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1440.364699][T29103] RAX: ffffffffffffffda RBX: 00007f7ce8be5fa0 RCX: 00007f7ce898f749 [ 1440.364714][T29103] RDX: 0000000020000050 RSI: 0000200000000100 RDI: 0000000000000003 [ 1440.364728][T29103] RBP: 00007f7ce9840090 R08: 0000000000000000 R09: 0000000000000000 [ 1440.364741][T29103] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1440.364754][T29103] R13: 00007f7ce8be6038 R14: 00007f7ce8be5fa0 R15: 00007ffc4e30afe8 [ 1440.364789][T29103] [ 1440.378132][T29105] FAULT_INJECTION: forcing a failure. [ 1440.378132][T29105] name failslab, interval 1, probability 0, space 0, times 0 [ 1440.828238][T29105] CPU: 1 UID: 0 PID: 29105 Comm: syz.0.21491 Not tainted syzkaller #0 PREEMPT(full) [ 1440.828265][T29105] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1440.828276][T29105] Call Trace: [ 1440.828284][T29105] [ 1440.828293][T29105] dump_stack_lvl+0xe8/0x150 [ 1440.828324][T29105] should_fail_ex+0x414/0x560 [ 1440.828358][T29105] should_failslab+0xa8/0x100 [ 1440.828381][T29105] kmem_cache_alloc_noprof+0x88/0x710 [ 1440.828411][T29105] ? skb_clone+0x212/0x3a0 [ 1440.828439][T29105] skb_clone+0x212/0x3a0 [ 1440.828466][T29105] __netlink_deliver_tap+0x404/0x850 [ 1440.828503][T29105] ? netlink_deliver_tap+0x2e/0x1b0 [ 1440.828528][T29105] netlink_deliver_tap+0x19c/0x1b0 [ 1440.828553][T29105] netlink_sendskb+0x68/0x140 [ 1440.828575][T29105] netlink_unicast+0x397/0x9e0 [ 1440.828595][T29105] ? __asan_memcpy+0x40/0x70 [ 1440.828630][T29105] ? __pfx_netlink_unicast+0x10/0x10 [ 1440.828662][T29105] netlink_rcv_skb+0x28c/0x470 [ 1440.828684][T29105] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1440.828708][T29105] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1440.828743][T29105] ? netlink_deliver_tap+0x2e/0x1b0 [ 1440.828773][T29105] netlink_unicast+0x82f/0x9e0 [ 1440.828803][T29105] ? __pfx_netlink_unicast+0x10/0x10 [ 1440.828824][T29105] ? __alloc_skb+0x198/0x3a0 [ 1440.828841][T29105] ? netlink_sendmsg+0x642/0xb30 [ 1440.828861][T29105] ? skb_put+0x11b/0x210 [ 1440.828890][T29105] netlink_sendmsg+0x805/0xb30 [ 1440.828921][T29105] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1440.828946][T29105] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1440.828973][T29105] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1440.828991][T29105] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1440.829015][T29105] __sock_sendmsg+0x21c/0x270 [ 1440.829045][T29105] ____sys_sendmsg+0x505/0x820 [ 1440.829074][T29105] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1440.829105][T29105] ? import_iovec+0x74/0xa0 [ 1440.829132][T29105] ___sys_sendmsg+0x21f/0x2a0 [ 1440.829157][T29105] ? __pfx____sys_sendmsg+0x10/0x10 [ 1440.829213][T29105] ? __fget_files+0x2a/0x420 [ 1440.829235][T29105] ? __fget_files+0x3a0/0x420 [ 1440.829269][T29105] __x64_sys_sendmsg+0x19b/0x260 [ 1440.829296][T29105] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1440.829329][T29105] ? __pfx_ksys_write+0x10/0x10 [ 1440.829359][T29105] do_syscall_64+0xec/0xf80 [ 1440.829380][T29105] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1440.829399][T29105] ? trace_irq_disable+0x37/0x100 [ 1440.829424][T29105] ? clear_bhb_loop+0x60/0xb0 [ 1440.829449][T29105] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1440.829468][T29105] RIP: 0033:0x7fc2c998f749 [ 1440.829487][T29105] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1440.829505][T29105] RSP: 002b:00007fc2ca8af038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1440.829528][T29105] RAX: ffffffffffffffda RBX: 00007fc2c9be5fa0 RCX: 00007fc2c998f749 [ 1440.829543][T29105] RDX: 0000000004000000 RSI: 0000200000000200 RDI: 0000000000000003 [ 1440.829556][T29105] RBP: 00007fc2ca8af090 R08: 0000000000000000 R09: 0000000000000000 [ 1440.829569][T29105] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1440.829581][T29105] R13: 00007fc2c9be6038 R14: 00007fc2c9be5fa0 R15: 00007fffe3730368 [ 1440.829618][T29105] [ 1441.543578][T29145] netlink: 'syz.4.21499': attribute type 1 has an invalid length. [ 1441.582057][T29148] IPVS: set_ctl: invalid protocol: 59 127.0.0.1:20003 [ 1441.648427][T29145] netlink: 'syz.4.21499': attribute type 1 has an invalid length. [ 1441.864680][T29164] netlink: 44 bytes leftover after parsing attributes in process `syz.2.21502'. [ 1441.885350][T29166] syz_tun: entered allmulticast mode [ 1441.897606][T29164] netlink: 43 bytes leftover after parsing attributes in process `syz.2.21502'. [ 1441.906844][T29164] netlink: 'syz.2.21502': attribute type 5 has an invalid length. [ 1441.975636][T29166] syz_tun: left allmulticast mode [ 1442.183819][T29189] SET target dimension over the limit! [ 1442.207116][T29191] netlink: 'syz.0.21513': attribute type 11 has an invalid length. [ 1442.232802][T29191] netlink: 'syz.0.21513': attribute type 11 has an invalid length. [ 1442.407624][T29202] xt_SECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 1442.546443][T29212] syzkaller0: entered promiscuous mode [ 1442.552282][T29212] syzkaller0: entered allmulticast mode [ 1442.860102][T29228] netlink: 'syz.3.21528': attribute type 6 has an invalid length. [ 1442.944662][T29234] FAULT_INJECTION: forcing a failure. [ 1442.944662][T29234] name failslab, interval 1, probability 0, space 0, times 0 [ 1442.958924][T29234] CPU: 1 UID: 0 PID: 29234 Comm: syz.2.21530 Not tainted syzkaller #0 PREEMPT(full) [ 1442.958951][T29234] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1442.958964][T29234] Call Trace: [ 1442.958972][T29234] [ 1442.958981][T29234] dump_stack_lvl+0xe8/0x150 [ 1442.959012][T29234] should_fail_ex+0x414/0x560 [ 1442.959047][T29234] should_failslab+0xa8/0x100 [ 1442.959074][T29234] kmem_cache_alloc_node_noprof+0x8c/0x720 [ 1442.959104][T29234] ? __alloc_skb+0x198/0x3a0 [ 1442.959124][T29234] ? __alloc_skb+0x1dc/0x3a0 [ 1442.959142][T29234] ? __local_bh_enable_ip+0xd0/0x130 [ 1442.959166][T29234] ? __alloc_skb+0x198/0x3a0 [ 1442.959187][T29234] __alloc_skb+0x1dc/0x3a0 [ 1442.959212][T29234] netlink_sendmsg+0x5c6/0xb30 [ 1442.959248][T29234] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1442.959277][T29234] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1442.959305][T29234] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1442.959323][T29234] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1442.959350][T29234] __sock_sendmsg+0x21c/0x270 [ 1442.959381][T29234] ____sys_sendmsg+0x505/0x820 [ 1442.959411][T29234] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1442.959444][T29234] ? import_iovec+0x74/0xa0 [ 1442.959473][T29234] ___sys_sendmsg+0x21f/0x2a0 [ 1442.959499][T29234] ? __pfx____sys_sendmsg+0x10/0x10 [ 1442.959560][T29234] ? __fget_files+0x2a/0x420 [ 1442.959583][T29234] ? __fget_files+0x3a0/0x420 [ 1442.959625][T29234] __x64_sys_sendmsg+0x19b/0x260 [ 1442.959652][T29234] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1442.959686][T29234] ? __pfx_ksys_write+0x10/0x10 [ 1442.959718][T29234] do_syscall_64+0xec/0xf80 [ 1442.959739][T29234] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1442.959758][T29234] ? trace_irq_disable+0x37/0x100 [ 1442.959802][T29234] ? clear_bhb_loop+0x60/0xb0 [ 1442.959826][T29234] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1442.959846][T29234] RIP: 0033:0x7fa72e78f749 [ 1442.959867][T29234] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1442.959886][T29234] RSP: 002b:00007fa72f5a9038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1442.959908][T29234] RAX: ffffffffffffffda RBX: 00007fa72e9e5fa0 RCX: 00007fa72e78f749 [ 1442.959925][T29234] RDX: 0000000000000000 RSI: 0000200000001380 RDI: 0000000000000003 [ 1442.959939][T29234] RBP: 00007fa72f5a9090 R08: 0000000000000000 R09: 0000000000000000 [ 1442.959952][T29234] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1442.959965][T29234] R13: 00007fa72e9e6038 R14: 00007fa72e9e5fa0 R15: 00007fff7e9d2868 [ 1442.960000][T29234] [ 1443.368993][T29214] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 1443.563092][T29258] __nla_validate_parse: 4 callbacks suppressed [ 1443.563112][T29258] netlink: 12 bytes leftover after parsing attributes in process `syz.0.21540'. [ 1443.696041][T29270] tls_set_device_offload_rx: netdev not found [ 1443.889140][T29285] tipc: Trying to set illegal importance in message [ 1443.966449][T29287] speed is unknown, defaulting to 1000 [ 1444.343794][T29301] netlink: 32 bytes leftover after parsing attributes in process `syz.2.21556'. [ 1444.355015][T29287] wlan0 speed is unknown, defaulting to 1000 [ 1445.205244][T29340] tipc: Enabled bearer , priority 0 [ 1445.264999][T29347] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 1445.314420][T29340] syzkaller0: mtu greater than device maximum [ 1445.321931][T29350] netlink: 'syz.4.21568': attribute type 10 has an invalid length. [ 1445.384171][T29339] tipc: Disabling bearer [ 1445.601609][T29361] netlink: 52 bytes leftover after parsing attributes in process `syz.1.21573'. [ 1445.628722][T29361] netlink: 52 bytes leftover after parsing attributes in process `syz.1.21573'. [ 1445.644352][T29366] netlink: 48 bytes leftover after parsing attributes in process `syz.2.21575'. [ 1445.690335][T29358] speed is unknown, defaulting to 1000 [ 1445.934996][T29379] netlink: 8 bytes leftover after parsing attributes in process `syz.2.21577'. [ 1445.980613][T29344] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1] SMP KASAN PTI [ 1445.992539][T29344] KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037] [ 1446.000950][T29344] CPU: 0 UID: 0 PID: 29344 Comm: syz.0.21567 Not tainted syzkaller #0 PREEMPT(full) [ 1446.010399][T29344] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1446.020487][T29344] RIP: 0010:rose_transmit_link+0x32/0x740 [ 1446.026207][T29344] Code: 56 41 55 41 54 53 48 83 ec 18 48 89 f5 49 89 fc 49 be 00 00 00 00 00 fc ff df e8 39 55 76 f7 4c 8d 7d 36 4c 89 f8 48 c1 e8 03 <42> 0f b6 04 30 84 c0 0f 85 6e 05 00 00 41 0f b6 1f 31 ff 89 de e8 [ 1446.045813][T29344] RSP: 0018:ffffc9000c81f910 EFLAGS: 00010207 [ 1446.051879][T29344] RAX: 0000000000000006 RBX: 0000000000000000 RCX: ffff8880559a9e80 [ 1446.059843][T29344] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff888032510c80 [ 1446.067807][T29344] RBP: 0000000000000000 R08: ffff8880559a9e80 R09: 0000000000000008 [ 1446.075771][T29344] R10: 000000000000000f R11: 0000000000000000 R12: ffff888032510c80 [ 1446.083736][T29344] R13: dffffc0000000000 R14: dffffc0000000000 R15: 0000000000000036 [ 1446.091706][T29344] FS: 00007fc2ca8af6c0(0000) GS:ffff888125e1f000(0000) knlGS:0000000000000000 [ 1446.100635][T29344] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1446.107261][T29344] CR2: 00007f1eec5ffe9c CR3: 00000000582b6000 CR4: 00000000003526f0 [ 1446.115227][T29344] Call Trace: [ 1446.118501][T29344] [ 1446.121428][T29344] ? skb_put+0x11b/0x210 [ 1446.125669][T29344] rose_write_internal+0x11dc/0x1ac0 [ 1446.130961][T29344] ? lockdep_hardirqs_on+0x7b/0x110 [ 1446.136165][T29344] ? __pfx_rose_write_internal+0x10/0x10 [ 1446.141795][T29344] ? __timer_delete+0x5d/0x390 [ 1446.146555][T29344] rose_release+0x25b/0x510 [ 1446.151062][T29344] sock_close+0xc3/0x240 [ 1446.155313][T29344] ? __pfx_sock_close+0x10/0x10 [ 1446.160163][T29344] __fput+0x44c/0xa70 [ 1446.164149][T29344] task_work_run+0x1d4/0x260 [ 1446.168739][T29344] ? __pfx_task_work_run+0x10/0x10 [ 1446.173857][T29344] ? task_work_add+0x391/0x440 [ 1446.178623][T29344] ? __pfx_task_work_add+0x10/0x10 [ 1446.183733][T29344] get_signal+0x11ec/0x1340 [ 1446.188287][T29344] arch_do_signal_or_restart+0x9a/0x7a0 [ 1446.193834][T29344] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 1446.199995][T29344] exit_to_user_mode_loop+0x87/0x4e0 [ 1446.205320][T29344] ? rcu_is_watching+0x15/0xb0 [ 1446.210085][T29344] do_syscall_64+0x2c1/0xf80 [ 1446.214684][T29344] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1446.220742][T29344] ? trace_irq_disable+0x37/0x100 [ 1446.225824][T29344] ? clear_bhb_loop+0x60/0xb0 [ 1446.230496][T29344] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1446.236384][T29344] RIP: 0033:0x7fc2c998f749 [ 1446.240797][T29344] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1446.260401][T29344] RSP: 002b:00007fc2ca8af038 EFLAGS: 00000246 ORIG_RAX: 000000000000002a [ 1446.268809][T29344] RAX: 0000000000000000 RBX: 00007fc2c9be5fa0 RCX: 00007fc2c998f749 [ 1446.276774][T29344] RDX: 0000000000000040 RSI: 0000200000000580 RDI: 0000000000000009 [ 1446.284736][T29344] RBP: 00007fc2c9a13f91 R08: 0000000000000000 R09: 0000000000000000 [ 1446.292701][T29344] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1446.300660][T29344] R13: 00007fc2c9be6038 R14: 00007fc2c9be5fa0 R15: 00007fffe3730368 [ 1446.308635][T29344] [ 1446.311653][T29344] Modules linked in: [ 1446.318904][T29344] ---[ end trace 0000000000000000 ]--- [ 1446.353387][T29358] wlan0 speed is unknown, defaulting to 1000 [ 1446.361149][T29344] RIP: 0010:rose_transmit_link+0x32/0x740 [ 1446.367058][T29344] Code: 56 41 55 41 54 53 48 83 ec 18 48 89 f5 49 89 fc 49 be 00 00 00 00 00 fc ff df e8 39 55 76 f7 4c 8d 7d 36 4c 89 f8 48 c1 e8 03 <42> 0f b6 04 30 84 c0 0f 85 6e 05 00 00 41 0f b6 1f 31 ff 89 de e8 [ 1446.389975][T29344] RSP: 0018:ffffc9000c81f910 EFLAGS: 00010207 [ 1446.396153][T29344] RAX: 0000000000000006 RBX: 0000000000000000 RCX: ffff8880559a9e80 [ 1446.404360][T29344] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff888032510c80 [ 1446.413064][T29344] RBP: 0000000000000000 R08: ffff8880559a9e80 R09: 0000000000000008 [ 1446.421398][T29344] R10: 000000000000000f R11: 0000000000000000 R12: ffff888032510c80 [ 1446.429586][T29344] R13: dffffc0000000000 R14: dffffc0000000000 R15: 0000000000000036 [ 1446.442896][T29344] FS: 00007fc2ca8af6c0(0000) GS:ffff888125e1f000(0000) knlGS:0000000000000000 [ 1446.453036][T29344] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1446.460065][T29344] CR2: 00007fa72f587f98 CR3: 00000000582b6000 CR4: 00000000003526f0 [ 1446.485472][T29344] Kernel panic - not syncing: Fatal exception [ 1446.491923][T29344] Kernel Offset: disabled [ 1446.496244][T29344] Rebooting in 86400 seconds..