last executing test programs: 26.434999229s ago: executing program 3 (id=19627): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0xc0041, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) ioctl$TUNSETVNETHDRSZ(r0, 0x400454d8, &(0x7f0000000140)=0x90) write$tun(r0, &(0x7f0000000080)=ANY=[@ANYRESOCT], 0xfdef) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$kcm(0x29, 0x2, 0x0) sendmsg$kcm(r2, &(0x7f0000000b80)={&(0x7f00000000c0)=@nl=@proc={0x10, 0x0, 0x25dfdbfd, 0x2e80100}, 0x80, &(0x7f0000000840)=[{&(0x7f0000000380)="e5216fbc6aae629deb4b8dc7e0593c7f9410066adeabe0597f6da27df61765d7eee2bb0aba7e65b457381f081b0f1571170de569413d9e67c35f4fa5e3048c2f2ab89d39ed11d9028d0aec8181a2fae7c6c4ade83f3d19053aad24810465ade8c5fb38c8db1528de8e0cf41a0ecd09f62834dd134779f2faa3f40fa9bfe8d58abd8e98ab546628afaf48b30bad49eef42dccb9a6c1385191", 0x98}, {&(0x7f0000000440)="ec87fa1a6d9a146983c169cbbab493e9e54a9054ec3c124494c8747d3d3cb673704aee3ace20456e29e289ea3363242904cab554486d33c3cb45", 0x3a}, {&(0x7f0000000480)="9e595655860b3602281440d6640a239d494ae71d6c33e7c320611b876a955fffebaff071ba23278caae1eb488fc5b9751bb026c1c59b3e79c35c1bf993804e34ac581c97b50a162c454dcd816b2193a9012e4cda3606f651f8bb624220c8ade6ca8d3d2d2421d61407f4ef9fcf2c8fca52fc1a966885175a93e71b3ba5a42ffd4cc7d12fea1dc17a9e710614d13b1132cfa160bcb868d4ee706a9271128042ab9e", 0xa1}, {&(0x7f0000000540)="23e1d55e60fa5a30c92b65ec04ba77e980369420da6dc42ba5179034888c73f8", 0x20}, {&(0x7f0000000580)="59acaea882d3029907bd6dab1e18c97f8d0e6e5184e205deb87fa4dfeda3463176cd443a391ec8bff8a3e2a75b680e3b21dbd01d90b0131612df6d99d05d964234a93a5cb627eb04ff91778d5995c93c3a83fc2bb0e0383f7f75eec3acf6883080f426996e2b94386d3bcae222c66ee4e02a18afe40c1e1f315c792444a7642f720e408c79ec8c88dc9968c69b40f81eacb78d7ac4d8965fb782877f8b5cb7ef8a48afd64c043083e3203f20cee4eb7378d2a2866e096cc202c5a1750f718d1dfd7b03a385ea08421a49d98eb189279d568aa4dce4bf", 0xd6}, {&(0x7f0000000780)="9f721e57d41e40c2d02c754cf0773499e3bef63c2f3952ed6c46639b6d6892294c53605aee0c65bfd878a7b23c7e1a1d3e750df49b71239c1e5a96e7bfed08d3b4e1efaf84c6b1448847372d9a0ae36dc574beedbaac3c5aabaa5782b311c362edb28c66443e98f9af737b72f7d8c3c55b927846194b8b700163e11dee787ce075cb641553b036d64eec80ec1aacf3f3", 0x90}], 0x6}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000200)=@newtaction={0x7c, 0x30, 0x871a15abc695fb3d, 0x0, 0x0, {}, [{0x68, 0x1, [@m_tunnel_key={0x64, 0x1, 0x0, 0x0, {{0xf}, {0x7c, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0x5, @empty}, @TCA_TUNNEL_KEY_PARMS={0x1c}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x7c}}, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x6, 0xe, &(0x7f00000008c0)=ANY=[@ANYBLOB="b7020000ff0d1400bfa30000000000000703000000feffff7a0af0fff8ffff1971a4f0ff00000000b7060000080000006f6400000000000045040400010000001704000001000a00b7040000ff0100006a0a00fe0000000085000000bd000000b70000000000000095000000000000009e17f199a68b06d83298a8cdc21ce784909b849d5550ad857d0454d8877a6db61d69f2ffcaa10350e11cb97c8adf1bc9a0c4eeceb9971e43405d621ffbc9ce000000d8ca56b50d0c010d631f6dde53a9a53608c10556e5734eb84049761451ce540c772e2d9f8004e26f7fcc059c062234d5595f6fbaa187b81d1106000000000fd60000fd9ac3d09e29a9d542ca9d85a5c9c88474895d679838def0a83a733dc6a39b63a5ed69d32394c53361d7e43c5cbd80450f859ce8122a79c3e40000b59b0fc46d6cec3c0802882add4e3179bd4a44f231b6d753a7be428ba953df4aece69311687f4122073a236c3a32efa04137d4524847d2638da3261c8162bb7c7824be6195a66d2e17e122040e1100000000928612a29fc691e4f1f7bd053abb885f39381f1759410b1059f05684261f332d606834669b49ec99320ca7712d7e79bd5bf5ed818ecc7640917f6a559a47db608fcf9f6c131b84e41c354c66838f72b9e12d36e996f316f0812ca83efb30c7f6c6d57c4a64590401eec22523dd712c680013e87f649a1ede7142ca9d5d8a8c9f9b440fe4331ad5532c74d9a31a5d737537f7a2caa30581253d14dd3e92af7dc836686365ae01bdec561c0402b67801267a8df97d2f85426a5963d4fa3e26cc05972c162f223f000000d999e80de00fcbcc02d0aed7bb8f7ba337d59c14f39dcd4aad4139ef6425a9367f1bd1467fc6b95a4df7669839771ce9d5788029901e5a79d8b9990ace8f74087f25ad50c46088000000008000"/686], &(0x7f0000000040)='syzkaller\x00', 0x1000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000340), 0x10}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000c80)={r3, 0x2000012, 0xffe, 0x0, &(0x7f0000000c40), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 20.781780052s ago: executing program 3 (id=19650): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e21, @broadcast}, 0x2f) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000440)='vegas', 0x5) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f00000015c0), 0x2300, 0x0) ioctl$PPPIOCATTCHAN(r1, 0x40047438, 0x0) socket$netlink(0x10, 0x3, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, 0x0, 0x4000000) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB], 0xa4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB], 0x50}}, 0x0) sendmsg$NFT_BATCH(r2, 0x0, 0x40810) connect$inet(r0, 0x0, 0x0) r3 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000840)="89000000120081ae08060cdc030000fe7f030000000000000001ffca1b1f0000000024c00e72f750375ed08a56331dbf9ed7815e381ad6e747033a0093b837dc6cc01e32efaec8c7a6ec00150c00014003080c00bdad446b31007a46e3988285dcdf12f21308f868fece01955fed0009d78f0a947e", 0x75}, {&(0x7f0000000140)="11d6cb557c8496a2fe7a81f38210bfa9b70ee09c", 0x14}], 0x2}, 0x4000000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000640)={0xd, 0x4, &(0x7f0000000040)=@framed={{}, [@ldst={0x1, 0x0, 0x3, 0x2, 0x1, 0x50}]}, &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) 20.17455356s ago: executing program 3 (id=19652): bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x10, 0x4, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000001000000000000110000000071121f000000000095"], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0xf00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) 19.6794041s ago: executing program 3 (id=19654): setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x4e, &(0x7f0000000400)=0x2, 0x4) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000400)=ANY=[@ANYBLOB], 0x18}, 0x1, 0x0, 0x0, 0x4008}, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f0000000240), 0xffffffffffffffff) recvmsg(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000001d40)=""/4068, 0xfe4}, {&(0x7f0000002d80)=""/4112, 0x1010}, {&(0x7f0000000000)=""/15, 0xf}, {&(0x7f0000004000)=""/4085, 0xff5}, {&(0x7f00000016c0)=""/198, 0xc6}, {&(0x7f0000000500)=""/161, 0xa1}, {&(0x7f00000000c0)=""/42, 0x2a}, {&(0x7f0000000080)=""/60, 0x3c}, {&(0x7f00000005c0)=""/110, 0x6e}], 0x9}, 0x20100) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000c80)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@setlink={0x40, 0x13, 0x5, 0x70bd2c, 0x0, {0x0, 0x0, 0x0, 0x0, 0x102}, [@IFLA_IFNAME={0x14, 0x3, 'vlan0\x00'}, @IFLA_ADDRESS={0xa, 0x1, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x30}}]}, 0x40}, 0x1, 0x0, 0x0, 0x40000}, 0x42) syz_genetlink_get_family_id$gtp(&(0x7f00000008c0), 0xffffffffffffffff) 18.70137047s ago: executing program 3 (id=19656): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r0) r1 = socket$packet(0x11, 0x3, 0x300) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000003c0)={0x0, 0x24}}, 0x0) getsockname$packet(r3, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffff00f687000000", @ANYRES32=r4, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000400)=@newqdisc={0x50, 0x24, 0xe0b, 0x70bd28, 0x0, {0x0, 0x0, 0x0, r4, {}, {0xffff, 0xffff}, {0xffe0, 0xd064db0e491fa98f}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x20, 0x2, [@TCA_CAKE_INGRESS={0x8, 0xf, 0x1}, @TCA_CAKE_BASE_RATE64={0xc, 0x2, 0x81}, @TCA_CAKE_MEMORY={0x8, 0xa, 0x842}]}}]}, 0x50}, 0x1, 0x0, 0x0, 0x40}, 0x4000080) bind$packet(r1, &(0x7f0000000040)={0x11, 0x0, r4, 0x1, 0x0, 0x6, @remote}, 0x14) sendmsg$NFT_BATCH(r0, 0x0, 0x40) 17.887829773s ago: executing program 1 (id=19659): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000009c0)={{0x14}, [@NFT_MSG_NEWRULE={0x48, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x4}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_HANDLE={0xc, 0x3, 0x1, 0x0, 0x2}, @NFTA_RULE_HANDLE={0xc, 0x3, 0x1, 0x0, 0x1}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x5}}}, 0x70}, 0x1, 0x200000000000000, 0x0, 0x2000094}, 0x4000800) 17.644154964s ago: executing program 3 (id=19662): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r0) socket$nl_route(0x10, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, 0x0, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000480)=@newqdisc={0x50, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbfc, {0x0, 0x0, 0x0, r3, {0x0, 0xd}, {0x6, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x20, 0x2, [@TCA_CAKE_FLOW_MODE={0x8, 0x5, 0x1}, @TCA_CAKE_WASH={0x8, 0xd, 0x1}, @TCA_CAKE_BASE_RATE64={0xc, 0x2, 0x7}]}}]}, 0x50}, 0x1, 0x0, 0x0, 0x200040f0}, 0x4890) ioctl$SIOCSIFHWADDR(r0, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r4, 0x107, 0xf, &(0x7f0000000100)=0x4207, 0x4) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000040)={'syzkaller0\x00', 0x0}) sendto$packet(r4, &(0x7f00000002c0)="05031411d3fc220000004788031c09102c28", 0xfdef, 0x4, &(0x7f0000000140)={0x11, 0x86dd, r5, 0x1, 0x0, 0x6, @multicast}, 0x14) 17.479680525s ago: executing program 1 (id=19664): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000004c0)=@newsa={0xf0, 0x10, 0x7, 0x0, 0x0, {{@in6=@mcast2, @in=@multicast2, 0x4e20, 0x0, 0x4e23, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xee00}, {@in6=@mcast1, 0x0, 0x2b}, @in6=@private0, {0x0, 0x0, 0x2, 0x0, 0x10000000, 0xffffffffffffffff}, {0x0, 0x200000, 0x7}, {0x40000, 0xfffffffd, 0xae8}, 0x0, 0x0, 0xa, 0x2, 0x0, 0x34}}, 0xf0}}, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_PAUSE_SET(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000480)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="831008000000fcdb9f251608000018000180140002006e657464657673696d300000000000000500030001001300050004000100000005000400010000000500020001000000050002"], 0x54}, 0x1, 0x0, 0x0, 0x24000085}, 0x20000000) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @geneve={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GENEVE_LABEL={0x8, 0xb, 0x1, 0x0, 0x4f3e}]}}}]}, 0x3c}}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000300), r3) sendmsg$IPVS_CMD_SET_CONFIG(r3, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000340)={0x1c, r4, 0x1c20df3d40b5e7, 0x70bd27, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0xfffffff2}]}, 0x1c}, 0x1, 0x0, 0x0, 0xc000}, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r6 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r8 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@newqdisc={0x88, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r7, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x1, [], 0x0, [0x1, 0x2, 0xfffe, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x5c4, 0x8000, 0x0, 0x0, 0x3dc], [0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000]}}}}]}, 0x88}}, 0x20000000) r9 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(r9, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xfffbffff, {0x0, 0x0, 0x0, r7, {0x0, 0x8}, {0xffff, 0xffff}, {0xc, 0xfff3}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x1c, 0x2, [@TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x10, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0x8001}]}]}, @TCA_TAPRIO_ATTR_SCHED_CLOCKID={0x8, 0x5, 0x3}]}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40001}, 0x10) sendmsg$IPVS_CMD_GET_CONFIG(r1, &(0x7f0000000340)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000300)={&(0x7f0000000200)={0xcc, r4, 0x8, 0x70bd2a, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x1000}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x6deb}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x9}, @IPVS_DEST_ATTR_TUN_TYPE={0x5, 0xd, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x3c, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x6}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x4}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x2}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xb}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x6, 0xb, 0x2}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x6}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x4059}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8ae}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e24}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x9}, @IPVS_DEST_ATTR_FWD_METHOD={0x8}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8}, @IPVS_CMD_ATTR_DAEMON={0x24, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @loopback}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @broadcast}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x3}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}]}]}, 0xcc}, 0x1, 0x0, 0x0, 0x4c001}, 0x44000) 16.10087798s ago: executing program 4 (id=19669): bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x4, 0xe, &(0x7f0000000800)=ANY=[@ANYBLOB="b70200000a000000bfa30041000000000703000000feffff7a0af0ff0000000079a4f0ff00000000b7060000ffffffff2d6405000000000065040400010001010404000001007d60b7030000010000006a0a00fe00000000850000000d000000b700000001000000950000000000000075cdc4b57b0c65752a3ad50000007ddd0000cb4500639100002000000000000000ff7f0000b52f17cee19d0001000000000000000000cb04fcbb0b9bafe3ba431351a58a885ba9918d37b056b9bbd11b6b9f6cf7db6d574620260000000000008062d77e84cef4a2ab938f65aac33c4d620de2c9b7dc10d7d313f9f57606b83b994fb484510bef2e4872f5c2fe6faaf75e5cc4051ade12f41deff6df6a936b4ec3827c739bb39aad16cc75fe369258673b5df11cc2afb53611cc32a790bce5a6f087ae8f5e64be2c9d2d29db3d36dd015c7bd3f15aa6aadbeab2a01685108e61aa000000000000000000000000008b798b4f7458d1863cc67c4c6a06e828e5216f601b19db1af1b5d356d0f062137d866d11be4ba3f0151fdbbd4e97d62ecc645e143a60f1c6edc76609073909826151e2b42bf0ed0c8cef3ba2a730a00c87c493db845b10e9468bda6f82881eb8c9cfa72b08eecc952a3fd2c46f3c1cde71a19d1a2982492abaa96665372831210e00d2bfea3b8d188df2eff8d56aaae7d32a2e183722537395019f02ec4b85f6aad7faca088de9b26797a8446b16c28d85f225992dbdd5bb01ba51508951c7a7d6ca0916c3a12912715649c2b1c7192a4251b59d378d0616a48c7957e122665c8b7e89eddf"], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000100), 0x10}, 0x28) 15.440058825s ago: executing program 4 (id=19672): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r0) r1 = socket$packet(0x11, 0x3, 0x300) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000003c0)={0x0, 0x24}}, 0x0) getsockname$packet(r3, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffff00f687000000", @ANYRES32=r4, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000400)=@newqdisc={0x50, 0x24, 0xe0b, 0x70bd28, 0x0, {0x0, 0x0, 0x0, r4, {}, {0xffff, 0xffff}, {0xffe0, 0xd064db0e491fa98f}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x20, 0x2, [@TCA_CAKE_INGRESS={0x8, 0xf, 0x1}, @TCA_CAKE_BASE_RATE64={0xc, 0x2, 0x81}, @TCA_CAKE_MEMORY={0x8, 0xa, 0x842}]}}]}, 0x50}, 0x1, 0x0, 0x0, 0x40}, 0x4000080) bind$packet(r1, &(0x7f0000000040)={0x11, 0x0, r4, 0x1, 0x0, 0x6, @remote}, 0x14) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000850}, 0x40) 15.219406764s ago: executing program 2 (id=19673): bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0xe, 0x4, &(0x7f0000001300)=@framed={{}, [@ldst={0x1, 0x2, 0x3, 0x0, 0x1, 0x5d}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1e}, 0x94) (async) r0 = socket(0x11, 0x3, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000200)={'ip6tnl0\x00', &(0x7f0000000180)={'syztnl2\x00', 0x0, 0x29, 0x1, 0x2, 0x2, 0x28, @private1={0xfc, 0x1, '\x00', 0x1}, @mcast1, 0x40, 0x700, 0x2, 0x6}}) 14.931972741s ago: executing program 0 (id=19674): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001800)=ANY=[@ANYBLOB="180000002500010324bd7002ffdbdf25010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x88c}, 0x4040) recvmmsg(r0, &(0x7f0000002b00)=[{{0x0, 0x0, &(0x7f0000000340)=[{&(0x7f00000001c0)=""/217, 0xd9}, {&(0x7f0000000980)=""/90, 0x5a}, {&(0x7f00000006c0)=""/137, 0x89}, {&(0x7f0000001840)=""/4104, 0x1008}, {0x0}], 0x5}, 0x70001}, {{0x0, 0x0, 0x0}, 0xfffffffc}, {{0x0, 0x0, 0x0}, 0x5}, {{0x0, 0x0, 0x0}, 0x77}, {{0x0, 0x0, 0x0}, 0x7fffffff}, {{0x0, 0x0, 0x0}, 0xb}, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000}, 0x81}], 0x7, 0x102, 0x0) 5.433699032s ago: executing program 4 (id=19675): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000009c0)={{0x14}, [@NFT_MSG_NEWRULE={0x48, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x4}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_HANDLE={0xc, 0x3, 0x1, 0x0, 0x2}, @NFTA_RULE_HANDLE={0xc, 0x3, 0x1, 0x0, 0x1}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x5}}}, 0x70}, 0x1, 0xf5ffffffffffffff, 0x0, 0x2000094}, 0x4000800) 5.387320193s ago: executing program 0 (id=19676): bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0}, 0xe4) r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00'}, 0x94) r1 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000440)=@raw={'raw\x00', 0x8, 0x3, 0x4c8, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x3f8, 0xffffffff, 0xffffffff, 0x3f8, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'bridge0\x00'}, 0x0, 0x148, 0x170, 0x0, {}, [@common=@unspec=@helper={{0x48}}, @common=@inet=@hashlimit1={{0x58}, {'bond_slave_1\x00', {0x41, 0x1ff, 0x6, 0xb0e2, 0x10001, 0x84e, 0xfffffffb, 0x18, 0x8}, {0x1}}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'erspan0\x00', 'gre0\x00', {0xff}, {}, 0x0, 0x0, 0x0, 0x4b}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0xfffffffe, 0x2, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x528) syz_emit_ethernet(0x42, &(0x7f0000000000)=ANY=[@ANYBLOB="79ee7ca42eeaaaaaaaaaaabb86dd6a"], 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x88be, 0x0, 0x3b00, 0x0, 0x0, 0x2}, 0x48) 5.386956828s ago: executing program 1 (id=19677): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_JOIN_OCB(r0, &(0x7f00000005c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x64, r1, 0x200, 0x70bd26, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x2}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x383}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x2cb}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x1}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x1e}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x20}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x3a}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x2}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x24a}, @NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x170c}]}, 0x64}, 0x1, 0x0, 0x0, 0x14890}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_PUBL_GET(r2, &(0x7f0000000580)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000540)={&(0x7f0000000280)={0x2c0, 0x0, 0x400, 0x70bd2b, 0x25dfdbfc, {}, [@TIPC_NLA_PUBL={0x34, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0xafb}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x9}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x9}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x559}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0xfffffff8}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x1}]}, @TIPC_NLA_PUBL={0x24, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x10}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x8}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x1000000}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x4}]}, @TIPC_NLA_NET={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x80000001}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x4831}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffffffffffffff01}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x3}]}, @TIPC_NLA_BEARER={0x14, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}]}, @TIPC_NLA_SOCK={0x124, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_CON={0x2c, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0xc3}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0xda6}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0xfffffff8}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x9}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x4}]}, @TIPC_NLA_SOCK_CON={0x44, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x1}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0xff}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0xfffff001}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x7}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x7}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x4}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0xfffffffe}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x5}]}, @TIPC_NLA_SOCK_CON={0xc, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x8}]}, @TIPC_NLA_SOCK_CON={0x2c, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x6}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x9}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0xce}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0xd0d}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x8939}]}, @TIPC_NLA_SOCK_CON={0x14, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x1}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0xb}]}, @TIPC_NLA_SOCK_CON={0x44, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x1}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x80000001}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0xb}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x4}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x1}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x8}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x1}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x401}]}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x6}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x5ba3}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x4d22}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x5}]}, @TIPC_NLA_BEARER={0xb4, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e20, @rand_addr=0x64010101}}, {0x20, 0x2, @in6={0xa, 0x4e21, 0x2, @loopback, 0x1ff}}}}, @TIPC_NLA_BEARER_PROP={0x44, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x200}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xb054}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xd}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xd}]}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xffffff57}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xd0c0}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x751a}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xd}]}]}, @TIPC_NLA_MON={0x4}, @TIPC_NLA_NET={0x4}, @TIPC_NLA_PUBL={0x2c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x6}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0xfffffff7}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x3}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x3}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x7f}]}]}, 0x2c0}, 0x1, 0x0, 0x0, 0x4c003}, 0xc811) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080), r2) sendmsg$TIPC_NL_BEARER_ENABLE(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="0100000000000000000003000000240001800c0d00800700020003000000110001006574683a70696d367265673100000000"], 0x38}}, 0x0) 5.21393017s ago: executing program 2 (id=19678): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'bridge0\x00', 0x0}) r2 = socket(0x2a, 0x2, 0x0) getsockname$packet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) close(0xffffffffffffffff) sendmsg$nl_route(r0, &(0x7f0000001300)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="340000001c0001fc28bd7000fcdbdf2507000000", @ANYRES32=r1, @ANYBLOB="8000260b0a0002000180c200000c00000c000e800500010003"], 0x34}, 0x1, 0x0, 0x0, 0x1}, 0x20040010) (fail_nth: 5) 4.894415603s ago: executing program 1 (id=19679): r0 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_GET(0xffffffffffffffff, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000580)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="0100"], 0x34}}, 0x0) (async) r1 = socket(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)={0x2, 0xb, 0x0, 0x7, 0x2}, 0x10}}, 0x0) (async) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_group_source_req(r2, 0x29, 0x2e, &(0x7f0000000000)={0x3, {{0xa, 0x0, 0x0, @mcast2}}, {{0xa, 0x0, 0x6, @ipv4={'\x00', '\xff\xff', @local}}}}, 0x108) (async) setsockopt$inet6_group_source_req(r2, 0x29, 0x2e, &(0x7f0000000400)={0x3, {{0xa, 0x4e21, 0x7, @mcast2}}, {{0xa, 0x4e20, 0x2, @empty}}}, 0x108) (async) getsockopt$inet6_buf(r2, 0x29, 0x30, &(0x7f0000000000)=""/40, &(0x7f0000001000)=0xf9) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) write$bt_hci(r3, &(0x7f0000000580)=ANY=[@ANYBLOB="4600010002"], 0x8) 4.255308168s ago: executing program 4 (id=19680): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="22000000040000001000000012"], 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000000c0)={r0, 0xffffffffffffffff}, 0x4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000580)={0x11, 0x10, &(0x7f0000000100)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000643200007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r1, @ANYBLOB="0000000018000010b70500000800000085000000a500000095"], &(0x7f0000000080)='GPL\x00', 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffe}, 0x94) r2 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_bt_hidp_HIDPCONNDEL(r2, 0x400448c9, &(0x7f0000000000)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x12}, 0x6}) ioctl$sock_bt_hidp_HIDPCONNADD(r2, 0x400448c8, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff, 0x1, 0x0, 0x0, 0xb, 0x81, 0x6, 0xfff9, 0x10, 0x2, 0x8, 'syz0\x00'}) 4.029200507s ago: executing program 2 (id=19681): ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(0xffffffffffffffff, 0x4048587b, 0x0) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000440), r0) sendmsg$NLBL_UNLABEL_C_STATICADDDEF(r0, &(0x7f0000000a40)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000900)={&(0x7f0000000880)=ANY=[@ANYBLOB='x\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="000127bd7000fcdb000000000008000500ac14143e08000400640101002600070073797374656d5f753a6f626a6563745f723a7573625f6465000000005f743a733000000014000300fe8000000000000000000000000000bb0500010001000000080004000a010102000000000000000000"], 0x78}, 0x1, 0x0, 0x0, 0x24000000}, 0x404c0e4) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000001c0), r2) sendmsg$IEEE802154_LLSEC_ADD_DEV(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000100)={0x54, r3, 0x852dd6c070cd7e4b, 0x54000000, 0x25dfdbff, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8, 0x2f, 0xfffffffe}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0xfffd}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0102}}, @IEEE802154_ATTR_SHORT_ADDR={0x6, 0x4, 0xaaa3}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5, 0x37, 0x1}]}, 0x54}, 0x4, 0x700000000000000}, 0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl802154(0x0, 0xffffffffffffffff) r6 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r6, 0x0, &(0x7f00000000c0)) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r8 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f00000002c0)={'bridge_slave_0\x00'}) r9 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(r9, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x24000004}, 0x2000800) r10 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r7) sendmsg$NFC_CMD_DEV_UP(r7, &(0x7f0000000280)={0x0, 0xffffffffffffffc2, &(0x7f00000001c0)={&(0x7f0000000000)={0x14, 0x0, 0x1, 0x70bd2a, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x2002080d}, 0x2004c8c0) sendmsg$NFC_CMD_START_POLL(r4, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000300)={&(0x7f0000000380)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r10, @ANYBLOB="200029bd7000fddbdf2506000000080909d610cf834b91000d008800000008000e80000000a94bee60427c0199f39df142f61d"], 0x2c}, 0x1, 0x0, 0x0, 0x20004000}, 0x140420c0) sendmsg$NL802154_CMD_NEW_SEC_LEVEL(r4, &(0x7f0000000a80)={0x0, 0x0, &(0x7f0000000a40)={&(0x7f0000000700)={0x20, r5, 0x1, 0x70bd2a, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_SEC_LEVEL={0x4}]}, 0x20}}, 0x4004084) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000ac0)={'wpan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b00)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r2, &(0x7f0000000c00)={&(0x7f0000000a80)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000bc0)={&(0x7f0000000b40)={0x54, r5, 0x20, 0x70bd25, 0x5, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r11}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r12}]}, 0x54}, 0x1, 0x0, 0x0, 0x40}, 0x0) sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(r0, 0x0, 0x45080) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x0, 0x0, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x1f00, 0x0, '\x00', 0x0, 0x24}, 0x94) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r13 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r14 = openat$cgroup_ro(r13, &(0x7f00000002c0)='cgroup.kill\x00', 0x275a, 0x0) write$cgroup_int(r14, &(0x7f0000000200)=0x1, 0x12) 3.997643586s ago: executing program 1 (id=19682): bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x4, 0xe, &(0x7f0000000800)=ANY=[@ANYBLOB="b70200000a000000bfa30050000000000703000000feffff7a0af0ff0000000079a4f0ff00000000b7060000ffffffff2d6405000000000065040400010001010404000001007d60b7030000010000006a0a00fe00000000850000000d000000b700000001000000950000000000000075cdc4b57b0c65752a3ad50000007ddd0000cb4500639100002000000000000000ff7f0000b52f17cee19d0001000000000000000000cb04fcbb0b9bafe3ba431351a58a885ba9918d37b056b9bbd11b6b9f6cf7db6d574620260000000000008062d77e84cef4a2ab938f65aac33c4d620de2c9b7dc10d7d313f9f57606b83b994fb484510bef2e4872f5c2fe6faaf75e5cc4051ade12f41deff6df6a936b4ec3827c739bb39aad16cc75fe369258673b5df11cc2afb53611cc32a790bce5a6f087ae8f5e64be2c9d2d29db3d36dd015c7bd3f15aa6aadbeab2a01685108e61aa000000000000000000000000008b798b4f7458d1863cc67c4c6a06e828e5216f601b19db1af1b5d356d0f062137d866d11be4ba3f0151fdbbd4e97d62ecc645e143a60f1c6edc76609073909826151e2b42bf0ed0c8cef3ba2a730a00c87c493db845b10e9468bda6f82881eb8c9cfa72b08eecc952a3fd2c46f3c1cde71a19d1a2982492abaa96665372831210e00d2bfea3b8d188df2eff8d56aaae7d32a2e183722537395019f02ec4b85f6aad7faca088de9b26797a8446b16c28d85f225992dbdd5bb01ba51508951c7a7d6ca0916c3a12912715649c2b1c7192a4251b59d378d0616a48c7957e122665c8b7e89eddf"], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000100), 0x10}, 0x28) 3.951859143s ago: executing program 4 (id=19683): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x500, 0x0, &(0x7f0000000040)={&(0x7f0000000080)={0x2, 0x5, 0x0, 0x0, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @private1}}, @sadb_sa={0x2}, @sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}]}, 0x60}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="1c00000002030300000000e1ffffffffffffff000800010001000000d80c356ef3c7f2fd04c41ebe81c83cebe4764ff611046664e1d9ae39083eecdfe173ebb8309af950beb655704805d685e9477615ca7372c67471dc5772a1d93aabdd5b873547e592746120e3f9e51f058432bf8f2f536c3fc9c6187295dba160cb64c119e8939097c3ead840c152c196efe069c099caff92a0d1616814533fdf14e7d2f990fe68c77b25d74252"], 0x1c}}, 0x0) sendmsg$NFQNL_MSG_CONFIG(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)={0x1c, 0x2, 0x3, 0x3, 0x0, 0x0, {0x0, 0x0, 0x10}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1, 0x0, 0x15}}]}, 0x1c}}, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) writev(r2, &(0x7f0000001100)=[{&(0x7f0000001140)="4647b4f310d036b398bd576db787e7b4202ee128ae26c942fc41e537802686e8c349eb6c1ed386de2085218c1cc9fb2decdb2a5f89154999df0aeebf9b9c41add84afb98", 0x44}], 0x1) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r2, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f00000004c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000480)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0xa}}, [@NFT_MSG_DELFLOWTABLE={0x140, 0x18, 0xa, 0x301, 0x0, 0x0, {0x2, 0x0, 0x9}, [@NFTA_FLOWTABLE_FLAGS={0x8, 0x7, 0x1, 0x0, 0x2}, @NFTA_FLOWTABLE_FLAGS={0x8, 0x7, 0x1, 0x0, 0x1}, @NFTA_FLOWTABLE_HOOK={0x110, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_DEVS={0x2c, 0x3, 0x0, 0x1, [{0x14, 0x1, 'tunl0\x00'}, {0x14, 0x1, 'veth0_to_hsr\x00'}]}, @NFTA_FLOWTABLE_HOOK_DEVS={0xa4, 0x3, 0x0, 0x1, [{0x14, 0x1, 'veth0\x00'}, {0x14, 0x1, 'pimreg\x00'}, {0x14, 0x1, 'veth0_to_bridge\x00'}, {0x14, 0x1, 'veth0_virt_wifi\x00'}, {0x14, 0x1, 'ipvlan0\x00'}, {0x14, 0x1, 'syzkaller0\x00'}, {0x14, 0x1, 'vxcan1\x00'}, {0x14, 0x1, 'veth1_to_team\x00'}]}, @NFTA_FLOWTABLE_HOOK_DEVS={0x2c, 0x3, 0x0, 0x1, [{0x14, 0x1, 'vlan0\x00'}, {0x14, 0x1, 'macvlan1\x00'}]}, @NFTA_FLOWTABLE_HOOK_NUM={0x8}, @NFTA_FLOWTABLE_HOOK_NUM={0x8}]}, @NFTA_FLOWTABLE_HANDLE={0xc, 0x5, 0x1, 0x0, 0x4}]}, @NFT_MSG_DELCHAIN={0x20, 0x5, 0xa, 0x801, 0x0, 0x0, {0x3, 0x0, 0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x188}, 0x1, 0x0, 0x0, 0x1}, 0x810) connect$pppoe(0xffffffffffffffff, &(0x7f0000000040)={0x18, 0x0, {0x2, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}, 'bridge_slave_0\x00'}}, 0x1e) sendmsg$NFQNL_MSG_VERDICT_BATCH(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="20000000030303"], 0x20}}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPVS_CMD_NEW_DAEMON(0xffffffffffffffff, 0x0, 0x0) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000d40), 0xffffffffffffffff) sendmsg$TIPC_NL_PEER_REMOVE(r3, &(0x7f0000000f80)={0x0, 0x0, &(0x7f0000000f40)={&(0x7f0000000d80)={0x34, r4, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x20, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x7}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x101}]}]}, 0x34}}, 0x24000084) 3.582508355s ago: executing program 1 (id=19684): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x10, 0x3, &(0x7f0000000140)=@framed={{0x62, 0xa, 0x0, 0xffc4, 0x0, 0x71, 0x10, 0x1e, 0x1}}, &(0x7f0000000480)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x80000001}, 0x94) socket$kcm(0xa, 0x3, 0x87) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000002000/0x4000)=nil, 0x4000, 0xedc623580215bdcd, 0x12, r2, 0x0) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000340)={r2, 0x0, 0x25, 0x0, @void}, 0x10) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="01000000000000ff000005000000180001801400020073797a5f74756e00000000000000000005000200fc0000000800090006", @ANYRESHEX=r1, @ANYRES16=r5], 0x3c}, 0x1, 0x0, 0x0, 0x4044851}, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r6 = socket$kcm(0x2, 0xa, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000d80)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r7 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="17000000000000000400000001"], 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r7, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b7040000000000008500000057"], 0x0, 0x0, 0x0, 0x0, 0x41100}, 0x94) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000003c0)={r8, 0x2000300, 0xe, 0xfffffd83, &(0x7f0000000000)="63eced8e46dc3f0adf3389f7b986", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000008000000000000000000018110000", @ANYRES32=r7, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000058"], 0x0}, 0x90) r9 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xe, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0xfffffffc, 0x0, 0x0, 0x0, 0x12, '\x00', 0x0, @sk_skb=0x5, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_GET_PROG_INFO(0xa, &(0x7f0000000740)={r9, 0x0, 0x0}, 0x10) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) r10 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)=@newsa={0x150, 0x10, 0x713, 0x70bd2c, 0x25dfdbfc, {{@in=@multicast1, @in=@dev={0xac, 0x14, 0x14, 0x27}, 0x0, 0x0, 0x4e22, 0x2, 0x2, 0x0, 0x0, 0x6c, 0x0, 0xee00}, {@in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0xfe, 0x32}, @in6=@ipv4={'\x00', '\xff\xff', @empty}, {0x0, 0x5, 0x0, 0x9, 0x0, 0x0, 0x5, 0x543}, {0x7, 0x49}, {0x0, 0x0, 0x2004000}, 0x70bd2d, 0x34fd, 0xa, 0x1, 0x0, 0x50}, [@algo_aead={0x60, 0x12, {{'rfc4106(gcm(aes))\x00'}, 0xa0, 0x60, "210466d38547aa140db90100000000c54222cb7a"}}]}, 0x150}, 0x1, 0x0, 0x0, 0x880}, 0x0) write$tun(r3, &(0x7f0000000040)=ANY=[@ANYBLOB="034886dd200000000000140000006000000003088700fe88a43de1a400000000000000007d01ff020000000000000000000000000001"], 0xfdef) r11 = syz_genetlink_get_family_id$nl802154(&(0x7f0000002080), 0xffffffffffffffff) sendmsg$NL802154_CMD_NEW_INTERFACE(r0, &(0x7f0000002180)={0x0, 0x0, &(0x7f0000002140)={&(0x7f00000020c0)={0x34, r11, 0x1, 0x70bd2d, 0x25dfdbfc, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan3\x00'}, @NL802154_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x34}, 0x1, 0x0, 0x0, 0x40044084}, 0x10) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f00000001c0)={'bond0\x00', 0x200}) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000040)={'wpan3\x00', 0x0}) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f00000008c0)={r7, &(0x7f0000000500)="2afe31f581b134b72fde1ab483e1aa0f9988b23732c8d2f5371f96030b788640e1478da5feb780845a8e739f55659c1d46fcf6327441876f886124bbf4b5791c28ffcfa8b2ef53e13d091c0f1170d657bda234207bb04efc65c4bd85a822b68535d2b0cf74a2860bd97ad121f667cc96c8c889fdb1a56ef62b60a0173f2bc42af14614099486e91f85eba392e38ee3e7d3a6049069265a7da9ac0c1f95d18e639bbefb8b9fcd186d46771552558a73e3e5884b66a7b993bf66000aac945ff09a0965d65ef863d953cf791fc4d76972d5a7da", &(0x7f0000000800)=""/175}, 0x20) sendmsg$NL802154_CMD_SET_TX_POWER(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x2c, r11, 0x8, 0x70bd28, 0x25dfcbfc, {}, [@NL802154_ATTR_TX_POWER={0x8, 0xb, 0x8}, @NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r12}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4001}, 0x20000080) 3.045949036s ago: executing program 0 (id=19685): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r0) r1 = socket$packet(0x11, 0x3, 0x300) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000003c0)={0x0, 0x24}}, 0x0) getsockname$packet(r3, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffff00f687000000", @ANYRES32=r4, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000400)=@newqdisc={0x50, 0x24, 0xe0b, 0x70bd28, 0x0, {0x0, 0x0, 0x0, r4, {}, {0xffff, 0xffff}, {0xffe0, 0xd064db0e491fa98f}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x20, 0x2, [@TCA_CAKE_INGRESS={0x8, 0xf, 0x1}, @TCA_CAKE_BASE_RATE64={0xc, 0x2, 0x81}, @TCA_CAKE_MEMORY={0x8, 0xa, 0x842}]}}]}, 0x50}, 0x1, 0x0, 0x0, 0x40}, 0x4000080) bind$packet(r1, &(0x7f0000000040)={0x11, 0x0, r4, 0x1, 0x0, 0x6, @remote}, 0x14) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000850}, 0x40) 2.116354614s ago: executing program 32 (id=19662): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r0) socket$nl_route(0x10, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, 0x0, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000480)=@newqdisc={0x50, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbfc, {0x0, 0x0, 0x0, r3, {0x0, 0xd}, {0x6, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x20, 0x2, [@TCA_CAKE_FLOW_MODE={0x8, 0x5, 0x1}, @TCA_CAKE_WASH={0x8, 0xd, 0x1}, @TCA_CAKE_BASE_RATE64={0xc, 0x2, 0x7}]}}]}, 0x50}, 0x1, 0x0, 0x0, 0x200040f0}, 0x4890) ioctl$SIOCSIFHWADDR(r0, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r4, 0x107, 0xf, &(0x7f0000000100)=0x4207, 0x4) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000040)={'syzkaller0\x00', 0x0}) sendto$packet(r4, &(0x7f00000002c0)="05031411d3fc220000004788031c09102c28", 0xfdef, 0x4, &(0x7f0000000140)={0x11, 0x86dd, r5, 0x1, 0x0, 0x6, @multicast}, 0x14) 2.035930987s ago: executing program 2 (id=19687): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x0, 0x12, r0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x3, 0xb, &(0x7f0000000140)=@framed={{}, [@printk={@x={0x18, 0x1, 0x0, 0x0, 0x25782020, 0x0, 0x0, 0x900}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x62}}]}, &(0x7f0000000000)='syzkaller\x00', 0x5, 0xfe7, &(0x7f0000001e00)=""/4071}, 0x90) 2.035650775s ago: executing program 4 (id=19688): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000003c0)='blkio.bfq.io_serviced_recursive\x00', 0x275a, 0x0) r2 = socket$packet(0x11, 0x3, 0x300) getsockopt$packet_int(r2, 0x107, 0x8, 0x0, &(0x7f0000000140)) r3 = socket$inet6(0xa, 0x2, 0x0) sendmmsg$inet6(r3, &(0x7f0000000080)=[{{&(0x7f0000000100)={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @loopback}}, 0x1c, &(0x7f0000000140)=[{&(0x7f0000000180)="aabbcc", 0x3}], 0x1}}, {{&(0x7f00000001c0)={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @loopback}}, 0x1c, &(0x7f0000000200)=[{&(0x7f0000000240)="aabbcc", 0x3}], 0x1}}], 0x2, 0x0) socket$kcm(0xa, 0x3, 0x87) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r5 = socket$kcm(0x2, 0xa, 0x2) pselect6(0xffffff1b, &(0x7f0000000040)={0x3, 0x100000000, 0x100000000000000, 0x1, 0xfdb1, 0xc, 0x200, 0x3}, 0x0, 0x0, 0x0, 0x0) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r4, &(0x7f0000000040)=ANY=[@ANYBLOB="034886dd010000000000140000006000000003088700fe88a43de1a400000000000000007d01ff020000000000000000000000000001"], 0xfdef) writev(r1, &(0x7f0000000000)=[{&(0x7f0000000080)="a77e31390e292d75b2c51720ab6be056220ed32ba098dfd9c696d45e13dc0ca5a98f7dbc32e2e60640aa15abdfbadc54681a55acdba7b07db05160f8a1731380dc845e91921ee1d12e4725b2273391977181add62b06fb3efedac45f61cdd57ea78e54b0742f", 0x66}], 0x1) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r1, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000100)={@cgroup, 0x16, 0x1, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x1, 0x2a, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000097000000000000000000001818110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007baaf8fe00000000bfa200000000000007020000f8fdffffb703000000000000b704000000000000b5001c008200000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000070000008200000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8a00fe00000000bfa200000000000007020000f8ffffffb703000008000000b7040000010000008500000082000000bf91000000000000b7020000010000008500000085000000b70000000000000095"], &(0x7f0000000040)='syzkaller\x00', 0xf, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 1.613446818s ago: executing program 2 (id=19689): r0 = socket$nl_route(0x10, 0x3, 0x0) pipe(&(0x7f0000001f40)={0xffffffffffffffff, 0xffffffffffffffff}) ppoll(&(0x7f0000002000)=[{r1, 0x400}], 0x1, 0x0, 0x0, 0x0) write$bt_hci(r2, &(0x7f00000025c0)={0x1, @le_create_cis={{0x2064, 0x1}}}, 0x5) write$cgroup_subtree(r2, &(0x7f0000002980)={[{0x2b, 'cpuset'}]}, 0x8) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000002c0)=@newlink={0x5c, 0x10, 0x439, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x3c, 0x12, 0x0, 0x1, @ipip6={{0xb}, {0x2c, 0x2, 0x0, 0x1, [@IFLA_IPTUN_REMOTE={0x14, 0x3, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @IFLA_IPTUN_LOCAL={0x14, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}}]}}}]}, 0x5c}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@gettaction={0x20, 0x32, 0x300, 0x70bd25, 0x25dfdbfc, {}, [@action_dump_flags=@TCA_ROOT_FLAGS={0xc, 0x2, {0x1, 0x1}}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000000}, 0x20004080) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000000)={0x0, 0x4, &(0x7f0000000080)=[{&(0x7f0000000200)="2e0400001c008104e00f80ecdb4cb9f207c804a00d000000880802fb0a0002000a0ada1b40d80800c500c50083b8", 0xfec9}], 0x1, 0x0, 0x0, 0x5865}, 0x0) syz_emit_ethernet(0x5e, &(0x7f0000000000)={@multicast, @remote, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "122d92", 0x28, 0x3a, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @local, {[], @ndisc_redir={0xa1, 0x0, 0x0, '\x00', @private2, @private0={0xfc, 0x0, '\x00', 0x2}}}}}}}, 0x0) sendmsg$nl_generic(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB="280000002e00090027097000000000220400000008000c"], 0x28}, 0x1, 0x0, 0x0, 0x42804}, 0x0) 1.512384439s ago: executing program 0 (id=19690): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000009c0)={{0x14}, [@NFT_MSG_NEWRULE={0x48, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x4}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_HANDLE={0xc, 0x3, 0x1, 0x0, 0x2}, @NFTA_RULE_HANDLE={0xc, 0x3, 0x1, 0x0, 0x1}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x5}}}, 0x70}, 0x1, 0xfffffffffffffff5, 0x0, 0x2000094}, 0x4000800) 1.271111068s ago: executing program 0 (id=19691): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) (async) r1 = socket$kcm(0x11, 0x5, 0x300) setsockopt$sock_attach_bpf(r1, 0x1, 0x28, &(0x7f0000000040), 0x4) recvmsg(r1, &(0x7f00000017c0)={0x0, 0x0, 0x0}, 0x20) r2 = syz_genetlink_get_family_id$nfc(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f0000000100)=0x0) r4 = socket(0x400000000010, 0x3, 0x0) (async) r5 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, r6, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}}, 0x0) (async) sendmsg$nl_route_sched(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000006c0)=@newtfilter={0x2c, 0x2c, 0xd27, 0x70bd28, 0x25dfdbfe, {0x0, 0x0, 0x0, r6, {0xfff3, 0xfff2}, {}, {0xa, 0x6}}, [@TCA_RATE={0x6, 0x5, {0xf, 0x3}}]}, 0x2c}, 0x1, 0x0, 0x0, 0x22044028}, 0x0) sendmsg$IPSET_CMD_DESTROY(r4, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x44, 0x3, 0x6, 0x301, 0x0, 0x0, {0x88bf15e1f9a0db5a}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x40880}, 0x90) (async) ioctl$ifreq_SIOCGIFINDEX_team(r5, 0x8933, &(0x7f0000000440)={'team0\x00', 0x0}) (async, rerun: 32) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) (rerun: 32) getsockopt$sock_cred(r8, 0x1, 0x11, &(0x7f0000000380)={0x0, 0x0, 0x0}, &(0x7f00000003c0)=0xc) r12 = syz_open_procfs$namespace(r9, &(0x7f0000001780)='ns/ipc\x00') (async) r13 = getpid() sendmmsg$unix(r8, &(0x7f0000001b00)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=[@cred={{0x1c, 0x1, 0x2, {r9, 0x0, 0xee00}}}], 0x20, 0x4044014}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001bc0)=[@cred={{0x1c, 0x1, 0x2, {r9, 0x0, r11}}}, @cred={{0x1c, 0x1, 0x2, {r13, r10}}}, @rights={{0x18, 0x1, 0x1, [r12, 0xffffffffffffffff]}}], 0x58, 0x800}}], 0x2, 0x0) (async) sendmsg$nl_xfrm(r4, &(0x7f0000000600)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)=@migrate={0xec, 0x21, 0x10, 0x70bd26, 0x25dfdbfc, {{@in=@private=0xa010102, @in6=@dev={0xfe, 0x80, '\x00', 0xb}, 0x4e21, 0xccb6, 0x0, 0x0, 0x8, 0x20, 0x20, 0x3b, r7, r10}, 0x6e6bb7, 0x2}, [@migrate={0x9c, 0x11, [{@in=@rand_addr=0x64010101, @in=@multicast2, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, @in=@loopback, 0xd4, 0x4, 0x0, 0x3506, 0x0, 0xa}, {@in6=@empty, @in=@remote, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @in=@dev={0xac, 0x14, 0x14, 0x22}, 0x33, 0x4, 0x0, 0x3503, 0x2, 0x2}]}]}, 0xec}, 0x1, 0x0, 0x0, 0x810}, 0x0) (async) sendmsg$NFC_CMD_LLC_SET_PARAMS(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000200)={&(0x7f0000000140)={0x3c, r2, 0x200, 0x70bd28, 0x25dfdbfc, {}, [@NFC_ATTR_LLC_PARAM_RW={0x5, 0x10, 0x7}, @NFC_ATTR_LLC_PARAM_MIUX={0x6, 0x11, 0x5fd}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r3}, @NFC_ATTR_LLC_PARAM_MIUX={0x6, 0x11, 0x2f8}, @NFC_ATTR_LLC_PARAM_RW={0x5, 0x10, 0x3}]}, 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x20) setsockopt$sock_timeval(r0, 0x1, 0x43, &(0x7f00000001c0)={0x0, 0x2710}, 0x10) sendmmsg$unix(r0, &(0x7f00000bd000), 0x0, 0x4010) (async) socket$unix(0x1, 0x2, 0x0) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r0, 0x8983, &(0x7f0000000000)={0x0, 'batadv_slave_0\x00', {}, 0xfbd}) 67.754644ms ago: executing program 0 (id=19692): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000940)=ANY=[], 0x34}}, 0xc000) 0s ago: executing program 2 (id=19693): socket(0x2a, 0x2, 0x0) (async) r0 = socket(0x2a, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000005c0)=@newqdisc={0x24, 0x24, 0x0, 0x0, 0xffffffff, {0x0, 0x0, 0x0, 0x0, {}, {0x1}, {0x0, 0xf}}}, 0x24}}, 0x0) (async) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000005c0)=@newqdisc={0x24, 0x24, 0x0, 0x0, 0xffffffff, {0x0, 0x0, 0x0, 0x0, {}, {0x1}, {0x0, 0xf}}}, 0x24}}, 0x0) getsockname$packet(r0, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000440)=@newqdisc={0x44, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x9, 0x1}}}}]}, 0x44}}, 0x0) (async) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000440)=@newqdisc={0x44, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x9, 0x1}}}}]}, 0x44}}, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x40040, 0x0) (async) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x40040, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) socket$nl_route(0x10, 0x3, 0x0) (async) r3 = socket$nl_route(0x10, 0x3, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000600)={'tunl0\x00', &(0x7f00000004c0)={'syztnl0\x00', r1, 0x40, 0x40, 0x5, 0x9, {{0xc, 0x4, 0x3, 0x4, 0x30, 0x64, 0x0, 0x7, 0x4, 0x0, @private=0xa010100, @empty, {[@timestamp_addr={0x44, 0x1c, 0x2d, 0x1, 0x3, [{@initdev={0xac, 0x1e, 0x1, 0x0}, 0xffffa748}, {@broadcast, 0x9}, {@dev={0xac, 0x14, 0x14, 0x44}, 0x2}]}]}}}}}) (async) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000600)={'tunl0\x00', &(0x7f00000004c0)={'syztnl0\x00', r1, 0x40, 0x40, 0x5, 0x9, {{0xc, 0x4, 0x3, 0x4, 0x30, 0x64, 0x0, 0x7, 0x4, 0x0, @private=0xa010100, @empty, {[@timestamp_addr={0x44, 0x1c, 0x2d, 0x1, 0x3, [{@initdev={0xac, 0x1e, 0x1, 0x0}, 0xffffa748}, {@broadcast, 0x9}, {@dev={0xac, 0x14, 0x14, 0x44}, 0x2}]}]}}}}}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000880)=@newqdisc={0x6c, 0x24, 0x4ee4e6a52ff56541, 0x1001, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x40, 0x2, [@TCA_TBF_PRATE64={0xc, 0x5, 0xc2240edb8ac75ac7}, @TCA_TBF_BURST={0x8, 0x6, 0xff}, @TCA_TBF_PARMS={0x28, 0x1, {{0x5a, 0x2, 0x84a, 0x9, 0x1, 0x800}, {0x8c, 0x1, 0xfffc, 0x7fff, 0x2, 0xb}, 0x5, 0x34, 0x91f}}]}}]}, 0x6c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x50) (async) sendmsg$nl_route_sched(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000880)=@newqdisc={0x6c, 0x24, 0x4ee4e6a52ff56541, 0x1001, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x40, 0x2, [@TCA_TBF_PRATE64={0xc, 0x5, 0xc2240edb8ac75ac7}, @TCA_TBF_BURST={0x8, 0x6, 0xff}, @TCA_TBF_PARMS={0x28, 0x1, {{0x5a, 0x2, 0x84a, 0x9, 0x1, 0x800}, {0x8c, 0x1, 0xfffc, 0x7fff, 0x2, 0xb}, 0x5, 0x34, 0x91f}}]}}]}, 0x6c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x50) r5 = socket$kcm(0x11, 0x3, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r6) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket(0x10, 0x3, 0x0) r9 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=@newqdisc={0x48, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r10, {0x0, 0x3}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x18, 0x2, [@TCA_CAKE_DIFFSERV_MODE={0x8, 0x3, 0x4}, @TCA_CAKE_BASE_RATE64={0xc, 0x2, 0x100000000000001}]}}]}, 0x48}}, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) sendmsg$nl_route_sched(r7, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000006c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r10, {0x0, 0x7}, {0xffff, 0xf}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x14, 0x2, [@TCA_FQ_CODEL_CE_THRESHOLD={0x8, 0x7, 0xfffffff9}, @TCA_FQ_CODEL_CE_THRESHOLD_MASK={0x5, 0xb, 0x11}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r11 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) (async) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r5, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0x8, r12, 0x3a}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000180)='\a', 0x1}], 0x1}, 0x200480d4) (async) sendmsg$kcm(r5, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0x8, r12, 0x3a}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000180)='\a', 0x1}], 0x1}, 0x200480d4) r13 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bind$bt_l2cap(r13, &(0x7f0000000000)={0x1f, 0x21, @any, 0x0, 0x1}, 0xe) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000380)=@newtfilter={0x64, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {0xffff, 0x9}, {}, {0x1, 0x6}}, [@filter_kind_options=@f_cgroup={{0xb}, {0x34, 0x2, [@TCA_CGROUP_EMATCHES={0x30, 0x3, 0x0, 0x1, [@TCA_EMATCH_TREE_LIST={0x24, 0x2, 0x0, 0x1, [@TCF_EM_IPT={0x20, 0x1, 0x0, 0x0, {{0x3, 0x9, 0x4}, [@TCA_EM_IPT_HOOK={0x8, 0x1, 0x3}, @TCA_EM_IPT_MATCH_NAME={0xb}]}}]}, @TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x6}}]}]}}]}, 0x64}}, 0x1) (async) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000380)=@newtfilter={0x64, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {0xffff, 0x9}, {}, {0x1, 0x6}}, [@filter_kind_options=@f_cgroup={{0xb}, {0x34, 0x2, [@TCA_CGROUP_EMATCHES={0x30, 0x3, 0x0, 0x1, [@TCA_EMATCH_TREE_LIST={0x24, 0x2, 0x0, 0x1, [@TCF_EM_IPT={0x20, 0x1, 0x0, 0x0, {{0x3, 0x9, 0x4}, [@TCA_EM_IPT_HOOK={0x8, 0x1, 0x3}, @TCA_EM_IPT_MATCH_NAME={0xb}]}}]}, @TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x6}}]}]}}]}, 0x64}}, 0x1) r14 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r14, &(0x7f00000002c0), 0x40000000000009f, 0x0) kernel console output (not intermixed with test programs): vsim0: set [1, 0] type 2 family 0 port 20002 - 0 [ 1382.705816][T17694] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 20002 - 0 [ 1382.719209][T17694] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 20002 - 0 [ 1382.747374][T17694] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 20002 - 0 [ 1382.925321][T18873] lo: left promiscuous mode [ 1382.957940][T18873] tunl0: left promiscuous mode [ 1382.988765][T18873] gre0: left promiscuous mode [ 1383.001324][T18873] gretap0: left promiscuous mode [ 1383.016267][T18873] erspan0: left promiscuous mode [ 1383.023553][T18873] ip_vti0: left promiscuous mode [ 1383.215647][T18886] IPVS: set_ctl: invalid protocol: 50 172.30.0.5:20000 [ 1383.239395][T18873] bridge_slave_1: left allmulticast mode [ 1383.364075][T18873] tipc: Resetting bearer [ 1383.463983][T18873] A link change request failed with some changes committed already. Interface vlan0 may have been left with an inconsistent configuration, please check. [ 1383.798240][T18900] macvlan2: entered allmulticast mode [ 1384.072798][T18916] netlink: 'syz.3.18263': attribute type 1 has an invalid length. [ 1384.262767][T18913] syzkaller1: entered promiscuous mode [ 1384.268767][T18913] syzkaller1: entered allmulticast mode [ 1384.480001][T18931] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 1384.645342][T18936] __nla_validate_parse: 6 callbacks suppressed [ 1384.645363][T18936] netlink: 28 bytes leftover after parsing attributes in process `syz.2.18270'. [ 1384.702593][T18936] nbd: couldn't find a device at index 0 [ 1384.904962][T18944] netlink: 8 bytes leftover after parsing attributes in process `syz.1.18273'. [ 1384.957367][T18944] macvlan2: entered allmulticast mode [ 1384.980713][T18948] netlink: 'syz.2.18274': attribute type 1 has an invalid length. [ 1385.022547][T18948] netlink: 224 bytes leftover after parsing attributes in process `syz.2.18274'. [ 1385.561644][T18969] tunl0: left promiscuous mode [ 1385.684706][T18969] bridge0: port 1(gretap0) entered disabled state [ 1385.701116][T18969] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 1386.013597][T18980] netlink: 8 bytes leftover after parsing attributes in process `syz.0.18280'. [ 1386.057740][T18987] netlink: 24 bytes leftover after parsing attributes in process `syz.3.18287'. [ 1386.108253][T18987] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1386.143722][T18991] netlink: 12 bytes leftover after parsing attributes in process `syz.1.18289'. [ 1386.197295][T18991] netlink: 12 bytes leftover after parsing attributes in process `syz.1.18289'. [ 1386.247887][T18995] pim6reg: left allmulticast mode [ 1387.008005][T19015] netdevsim netdevsim1 netdevsim0: left promiscuous mode [ 1387.036829][T19015] veth3: left allmulticast mode [ 1387.044399][T19015] macvlan3: left allmulticast mode [ 1387.052592][T19015] xfrm1: left promiscuous mode [ 1387.059775][T19015] xfrm1: left allmulticast mode [ 1387.065761][T19015] bond2: left promiscuous mode [ 1387.072067][T19015] ip6gre1: left allmulticast mode [ 1387.078861][T19015] vlan3: left allmulticast mode [ 1387.084469][T19015] bond0: left allmulticast mode [ 1387.090638][T19015] bond4: left promiscuous mode [ 1387.095666][T19015] vcan1: left promiscuous mode [ 1387.101834][T19015] bond5: left promiscuous mode [ 1387.106829][T19015] vti0: left promiscuous mode [ 1387.115302][T19015] bridge11: left promiscuous mode [ 1387.120831][T19015] bridge11: left allmulticast mode [ 1387.126439][T19015] vlan4: left allmulticast mode [ 1387.131844][T19015] bond9: left allmulticast mode [ 1387.137738][T19015] gretap1: left promiscuous mode [ 1387.157869][T19015] bond10: left promiscuous mode [ 1387.164433][T19015] veth1: left promiscuous mode [ 1387.175350][T19015] veth7: left promiscuous mode [ 1387.185623][T19015] veth9: left promiscuous mode [ 1387.194532][T19015] veth11: left promiscuous mode [ 1387.202258][T19015] ip6erspan2: left allmulticast mode [ 1387.208096][T19015] h: left promiscuous mode [ 1387.213306][T19015] veth13: left promiscuous mode [ 1387.224726][T19015] veth15: left promiscuous mode [ 1387.232975][T19015] ipvlan0: left promiscuous mode [ 1387.247741][T19015] veth19: left promiscuous mode [ 1387.275894][T19015] ipvlan1: left allmulticast mode [ 1387.287311][T19015] bond23: left allmulticast mode [ 1387.297574][T19015] bridge20: left allmulticast mode [ 1387.311397][T19015] macvlan0: left promiscuous mode [ 1387.320707][T19015] mac80211_hwsim hwsim9 syzkaller0: left promiscuous mode [ 1387.328491][T19015] mac80211_hwsim hwsim9 syzkaller0: left allmulticast mode [ 1387.351960][T19015] macvlan1: left allmulticast mode [ 1387.364411][T19015] hsr0: left allmulticast mode [ 1387.374730][T19015] hsr_slave_0: left allmulticast mode [ 1387.385797][T19015] hsr_slave_1: left allmulticast mode [ 1387.398813][T19015] macvlan2: left allmulticast mode [ 1387.411862][T18558] syz1: Port: 1 Link DOWN [ 1387.416339][T17697] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1387.437992][T17697] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1387.478407][T17697] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1388.050186][T19056] netlink: 'syz.1.18309': attribute type 13 has an invalid length. [ 1388.060807][T19056] netlink: 16 bytes leftover after parsing attributes in process `syz.1.18309'. [ 1388.931683][T19092] veth29: entered allmulticast mode [ 1389.181066][T19104] vlan0: entered allmulticast mode [ 1389.212286][T19113] netlink: 'syz.4.18324': attribute type 1 has an invalid length. [ 1389.233128][T19104] veth1_virt_wifi: entered allmulticast mode [ 1389.243063][T19112] netlink: 'syz.3.18326': attribute type 10 has an invalid length. [ 1389.305513][T19114] netlink: 'syz.3.18326': attribute type 10 has an invalid length. [ 1389.386601][T19117] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 1389.464638][T19120] netlink: 108 bytes leftover after parsing attributes in process `syz.2.18327'. [ 1390.098304][T19144] netlink: 28 bytes leftover after parsing attributes in process `syz.2.18335'. [ 1390.319521][T19144] bond27: entered promiscuous mode [ 1390.369939][T19144] bond27: entered allmulticast mode [ 1390.460153][T19161] netlink: 'syz.4.18340': attribute type 1 has an invalid length. [ 1390.474391][T19161] netlink: 'syz.4.18340': attribute type 2 has an invalid length. [ 1390.483118][T19161] netlink: 'syz.4.18340': attribute type 1 has an invalid length. [ 1390.520928][T19161] netlink: 16 bytes leftover after parsing attributes in process `syz.4.18340'. [ 1390.658748][T19167] netlink: 12 bytes leftover after parsing attributes in process `syz.0.18343'. [ 1390.710662][T19172] netlink: 16 bytes leftover after parsing attributes in process `syz.2.18344'. [ 1390.972746][T19167] 8021q: adding VLAN 0 to HW filter on device bond16 [ 1390.993966][T19176] bond16: entered promiscuous mode [ 1390.999646][T19176] bond16: entered allmulticast mode [ 1391.007930][T19176] 8021q: adding VLAN 0 to HW filter on device bond16 [ 1391.022799][T19176] team0: Port device bond16 added [ 1391.043620][T19193] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 1391.090977][T19181] team_slave_1: entered promiscuous mode [ 1391.116130][T19181] team_slave_1: entered allmulticast mode [ 1391.123892][T19181] bond16: (slave team_slave_1): Enslaving as an active interface with an up link [ 1391.701402][T19223] netlink: 16 bytes leftover after parsing attributes in process `syz.1.18357'. [ 1391.810807][T19227] openvswitch: netlink: IP tunnel dst address not specified [ 1392.050516][T19238] netlink: 20 bytes leftover after parsing attributes in process `syz.0.18363'. [ 1392.162328][T19240] netlink: 640 bytes leftover after parsing attributes in process `syz.1.18364'. [ 1392.186125][T19244] netlink: 80 bytes leftover after parsing attributes in process `syz.2.18362'. [ 1392.196457][T19240] openvswitch: netlink: VXLAN extension message has 4 unknown bytes. [ 1392.219597][T19243] bond28: (slave 26±ÿª¨úrBº“): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 1392.378033][T19243] bond28: (slave 26±ÿª¨úrBº“): Enslaving as an active interface with an up link [ 1392.406745][T19243] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 1392.524510][T19247] vlan2: entered promiscuous mode [ 1392.540379][T19247] geneve1: entered promiscuous mode [ 1392.549267][T19247] vlan2: entered allmulticast mode [ 1392.561841][T19247] geneve1: entered allmulticast mode [ 1392.763135][T19261] FAULT_INJECTION: forcing a failure. [ 1392.763135][T19261] name failslab, interval 1, probability 0, space 0, times 0 [ 1392.776345][T19261] CPU: 0 UID: 0 PID: 19261 Comm: syz.4.18371 Not tainted syzkaller #0 PREEMPT(full) [ 1392.776376][T19261] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1392.776390][T19261] Call Trace: [ 1392.776400][T19261] [ 1392.776435][T19261] dump_stack_lvl+0xe8/0x150 [ 1392.776468][T19261] should_fail_ex+0x412/0x560 [ 1392.776510][T19261] should_failslab+0xa8/0x100 [ 1392.776544][T19261] __kmalloc_noprof+0xe8/0x760 [ 1392.776574][T19261] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 1392.776614][T19261] tomoyo_realpath_from_path+0xe3/0x5d0 [ 1392.776648][T19261] ? tomoyo_domain+0xd7/0x130 [ 1392.776687][T19261] ? tomoyo_path_number_perm+0x219/0x630 [ 1392.776713][T19261] tomoyo_path_number_perm+0x246/0x630 [ 1392.776742][T19261] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1392.776768][T19261] ? __lock_acquire+0x6b5/0x2cf0 [ 1392.776811][T19261] ? __mutex_unlock_slowpath+0x1be/0x6f0 [ 1392.776869][T19261] ? __fget_files+0x2a/0x420 [ 1392.776900][T19261] ? __fget_files+0x2a/0x420 [ 1392.776932][T19261] ? __fget_files+0x3a0/0x420 [ 1392.776957][T19261] ? __fget_files+0x2a/0x420 [ 1392.776989][T19261] security_file_ioctl+0xc3/0x2a0 [ 1392.777015][T19261] __se_sys_ioctl+0x47/0x170 [ 1392.777048][T19261] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1392.777073][T19261] do_syscall_64+0x15f/0xf80 [ 1392.777102][T19261] ? trace_irq_disable+0x3b/0x140 [ 1392.777135][T19261] ? clear_bhb_loop+0x40/0x90 [ 1392.777163][T19261] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1392.777185][T19261] RIP: 0033:0x7f551979cdd9 [ 1392.777206][T19261] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1392.777225][T19261] RSP: 002b:00007f551a5cb028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1392.777248][T19261] RAX: ffffffffffffffda RBX: 00007f5519a15fa0 RCX: 00007f551979cdd9 [ 1392.777264][T19261] RDX: 00002000000000c0 RSI: 0000000000008947 RDI: 0000000000000003 [ 1392.777279][T19261] RBP: 00007f551a5cb090 R08: 0000000000000000 R09: 0000000000000000 [ 1392.777292][T19261] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1392.777306][T19261] R13: 00007f5519a16038 R14: 00007f5519a15fa0 R15: 00007fff93281a58 [ 1392.777342][T19261] [ 1393.067027][T19261] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1393.079093][T19265] openvswitch: netlink: IP tunnel dst address not specified [ 1393.175713][T19263] veth1_to_hsr: Caught tx_queue_len zero misconfig [ 1393.393574][T19272] netlink: 12 bytes leftover after parsing attributes in process `syz.4.18375'. [ 1393.440204][T19273] netlink: 28 bytes leftover after parsing attributes in process `syz.3.18374'. [ 1393.467653][T19273] nbd: couldn't find a device at index 0 [ 1393.800001][T19279] syzkaller0: entered promiscuous mode [ 1393.808308][T19279] syzkaller0: entered allmulticast mode [ 1394.521146][T19303] openvswitch: netlink: IP tunnel dst address not specified [ 1397.827901][T19317] __nla_validate_parse: 2 callbacks suppressed [ 1397.827927][T19317] netlink: 4100 bytes leftover after parsing attributes in process `syz.3.18388'. [ 1397.873602][T19317] openvswitch: netlink: Flow key attr not present in new flow. [ 1398.004035][T19329] netlink: 'syz.4.18391': attribute type 3 has an invalid length. [ 1398.041219][T19329] netlink: 224 bytes leftover after parsing attributes in process `syz.4.18391'. [ 1398.162787][T19336] netlink: 12 bytes leftover after parsing attributes in process `syz.0.18393'. [ 1398.198137][T19339] FAULT_INJECTION: forcing a failure. [ 1398.198137][T19339] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1398.211641][T19336] netlink: 'syz.0.18393': attribute type 1 has an invalid length. [ 1398.211685][T19336] netlink: 'syz.0.18393': attribute type 1 has an invalid length. [ 1398.211707][T19336] netlink: 'syz.0.18393': attribute type 2 has an invalid length. [ 1398.211723][T19336] netlink: 68 bytes leftover after parsing attributes in process `syz.0.18393'. [ 1398.299351][T19339] CPU: 0 UID: 0 PID: 19339 Comm: syz.1.18395 Not tainted syzkaller #0 PREEMPT(full) [ 1398.299384][T19339] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1398.299398][T19339] Call Trace: [ 1398.299408][T19339] [ 1398.299418][T19339] dump_stack_lvl+0xe8/0x150 [ 1398.299451][T19339] should_fail_ex+0x412/0x560 [ 1398.299487][T19339] _copy_from_user+0x2d/0xb0 [ 1398.299522][T19339] sock_do_ioctl+0x195/0x320 [ 1398.299550][T19339] ? __pfx_sock_do_ioctl+0x10/0x10 [ 1398.299571][T19339] ? __mutex_unlock_slowpath+0x1be/0x6f0 [ 1398.299623][T19339] sock_ioctl+0x5c6/0x7f0 [ 1398.299648][T19339] ? __pfx_sock_ioctl+0x10/0x10 [ 1398.299671][T19339] ? __fget_files+0x2a/0x420 [ 1398.299704][T19339] ? __fget_files+0x3a0/0x420 [ 1398.299729][T19339] ? __fget_files+0x2a/0x420 [ 1398.299760][T19339] ? bpf_lsm_file_ioctl+0x9/0x20 [ 1398.299794][T19339] ? __pfx_sock_ioctl+0x10/0x10 [ 1398.299816][T19339] __se_sys_ioctl+0xfc/0x170 [ 1398.299850][T19339] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1398.299874][T19339] do_syscall_64+0x15f/0xf80 [ 1398.299904][T19339] ? trace_irq_disable+0x3b/0x140 [ 1398.299946][T19339] ? clear_bhb_loop+0x40/0x90 [ 1398.299975][T19339] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1398.299997][T19339] RIP: 0033:0x7f1ffa59cdd9 [ 1398.300018][T19339] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1398.300038][T19339] RSP: 002b:00007f1ff87f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1398.300062][T19339] RAX: ffffffffffffffda RBX: 00007f1ffa815fa0 RCX: 00007f1ffa59cdd9 [ 1398.300079][T19339] RDX: 00002000000000c0 RSI: 0000000000008947 RDI: 0000000000000003 [ 1398.300093][T19339] RBP: 00007f1ff87f6090 R08: 0000000000000000 R09: 0000000000000000 [ 1398.300107][T19339] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1398.300120][T19339] R13: 00007f1ffa816038 R14: 00007f1ffa815fa0 R15: 00007ffc2e72ade8 [ 1398.300157][T19339] [ 1398.316017][T19341] openvswitch: netlink: IP tunnel dst address not specified [ 1398.678453][T19344] xt_hashlimit: size too large, truncated to 1048576 [ 1398.899430][T19351] pimreg: left allmulticast mode [ 1399.572430][T19368] netlink: 24 bytes leftover after parsing attributes in process `syz.2.18404'. [ 1399.649429][T19372] netlink: 8 bytes leftover after parsing attributes in process `syz.4.18406'. [ 1399.694932][T19371] netlink: 8 bytes leftover after parsing attributes in process `syz.4.18406'. [ 1399.899516][T19385] openvswitch: netlink: IP tunnel dst address not specified [ 1399.960562][T19387] netlink: 40 bytes leftover after parsing attributes in process `syz.2.18410'. [ 1400.483354][T19411] netlink: 'syz.1.18420': attribute type 1 has an invalid length. [ 1400.682194][T19415] netlink: 12 bytes leftover after parsing attributes in process `syz.1.18420'. [ 1400.762326][T19411] bond26: entered promiscuous mode [ 1400.784706][T19415] netlink: 12 bytes leftover after parsing attributes in process `syz.1.18420'. [ 1400.797619][T19411] 8021q: adding VLAN 0 to HW filter on device bond26 [ 1401.069177][T19429] openvswitch: netlink: IP tunnel dst address not specified [ 1401.090361][T19411] bond26: (slave bridge24): making interface the new active one [ 1401.110380][T19411] bridge24: entered promiscuous mode [ 1401.136642][T19411] bond26: (slave bridge24): Enslaving as an active interface with an up link [ 1401.385034][T19437] 8021q: adding VLAN 0 to HW filter on device bond17 [ 1401.549816][T19450] xt_hashlimit: size too large, truncated to 1048576 [ 1401.890706][T19464] openvswitch: netlink: IP tunnel dst address not specified [ 1402.521061][T19493] netlink: 'syz.4.18449': attribute type 1 has an invalid length. [ 1402.529435][T19493] netlink: 'syz.4.18449': attribute type 4 has an invalid length. [ 1402.598011][T19497] openvswitch: netlink: IP tunnel dst address not specified [ 1402.632374][T19491] netlink: 'syz.0.18446': attribute type 2 has an invalid length. [ 1402.643968][T19491] netlink: 'syz.0.18446': attribute type 8 has an invalid length. [ 1402.805618][T19502] xt_hashlimit: size too large, truncated to 1048576 [ 1402.974972][T19516] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 1403.001137][T19511] __nla_validate_parse: 6 callbacks suppressed [ 1403.001155][T19511] netlink: 8 bytes leftover after parsing attributes in process `syz.0.18454'. [ 1403.047028][T19511] netlink: 8 bytes leftover after parsing attributes in process `syz.0.18454'. [ 1403.575827][T19541] netlink: zone id is out of range [ 1403.596084][T19541] netlink: zone id is out of range [ 1403.622712][T19543] netlink: 'syz.2.18464': attribute type 64 has an invalid length. [ 1403.646472][T19541] netlink: zone id is out of range [ 1403.663838][T19543] netlink: 8 bytes leftover after parsing attributes in process `syz.2.18464'. [ 1403.683427][T19541] netlink: zone id is out of range [ 1403.738764][T19541] netlink: zone id is out of range [ 1403.756255][T19541] netlink: zone id is out of range [ 1404.142099][T19568] vlan0: left allmulticast mode [ 1404.157084][T19568] veth1_virt_wifi: left allmulticast mode [ 1404.166399][T19571] xt_hashlimit: size too large, truncated to 1048576 [ 1404.189379][T19568] bond26: left promiscuous mode [ 1404.209010][T19568] bridge24: left promiscuous mode [ 1404.612400][T19589] netlink: 'syz.1.18476': attribute type 11 has an invalid length. [ 1404.636428][T19589] netlink: 64 bytes leftover after parsing attributes in process `syz.1.18476'. [ 1404.765298][T19595] netlink: 12 bytes leftover after parsing attributes in process `syz.0.18479'. [ 1404.913069][T19605] mac80211_hwsim hwsim9 syzkaller0: entered promiscuous mode [ 1404.952656][T19605] mac80211_hwsim hwsim9 syzkaller0: entered allmulticast mode [ 1405.038623][T19603] netlink: 212336 bytes leftover after parsing attributes in process `syz.3.18482'. [ 1405.188419][T19616] netlink: 640 bytes leftover after parsing attributes in process `syz.1.18486'. [ 1405.218211][T19616] net_ratelimit: 3 callbacks suppressed [ 1405.218232][T19616] openvswitch: netlink: Unknown VXLAN extension attribute 0 [ 1405.446853][T19631] netlink: 16 bytes leftover after parsing attributes in process `syz.1.18492'. [ 1405.559700][T19634] netlink: 68 bytes leftover after parsing attributes in process `syz.0.18493'. [ 1405.592677][T19642] netlink: 15563 bytes leftover after parsing attributes in process `syz.4.18494'. [ 1405.699436][T19646] openvswitch: netlink: Flow key attr not present in new flow. [ 1406.404598][T19685] openvswitch: netlink: Flow key attribute not present in set flow. [ 1406.444965][T19687] openvswitch: netlink: Flow key attr not present in new flow. [ 1406.720962][T19696] xfrm2: entered promiscuous mode [ 1406.743997][T19696] xfrm2: entered allmulticast mode [ 1407.368669][T19724] FAULT_INJECTION: forcing a failure. [ 1407.368669][T19724] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1407.416071][T19726] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1407.416414][T19724] CPU: 1 UID: 0 PID: 19724 Comm: syz.0.18523 Not tainted syzkaller #0 PREEMPT(full) [ 1407.416486][T19724] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1407.416519][T19724] Call Trace: [ 1407.416547][T19724] [ 1407.416569][T19724] dump_stack_lvl+0xe8/0x150 [ 1407.416658][T19724] should_fail_ex+0x412/0x560 [ 1407.416749][T19724] _copy_from_user+0x2d/0xb0 [ 1407.416812][T19724] ___sys_sendmsg+0x1c6/0x360 [ 1407.416880][T19724] ? __lock_acquire+0x6b5/0x2cf0 [ 1407.416969][T19724] ? __pfx____sys_sendmsg+0x10/0x10 [ 1407.417144][T19724] ? __fget_files+0x2a/0x420 [ 1407.417207][T19724] ? __fget_files+0x3a0/0x420 [ 1407.417307][T19724] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1407.417396][T19724] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1407.417505][T19724] ? __pfx_ksys_write+0x10/0x10 [ 1407.417620][T19724] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1407.417706][T19724] do_syscall_64+0x15f/0xf80 [ 1407.417803][T19724] ? clear_bhb_loop+0x40/0x90 [ 1407.417874][T19724] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1407.417926][T19724] RIP: 0033:0x7efe7539cdd9 [ 1407.417979][T19724] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1407.418029][T19724] RSP: 002b:00007efe76311028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1407.418089][T19724] RAX: ffffffffffffffda RBX: 00007efe75615fa0 RCX: 00007efe7539cdd9 [ 1407.418140][T19724] RDX: 0000000004008094 RSI: 0000200000000100 RDI: 0000000000000003 [ 1407.418180][T19724] RBP: 00007efe76311090 R08: 0000000000000000 R09: 0000000000000000 [ 1407.418218][T19724] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1407.418249][T19724] R13: 00007efe75616038 R14: 00007efe75615fa0 R15: 00007ffffe135708 [ 1407.418339][T19724] [ 1407.861896][T19737] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 1408.026529][T19741] __nla_validate_parse: 7 callbacks suppressed [ 1408.026550][T19741] netlink: 4 bytes leftover after parsing attributes in process `syz.1.18531'. [ 1408.064589][T19747] netlink: 12 bytes leftover after parsing attributes in process `syz.2.18533'. [ 1408.084826][T19741] netlink: 'syz.1.18531': attribute type 3 has an invalid length. [ 1408.103732][T19747] 8021q: adding VLAN 0 to HW filter on device ipvlan1 [ 1408.124063][T19741] openvswitch: netlink: Invalid VLAN frame [ 1408.140321][T19750] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 1408.376721][T19759] FAULT_INJECTION: forcing a failure. [ 1408.376721][T19759] name failslab, interval 1, probability 0, space 0, times 0 [ 1408.421864][T19759] CPU: 1 UID: 0 PID: 19759 Comm: syz.4.18538 Not tainted syzkaller #0 PREEMPT(full) [ 1408.421895][T19759] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1408.421909][T19759] Call Trace: [ 1408.421918][T19759] [ 1408.421927][T19759] dump_stack_lvl+0xe8/0x150 [ 1408.421958][T19759] should_fail_ex+0x412/0x560 [ 1408.421991][T19759] should_failslab+0xa8/0x100 [ 1408.422027][T19759] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 1408.422063][T19759] ? __alloc_skb+0x186/0x7d0 [ 1408.422090][T19759] ? __alloc_skb+0x1d0/0x7d0 [ 1408.422113][T19759] ? __local_bh_enable_ip+0xd0/0x130 [ 1408.422142][T19759] __alloc_skb+0x1d0/0x7d0 [ 1408.422174][T19759] netlink_sendmsg+0x5d4/0xb40 [ 1408.422215][T19759] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1408.422249][T19759] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1408.422279][T19759] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1408.422312][T19759] ____sys_sendmsg+0x972/0x9f0 [ 1408.422342][T19759] ? __might_fault+0xaf/0x130 [ 1408.422376][T19759] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1408.422417][T19759] ? import_iovec+0x73/0xa0 [ 1408.422453][T19759] ___sys_sendmsg+0x2a5/0x360 [ 1408.422482][T19759] ? __lock_acquire+0x6b5/0x2cf0 [ 1408.422511][T19759] ? __pfx____sys_sendmsg+0x10/0x10 [ 1408.422584][T19759] ? __fget_files+0x2a/0x420 [ 1408.422610][T19759] ? __fget_files+0x3a0/0x420 [ 1408.422648][T19759] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1408.422682][T19759] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1408.422723][T19759] ? __pfx_ksys_write+0x10/0x10 [ 1408.422763][T19759] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1408.422787][T19759] do_syscall_64+0x15f/0xf80 [ 1408.422817][T19759] ? trace_irq_disable+0x3b/0x140 [ 1408.422849][T19759] ? clear_bhb_loop+0x40/0x90 [ 1408.422876][T19759] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1408.422897][T19759] RIP: 0033:0x7f551979cdd9 [ 1408.422917][T19759] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1408.422936][T19759] RSP: 002b:00007f551a5cb028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1408.422959][T19759] RAX: ffffffffffffffda RBX: 00007f5519a15fa0 RCX: 00007f551979cdd9 [ 1408.422975][T19759] RDX: 0000000004008094 RSI: 0000200000000100 RDI: 0000000000000003 [ 1408.422989][T19759] RBP: 00007f551a5cb090 R08: 0000000000000000 R09: 0000000000000000 [ 1408.423003][T19759] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1408.423016][T19759] R13: 00007f5519a16038 R14: 00007f5519a15fa0 R15: 00007fff93281a58 [ 1408.423057][T19759] [ 1408.491444][T19762] nbd: couldn't find a device at index 0 [ 1408.852692][T19766] bridge13: entered promiscuous mode [ 1409.006479][T19776] openvswitch: netlink: VXLAN extension 78 out of range max 1 [ 1409.354766][T19794] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 1409.391392][T19796] netlink: 12 bytes leftover after parsing attributes in process `syz.2.18553'. [ 1409.416473][T19799] openvswitch: netlink: Geneve opt len 1 is not a multiple of 4. [ 1409.639479][T19792] syzkaller0: entered promiscuous mode [ 1409.646600][T19792] syzkaller0: entered allmulticast mode [ 1412.710446][T19826] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 1413.436124][T19867] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 1413.721659][T19884] tipc: New replicast peer: 255.255.255.255 [ 1413.731370][T19884] tipc: Enabled bearer , priority 10 [ 1413.761655][T19882] tipc: Enabling of bearer rejected, already enabled [ 1413.920448][T19893] netlink: 56 bytes leftover after parsing attributes in process `syz.2.18585'. [ 1414.162795][T19899] netlink: 148 bytes leftover after parsing attributes in process `syz.1.18587'. [ 1414.203613][T19899] openvswitch: netlink: Flow key attr not present in new flow. [ 1414.699148][T19921] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 1414.953287][T19929] netlink: 12 bytes leftover after parsing attributes in process `syz.2.18595'. [ 1415.000106][T19929] netlink: 24 bytes leftover after parsing attributes in process `syz.2.18595'. [ 1415.174806][T19934] netlink: 212336 bytes leftover after parsing attributes in process `syz.3.18599'. [ 1415.221524][T19941] openvswitch: netlink: Unexpected mask (mask=240040, allowed=10048) [ 1415.453252][T19955] netlink: 16 bytes leftover after parsing attributes in process `syz.3.18605'. [ 1415.663714][T19967] netlink: 12 bytes leftover after parsing attributes in process `syz.0.18608'. [ 1415.666376][T19965] mac80211_hwsim hwsim9 syzkaller0: left promiscuous mode [ 1415.680205][T19965] mac80211_hwsim hwsim9 syzkaller0: left allmulticast mode [ 1415.689564][T19967] netlink: 12 bytes leftover after parsing attributes in process `syz.0.18608'. [ 1415.837249][T19969] xt_hashlimit: size too large, truncated to 1048576 [ 1415.943299][T19975] netlink: 4 bytes leftover after parsing attributes in process `syz.1.18611'. [ 1416.273326][T19988] netlink: 8 bytes leftover after parsing attributes in process `syz.4.18615'. [ 1416.374400][T19992] ip6gre0: Master is either lo or non-ether device [ 1416.786718][T20013] xt_hashlimit: size too large, truncated to 1048576 [ 1417.948224][T20043] openvswitch: netlink: Geneve opt len 1 is not a multiple of 4. [ 1417.978055][T20044] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 1418.149320][T20050] xt_hashlimit: size too large, truncated to 1048576 [ 1418.622604][T20066] workqueue: Failed to create a rescuer kthread for wq "nfc4_nci_cmd_wq": -EINTR [ 1418.629271][T20072] workqueue: Failed to create a rescuer kthread for wq "nfc4_nci_cmd_wq": -EINTR [ 1419.258337][T20097] hsr0: left allmulticast mode [ 1419.286708][T20097] hsr_slave_0: left allmulticast mode [ 1419.294307][T20097] hsr_slave_1: left allmulticast mode [ 1419.316097][T20097] macvlan1: left allmulticast mode [ 1419.415249][T20097] bond27: left promiscuous mode [ 1419.430330][T20097] bond27: left allmulticast mode [ 1419.448664][T20097] bridge13: left promiscuous mode [ 1419.467159][ T1177] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 20002 - 0 [ 1419.500697][ T1177] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 20002 - 0 [ 1419.530604][T20108] __nla_validate_parse: 3 callbacks suppressed [ 1419.530625][T20108] netlink: 16 bytes leftover after parsing attributes in process `syz.3.18655'. [ 1419.598932][ T156] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 20002 - 0 [ 1419.640707][ T156] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 20002 - 0 [ 1419.711408][T20113] openvswitch: netlink: Geneve opt len 1 is not a multiple of 4. [ 1419.801826][T20115] netlink: 'syz.2.18658': attribute type 2 has an invalid length. [ 1420.257477][T20135] netlink: 20 bytes leftover after parsing attributes in process `syz.4.18667'. [ 1420.374142][T20143] netlink: 16 bytes leftover after parsing attributes in process `syz.4.18667'. [ 1420.441841][T20145] netlink: 8 bytes leftover after parsing attributes in process `syz.1.18669'. [ 1420.481989][T20145] gtp2: entered promiscuous mode [ 1420.502232][T20145] gtp2: entered allmulticast mode [ 1420.538344][T20151] netlink: 20 bytes leftover after parsing attributes in process `syz.1.18669'. [ 1420.943071][T20167] netlink: 8 bytes leftover after parsing attributes in process `syz.4.18678'. [ 1420.958238][T20167] netlink: 12 bytes leftover after parsing attributes in process `syz.4.18678'. [ 1421.037606][T20172] netlink: 8 bytes leftover after parsing attributes in process `syz.2.18679'. [ 1421.068845][T20172] netlink: 'syz.2.18679': attribute type 6 has an invalid length. [ 1421.085371][T20172] netlink: 4 bytes leftover after parsing attributes in process `syz.2.18679'. [ 1421.116586][T20172] netlink: 8 bytes leftover after parsing attributes in process `syz.2.18679'. [ 1421.191185][T20172] netlink: 'syz.2.18679': attribute type 6 has an invalid length. [ 1421.429719][T20190] sctp: [Deprecated]: syz.1.18687 (pid 20190) Use of int in maxseg socket option. [ 1421.429719][T20190] Use struct sctp_assoc_value instead [ 1421.791292][T20196] netlink: 'syz.2.18688': attribute type 10 has an invalid length. [ 1421.978045][T20199] netlink: 'syz.2.18690': attribute type 1 has an invalid length. [ 1421.994507][T20200] netlink: 'syz.2.18690': attribute type 1 has an invalid length. [ 1422.155242][T20205] bond28: option mode: unable to set because the bond device has slaves [ 1422.164544][T20205] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 1422.353537][T20214] netlink: 'syz.0.18695': attribute type 1 has an invalid length. [ 1422.449360][T20217] FAULT_INJECTION: forcing a failure. [ 1422.449360][T20217] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1422.492813][T20218] openvswitch: netlink: Geneve opt len 1 is not a multiple of 4. [ 1422.550330][T20217] CPU: 1 UID: 0 PID: 20217 Comm: syz.1.18696 Not tainted syzkaller #0 PREEMPT(full) [ 1422.550362][T20217] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1422.550376][T20217] Call Trace: [ 1422.550386][T20217] [ 1422.550397][T20217] dump_stack_lvl+0xe8/0x150 [ 1422.550431][T20217] should_fail_ex+0x412/0x560 [ 1422.550465][T20217] _copy_from_user+0x2d/0xb0 [ 1422.550499][T20217] ___sys_sendmsg+0x1c6/0x360 [ 1422.550530][T20217] ? __lock_acquire+0x6b5/0x2cf0 [ 1422.550561][T20217] ? __pfx____sys_sendmsg+0x10/0x10 [ 1422.550639][T20217] ? __fget_files+0x2a/0x420 [ 1422.550665][T20217] ? __fget_files+0x3a0/0x420 [ 1422.550703][T20217] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1422.550738][T20217] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1422.550781][T20217] ? __pfx_ksys_write+0x10/0x10 [ 1422.550823][T20217] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1422.550847][T20217] do_syscall_64+0x15f/0xf80 [ 1422.550878][T20217] ? trace_irq_disable+0x3b/0x140 [ 1422.550912][T20217] ? clear_bhb_loop+0x40/0x90 [ 1422.550940][T20217] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1422.550963][T20217] RIP: 0033:0x7f1ffa59cdd9 [ 1422.550983][T20217] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1422.551002][T20217] RSP: 002b:00007f1ff87f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1422.551025][T20217] RAX: ffffffffffffffda RBX: 00007f1ffa815fa0 RCX: 00007f1ffa59cdd9 [ 1422.551041][T20217] RDX: 0000000004048850 RSI: 0000200000002b80 RDI: 0000000000000003 [ 1422.551056][T20217] RBP: 00007f1ff87f6090 R08: 0000000000000000 R09: 0000000000000000 [ 1422.551069][T20217] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1422.551083][T20217] R13: 00007f1ffa816038 R14: 00007f1ffa815fa0 R15: 00007ffc2e72ade8 [ 1422.551118][T20217] [ 1422.555863][T20222] Unsupported ieee802154 address type: 0 [ 1422.700481][T20223] openvswitch: netlink: Flow key attr not present in new flow. [ 1423.059517][T20233] openvswitch: netlink: Message has 1 unknown bytes. [ 1423.076684][T20233] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1423.154670][T20240] openvswitch: netlink: Key 6 has unexpected len 0 expected 2 [ 1423.350522][T20246] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 1423.412479][T20250] FAULT_INJECTION: forcing a failure. [ 1423.412479][T20250] name failslab, interval 1, probability 0, space 0, times 0 [ 1423.435764][T20250] CPU: 0 UID: 0 PID: 20250 Comm: syz.4.18711 Not tainted syzkaller #0 PREEMPT(full) [ 1423.435797][T20250] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1423.435812][T20250] Call Trace: [ 1423.435821][T20250] [ 1423.435831][T20250] dump_stack_lvl+0xe8/0x150 [ 1423.435863][T20250] should_fail_ex+0x412/0x560 [ 1423.435899][T20250] should_failslab+0xa8/0x100 [ 1423.435936][T20250] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 1423.435972][T20250] ? __alloc_skb+0x186/0x7d0 [ 1423.435999][T20250] ? __alloc_skb+0x1d0/0x7d0 [ 1423.436025][T20250] ? __local_bh_enable_ip+0xd0/0x130 [ 1423.436054][T20250] __alloc_skb+0x1d0/0x7d0 [ 1423.436088][T20250] netlink_sendmsg+0x5d4/0xb40 [ 1423.436132][T20250] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1423.436167][T20250] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1423.436207][T20250] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1423.436242][T20250] ____sys_sendmsg+0x972/0x9f0 [ 1423.436273][T20250] ? __might_fault+0xaf/0x130 [ 1423.436306][T20250] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1423.436348][T20250] ? import_iovec+0x73/0xa0 [ 1423.436385][T20250] ___sys_sendmsg+0x2a5/0x360 [ 1423.436415][T20250] ? __lock_acquire+0x6b5/0x2cf0 [ 1423.436444][T20250] ? __pfx____sys_sendmsg+0x10/0x10 [ 1423.436515][T20250] ? __fget_files+0x2a/0x420 [ 1423.436542][T20250] ? __fget_files+0x3a0/0x420 [ 1423.436580][T20250] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1423.436616][T20250] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1423.436659][T20250] ? __pfx_ksys_write+0x10/0x10 [ 1423.436702][T20250] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1423.436726][T20250] do_syscall_64+0x15f/0xf80 [ 1423.436755][T20250] ? trace_irq_disable+0x3b/0x140 [ 1423.436787][T20250] ? clear_bhb_loop+0x40/0x90 [ 1423.436814][T20250] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1423.436836][T20250] RIP: 0033:0x7f551979cdd9 [ 1423.436857][T20250] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1423.436875][T20250] RSP: 002b:00007f551a5cb028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1423.436899][T20250] RAX: ffffffffffffffda RBX: 00007f5519a15fa0 RCX: 00007f551979cdd9 [ 1423.436914][T20250] RDX: 0000000004048850 RSI: 0000200000002b80 RDI: 0000000000000003 [ 1423.436928][T20250] RBP: 00007f551a5cb090 R08: 0000000000000000 R09: 0000000000000000 [ 1423.436940][T20250] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1423.436952][T20250] R13: 00007f5519a16038 R14: 00007f5519a15fa0 R15: 00007fff93281a58 [ 1423.436987][T20250] [ 1423.976657][T20266] openvswitch: netlink: Flow actions attr not present in new flow. [ 1424.142850][T20256] syzkaller0: entered promiscuous mode [ 1424.157923][T20256] syzkaller0: entered allmulticast mode [ 1427.439907][T20274] tipc: Enabled bearer , priority 0 [ 1427.521951][T20281] syzkaller0: entered promiscuous mode [ 1427.538728][T20281] syzkaller0: entered allmulticast mode [ 1427.551325][T20281] tipc: Resetting bearer [ 1427.557680][T20286] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 1427.763549][T20302] FAULT_INJECTION: forcing a failure. [ 1427.763549][T20302] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1427.778056][T20302] CPU: 0 UID: 0 PID: 20302 Comm: syz.1.18729 Not tainted syzkaller #0 PREEMPT(full) [ 1427.778086][T20302] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1427.778100][T20302] Call Trace: [ 1427.778110][T20302] [ 1427.778120][T20302] dump_stack_lvl+0xe8/0x150 [ 1427.778156][T20302] should_fail_ex+0x412/0x560 [ 1427.778192][T20302] _copy_from_iter+0x1d3/0x1670 [ 1427.778225][T20302] ? rcu_is_watching+0x15/0xb0 [ 1427.778260][T20302] ? __pfx__copy_from_iter+0x10/0x10 [ 1427.778298][T20302] ? netlink_sendmsg+0x650/0xb40 [ 1427.778328][T20302] ? skb_put+0x11b/0x210 [ 1427.778362][T20302] netlink_sendmsg+0x6c0/0xb40 [ 1427.778402][T20302] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1427.778437][T20302] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1427.778468][T20302] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1427.778503][T20302] ____sys_sendmsg+0x972/0x9f0 [ 1427.778534][T20302] ? __might_fault+0xaf/0x130 [ 1427.778571][T20302] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1427.778612][T20302] ? import_iovec+0x73/0xa0 [ 1427.778649][T20302] ___sys_sendmsg+0x2a5/0x360 [ 1427.778679][T20302] ? __lock_acquire+0x6b5/0x2cf0 [ 1427.778707][T20302] ? __pfx____sys_sendmsg+0x10/0x10 [ 1427.778779][T20302] ? __fget_files+0x2a/0x420 [ 1427.778805][T20302] ? __fget_files+0x3a0/0x420 [ 1427.778843][T20302] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1427.778878][T20302] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1427.778928][T20302] ? __pfx_ksys_write+0x10/0x10 [ 1427.778970][T20302] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1427.778995][T20302] do_syscall_64+0x15f/0xf80 [ 1427.779025][T20302] ? trace_irq_disable+0x3b/0x140 [ 1427.779059][T20302] ? clear_bhb_loop+0x40/0x90 [ 1427.779086][T20302] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1427.779108][T20302] RIP: 0033:0x7f1ffa59cdd9 [ 1427.779128][T20302] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1427.779147][T20302] RSP: 002b:00007f1ff87f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1427.779170][T20302] RAX: ffffffffffffffda RBX: 00007f1ffa815fa0 RCX: 00007f1ffa59cdd9 [ 1427.779187][T20302] RDX: 0000000004048850 RSI: 0000200000002b80 RDI: 0000000000000003 [ 1427.779201][T20302] RBP: 00007f1ff87f6090 R08: 0000000000000000 R09: 0000000000000000 [ 1427.779215][T20302] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1427.779229][T20302] R13: 00007f1ffa816038 R14: 00007f1ffa815fa0 R15: 00007ffc2e72ade8 [ 1427.779265][T20302] [ 1428.109256][T17697] tipc: Resetting bearer [ 1428.140182][T20272] tipc: Resetting bearer [ 1428.340329][T20317] xt_hashlimit: size too large, truncated to 1048576 [ 1428.403063][T20321] openvswitch: netlink: Geneve opt len 1 is not a multiple of 4. [ 1431.850277][T20272] tipc: Disabling bearer [ 1432.020173][T20337] __nla_validate_parse: 6 callbacks suppressed [ 1432.020196][T20337] netlink: 28 bytes leftover after parsing attributes in process `syz.2.18743'. [ 1432.091903][T20338] netlink: 4 bytes leftover after parsing attributes in process `syz.2.18743'. [ 1432.139971][T20338] netlink: 28 bytes leftover after parsing attributes in process `syz.2.18743'. [ 1432.148914][T20344] xt_hashlimit: size too large, truncated to 1048576 [ 1432.166605][T20347] tipc: Enabling of bearer rejected, failed to enable media [ 1432.278501][T20342] netlink: 212348 bytes leftover after parsing attributes in process `syz.4.18742'. [ 1432.579047][T20360] openvswitch: netlink: Geneve opt len 1 is not a multiple of 4. [ 1432.841304][T20373] netlink: 8 bytes leftover after parsing attributes in process `syz.0.18754'. [ 1432.940670][T20376] netlink: 20 bytes leftover after parsing attributes in process `syz.3.18755'. [ 1433.019323][T20385] netlink: 48 bytes leftover after parsing attributes in process `syz.2.18757'. [ 1433.281684][T20395] netlink: 8 bytes leftover after parsing attributes in process `syz.3.18760'. [ 1433.311968][T20395] macvlan3: entered allmulticast mode [ 1433.380547][T20398] openvswitch: netlink: Geneve opt len 1 is not a multiple of 4. [ 1433.434264][T20401] netlink: 65039 bytes leftover after parsing attributes in process `syz.4.18762'. [ 1433.464965][T20401] netlink: 56 bytes leftover after parsing attributes in process `syz.4.18762'. [ 1433.804578][ T4946] block nbd7: Receive control failed (result -107) [ 1434.200910][T20435] netlink: 'syz.3.18772': attribute type 4 has an invalid length. [ 1434.204141][T20433] netlink: 'syz.3.18772': attribute type 4 has an invalid length. [ 1434.278845][T20433] A link change request failed with some changes committed already. Interface .`¹ may have been left with an inconsistent configuration, please check. [ 1434.451553][T20442] macvlan4: entered allmulticast mode [ 1434.461464][T20442] hsr0: entered allmulticast mode [ 1434.466587][T20442] hsr_slave_0: entered allmulticast mode [ 1434.472438][T20442] hsr_slave_1: entered allmulticast mode [ 1434.482928][T20435] A link change request failed with some changes committed already. Interface .`¹ may have been left with an inconsistent configuration, please check. [ 1434.630314][T20449] netlink: 'syz.4.18776': attribute type 4 has an invalid length. [ 1435.151634][T20479] netlink: 'syz.0.18787': attribute type 1 has an invalid length. [ 1436.090276][T20520] netlink: 'syz.0.18800': attribute type 8 has an invalid length. [ 1436.150046][T20520] bond0: entered promiscuous mode [ 1436.180787][T20520] gretap0: entered promiscuous mode [ 1436.230740][T20520] team0: entered promiscuous mode [ 1436.251526][T20520] vlan0: entered promiscuous mode [ 1436.314412][T20520] hsr1: Slave A (bond0) is not up; please bring it up to get a fully working HSR network [ 1436.345473][T20520] hsr1: Slave B (gretap0) is not up; please bring it up to get a fully working HSR network [ 1436.359007][T20520] hsr1: Interlink (team0) is not up; please bring it up to get a fully working HSR network [ 1436.372979][T20520] hsr1: entered promiscuous mode [ 1436.884215][T20556] netlink: Conntrack attr type has unexpected length (type=2, length=0, expected=2) [ 1437.042348][T20564] __nla_validate_parse: 12 callbacks suppressed [ 1437.042369][T20564] netlink: 256 bytes leftover after parsing attributes in process `syz.3.18813'. [ 1437.070338][T20565] openvswitch: netlink: Unexpected mask (mask=2020040, allowed=2010048) [ 1437.176558][T20571] syzkaller0: entered promiscuous mode [ 1437.217663][T20571] syzkaller0: entered allmulticast mode [ 1437.304951][T20582] lo: Caught tx_queue_len zero misconfig [ 1437.561755][T20578] syzkaller1: entered promiscuous mode [ 1437.569958][T20578] syzkaller1: entered allmulticast mode [ 1437.875924][T20599] netlink: 16 bytes leftover after parsing attributes in process `syz.2.18822'. [ 1437.961994][T20608] netlink: 16 bytes leftover after parsing attributes in process `syz.1.18824'. [ 1438.173695][T20614] netlink: 9 bytes leftover after parsing attributes in process `syz.2.18826'. [ 1438.220738][T20614] 0·: renamed from hsr0 [ 1438.251438][T20614] 0·: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 1438.290393][T20614] 0·: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1438.318759][T20614] 0·: entered allmulticast mode [ 1438.325050][T20614] hsr_slave_0: entered allmulticast mode [ 1438.343325][T20614] hsr_slave_1: entered allmulticast mode [ 1438.345841][T20620] netlink: 8 bytes leftover after parsing attributes in process `syz.3.18829'. [ 1438.399869][T20614] A link change request failed with some changes committed already. Interface c0· may have been left with an inconsistent configuration, please check. [ 1438.469902][T20620] macvlan4: entered allmulticast mode [ 1438.641043][T20630] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 1439.014908][T20644] openvswitch: : Dropping previously announced user features [ 1439.034437][T20646] netlink: 16 bytes leftover after parsing attributes in process `syz.0.18839'. [ 1439.063708][T20649] openvswitch: netlink: Flow key attr not present in new flow. [ 1439.399484][T20664] netlink: 'syz.0.18842': attribute type 64 has an invalid length. [ 1439.598061][T20670] sctp: [Deprecated]: syz.4.18845 (pid 20670) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1439.598061][T20670] Use struct sctp_sack_info instead [ 1439.639211][T20671] netlink: 16 bytes leftover after parsing attributes in process `syz.2.18846'. [ 1439.921729][T20685] netlink: 16 bytes leftover after parsing attributes in process `syz.2.18852'. [ 1440.429877][T20704] netlink: 12 bytes leftover after parsing attributes in process `syz.2.18858'. [ 1440.766758][T20723] netlink: 16 bytes leftover after parsing attributes in process `syz.2.18865'. [ 1440.789532][T20719] team0: Device vlan0 failed to change mtu [ 1440.869199][T20727] geneve1: Caught tx_queue_len zero misconfig [ 1441.350537][T20750] A link change request failed with some changes committed already. Interface 26±ÿª¨úrBº“ may have been left with an inconsistent configuration, please check. [ 1441.468336][T20752] openvswitch: netlink: EtherType 50a is less than min 600 [ 1442.360472][T20796] __nla_validate_parse: 7 callbacks suppressed [ 1442.360493][T20796] netlink: 16 bytes leftover after parsing attributes in process `syz.1.18882'. [ 1442.534836][T20804] batadv_slave_0: Caught tx_queue_len zero misconfig [ 1442.581579][T20806] netlink: 12 bytes leftover after parsing attributes in process `syz.4.18885'. [ 1442.712260][T20811] netlink: 4 bytes leftover after parsing attributes in process `syz.0.18887'. [ 1442.865268][T20811] team0 (unregistering): left promiscuous mode [ 1442.897428][T20811] vlan0: left promiscuous mode [ 1442.950851][T20811] team0 (unregistering): Port device bond13 removed [ 1442.964703][T20811] team0 (unregistering): Port device vlan0 removed [ 1442.991111][T20811] team0 (unregistering): Port device bond16 removed [ 1443.015566][T20827] xt_hashlimit: size too large, truncated to 1048576 [ 1443.230220][T20835] netlink: 4 bytes leftover after parsing attributes in process `syz.1.18894'. [ 1443.311579][T20840] netlink: 8 bytes leftover after parsing attributes in process `syz.4.18896'. [ 1443.323082][T20835] netlink: 4 bytes leftover after parsing attributes in process `syz.1.18894'. [ 1443.344854][T20840] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1443.585269][T20850] netlink: 808 bytes leftover after parsing attributes in process `syz.1.18898'. [ 1443.810490][T20859] netlink: 16 bytes leftover after parsing attributes in process `syz.1.18902'. [ 1443.859679][T20864] pimreg3: entered allmulticast mode [ 1444.133040][T20887] netlink: 12 bytes leftover after parsing attributes in process `syz.0.18909'. [ 1444.188092][T20886] netlink: 12 bytes leftover after parsing attributes in process `syz.0.18909'. [ 1444.635259][T20911] openvswitch: netlink: IP tunnel dst address not specified [ 1444.642226][T20909] xt_hashlimit: size too large, truncated to 1048576 [ 1444.679366][T20911] netlink: 'syz.3.18916': attribute type 10 has an invalid length. [ 1444.955145][T20924] netlink: 'syz.3.18920': attribute type 30 has an invalid length. [ 1445.254668][T20938] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 1446.050351][T20986] netlink: 'syz.3.18939': attribute type 1 has an invalid length. [ 1446.075536][T20974] netlink: 'syz.4.18935': attribute type 39 has an invalid length. [ 1446.280712][T20986] workqueue: Failed to create a rescuer kthread for wq "bond29": -EINTR [ 1446.388336][T21001] tipc: New replicast peer: 255.255.255.255 [ 1446.446454][T21001] tipc: Enabled bearer , priority 10 [ 1446.465559][T21001] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1446.546358][T21001] bond0: ARP target 8.4.0.0 is already present [ 1446.564573][T21001] bond0: option arp_ip_target: invalid value (1032) [ 1447.740634][T21068] __nla_validate_parse: 10 callbacks suppressed [ 1447.740656][T21068] netlink: 4 bytes leftover after parsing attributes in process `syz.1.18964'. [ 1448.085861][T21089] netlink: 12 bytes leftover after parsing attributes in process `syz.1.18969'. [ 1448.316294][T21095] netlink: 212176 bytes leftover after parsing attributes in process `syz.4.18972'. [ 1448.523166][T21101] netlink: 'syz.3.18975': attribute type 39 has an invalid length. [ 1448.536029][T21104] bond29: (slave C): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 1448.642047][T21104] bond29: (slave C): Enslaving as an active interface with an up link [ 1448.663513][T21104] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 1448.694782][T21105] netdevsim netdevsim1 netdevsim0: left allmulticast mode [ 1448.754083][T21115] openvswitch: netlink: Geneve opt len 1 is not a multiple of 4. [ 1449.030242][T21119] netlink: 28 bytes leftover after parsing attributes in process `syz.1.18981'. [ 1449.238470][T21131] netlink: 'syz.4.18985': attribute type 1 has an invalid length. [ 1449.303084][T21131] netlink: 'syz.4.18985': attribute type 4 has an invalid length. [ 1449.330098][T21131] netlink: 9462 bytes leftover after parsing attributes in process `syz.4.18985'. [ 1449.573144][T21143] netlink: 20 bytes leftover after parsing attributes in process `syz.4.18992'. [ 1449.724252][T21145] netlink: 'syz.3.18993': attribute type 29 has an invalid length. [ 1449.771398][T21145] netlink: 'syz.3.18993': attribute type 29 has an invalid length. [ 1449.836115][T21145] netlink: 'syz.3.18993': attribute type 32 has an invalid length. [ 1449.862299][T21152] netlink: 8 bytes leftover after parsing attributes in process `syz.4.18996'. [ 1449.966578][T21156] dvmrp0: entered allmulticast mode [ 1450.055543][T21164] netlink: 'syz.3.18999': attribute type 4 has an invalid length. [ 1450.079606][T21164] netlink: 152 bytes leftover after parsing attributes in process `syz.3.18999'. [ 1450.147822][T21164] netlink: 12 bytes leftover after parsing attributes in process `syz.3.18999'. [ 1450.353083][T21169] netlink: 16 bytes leftover after parsing attributes in process `syz.2.19001'. [ 1450.378058][T21173] rdma_rxe: rxe_newlink: failed to add batadv_slave_1 [ 1450.387699][T21173] veth0_to_bond: entered allmulticast mode [ 1451.359015][T21201] sctp: [Deprecated]: syz.3.19012 (pid 21201) Use of int in maxseg socket option. [ 1451.359015][T21201] Use struct sctp_assoc_value instead [ 1451.436793][T21205] netlink: 'syz.4.19013': attribute type 1 has an invalid length. [ 1451.459553][T21206] netlink: 'syz.2.19014': attribute type 4 has an invalid length. [ 1451.459570][T21205] netlink: 'syz.4.19013': attribute type 1 has an invalid length. [ 1451.459592][T21205] netlink: 'syz.4.19013': attribute type 8 has an invalid length. [ 1452.534598][T21246] FAULT_INJECTION: forcing a failure. [ 1452.534598][T21246] name failslab, interval 1, probability 0, space 0, times 0 [ 1452.631420][T21246] CPU: 1 UID: 0 PID: 21246 Comm: syz.3.19024 Not tainted syzkaller #0 PREEMPT(full) [ 1452.631452][T21246] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1452.631467][T21246] Call Trace: [ 1452.631476][T21246] [ 1452.631486][T21246] dump_stack_lvl+0xe8/0x150 [ 1452.631517][T21246] should_fail_ex+0x412/0x560 [ 1452.631553][T21246] should_failslab+0xa8/0x100 [ 1452.631590][T21246] __kmalloc_cache_noprof+0x88/0x660 [ 1452.631621][T21246] ? sctp_copy_local_addr_list+0xa4/0x4f0 [ 1452.631654][T21246] ? sctp_add_bind_addr+0x8c/0x370 [ 1452.631692][T21246] sctp_add_bind_addr+0x8c/0x370 [ 1452.631729][T21246] sctp_copy_local_addr_list+0x314/0x4f0 [ 1452.631769][T21246] ? sctp_copy_local_addr_list+0xa4/0x4f0 [ 1452.631803][T21246] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 1452.631838][T21246] ? sctp_v6_is_any+0x64/0x80 [ 1452.631873][T21246] ? sctp_copy_one_addr+0x93/0x360 [ 1452.631909][T21246] sctp_bind_addr_copy+0xb3/0x3c0 [ 1452.631942][T21246] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 1452.631975][T21246] sctp_connect_new_asoc+0x2ff/0x6b0 [ 1452.632004][T21246] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 1452.632038][T21246] ? __local_bh_enable_ip+0xd0/0x130 [ 1452.632060][T21246] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 1452.632101][T21246] ? security_sctp_bind_connect+0x7e/0x2c0 [ 1452.632129][T21246] sctp_sendmsg+0x1528/0x2c10 [ 1452.632167][T21246] ? __pfx_sctp_sendmsg+0x10/0x10 [ 1452.632195][T21246] ? aa_sk_perm+0x6d5/0x900 [ 1452.632221][T21246] ? __might_fault+0xaf/0x130 [ 1452.632258][T21246] ? __pfx_aa_sk_perm+0x10/0x10 [ 1452.632289][T21246] ? sock_rps_record_flow+0x19/0x350 [ 1452.632324][T21246] ? __pfx_inet_sendmsg+0x10/0x10 [ 1452.632346][T21246] ? inet_sendmsg+0x2f4/0x370 [ 1452.632368][T21246] ? __pfx_inet_sendmsg+0x10/0x10 [ 1452.632390][T21246] __sys_sendto+0x5de/0x710 [ 1452.632422][T21246] ? __pfx___sys_sendto+0x10/0x10 [ 1452.632448][T21246] ? __mutex_unlock_slowpath+0x1be/0x6f0 [ 1452.632497][T21246] ? __fget_files+0x3a0/0x420 [ 1452.632537][T21246] ? ksys_write+0x242/0x270 [ 1452.632572][T21246] ? __pfx_ksys_write+0x10/0x10 [ 1452.632610][T21246] __x64_sys_sendto+0xde/0x100 [ 1452.632640][T21246] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1452.632664][T21246] do_syscall_64+0x15f/0xf80 [ 1452.632695][T21246] ? trace_irq_disable+0x3b/0x140 [ 1452.632729][T21246] ? clear_bhb_loop+0x40/0x90 [ 1452.632758][T21246] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1452.632779][T21246] RIP: 0033:0x7fb738d9cdd9 [ 1452.632801][T21246] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1452.632820][T21246] RSP: 002b:00007fb736fee028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 1452.632844][T21246] RAX: ffffffffffffffda RBX: 00007fb739015fa0 RCX: 00007fb738d9cdd9 [ 1452.632860][T21246] RDX: 000000000000fef4 RSI: 0000200000000100 RDI: 0000000000000005 [ 1452.632875][T21246] RBP: 00007fb736fee090 R08: 0000200000000140 R09: 000000000000001c [ 1452.632889][T21246] R10: 0000000000000800 R11: 0000000000000246 R12: 0000000000000002 [ 1452.632903][T21246] R13: 00007fb739016038 R14: 00007fb739015fa0 R15: 00007ffdbb376c38 [ 1452.632940][T21246] [ 1453.018777][T21251] openvswitch: netlink: Geneve opt len 1 is not a multiple of 4. [ 1453.161894][T21256] __nla_validate_parse: 10 callbacks suppressed [ 1453.161917][T21256] netlink: 12 bytes leftover after parsing attributes in process `syz.0.19026'. [ 1453.285561][T21256] bond18 (unregistering): Released all slaves [ 1453.292436][T21249] netlink: 4 bytes leftover after parsing attributes in process `syz.0.19026'. [ 1453.430010][T21267] netlink: 8 bytes leftover after parsing attributes in process `syz.4.19031'. [ 1453.502333][T21271] Cannot find del_set index 49151 as target [ 1453.535718][T21267] 8021q: adding VLAN 0 to HW filter on device macsec0 [ 1453.560987][T21271] vlan0: entered promiscuous mode [ 1453.584135][T21271] bond23: entered promiscuous mode [ 1453.606785][T21271] ip6gretap0: entered promiscuous mode [ 1453.885972][T21290] openvswitch: netlink: IP tunnel TTL not specified. [ 1454.044173][T21296] netlink: 8 bytes leftover after parsing attributes in process `syz.2.19036'. [ 1454.329481][T21306] FAULT_INJECTION: forcing a failure. [ 1454.329481][T21306] name failslab, interval 1, probability 0, space 0, times 0 [ 1454.366142][T21306] CPU: 0 UID: 0 PID: 21306 Comm: syz.3.19042 Not tainted syzkaller #0 PREEMPT(full) [ 1454.366179][T21306] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1454.366192][T21306] Call Trace: [ 1454.366202][T21306] [ 1454.366212][T21306] dump_stack_lvl+0xe8/0x150 [ 1454.366243][T21306] should_fail_ex+0x412/0x560 [ 1454.366278][T21306] should_failslab+0xa8/0x100 [ 1454.366315][T21306] __kmalloc_cache_noprof+0x88/0x660 [ 1454.366345][T21306] ? sctp_copy_local_addr_list+0xa4/0x4f0 [ 1454.366376][T21306] ? sctp_add_bind_addr+0x8c/0x370 [ 1454.366413][T21306] sctp_add_bind_addr+0x8c/0x370 [ 1454.366450][T21306] sctp_copy_local_addr_list+0x314/0x4f0 [ 1454.366484][T21306] ? sctp_copy_local_addr_list+0xa4/0x4f0 [ 1454.366517][T21306] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 1454.366550][T21306] ? sctp_v6_is_any+0x64/0x80 [ 1454.366585][T21306] ? sctp_copy_one_addr+0x93/0x360 [ 1454.366620][T21306] sctp_bind_addr_copy+0xb3/0x3c0 [ 1454.366652][T21306] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 1454.366684][T21306] sctp_connect_new_asoc+0x2ff/0x6b0 [ 1454.366711][T21306] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 1454.366743][T21306] ? __local_bh_enable_ip+0xd0/0x130 [ 1454.366765][T21306] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 1454.366796][T21306] ? security_sctp_bind_connect+0x7e/0x2c0 [ 1454.366824][T21306] sctp_sendmsg+0x1528/0x2c10 [ 1454.366865][T21306] ? __pfx_sctp_sendmsg+0x10/0x10 [ 1454.366892][T21306] ? aa_sk_perm+0x6d5/0x900 [ 1454.366917][T21306] ? __might_fault+0xaf/0x130 [ 1454.366951][T21306] ? __pfx_aa_sk_perm+0x10/0x10 [ 1454.366993][T21306] ? sock_rps_record_flow+0x19/0x350 [ 1454.367024][T21306] ? __pfx_inet_sendmsg+0x10/0x10 [ 1454.367045][T21306] ? inet_sendmsg+0x2f4/0x370 [ 1454.367071][T21306] ? __pfx_inet_sendmsg+0x10/0x10 [ 1454.367092][T21306] __sys_sendto+0x5de/0x710 [ 1454.367122][T21306] ? __pfx___sys_sendto+0x10/0x10 [ 1454.367145][T21306] ? __mutex_unlock_slowpath+0x1be/0x6f0 [ 1454.367189][T21306] ? __fget_files+0x3a0/0x420 [ 1454.367225][T21306] ? ksys_write+0x242/0x270 [ 1454.367257][T21306] ? __pfx_ksys_write+0x10/0x10 [ 1454.367292][T21306] __x64_sys_sendto+0xde/0x100 [ 1454.367319][T21306] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1454.367342][T21306] do_syscall_64+0x15f/0xf80 [ 1454.367370][T21306] ? trace_irq_disable+0x3b/0x140 [ 1454.367401][T21306] ? clear_bhb_loop+0x40/0x90 [ 1454.367428][T21306] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1454.367448][T21306] RIP: 0033:0x7fb738d9cdd9 [ 1454.367468][T21306] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1454.367486][T21306] RSP: 002b:00007fb736fee028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 1454.367508][T21306] RAX: ffffffffffffffda RBX: 00007fb739015fa0 RCX: 00007fb738d9cdd9 [ 1454.367523][T21306] RDX: 000000000000fef4 RSI: 0000200000000100 RDI: 0000000000000005 [ 1454.367537][T21306] RBP: 00007fb736fee090 R08: 0000200000000140 R09: 000000000000001c [ 1454.367551][T21306] R10: 0000000000000800 R11: 0000000000000246 R12: 0000000000000002 [ 1454.367564][T21306] R13: 00007fb739016038 R14: 00007fb739015fa0 R15: 00007ffdbb376c38 [ 1454.367598][T21306] [ 1454.963918][T21322] Cannot find del_set index 49151 as target [ 1455.306863][T21333] vlan0: entered promiscuous mode [ 1455.494320][T21343] xt_hashlimit: size too large, truncated to 1048576 [ 1455.579583][T21351] FAULT_INJECTION: forcing a failure. [ 1455.579583][T21351] name failslab, interval 1, probability 0, space 0, times 0 [ 1455.628050][T21351] CPU: 0 UID: 0 PID: 21351 Comm: syz.0.19055 Not tainted syzkaller #0 PREEMPT(full) [ 1455.628082][T21351] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1455.628097][T21351] Call Trace: [ 1455.628106][T21351] [ 1455.628116][T21351] dump_stack_lvl+0xe8/0x150 [ 1455.628149][T21351] should_fail_ex+0x412/0x560 [ 1455.628186][T21351] should_failslab+0xa8/0x100 [ 1455.628224][T21351] __kmalloc_cache_noprof+0x88/0x660 [ 1455.628257][T21351] ? sctp_add_bind_addr+0x8c/0x370 [ 1455.628295][T21351] sctp_add_bind_addr+0x8c/0x370 [ 1455.628333][T21351] sctp_copy_local_addr_list+0x314/0x4f0 [ 1455.628369][T21351] ? sctp_copy_local_addr_list+0xa4/0x4f0 [ 1455.628402][T21351] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 1455.628437][T21351] ? sctp_v6_is_any+0x64/0x80 [ 1455.628472][T21351] ? sctp_copy_one_addr+0x93/0x360 [ 1455.628508][T21351] sctp_bind_addr_copy+0xb3/0x3c0 [ 1455.628540][T21351] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 1455.628571][T21351] sctp_connect_new_asoc+0x2ff/0x6b0 [ 1455.628600][T21351] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 1455.628633][T21351] ? __local_bh_enable_ip+0xd0/0x130 [ 1455.628656][T21351] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 1455.628688][T21351] ? security_sctp_bind_connect+0x7e/0x2c0 [ 1455.628724][T21351] sctp_sendmsg+0x1528/0x2c10 [ 1455.628766][T21351] ? __pfx_sctp_sendmsg+0x10/0x10 [ 1455.628794][T21351] ? aa_sk_perm+0x6d5/0x900 [ 1455.628820][T21351] ? __might_fault+0xaf/0x130 [ 1455.628860][T21351] ? __pfx_aa_sk_perm+0x10/0x10 [ 1455.628892][T21351] ? sock_rps_record_flow+0x19/0x350 [ 1455.628926][T21351] ? __pfx_inet_sendmsg+0x10/0x10 [ 1455.628949][T21351] ? inet_sendmsg+0x2f4/0x370 [ 1455.628970][T21351] ? __pfx_inet_sendmsg+0x10/0x10 [ 1455.628993][T21351] __sys_sendto+0x5de/0x710 [ 1455.629025][T21351] ? __pfx___sys_sendto+0x10/0x10 [ 1455.629051][T21351] ? __mutex_unlock_slowpath+0x1be/0x6f0 [ 1455.629099][T21351] ? __fget_files+0x3a0/0x420 [ 1455.629139][T21351] ? ksys_write+0x242/0x270 [ 1455.629173][T21351] ? __pfx_ksys_write+0x10/0x10 [ 1455.629211][T21351] __x64_sys_sendto+0xde/0x100 [ 1455.629241][T21351] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1455.629265][T21351] do_syscall_64+0x15f/0xf80 [ 1455.629296][T21351] ? trace_irq_disable+0x3b/0x140 [ 1455.629329][T21351] ? clear_bhb_loop+0x40/0x90 [ 1455.629357][T21351] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1455.629379][T21351] RIP: 0033:0x7efe7539cdd9 [ 1455.629399][T21351] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1455.629419][T21351] RSP: 002b:00007efe76311028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 1455.629442][T21351] RAX: ffffffffffffffda RBX: 00007efe75615fa0 RCX: 00007efe7539cdd9 [ 1455.629459][T21351] RDX: 000000000000fef4 RSI: 0000200000000100 RDI: 0000000000000005 [ 1455.629474][T21351] RBP: 00007efe76311090 R08: 0000200000000140 R09: 000000000000001c [ 1455.629489][T21351] R10: 0000000000000800 R11: 0000000000000246 R12: 0000000000000002 [ 1455.629502][T21351] R13: 00007efe75616038 R14: 00007efe75615fa0 R15: 00007ffffe135708 [ 1455.629539][T21351] [ 1456.430262][T21363] rdma_op ffff8880284861f0 conn xmit_rdma 0000000000000000 [ 1456.617453][T21373] netlink: 'syz.4.19063': attribute type 10 has an invalid length. [ 1456.644813][T21373] netlink: 96 bytes leftover after parsing attributes in process `syz.4.19063'. [ 1456.840286][T21382] Cannot find del_set index 49151 as target [ 1456.854441][T21382] tipc: Resetting bearer [ 1456.864268][T21382] vlan0: entered promiscuous mode [ 1457.059454][T21384] netlink: 12 bytes leftover after parsing attributes in process `syz.2.19067'. [ 1457.083313][T21388] netlink: 'syz.3.19068': attribute type 4 has an invalid length. [ 1457.103701][T21388] netlink: 152 bytes leftover after parsing attributes in process `syz.3.19068'. [ 1457.143770][T21388] netlink: 12 bytes leftover after parsing attributes in process `syz.3.19068'. [ 1457.331406][T21395] netlink: 8 bytes leftover after parsing attributes in process `syz.4.19071'. [ 1457.374152][T21399] FAULT_INJECTION: forcing a failure. [ 1457.374152][T21399] name failslab, interval 1, probability 0, space 0, times 0 [ 1457.426281][T21399] CPU: 0 UID: 0 PID: 21399 Comm: syz.2.19072 Not tainted syzkaller #0 PREEMPT(full) [ 1457.426312][T21399] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1457.426326][T21399] Call Trace: [ 1457.426333][T21399] [ 1457.426344][T21399] dump_stack_lvl+0xe8/0x150 [ 1457.426376][T21399] should_fail_ex+0x412/0x560 [ 1457.426412][T21399] should_failslab+0xa8/0x100 [ 1457.426450][T21399] __kmalloc_cache_noprof+0x88/0x660 [ 1457.426492][T21399] ? sctp_copy_local_addr_list+0xa4/0x4f0 [ 1457.426526][T21399] ? sctp_add_bind_addr+0x8c/0x370 [ 1457.426564][T21399] sctp_add_bind_addr+0x8c/0x370 [ 1457.426601][T21399] sctp_copy_local_addr_list+0x314/0x4f0 [ 1457.426637][T21399] ? sctp_copy_local_addr_list+0xa4/0x4f0 [ 1457.426670][T21399] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 1457.426705][T21399] ? sctp_v6_is_any+0x64/0x80 [ 1457.426740][T21399] ? sctp_copy_one_addr+0x93/0x360 [ 1457.426777][T21399] sctp_bind_addr_copy+0xb3/0x3c0 [ 1457.426810][T21399] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 1457.426843][T21399] sctp_connect_new_asoc+0x2ff/0x6b0 [ 1457.426872][T21399] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 1457.426904][T21399] ? __local_bh_enable_ip+0xd0/0x130 [ 1457.426925][T21399] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 1457.426957][T21399] ? security_sctp_bind_connect+0x7e/0x2c0 [ 1457.426986][T21399] sctp_sendmsg+0x1528/0x2c10 [ 1457.427028][T21399] ? __pfx_sctp_sendmsg+0x10/0x10 [ 1457.427056][T21399] ? aa_sk_perm+0x6d5/0x900 [ 1457.427083][T21399] ? __might_fault+0xaf/0x130 [ 1457.427120][T21399] ? __pfx_aa_sk_perm+0x10/0x10 [ 1457.427152][T21399] ? sock_rps_record_flow+0x19/0x350 [ 1457.427186][T21399] ? __pfx_inet_sendmsg+0x10/0x10 [ 1457.427209][T21399] ? inet_sendmsg+0x2f4/0x370 [ 1457.427230][T21399] ? __pfx_inet_sendmsg+0x10/0x10 [ 1457.427251][T21399] __sys_sendto+0x5de/0x710 [ 1457.427286][T21399] ? __pfx___sys_sendto+0x10/0x10 [ 1457.427312][T21399] ? __mutex_unlock_slowpath+0x1be/0x6f0 [ 1457.427360][T21399] ? __fget_files+0x3a0/0x420 [ 1457.427402][T21399] ? ksys_write+0x242/0x270 [ 1457.427437][T21399] ? __pfx_ksys_write+0x10/0x10 [ 1457.427483][T21399] __x64_sys_sendto+0xde/0x100 [ 1457.427515][T21399] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1457.427540][T21399] do_syscall_64+0x15f/0xf80 [ 1457.427571][T21399] ? trace_irq_disable+0x3b/0x140 [ 1457.427605][T21399] ? clear_bhb_loop+0x40/0x90 [ 1457.427633][T21399] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1457.427656][T21399] RIP: 0033:0x7fa76159cdd9 [ 1457.427677][T21399] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1457.427697][T21399] RSP: 002b:00007fa76241f028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 1457.427721][T21399] RAX: ffffffffffffffda RBX: 00007fa761815fa0 RCX: 00007fa76159cdd9 [ 1457.427738][T21399] RDX: 000000000000fef4 RSI: 0000200000000100 RDI: 0000000000000005 [ 1457.427752][T21399] RBP: 00007fa76241f090 R08: 0000200000000140 R09: 000000000000001c [ 1457.427768][T21399] R10: 0000000000000800 R11: 0000000000000246 R12: 0000000000000002 [ 1457.427781][T21399] R13: 00007fa761816038 R14: 00007fa761815fa0 R15: 00007ffc31ba54e8 [ 1457.427819][T21399] [ 1458.256073][T21426] netlink: 24 bytes leftover after parsing attributes in process `syz.3.19082'. [ 1458.287350][T21425] netlink: 24 bytes leftover after parsing attributes in process `syz.3.19082'. [ 1458.664643][T21444] openvswitch: netlink: Geneve opt len 1 is not a multiple of 4. [ 1459.098712][T21459] openvswitch: netlink: Flow set message rejected, Key attribute missing. [ 1459.353079][T21463] netlink: 4 bytes leftover after parsing attributes in process `syz.3.19092'. [ 1459.670089][T21476] syzkaller0: entered promiscuous mode [ 1459.681397][T21476] syzkaller0: entered allmulticast mode [ 1459.710585][T21480] xt_hashlimit: invalid rate [ 1459.864106][T21487] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 1459.920618][T21489] openvswitch: netlink: IP tunnel dst address not specified [ 1460.074911][T21497] SET target dimension over the limit! [ 1460.115683][T21498] SET target dimension over the limit! [ 1460.134312][T21507] netlink: 8 bytes leftover after parsing attributes in process `syz.4.19105'. [ 1460.170812][T21509] netlink: 20 bytes leftover after parsing attributes in process `syz.3.19108'. [ 1460.243274][T21505] xt_hashlimit: size too large, truncated to 1048576 [ 1460.459092][T21517] netlink: 'syz.0.19110': attribute type 4 has an invalid length. [ 1460.493456][T21517] netlink: 152 bytes leftover after parsing attributes in process `syz.0.19110'. [ 1460.510258][T21517] netlink: 12 bytes leftover after parsing attributes in process `syz.0.19110'. [ 1460.650344][T21520] netlink: 24 bytes leftover after parsing attributes in process `syz.1.19113'. [ 1461.003514][T21534] netlink: 48 bytes leftover after parsing attributes in process `syz.2.19118'. [ 1461.323390][T21540] bond20 (unregistering): Released all slaves [ 1461.396322][T21550] openvswitch: netlink: Geneve opt len 1 is not a multiple of 4. [ 1461.428207][T21549] netlink: 'syz.0.19121': attribute type 1 has an invalid length. [ 1461.734521][T21559] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1461.766876][T21565] xt_hashlimit: size too large, truncated to 1048576 [ 1461.924204][T21577] bridge15: trying to set multicast query interval below minimum, setting to 100 (1000ms) [ 1461.969470][T21577] netlink: 12 bytes leftover after parsing attributes in process `syz.2.19130'. [ 1462.696048][T21597] syzkaller0: entered promiscuous mode [ 1462.710272][T21597] syzkaller0: entered allmulticast mode [ 1462.746612][T21611] team_slave_1: Caught tx_queue_len zero misconfig [ 1466.836265][T21611] syzkaller0: entered promiscuous mode [ 1466.849031][T21611] syzkaller0: entered allmulticast mode [ 1466.894111][T21645] __nla_validate_parse: 1 callbacks suppressed [ 1466.894131][T21645] netlink: 28 bytes leftover after parsing attributes in process `syz.0.19151'. [ 1470.072392][T21654] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 1470.132034][T21656] netlink: 8 bytes leftover after parsing attributes in process `syz.2.19154'. [ 1470.361644][T21669] netlink: 16 bytes leftover after parsing attributes in process `syz.1.19160'. [ 1470.747833][T21681] netlink: 4 bytes leftover after parsing attributes in process `syz.2.19165'. [ 1470.799721][T21686] netlink: 8 bytes leftover after parsing attributes in process `syz.0.19167'. [ 1471.138592][T21700] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 1471.928692][T21743] tipc: Enabling of bearer rejected, failed to enable media [ 1472.474809][T21760] netlink: 32 bytes leftover after parsing attributes in process `syz.4.19180'. [ 1472.734093][T21772] mac80211_hwsim hwsim9 syzkaller0: entered promiscuous mode [ 1472.765047][T21772] mac80211_hwsim hwsim9 syzkaller0: entered allmulticast mode [ 1472.824308][T21772] tipc: Enabled bearer , priority 0 [ 1473.230123][T21788] openvswitch: netlink: Geneve opt len 1 is not a multiple of 4. [ 1473.301718][T21793] netlink: 'syz.3.19189': attribute type 11 has an invalid length. [ 1473.782976][T21817] netlink: 8 bytes leftover after parsing attributes in process `syz.2.19199'. [ 1474.057880][T21829] openvswitch: netlink: Geneve opt len 1 is not a multiple of 4. [ 1474.188750][T21835] tipc: Enabling of bearer rejected, already enabled [ 1474.324616][T21843] netlink: 8 bytes leftover after parsing attributes in process `syz.0.19208'. [ 1474.359252][T21844] netlink: 20 bytes leftover after parsing attributes in process `syz.1.19209'. [ 1474.488024][T21850] openvswitch: netlink: Unknown key attributes 2 [ 1474.600114][T21848] netlink: 'syz.4.19210': attribute type 16 has an invalid length. [ 1474.646375][T21848] netlink: 'syz.4.19210': attribute type 17 has an invalid length. [ 1474.691839][T21848] tunl0: left promiscuous mode [ 1474.699764][T21848] gre0: left promiscuous mode [ 1474.812720][T21848] gretap0: left promiscuous mode [ 1474.836500][T21848] ip_vti0: left promiscuous mode [ 1474.924599][T21848] .`¹: left promiscuous mode [ 1474.934961][T21848] bond_slave_0: left promiscuous mode [ 1474.941118][T21848] bond_slave_1: left promiscuous mode [ 1475.016769][T21848] bridge0: port 1(bridge_slave_0) entered blocking state [ 1475.024227][T21848] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1475.043564][T21866] netlink: 16 bytes leftover after parsing attributes in process `syz.1.19216'. [ 1475.121351][T21848] bridge0: port 2(bridge_slave_1) entered blocking state [ 1475.128665][T21848] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1475.151925][T21848] veth0_to_bond: left allmulticast mode [ 1475.173734][T21848] 0·: left allmulticast mode [ 1475.180055][T21848] hsr_slave_0: left allmulticast mode [ 1475.185699][T21848] hsr_slave_1: left allmulticast mode [ 1475.199439][T21848] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1475.215998][T21848] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check. [ 1476.664129][T21871] netlink: 4 bytes leftover after parsing attributes in process `syz.3.19217'. [ 1478.395674][T21883] netlink: 8 bytes leftover after parsing attributes in process `syz.0.19222'. [ 1478.461084][T21886] netlink: 184 bytes leftover after parsing attributes in process `syz.2.19223'. [ 1478.474567][T21883] netlink: 24 bytes leftover after parsing attributes in process `syz.0.19222'. [ 1478.539247][T21886] netlink: 12 bytes leftover after parsing attributes in process `syz.2.19223'. [ 1479.083618][T21910] netlink: 'syz.1.19233': attribute type 6 has an invalid length. [ 1479.118294][T21910] netlink: 12 bytes leftover after parsing attributes in process `syz.1.19233'. [ 1479.131945][T21912] netlink: 4 bytes leftover after parsing attributes in process `syz.2.19234'. [ 1479.173782][T21912] netlink: 4 bytes leftover after parsing attributes in process `syz.2.19234'. [ 1479.190046][T21917] netlink: 8 bytes leftover after parsing attributes in process `syz.0.19236'. [ 1479.205456][T21918] netlink: 8 bytes leftover after parsing attributes in process `syz.1.19233'. [ 1479.259634][T21910] bond27: option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0) [ 1479.314629][T21910] bond27 (unregistering): Released all slaves [ 1479.433764][T21928] netlink: 'syz.2.19238': attribute type 4 has an invalid length. [ 1479.498258][T21928] netlink: 152 bytes leftover after parsing attributes in process `syz.2.19238'. [ 1479.564447][T21923] bond27: (slave bond_slave_1): Device is not bonding slave [ 1479.593123][T21923] bond27: option active_slave: invalid value (bond_slave_1) [ 1479.625174][T21923] bond27 (unregistering): Released all slaves [ 1479.889036][T21949] syzkaller0: entered promiscuous mode [ 1479.914741][T21949] syzkaller0: entered allmulticast mode [ 1480.846445][T21989] macvlan5: entered allmulticast mode [ 1481.084469][T22005] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 1481.455482][T22016] syzkaller0: entered promiscuous mode [ 1481.462250][T22016] syzkaller0: entered allmulticast mode [ 1481.795010][T22028] sctp: [Deprecated]: syz.0.19275 (pid 22028) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1481.795010][T22028] Use struct sctp_sack_info instead [ 1481.907419][T22026] macvlan6: entered allmulticast mode [ 1482.574551][T22056] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1482.603403][T22056] sctp: [Deprecated]: syz.2.19287 (pid 22056) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1482.603403][T22056] Use struct sctp_sack_info instead [ 1482.654523][T22060] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 1482.699764][T22060] bridge0: port 3(veth1_to_bridge) entered blocking state [ 1482.707569][T22060] bridge0: port 3(veth1_to_bridge) entered disabled state [ 1482.714992][T22060] veth1_to_bridge: entered allmulticast mode [ 1482.725288][T22060] veth1_to_bridge: entered promiscuous mode [ 1482.742876][T22060] bridge0: adding interface veth1_to_bridge with same address as a received packet (addr:aa:aa:aa:aa:aa:1c, vlan:0) [ 1482.769162][T22060] bridge0: port 3(veth1_to_bridge) entered blocking state [ 1482.776478][T22060] bridge0: port 3(veth1_to_bridge) entered forwarding state [ 1482.819607][T22059] syzkaller0: entered promiscuous mode [ 1482.834577][T22059] syzkaller0: entered allmulticast mode [ 1482.884813][T22062] bond3: (slave lo): Releasing backup interface [ 1482.915679][T22062] bond3: (slave lo): last VLAN challenged slave left bond - VLAN blocking is removed [ 1482.927922][T22062] bond20: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 1482.950690][T22062] bond20: (slave lo): Enslaving as an active interface with an up link [ 1482.982479][T22062] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 1483.511693][T22085] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1483.677835][T22097] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1484.204719][T22118] __nla_validate_parse: 3 callbacks suppressed [ 1484.204741][T22118] netlink: 8 bytes leftover after parsing attributes in process `syz.3.19309'. [ 1484.227916][T22118] netlink: 8 bytes leftover after parsing attributes in process `syz.3.19309'. [ 1484.265122][T22124] netlink: 12 bytes leftover after parsing attributes in process `syz.0.19312'. [ 1484.454141][T22127] syzkaller0: entered promiscuous mode [ 1484.471234][T22127] syzkaller0: entered allmulticast mode [ 1484.645228][T22143] netlink: 8 bytes leftover after parsing attributes in process `syz.1.19319'. [ 1484.870245][T22160] netlink: 8 bytes leftover after parsing attributes in process `syz.3.19320'. [ 1485.117898][T22143] macvlan5: entered allmulticast mode [ 1485.239126][T22173] netlink: 12 bytes leftover after parsing attributes in process `syz.0.19324'. [ 1485.275009][T22175] netlink: 216 bytes leftover after parsing attributes in process `syz.1.19326'. [ 1485.446159][T22182] netlink: 16 bytes leftover after parsing attributes in process `syz.0.19327'. [ 1485.512648][T22186] FAULT_INJECTION: forcing a failure. [ 1485.512648][T22186] name failslab, interval 1, probability 0, space 0, times 0 [ 1485.537095][T22186] CPU: 1 UID: 0 PID: 22186 Comm: syz.4.19329 Not tainted syzkaller #0 PREEMPT(full) [ 1485.537124][T22186] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1485.537138][T22186] Call Trace: [ 1485.537146][T22186] [ 1485.537156][T22186] dump_stack_lvl+0xe8/0x150 [ 1485.537187][T22186] should_fail_ex+0x412/0x560 [ 1485.537220][T22186] should_failslab+0xa8/0x100 [ 1485.537255][T22186] __kmalloc_cache_noprof+0x88/0x660 [ 1485.537283][T22186] ? __sctp_v6_cmp_addr+0x1dc/0x510 [ 1485.537315][T22186] ? sctp_v6_cmp_addr+0x15/0xd0 [ 1485.537344][T22186] ? sctp_add_bind_addr+0x8c/0x370 [ 1485.537380][T22186] sctp_add_bind_addr+0x8c/0x370 [ 1485.537418][T22186] sctp_copy_local_addr_list+0x314/0x4f0 [ 1485.537454][T22186] ? sctp_copy_local_addr_list+0xa4/0x4f0 [ 1485.537487][T22186] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 1485.537639][T22186] ? sctp_v6_is_any+0x64/0x80 [ 1485.537675][T22186] ? sctp_copy_one_addr+0x93/0x360 [ 1485.537709][T22186] sctp_bind_addr_copy+0xb3/0x3c0 [ 1485.537749][T22186] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 1485.537891][T22186] sctp_connect_new_asoc+0x2ff/0x6b0 [ 1485.537933][T22186] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 1485.537964][T22186] ? __local_bh_enable_ip+0xd0/0x130 [ 1485.537992][T22186] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 1485.538024][T22186] ? security_sctp_bind_connect+0x7e/0x2c0 [ 1485.538052][T22186] sctp_sendmsg+0x1528/0x2c10 [ 1485.538093][T22186] ? __pfx_sctp_sendmsg+0x10/0x10 [ 1485.538120][T22186] ? aa_sk_perm+0x6d5/0x900 [ 1485.538146][T22186] ? __might_fault+0xaf/0x130 [ 1485.538183][T22186] ? __pfx_aa_sk_perm+0x10/0x10 [ 1485.538215][T22186] ? sock_rps_record_flow+0x19/0x350 [ 1485.538249][T22186] ? __pfx_inet_sendmsg+0x10/0x10 [ 1485.538272][T22186] ? inet_sendmsg+0x2f4/0x370 [ 1485.538294][T22186] ? __pfx_inet_sendmsg+0x10/0x10 [ 1485.538317][T22186] __sys_sendto+0x5de/0x710 [ 1485.538349][T22186] ? __pfx___sys_sendto+0x10/0x10 [ 1485.538375][T22186] ? __mutex_unlock_slowpath+0x1be/0x6f0 [ 1485.538424][T22186] ? __fget_files+0x3a0/0x420 [ 1485.538465][T22186] ? ksys_write+0x242/0x270 [ 1485.538500][T22186] ? __pfx_ksys_write+0x10/0x10 [ 1485.538546][T22186] __x64_sys_sendto+0xde/0x100 [ 1485.538576][T22186] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1485.538601][T22186] do_syscall_64+0x15f/0xf80 [ 1485.538632][T22186] ? trace_irq_disable+0x3b/0x140 [ 1485.538667][T22186] ? clear_bhb_loop+0x40/0x90 [ 1485.538695][T22186] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1485.538718][T22186] RIP: 0033:0x7f551979cdd9 [ 1485.538748][T22186] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1485.538768][T22186] RSP: 002b:00007f551a5cb028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 1485.538793][T22186] RAX: ffffffffffffffda RBX: 00007f5519a15fa0 RCX: 00007f551979cdd9 [ 1485.538811][T22186] RDX: 000000000000fef4 RSI: 0000200000000100 RDI: 0000000000000005 [ 1485.538826][T22186] RBP: 00007f551a5cb090 R08: 0000200000000140 R09: 000000000000001c [ 1485.538842][T22186] R10: 0000000000000800 R11: 0000000000000246 R12: 0000000000000002 [ 1485.538856][T22186] R13: 00007f5519a16038 R14: 00007f5519a15fa0 R15: 00007fff93281a58 [ 1485.538893][T22186] [ 1485.943010][T22189] netlink: 8 bytes leftover after parsing attributes in process `syz.1.19331'. [ 1485.980805][T22189] IPVS: Error connecting to the multicast addr [ 1486.090684][T22195] netlink: 12 bytes leftover after parsing attributes in process `syz.4.19332'. [ 1486.157653][T22199] netlink: 'syz.2.19330': attribute type 4 has an invalid length. [ 1486.342503][T22202] syzkaller0: entered promiscuous mode [ 1486.383164][T22202] syzkaller0: entered allmulticast mode [ 1486.836443][T22219] bridge17: entered promiscuous mode [ 1486.874480][T22219] bridge17: entered allmulticast mode [ 1486.999077][T22229] FAULT_INJECTION: forcing a failure. [ 1486.999077][T22229] name failslab, interval 1, probability 0, space 0, times 0 [ 1487.040030][T22229] CPU: 1 UID: 0 PID: 22229 Comm: syz.3.19342 Not tainted syzkaller #0 PREEMPT(full) [ 1487.040062][T22229] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1487.040077][T22229] Call Trace: [ 1487.040086][T22229] [ 1487.040096][T22229] dump_stack_lvl+0xe8/0x150 [ 1487.040130][T22229] should_fail_ex+0x412/0x560 [ 1487.040166][T22229] should_failslab+0xa8/0x100 [ 1487.040204][T22229] __kmalloc_cache_noprof+0x88/0x660 [ 1487.040234][T22229] ? __sctp_v6_cmp_addr+0x1dc/0x510 [ 1487.040266][T22229] ? sctp_v6_cmp_addr+0x15/0xd0 [ 1487.040297][T22229] ? sctp_add_bind_addr+0x8c/0x370 [ 1487.040335][T22229] sctp_add_bind_addr+0x8c/0x370 [ 1487.040381][T22229] sctp_copy_local_addr_list+0x314/0x4f0 [ 1487.040418][T22229] ? sctp_copy_local_addr_list+0xa4/0x4f0 [ 1487.040450][T22229] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 1487.040485][T22229] ? sctp_v6_is_any+0x64/0x80 [ 1487.040518][T22229] ? sctp_copy_one_addr+0x93/0x360 [ 1487.040554][T22229] sctp_bind_addr_copy+0xb3/0x3c0 [ 1487.040588][T22229] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 1487.040621][T22229] sctp_connect_new_asoc+0x2ff/0x6b0 [ 1487.040650][T22229] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 1487.040683][T22229] ? __local_bh_enable_ip+0xd0/0x130 [ 1487.040704][T22229] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 1487.040736][T22229] ? security_sctp_bind_connect+0x7e/0x2c0 [ 1487.040764][T22229] sctp_sendmsg+0x1528/0x2c10 [ 1487.040806][T22229] ? __pfx_sctp_sendmsg+0x10/0x10 [ 1487.040833][T22229] ? aa_sk_perm+0x6d5/0x900 [ 1487.040860][T22229] ? __might_fault+0xaf/0x130 [ 1487.040896][T22229] ? __pfx_aa_sk_perm+0x10/0x10 [ 1487.040931][T22229] ? sock_rps_record_flow+0x19/0x350 [ 1487.040965][T22229] ? __pfx_inet_sendmsg+0x10/0x10 [ 1487.040987][T22229] ? inet_sendmsg+0x2f4/0x370 [ 1487.041009][T22229] ? __pfx_inet_sendmsg+0x10/0x10 [ 1487.041031][T22229] __sys_sendto+0x5de/0x710 [ 1487.041064][T22229] ? __pfx___sys_sendto+0x10/0x10 [ 1487.041090][T22229] ? __mutex_unlock_slowpath+0x1be/0x6f0 [ 1487.041138][T22229] ? __fget_files+0x3a0/0x420 [ 1487.041179][T22229] ? ksys_write+0x242/0x270 [ 1487.041213][T22229] ? __pfx_ksys_write+0x10/0x10 [ 1487.041252][T22229] __x64_sys_sendto+0xde/0x100 [ 1487.041282][T22229] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1487.041306][T22229] do_syscall_64+0x15f/0xf80 [ 1487.041336][T22229] ? trace_irq_disable+0x3b/0x140 [ 1487.041375][T22229] ? clear_bhb_loop+0x40/0x90 [ 1487.041403][T22229] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1487.041425][T22229] RIP: 0033:0x7fb738d9cdd9 [ 1487.041446][T22229] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1487.041465][T22229] RSP: 002b:00007fb736fee028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 1487.041489][T22229] RAX: ffffffffffffffda RBX: 00007fb739015fa0 RCX: 00007fb738d9cdd9 [ 1487.041505][T22229] RDX: 000000000000fef4 RSI: 0000200000000100 RDI: 0000000000000005 [ 1487.041520][T22229] RBP: 00007fb736fee090 R08: 0000200000000140 R09: 000000000000001c [ 1487.041534][T22229] R10: 0000000000000800 R11: 0000000000000246 R12: 0000000000000002 [ 1487.041548][T22229] R13: 00007fb739016038 R14: 00007fb739015fa0 R15: 00007ffdbb376c38 [ 1487.041585][T22229] [ 1487.832089][T22252] syzkaller0: entered promiscuous mode [ 1487.858974][T22252] syzkaller0: entered allmulticast mode [ 1487.877848][T22254] netlink: 'syz.1.19354': attribute type 1 has an invalid length. [ 1488.302634][T22271] netlink: 'syz.0.19357': attribute type 49 has an invalid length. [ 1488.323509][T22273] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 1488.366815][T22275] FAULT_INJECTION: forcing a failure. [ 1488.366815][T22275] name failslab, interval 1, probability 0, space 0, times 0 [ 1488.385038][T22275] CPU: 1 UID: 0 PID: 22275 Comm: syz.3.19359 Not tainted syzkaller #0 PREEMPT(full) [ 1488.385066][T22275] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1488.385079][T22275] Call Trace: [ 1488.385087][T22275] [ 1488.385097][T22275] dump_stack_lvl+0xe8/0x150 [ 1488.385128][T22275] should_fail_ex+0x412/0x560 [ 1488.385162][T22275] should_failslab+0xa8/0x100 [ 1488.385198][T22275] __kmalloc_cache_noprof+0x88/0x660 [ 1488.385234][T22275] ? __sctp_v6_cmp_addr+0x1e6/0x510 [ 1488.385266][T22275] ? sctp_add_bind_addr+0x8c/0x370 [ 1488.385302][T22275] sctp_add_bind_addr+0x8c/0x370 [ 1488.385337][T22275] sctp_copy_local_addr_list+0x314/0x4f0 [ 1488.385371][T22275] ? sctp_copy_local_addr_list+0xa4/0x4f0 [ 1488.385400][T22275] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 1488.385430][T22275] ? sctp_v6_is_any+0x64/0x80 [ 1488.385461][T22275] ? sctp_copy_one_addr+0x93/0x360 [ 1488.385493][T22275] sctp_bind_addr_copy+0xb3/0x3c0 [ 1488.385522][T22275] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 1488.385550][T22275] sctp_connect_new_asoc+0x2ff/0x6b0 [ 1488.385575][T22275] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 1488.385604][T22275] ? __local_bh_enable_ip+0xd0/0x130 [ 1488.385624][T22275] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 1488.385652][T22275] ? security_sctp_bind_connect+0x7e/0x2c0 [ 1488.385677][T22275] sctp_sendmsg+0x1528/0x2c10 [ 1488.385713][T22275] ? __pfx_sctp_sendmsg+0x10/0x10 [ 1488.385736][T22275] ? aa_sk_perm+0x6d5/0x900 [ 1488.385759][T22275] ? __might_fault+0xaf/0x130 [ 1488.385791][T22275] ? __pfx_aa_sk_perm+0x10/0x10 [ 1488.385822][T22275] ? sock_rps_record_flow+0x19/0x350 [ 1488.385854][T22275] ? __pfx_inet_sendmsg+0x10/0x10 [ 1488.385875][T22275] ? inet_sendmsg+0x2f4/0x370 [ 1488.385895][T22275] ? __pfx_inet_sendmsg+0x10/0x10 [ 1488.385916][T22275] __sys_sendto+0x5de/0x710 [ 1488.385948][T22275] ? __pfx___sys_sendto+0x10/0x10 [ 1488.385972][T22275] ? __mutex_unlock_slowpath+0x1be/0x6f0 [ 1488.386020][T22275] ? __fget_files+0x3a0/0x420 [ 1488.386058][T22275] ? ksys_write+0x242/0x270 [ 1488.386091][T22275] ? __pfx_ksys_write+0x10/0x10 [ 1488.386128][T22275] __x64_sys_sendto+0xde/0x100 [ 1488.386177][T22275] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1488.386235][T22275] do_syscall_64+0x15f/0xf80 [ 1488.386265][T22275] ? trace_irq_disable+0x3b/0x140 [ 1488.386299][T22275] ? clear_bhb_loop+0x40/0x90 [ 1488.386326][T22275] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1488.386355][T22275] RIP: 0033:0x7fb738d9cdd9 [ 1488.386376][T22275] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1488.386396][T22275] RSP: 002b:00007fb736fee028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 1488.386418][T22275] RAX: ffffffffffffffda RBX: 00007fb739015fa0 RCX: 00007fb738d9cdd9 [ 1488.386434][T22275] RDX: 000000000000fef4 RSI: 0000200000000100 RDI: 0000000000000005 [ 1488.386448][T22275] RBP: 00007fb736fee090 R08: 0000200000000140 R09: 000000000000001c [ 1488.386466][T22275] R10: 0000000000000800 R11: 0000000000000246 R12: 0000000000000002 [ 1488.386479][T22275] R13: 00007fb739016038 R14: 00007fb739015fa0 R15: 00007ffdbb376c38 [ 1488.386515][T22275] [ 1489.014855][T22285] netlink: 'syz.0.19365': attribute type 1 has an invalid length. [ 1489.042531][T22283] syzkaller1: entered promiscuous mode [ 1489.092102][T22283] syzkaller1: entered allmulticast mode [ 1489.243488][T22297] __nla_validate_parse: 9 callbacks suppressed [ 1489.243507][T22297] netlink: 12 bytes leftover after parsing attributes in process `syz.1.19368'. [ 1489.452529][T22304] FAULT_INJECTION: forcing a failure. [ 1489.452529][T22304] name failslab, interval 1, probability 0, space 0, times 0 [ 1489.465842][T22304] CPU: 1 UID: 0 PID: 22304 Comm: syz.3.19373 Not tainted syzkaller #0 PREEMPT(full) [ 1489.465873][T22304] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1489.465887][T22304] Call Trace: [ 1489.465897][T22304] [ 1489.465907][T22304] dump_stack_lvl+0xe8/0x150 [ 1489.465939][T22304] should_fail_ex+0x412/0x560 [ 1489.465975][T22304] should_failslab+0xa8/0x100 [ 1489.466011][T22304] __kmalloc_cache_noprof+0x88/0x660 [ 1489.466065][T22304] ? sctp_add_bind_addr+0x8c/0x370 [ 1489.466107][T22304] sctp_add_bind_addr+0x8c/0x370 [ 1489.466144][T22304] sctp_copy_local_addr_list+0x314/0x4f0 [ 1489.466181][T22304] ? sctp_copy_local_addr_list+0xa4/0x4f0 [ 1489.466214][T22304] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 1489.466247][T22304] ? sctp_v6_is_any+0x64/0x80 [ 1489.466283][T22304] ? sctp_copy_one_addr+0x93/0x360 [ 1489.466327][T22304] sctp_bind_addr_copy+0xb3/0x3c0 [ 1489.466361][T22304] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 1489.466394][T22304] sctp_connect_new_asoc+0x2ff/0x6b0 [ 1489.466423][T22304] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 1489.466456][T22304] ? __local_bh_enable_ip+0xd0/0x130 [ 1489.466479][T22304] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 1489.466512][T22304] ? security_sctp_bind_connect+0x7e/0x2c0 [ 1489.466541][T22304] sctp_sendmsg+0x1528/0x2c10 [ 1489.466583][T22304] ? __pfx_sctp_sendmsg+0x10/0x10 [ 1489.466611][T22304] ? aa_sk_perm+0x6d5/0x900 [ 1489.466638][T22304] ? __might_fault+0xaf/0x130 [ 1489.466674][T22304] ? __pfx_aa_sk_perm+0x10/0x10 [ 1489.466707][T22304] ? sock_rps_record_flow+0x19/0x350 [ 1489.466741][T22304] ? __pfx_inet_sendmsg+0x10/0x10 [ 1489.466764][T22304] ? inet_sendmsg+0x2f4/0x370 [ 1489.466786][T22304] ? __pfx_inet_sendmsg+0x10/0x10 [ 1489.466809][T22304] __sys_sendto+0x5de/0x710 [ 1489.466842][T22304] ? __pfx___sys_sendto+0x10/0x10 [ 1489.466869][T22304] ? __mutex_unlock_slowpath+0x1be/0x6f0 [ 1489.466922][T22304] ? __fget_files+0x3a0/0x420 [ 1489.466961][T22304] ? ksys_write+0x242/0x270 [ 1489.466996][T22304] ? __pfx_ksys_write+0x10/0x10 [ 1489.467034][T22304] __x64_sys_sendto+0xde/0x100 [ 1489.467062][T22304] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1489.467085][T22304] do_syscall_64+0x15f/0xf80 [ 1489.467114][T22304] ? trace_irq_disable+0x3b/0x140 [ 1489.467146][T22304] ? clear_bhb_loop+0x40/0x90 [ 1489.467174][T22304] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1489.467196][T22304] RIP: 0033:0x7fb738d9cdd9 [ 1489.467217][T22304] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1489.467238][T22304] RSP: 002b:00007fb736fee028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 1489.467261][T22304] RAX: ffffffffffffffda RBX: 00007fb739015fa0 RCX: 00007fb738d9cdd9 [ 1489.467278][T22304] RDX: 000000000000fef4 RSI: 0000200000000100 RDI: 0000000000000005 [ 1489.467292][T22304] RBP: 00007fb736fee090 R08: 0000200000000140 R09: 000000000000001c [ 1489.467307][T22304] R10: 0000000000000800 R11: 0000000000000246 R12: 0000000000000002 [ 1489.467329][T22304] R13: 00007fb739016038 R14: 00007fb739015fa0 R15: 00007ffdbb376c38 [ 1489.467366][T22304] [ 1489.830569][T22307] netlink: 'syz.0.19372': attribute type 1 has an invalid length. [ 1490.280215][T22326] xt_hashlimit: size too large, truncated to 1048576 [ 1490.555919][T22337] netlink: 16 bytes leftover after parsing attributes in process `syz.3.19382'. [ 1490.854191][T22342] netlink: 24 bytes leftover after parsing attributes in process `syz.2.19383'. [ 1490.864161][T22346] netlink: 'syz.3.19384': attribute type 16 has an invalid length. [ 1490.873745][T22346] netlink: 20 bytes leftover after parsing attributes in process `syz.3.19384'. [ 1491.046482][T22350] sctp: [Deprecated]: syz.3.19386 (pid 22350) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1491.046482][T22350] Use struct sctp_sack_info instead [ 1491.154062][T22352] netlink: 28 bytes leftover after parsing attributes in process `syz.1.19387'. [ 1491.272743][T22352] sctp: [Deprecated]: syz.1.19387 (pid 22352) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1491.272743][T22352] Use struct sctp_sack_info instead [ 1491.326627][T22357] netlink: 8 bytes leftover after parsing attributes in process `syz.3.19388'. [ 1491.366318][T22357] macvlan7: entered allmulticast mode [ 1491.577713][T22369] netlink: 16 bytes leftover after parsing attributes in process `syz.4.19394'. [ 1491.819721][T22376] netlink: 12 bytes leftover after parsing attributes in process `syz.0.19395'. [ 1491.919410][T22381] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 1491.921384][T22379] netlink: 20 bytes leftover after parsing attributes in process `syz.4.19396'. [ 1491.961443][T22379] netlink: 20 bytes leftover after parsing attributes in process `syz.4.19396'. [ 1492.008275][T22380] bridge19: port 1(veth27) entered blocking state [ 1492.028639][T22380] bridge19: port 1(veth27) entered disabled state [ 1492.045850][T22380] veth27: entered allmulticast mode [ 1492.068290][T22380] veth27: entered promiscuous mode [ 1492.086674][T22374] bridge19: port 2(veth0_to_bond) entered blocking state [ 1492.123540][T22374] bridge19: port 2(veth0_to_bond) entered disabled state [ 1492.158646][T22374] veth0_to_bond: entered allmulticast mode [ 1492.208003][T22374] veth0_to_bond: entered promiscuous mode [ 1492.699690][T22414] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1493.611220][T22451] netlink: 'syz.3.19421': attribute type 1 has an invalid length. [ 1493.737186][T22451] 8021q: adding VLAN 0 to HW filter on device bond30 [ 1494.014209][T22468] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 1494.404149][T22489] netlink: 'syz.3.19436': attribute type 1 has an invalid length. [ 1494.629278][T22489] 8021q: adding VLAN 0 to HW filter on device bond31 [ 1495.012506][T22533] __nla_validate_parse: 10 callbacks suppressed [ 1495.012531][T22533] netlink: 20 bytes leftover after parsing attributes in process `syz.0.19445'. [ 1495.162874][T22538] 0·: left allmulticast mode [ 1495.188923][T22538] hsr_slave_0: left allmulticast mode [ 1495.224482][T22538] hsr_slave_1: left allmulticast mode [ 1495.319301][T22538] A link change request failed with some changes committed already. Interface ip6gre1 may have been left with an inconsistent configuration, please check. [ 1495.476562][T22553] netlink: 16 bytes leftover after parsing attributes in process `syz.4.19452'. [ 1495.901746][T22580] netlink: 4 bytes leftover after parsing attributes in process `syz.1.19457'. [ 1495.963931][T22580] netlink: 4 bytes leftover after parsing attributes in process `syz.1.19457'. [ 1495.973945][ T1177] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1496.013193][ T1177] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1496.058787][ T1177] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1496.343298][T22596] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 1496.441166][T22598] netlink: 4 bytes leftover after parsing attributes in process `syz.2.19462'. [ 1496.464771][T22598] openvswitch: netlink: Unknown nsh attribute 0 [ 1496.526139][T22600] A link change request failed with some changes committed already. Interface veth1_to_bridge may have been left with an inconsistent configuration, please check. [ 1497.110635][T22633] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 1497.236870][T22635] netlink: 12 bytes leftover after parsing attributes in process `syz.4.19476'. [ 1497.263253][T22635] netlink: 12 bytes leftover after parsing attributes in process `syz.4.19476'. [ 1497.325876][T22639] xt_hashlimit: size too large, truncated to 1048576 [ 1497.466090][T22647] FAULT_INJECTION: forcing a failure. [ 1497.466090][T22647] name failslab, interval 1, probability 0, space 0, times 0 [ 1497.486573][T22652] netlink: 'syz.0.19483': attribute type 1 has an invalid length. [ 1497.508933][T22647] CPU: 1 UID: 0 PID: 22647 Comm: syz.4.19481 Not tainted syzkaller #0 PREEMPT(full) [ 1497.508964][T22647] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1497.508979][T22647] Call Trace: [ 1497.508988][T22647] [ 1497.508998][T22647] dump_stack_lvl+0xe8/0x150 [ 1497.509031][T22647] should_fail_ex+0x412/0x560 [ 1497.509067][T22647] should_failslab+0xa8/0x100 [ 1497.509102][T22647] ? skb_clone+0x212/0x3a0 [ 1497.509135][T22647] kmem_cache_alloc_noprof+0x87/0x650 [ 1497.509167][T22647] ? __netlink_lookup+0xc6/0x8b0 [ 1497.509215][T22647] skb_clone+0x212/0x3a0 [ 1497.509252][T22647] __netlink_deliver_tap+0x404/0x850 [ 1497.509298][T22647] ? netlink_deliver_tap+0x2e/0x1b0 [ 1497.509330][T22647] netlink_deliver_tap+0x19c/0x1b0 [ 1497.509362][T22647] netlink_unicast+0x730/0x8e0 [ 1497.509402][T22647] netlink_sendmsg+0x813/0xb40 [ 1497.509445][T22647] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1497.509481][T22647] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1497.509512][T22647] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1497.509553][T22647] ____sys_sendmsg+0x972/0x9f0 [ 1497.509585][T22647] ? __might_fault+0xaf/0x130 [ 1497.509622][T22647] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1497.509664][T22647] ? import_iovec+0x73/0xa0 [ 1497.509700][T22647] ___sys_sendmsg+0x2a5/0x360 [ 1497.509731][T22647] ? __lock_acquire+0x6b5/0x2cf0 [ 1497.509761][T22647] ? __pfx____sys_sendmsg+0x10/0x10 [ 1497.509834][T22647] ? __fget_files+0x2a/0x420 [ 1497.509861][T22647] ? __fget_files+0x3a0/0x420 [ 1497.509900][T22647] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1497.509935][T22647] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1497.509979][T22647] ? __pfx_ksys_write+0x10/0x10 [ 1497.510021][T22647] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1497.510046][T22647] do_syscall_64+0x15f/0xf80 [ 1497.510077][T22647] ? trace_irq_disable+0x3b/0x140 [ 1497.510111][T22647] ? clear_bhb_loop+0x40/0x90 [ 1497.510140][T22647] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1497.510162][T22647] RIP: 0033:0x7f551979cdd9 [ 1497.510183][T22647] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1497.510212][T22647] RSP: 002b:00007f551a5cb028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1497.510236][T22647] RAX: ffffffffffffffda RBX: 00007f5519a15fa0 RCX: 00007f551979cdd9 [ 1497.510252][T22647] RDX: 0000000000000090 RSI: 00002000000002c0 RDI: 0000000000000003 [ 1497.510266][T22647] RBP: 00007f551a5cb090 R08: 0000000000000000 R09: 0000000000000000 [ 1497.510280][T22647] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1497.510293][T22647] R13: 00007f5519a16038 R14: 00007f5519a15fa0 R15: 00007fff93281a58 [ 1497.510331][T22647] [ 1497.856679][T22652] 8021q: adding VLAN 0 to HW filter on device bond18 [ 1497.986270][T22663] netlink: 'syz.4.19486': attribute type 33 has an invalid length. [ 1498.254139][T22663] bond21: option broadcast_neighbor: mode dependency failed, not supported in mode balance-rr(0) [ 1498.268939][T22663] bond21 (unregistering): Released all slaves [ 1499.312790][T22704] FAULT_INJECTION: forcing a failure. [ 1499.312790][T22704] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1499.332007][T22704] CPU: 1 UID: 0 PID: 22704 Comm: syz.2.19496 Not tainted syzkaller #0 PREEMPT(full) [ 1499.332037][T22704] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1499.332052][T22704] Call Trace: [ 1499.332062][T22704] [ 1499.332072][T22704] dump_stack_lvl+0xe8/0x150 [ 1499.332104][T22704] should_fail_ex+0x412/0x560 [ 1499.332139][T22704] _copy_from_user+0x2d/0xb0 [ 1499.332173][T22704] kstrtouint_from_user+0xd6/0x180 [ 1499.332204][T22704] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 1499.332262][T22704] proc_fail_nth_write+0x8e/0x210 [ 1499.332292][T22704] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 1499.332329][T22704] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 1499.332360][T22704] vfs_write+0x29a/0xb90 [ 1499.332403][T22704] ? __pfx_vfs_write+0x10/0x10 [ 1499.332437][T22704] ? __fget_files+0x2a/0x420 [ 1499.332468][T22704] ? __fget_files+0x3a0/0x420 [ 1499.332494][T22704] ? __fget_files+0x2a/0x420 [ 1499.332529][T22704] ksys_write+0x150/0x270 [ 1499.332564][T22704] ? __pfx_ksys_write+0x10/0x10 [ 1499.332606][T22704] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1499.332630][T22704] do_syscall_64+0x15f/0xf80 [ 1499.332662][T22704] ? trace_irq_disable+0x3b/0x140 [ 1499.332697][T22704] ? clear_bhb_loop+0x40/0x90 [ 1499.332725][T22704] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1499.332747][T22704] RIP: 0033:0x7fa76155d60e [ 1499.332768][T22704] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1499.332789][T22704] RSP: 002b:00007fa76241efe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1499.332813][T22704] RAX: ffffffffffffffda RBX: 00007fa76241f6c0 RCX: 00007fa76155d60e [ 1499.332829][T22704] RDX: 0000000000000001 RSI: 00007fa76241f0a0 RDI: 0000000000000004 [ 1499.332844][T22704] RBP: 00007fa76241f090 R08: 0000000000000000 R09: 0000000000000000 [ 1499.332858][T22704] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1499.332871][T22704] R13: 00007fa761816038 R14: 00007fa761815fa0 R15: 00007ffc31ba54e8 [ 1499.332911][T22704] [ 1499.679775][T22708] netlink: 104 bytes leftover after parsing attributes in process `syz.0.19498'. [ 1499.779319][T22715] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 1500.402235][T22741] netlink: 8 bytes leftover after parsing attributes in process `syz.1.19509'. [ 1500.480677][T22741] macvlan6: entered allmulticast mode [ 1500.588039][T22746] netlink: 212368 bytes leftover after parsing attributes in process `syz.2.19511'. [ 1502.663249][T22827] xt_hashlimit: invalid interval [ 1502.699616][T22827] netlink: 'syz.1.19533': attribute type 10 has an invalid length. [ 1502.761048][ T29] audit: type=1804 audit(1778284068.342:138): pid=22827 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.1.19533" name="/newroot/3890/cgroup.controllers" dev="tmpfs" ino=19637 res=1 errno=0 [ 1502.869932][ T29] audit: type=1800 audit(1778284068.342:139): pid=22827 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.19533" name="cgroup.controllers" dev="tmpfs" ino=19637 res=0 errno=0 [ 1502.893637][T22834] openvswitch: netlink: VXLAN extension 1 has unexpected len 8 expected 4 [ 1503.321699][T22840] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 1504.089454][T22888] bond20: (slave lo): Releasing backup interface [ 1504.134778][T22888] bond20: (slave lo): last VLAN challenged slave left bond - VLAN blocking is removed [ 1504.177248][T22888] bond3: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 1504.201735][T22890] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_tx_wq": -EINTR [ 1504.241753][T22888] bond3: (slave lo): Enslaving as an active interface with an up link [ 1504.262899][T22888] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 1504.524613][T22906] syzkaller1: entered promiscuous mode [ 1504.544708][T22906] syzkaller1: entered allmulticast mode [ 1504.634648][T22912] netlink: 'syz.4.19557': attribute type 2 has an invalid length. [ 1504.752107][T22921] xt_hashlimit: max too large, truncated to 1048576 [ 1505.131408][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1505.144323][ C0] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1505.156861][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1505.169149][ C0] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1505.181514][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1505.193773][ C0] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1505.206146][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1505.218424][ C0] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1505.230816][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1505.243083][ C0] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1505.541217][T22951] netlink: 12 bytes leftover after parsing attributes in process `syz.0.19565'. [ 1506.693434][T22967] netlink: 'syz.2.19571': attribute type 13 has an invalid length. [ 1506.738313][T22967] netlink: 'syz.2.19571': attribute type 58 has an invalid length. [ 1506.773886][T22967] netlink: 152 bytes leftover after parsing attributes in process `syz.2.19571'. [ 1508.578117][T22951] workqueue: Failed to create a rescuer kthread for wq "bond19": -EINTR [ 1508.890603][T22989] netlink: 12 bytes leftover after parsing attributes in process `syz.2.19576'. [ 1508.938611][T22990] netlink: 8 bytes leftover after parsing attributes in process `syz.3.19577'. [ 1510.137714][ C0] net_ratelimit: 16806 callbacks suppressed [ 1510.137738][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1510.156597][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1510.168901][ C0] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1510.181289][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1510.193696][ C0] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1510.206162][ C0] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1510.218582][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1510.230966][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1510.243240][ C0] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1510.255619][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1511.052691][T23028] netlink: 'syz.1.19587': attribute type 62 has an invalid length. [ 1511.572110][T23044] netlink: 4 bytes leftover after parsing attributes in process `syz.4.19589'. [ 1513.775873][T23073] netlink: 16 bytes leftover after parsing attributes in process `syz.0.19594'. [ 1515.146996][ C0] net_ratelimit: 16976 callbacks suppressed [ 1515.147019][ C0] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1515.165302][ C0] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1515.177716][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1515.190082][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1515.202378][ C0] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1515.214743][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1515.227048][ C0] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1515.239401][ C0] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1515.251850][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1515.264179][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1515.334759][T23098] xt_hashlimit: size too large, truncated to 1048576 [ 1517.338856][T23127] netlink: 24 bytes leftover after parsing attributes in process `syz.0.19609'. [ 1518.037525][T23142] netlink: 12 bytes leftover after parsing attributes in process `syz.1.19614'. [ 1518.190400][T23144] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1518.335721][T23145] netlink: 'syz.0.19615': attribute type 58 has an invalid length. [ 1518.450029][T23145] netlink: 20 bytes leftover after parsing attributes in process `syz.0.19615'. [ 1518.803480][T23152] xt_connbytes: Forcing CT accounting to be enabled [ 1519.263825][T23159] netlink: 'syz.4.19618': attribute type 4 has an invalid length. [ 1519.377321][T23159] netlink: 152 bytes leftover after parsing attributes in process `syz.4.19618'. [ 1519.539018][T23162] netlink: 12 bytes leftover after parsing attributes in process `syz.4.19618'. [ 1519.979406][T23171] netlink: 'syz.1.19620': attribute type 1 has an invalid length. [ 1520.021575][T23171] netlink: 'syz.1.19620': attribute type 3 has an invalid length. [ 1520.063638][T23171] netlink: 224 bytes leftover after parsing attributes in process `syz.1.19620'. [ 1520.156968][ C0] net_ratelimit: 16878 callbacks suppressed [ 1520.156990][ C0] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1520.175454][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1520.187674][ C0] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1520.199948][ C0] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1520.212259][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1520.224972][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1520.237250][ C0] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1520.249598][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1520.262342][ C0] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1520.274686][ C0] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1521.829567][T23193] netlink: 'syz.1.19625': attribute type 4 has an invalid length. [ 1522.320739][T23197] netlink: 80 bytes leftover after parsing attributes in process `syz.3.19627'. [ 1522.371666][T23200] netlink: 4 bytes leftover after parsing attributes in process `syz.4.19628'. [ 1522.381235][T23197] netlink: 80 bytes leftover after parsing attributes in process `syz.3.19627'. [ 1522.445066][T23200] netlink: 4 bytes leftover after parsing attributes in process `syz.4.19628'. [ 1522.529124][T23206] sctp: [Deprecated]: syz.0.19629 (pid 23206) Use of int in max_burst socket option deprecated. [ 1522.529124][T23206] Use struct sctp_assoc_value instead [ 1525.167054][ C0] net_ratelimit: 16988 callbacks suppressed [ 1525.167075][ C0] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1525.185420][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1525.197699][ C0] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1525.210114][ C0] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1525.222593][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1525.234942][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1525.247409][ C0] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1525.259863][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1525.272186][ C0] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1525.284626][ C0] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1526.092318][T23254] netlink: 12 bytes leftover after parsing attributes in process `syz.1.19642'. [ 1526.792477][T23267] netlink: 'syz.2.19644': attribute type 12 has an invalid length. [ 1527.022264][T23267] bond29: option primary_reselect: invalid value (255) [ 1527.112396][T23267] bond29 (unregistering): Released all slaves [ 1527.589984][T23277] netlink: 16 bytes leftover after parsing attributes in process `syz.1.19648'. [ 1527.683551][T23277] netlink: 12 bytes leftover after parsing attributes in process `syz.1.19648'. [ 1528.978315][T23303] vlan0: entered promiscuous mode [ 1529.042973][T23303] bond15: entered promiscuous mode [ 1529.099852][T23303] geneve4: entered promiscuous mode [ 1529.145258][T23303] vlan0: left allmulticast mode [ 1529.192360][T23303] bond15: left allmulticast mode [ 1529.213845][T23308] netlink: 12 bytes leftover after parsing attributes in process `syz.4.19655'. [ 1529.248892][T23303] geneve4: left allmulticast mode [ 1530.041469][T23314] netlink: 12 bytes leftover after parsing attributes in process `syz.3.19656'. [ 1530.177127][ C0] net_ratelimit: 16260 callbacks suppressed [ 1530.177148][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1530.195391][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1530.207683][ C0] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1530.220057][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1530.232438][ C0] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1530.244843][ C0] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1530.257205][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1530.269463][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1530.281780][ C0] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1530.294133][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1531.232505][T23336] netlink: 8 bytes leftover after parsing attributes in process `syz.4.19666'. [ 1531.440620][T23330] syzkaller0: entered promiscuous mode [ 1531.500189][T23330] syzkaller0: entered allmulticast mode [ 1531.784609][T23350] netlink: 12 bytes leftover after parsing attributes in process `syz.2.19668'. [ 1533.060161][T23361] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 1533.136844][T23363] netlink: 12 bytes leftover after parsing attributes in process `syz.4.19672'. [ 1535.187019][ C0] net_ratelimit: 18090 callbacks suppressed [ 1535.187044][ C0] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1535.205284][ C0] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1535.217602][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1535.229873][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1535.242050][ C0] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1535.254340][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1535.266524][ C0] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1535.278799][ C0] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1535.291087][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1535.303287][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1540.209817][ C0] net_ratelimit: 20480 callbacks suppressed [ 1540.209839][ C0] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1540.228114][ C0] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1540.240446][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1540.252668][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1540.264853][ C0] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1540.277220][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1540.289481][ C0] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1540.301799][ C0] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1540.314030][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1540.326224][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1543.024260][T23373] netlink: 32 bytes leftover after parsing attributes in process `syz.1.19677'. [ 1543.370430][T23376] xt_hashlimit: size too large, truncated to 1048576 [ 1543.419297][T23380] FAULT_INJECTION: forcing a failure. [ 1543.419297][T23380] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1543.488888][T23380] CPU: 1 UID: 0 PID: 23380 Comm: syz.2.19678 Not tainted syzkaller #0 PREEMPT(full) [ 1543.488926][T23380] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1543.488940][T23380] Call Trace: [ 1543.488950][T23380] [ 1543.488960][T23380] dump_stack_lvl+0xe8/0x150 [ 1543.488994][T23380] should_fail_ex+0x412/0x560 [ 1543.489030][T23380] _copy_to_user+0x31/0xb0 [ 1543.489066][T23380] simple_read_from_buffer+0xe1/0x170 [ 1543.489100][T23380] proc_fail_nth_read+0x1bb/0x230 [ 1543.489134][T23380] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1543.489167][T23380] ? rw_verify_area+0x2a6/0x4d0 [ 1543.489198][T23380] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1543.489229][T23380] vfs_read+0x20c/0xa70 [ 1543.489267][T23380] ? __pfx___mutex_lock+0x10/0x10 [ 1543.489301][T23380] ? __pfx_vfs_read+0x10/0x10 [ 1543.489335][T23380] ? __fget_files+0x2a/0x420 [ 1543.489368][T23380] ? __fget_files+0x3a0/0x420 [ 1543.489394][T23380] ? __fget_files+0x2a/0x420 [ 1543.489432][T23380] ksys_read+0x150/0x270 [ 1543.489467][T23380] ? __pfx_ksys_read+0x10/0x10 [ 1543.489510][T23380] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1543.489535][T23380] do_syscall_64+0x15f/0xf80 [ 1543.489575][T23380] ? clear_bhb_loop+0x40/0x90 [ 1543.489604][T23380] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1543.489627][T23380] RIP: 0033:0x7fa76155d60e [ 1543.489649][T23380] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1543.489669][T23380] RSP: 002b:00007fa76241efe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1543.489693][T23380] RAX: ffffffffffffffda RBX: 00007fa76241f6c0 RCX: 00007fa76155d60e [ 1543.489710][T23380] RDX: 000000000000000f RSI: 00007fa76241f0a0 RDI: 0000000000000005 [ 1543.489724][T23380] RBP: 00007fa76241f090 R08: 0000000000000000 R09: 0000000000000000 [ 1543.489744][T23380] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1543.489758][T23380] R13: 00007fa761816038 R14: 00007fa761815fa0 R15: 00007ffc31ba54e8 [ 1543.489794][T23380] [ 1543.965980][T23384] Bluetooth: hci1: expected 19 bytes, got 2 bytes [ 1545.217010][ C0] net_ratelimit: 18601 callbacks suppressed [ 1545.217033][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1545.236141][ C0] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1545.248588][ C0] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1545.261067][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1545.273372][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1545.285677][ C0] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1545.298028][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1545.310289][ C0] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1545.322653][ C0] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1545.335007][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1546.058721][T23414] netlink: 12 bytes leftover after parsing attributes in process `syz.0.19685'. [ 1547.091406][T23430] netlink: 12 bytes leftover after parsing attributes in process `syz.2.19689'. [ 1547.307263][T23429] netlink: 786 bytes leftover after parsing attributes in process `syz.2.19689'. [ 1547.794648][ T5631] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 1547.815637][ T5631] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 1547.834949][ T5631] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 1547.849101][ T5631] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 1547.861085][ T5631] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 1548.325124][ T4946] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 1548.359847][ T4946] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 1548.369779][ T4946] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 1548.395828][ T4946] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 1548.410897][ T4946] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 1548.443848][ T4946] [ 1548.446235][ T4946] ====================================================== [ 1548.453270][ T4946] WARNING: possible circular locking dependency detected [ 1548.460332][ T4946] syzkaller #0 Not tainted [ 1548.464788][ T4946] ------------------------------------------------------ [ 1548.471847][ T4946] kworker/u9:1/4946 is trying to acquire lock: [ 1548.478032][ T4946] ffff88801be8d210 (&root->kernfs_iattr_rwsem){++++}-{4:4}, at: kernfs_link_sibling+0x4ed/0x5c0 [ 1548.488600][ T4946] [ 1548.488600][ T4946] but task is already holding lock: [ 1548.496106][ T4946] ffff88801be8d180 (&root->kernfs_rwsem){++++}-{4:4}, at: kernfs_add_one+0x41/0x5c0 [ 1548.505661][ T4946] [ 1548.505661][ T4946] which lock already depends on the new lock. [ 1548.505661][ T4946] [ 1548.516120][ T4946] [ 1548.516120][ T4946] the existing dependency chain (in reverse order) is: [ 1548.525168][ T4946] [ 1548.525168][ T4946] -> #10 (&root->kernfs_rwsem){++++}-{4:4}: [ 1548.533339][ T4946] down_write+0x96/0x200 [ 1548.538177][ T4946] kernfs_add_one+0x41/0x5c0 [ 1548.543373][ T4946] kernfs_create_dir_ns+0xde/0x130 [ 1548.549092][ T4946] internal_create_group+0x425/0x1180 [ 1548.555066][ T4946] cpuhp_invoke_callback+0x445/0x860 [ 1548.560978][ T4946] cpuhp_issue_call+0x430/0x7a0 [ 1548.566443][ T4946] __cpuhp_setup_state_cpuslocked+0x3d9/0x6b0 [ 1548.573094][ T4946] __cpuhp_setup_state+0x3f/0x60 [ 1548.578654][ T4946] do_one_initcall+0x250/0x870 [ 1548.584044][ T4946] do_initcall_level+0x104/0x190 [ 1548.589560][ T4946] do_initcalls+0x59/0xa0 [ 1548.594461][ T4946] kernel_init_freeable+0x2a6/0x3e0 [ 1548.600245][ T4946] kernel_init+0x1d/0x1d0 [ 1548.605176][ T4946] ret_from_fork+0x514/0xb70 [ 1548.610346][ T4946] ret_from_fork_asm+0x1a/0x30 [ 1548.615716][ T4946] [ 1548.615716][ T4946] -> #9 (cpuhp_state_mutex){+.+.}-{4:4}: [ 1548.623609][ T4946] [ 1548.623609][ T4946] -> #8 (cpu_hotplug_lock){++++}-{0:0}: [ 1548.631432][ T4946] cpus_read_lock+0x42/0x160 [ 1548.636598][ T4946] static_key_disable+0x12/0x20 [ 1548.642045][ T4946] __inet_hash_connect+0x25bb/0x25c0 [ 1548.647929][ T4946] tcp_v4_connect+0xd5f/0x19b0 [ 1548.653281][ T4946] __inet_stream_connect+0x25a/0xdd0 [ 1548.659180][ T4946] inet_stream_connect+0x66/0xa0 [ 1548.664729][ T4946] __sys_connect+0x312/0x450 [ 1548.669912][ T4946] __x64_sys_connect+0x7a/0x90 [ 1548.675279][ T4946] do_syscall_64+0x15f/0xf80 [ 1548.680457][ T4946] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1548.686936][ T4946] [ 1548.686936][ T4946] -> #7 (sk_lock-AF_INET){+.+.}-{0:0}: [ 1548.694723][ T4946] lock_sock_nested+0x41/0x100 [ 1548.700084][ T4946] inet_shutdown+0x6a/0x390 [ 1548.705188][ T4946] nbd_mark_nsock_dead+0x2e9/0x560 [ 1548.710889][ T4946] recv_work+0x1c2e/0x1d40 [ 1548.715896][ T4946] process_scheduled_works+0xb5d/0x1860 [ 1548.722042][ T4946] worker_thread+0xa53/0xfc0 [ 1548.727234][ T4946] kthread+0x388/0x470 [ 1548.731916][ T4946] ret_from_fork+0x514/0xb70 [ 1548.737101][ T4946] ret_from_fork_asm+0x1a/0x30 [ 1548.742448][ T4946] [ 1548.742448][ T4946] -> #6 (&nsock->tx_lock){+.+.}-{4:4}: [ 1548.750184][ T4946] __mutex_lock+0x1a3/0x1550 [ 1548.755400][ T4946] nbd_queue_rq+0x37b/0x1100 [ 1548.760567][ T4946] blk_mq_dispatch_rq_list+0xa70/0x1910 [ 1548.766737][ T4946] __blk_mq_sched_dispatch_requests+0xdcc/0x1600 [ 1548.773708][ T4946] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 1548.780307][ T4946] blk_mq_run_hw_queue+0x348/0x4f0 [ 1548.786032][ T4946] blk_mq_dispatch_list+0xd16/0xe10 [ 1548.791859][ T4946] blk_mq_flush_plug_list+0x48d/0x570 [ 1548.797832][ T4946] __blk_flush_plug+0x3ed/0x4d0 [ 1548.803304][ T4946] __submit_bio+0x28d/0x580 [ 1548.808370][ T4946] submit_bio_noacct_nocheck+0x2f4/0xa40 [ 1548.814604][ T4946] block_read_full_folio+0x599/0x830 [ 1548.820536][ T4946] filemap_read_folio+0x137/0x3b0 [ 1548.826178][ T4946] do_read_cache_folio+0x358/0x590 [ 1548.831887][ T4946] read_part_sector+0xb6/0x2b0 [ 1548.837246][ T4946] adfspart_check_ICS+0xb1/0x960 [ 1548.842797][ T4946] bdev_disk_changed+0x817/0x1770 [ 1548.848408][ T4946] blkdev_get_whole+0x380/0x510 [ 1548.853897][ T4946] bdev_open+0x31e/0xd30 [ 1548.858751][ T4946] blkdev_open+0x470/0x610 [ 1548.863760][ T4946] do_dentry_open+0x785/0x14e0 [ 1548.869105][ T4946] vfs_open+0x3b/0x340 [ 1548.873769][ T4946] path_openat+0x2e08/0x3860 [ 1548.878964][ T4946] do_file_open+0x23e/0x4a0 [ 1548.884084][ T4946] do_sys_openat2+0x113/0x200 [ 1548.889367][ T4946] __x64_sys_openat+0x138/0x170 [ 1548.894826][ T4946] do_syscall_64+0x15f/0xf80 [ 1548.900077][ T4946] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1548.906563][ T4946] [ 1548.906563][ T4946] -> #5 (&cmd->lock){+.+.}-{4:4}: [ 1548.913889][ T4946] __mutex_lock+0x1a3/0x1550 [ 1548.919123][ T4946] nbd_queue_rq+0xc6/0x1100 [ 1548.924218][ T4946] blk_mq_dispatch_rq_list+0xa70/0x1910 [ 1548.930398][ T4946] __blk_mq_sched_dispatch_requests+0xdcc/0x1600 [ 1548.937355][ T4946] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 1548.943998][ T4946] blk_mq_run_hw_queue+0x348/0x4f0 [ 1548.949756][ T4946] blk_mq_dispatch_list+0xd16/0xe10 [ 1548.955600][ T4946] blk_mq_flush_plug_list+0x48d/0x570 [ 1548.961610][ T4946] __blk_flush_plug+0x3ed/0x4d0 [ 1548.967101][ T4946] __submit_bio+0x28d/0x580 [ 1548.972213][ T4946] submit_bio_noacct_nocheck+0x2f4/0xa40 [ 1548.978458][ T4946] block_read_full_folio+0x599/0x830 [ 1548.984359][ T4946] filemap_read_folio+0x137/0x3b0 [ 1548.990073][ T4946] do_read_cache_folio+0x358/0x590 [ 1548.995796][ T4946] read_part_sector+0xb6/0x2b0 [ 1549.001176][ T4946] adfspart_check_ICS+0xb1/0x960 [ 1549.006762][ T4946] bdev_disk_changed+0x817/0x1770 [ 1549.012426][ T4946] blkdev_get_whole+0x380/0x510 [ 1549.017901][ T4946] bdev_open+0x31e/0xd30 [ 1549.022782][ T4946] blkdev_open+0x470/0x610 [ 1549.027810][ T4946] do_dentry_open+0x785/0x14e0 [ 1549.033354][ T4946] vfs_open+0x3b/0x340 [ 1549.038061][ T4946] path_openat+0x2e08/0x3860 [ 1549.043276][ T4946] do_file_open+0x23e/0x4a0 [ 1549.048428][ T4946] do_sys_openat2+0x113/0x200 [ 1549.053696][ T4946] __x64_sys_openat+0x138/0x170 [ 1549.059162][ T4946] do_syscall_64+0x15f/0xf80 [ 1549.064381][ T4946] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1549.070886][ T4946] [ 1549.070886][ T4946] -> #4 (set->srcu){.+.+}-{0:0}: [ 1549.078122][ T4946] __synchronize_srcu+0xca/0x300 [ 1549.083650][ T4946] elevator_switch+0x1e8/0x7a0 [ 1549.089049][ T4946] elevator_change+0x2cc/0x450 [ 1549.094446][ T4946] elevator_set_default+0x36c/0x430 [ 1549.100258][ T4946] blk_register_queue+0x3e9/0x4e0 [ 1549.105894][ T4946] __add_disk+0x677/0xd50 [ 1549.110819][ T4946] add_disk_fwnode+0xfb/0x480 [ 1549.116106][ T4946] nbd_dev_add+0x72c/0xb50 [ 1549.121133][ T4946] nbd_init+0x168/0x1f0 [ 1549.125901][ T4946] do_one_initcall+0x250/0x870 [ 1549.131266][ T4946] do_initcall_level+0x104/0x190 [ 1549.136797][ T4946] do_initcalls+0x59/0xa0 [ 1549.141745][ T4946] kernel_init_freeable+0x2a6/0x3e0 [ 1549.147559][ T4946] kernel_init+0x1d/0x1d0 [ 1549.152482][ T4946] ret_from_fork+0x514/0xb70 [ 1549.157706][ T4946] ret_from_fork_asm+0x1a/0x30 [ 1549.163101][ T4946] [ 1549.163101][ T4946] -> #3 (&q->elevator_lock){+.+.}-{4:4}: [ 1549.171029][ T4946] __mutex_lock+0x1a3/0x1550 [ 1549.176242][ T4946] elevator_change+0x1b3/0x450 [ 1549.181639][ T4946] elevator_set_none+0xb5/0x140 [ 1549.187128][ T4946] blk_mq_update_nr_hw_queues+0x5e7/0x1a60 [ 1549.193557][ T4946] nbd_start_device+0x17f/0xb10 [ 1549.199045][ T4946] nbd_genl_connect+0x165b/0x1cf0 [ 1549.204674][ T4946] genl_family_rcv_msg_doit+0x22a/0x330 [ 1549.210820][ T4946] genl_rcv_msg+0x61c/0x7a0 [ 1549.215963][ T4946] netlink_rcv_skb+0x232/0x4b0 [ 1549.221357][ T4946] genl_rcv+0x28/0x40 [ 1549.225933][ T4946] netlink_unicast+0x75c/0x8e0 [ 1549.231400][ T4946] netlink_sendmsg+0x813/0xb40 [ 1549.236833][ T4946] ____sys_sendmsg+0x972/0x9f0 [ 1549.242217][ T4946] ___sys_sendmsg+0x2a5/0x360 [ 1549.247544][ T4946] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1549.253100][ T4946] do_syscall_64+0x15f/0xf80 [ 1549.258340][ T4946] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1549.264834][ T4946] [ 1549.264834][ T4946] -> #2 (&q->q_usage_counter(io)#51){++++}-{0:0}: [ 1549.273566][ T4946] blk_alloc_queue+0x546/0x680 [ 1549.278960][ T4946] __blk_mq_alloc_disk+0x197/0x390 [ 1549.284668][ T4946] nbd_dev_add+0x499/0xb50 [ 1549.289745][ T4946] nbd_init+0x168/0x1f0 [ 1549.294514][ T4946] do_one_initcall+0x250/0x870 [ 1549.299872][ T4946] do_initcall_level+0x104/0x190 [ 1549.305411][ T4946] do_initcalls+0x59/0xa0 [ 1549.310372][ T4946] kernel_init_freeable+0x2a6/0x3e0 [ 1549.316174][ T4946] kernel_init+0x1d/0x1d0 [ 1549.321101][ T4946] ret_from_fork+0x514/0xb70 [ 1549.326306][ T4946] ret_from_fork_asm+0x1a/0x30 [ 1549.331673][ T4946] [ 1549.331673][ T4946] -> #1 (fs_reclaim){+.+.}-{0:0}: [ 1549.338966][ T4946] fs_reclaim_acquire+0x71/0x100 [ 1549.344506][ T4946] kmem_cache_alloc_noprof+0x40/0x650 [ 1549.350478][ T4946] __kernfs_iattrs+0xdf/0x320 [ 1549.355756][ T4946] kernfs_iop_setattr+0xea/0x3f0 [ 1549.361302][ T4946] notify_change+0xc1a/0xf40 [ 1549.366456][ T4946] do_truncate+0x1c2/0x250 [ 1549.371498][ T4946] path_openat+0x2f89/0x3860 [ 1549.376721][ T4946] do_file_open+0x23e/0x4a0 [ 1549.381825][ T4946] do_sys_openat2+0x113/0x200 [ 1549.387107][ T4946] __x64_sys_openat+0x138/0x170 [ 1549.392556][ T4946] do_syscall_64+0x15f/0xf80 [ 1549.397750][ T4946] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1549.404225][ T4946] [ 1549.404225][ T4946] -> #0 (&root->kernfs_iattr_rwsem){++++}-{4:4}: [ 1549.412832][ T4946] __lock_acquire+0x15a5/0x2cf0 [ 1549.418313][ T4946] lock_acquire+0x106/0x350 [ 1549.423415][ T4946] down_write+0x96/0x200 [ 1549.428240][ T4946] kernfs_link_sibling+0x4ed/0x5c0 [ 1549.433961][ T4946] kernfs_add_one+0x1ca/0x5c0 [ 1549.439261][ T4946] kernfs_create_dir_ns+0xde/0x130 [ 1549.444979][ T4946] sysfs_create_dir_ns+0x12f/0x2a0 [ 1549.450798][ T4946] kobject_add_internal+0x62b/0xd00 [ 1549.456601][ T4946] kobject_add+0x163/0x240 [ 1549.461617][ T4946] device_add+0x408/0xbb0 [ 1549.466575][ T4946] hci_conn_add_sysfs+0xd5/0x210 [ 1549.472142][ T4946] hci_conn_complete_evt+0x84e/0x1290 [ 1549.478134][ T4946] hci_event_packet+0x6ab/0xef0 [ 1549.483595][ T4946] hci_rx_work+0x3ee/0x1040 [ 1549.488795][ T4946] process_scheduled_works+0xb5d/0x1860 [ 1549.494938][ T4946] worker_thread+0xa53/0xfc0 [ 1549.500101][ T4946] kthread+0x388/0x470 [ 1549.504793][ T4946] ret_from_fork+0x514/0xb70 [ 1549.509958][ T4946] ret_from_fork_asm+0x1a/0x30 [ 1549.515317][ T4946] [ 1549.515317][ T4946] other info that might help us debug this: [ 1549.515317][ T4946] [ 1549.525593][ T4946] Chain exists of: [ 1549.525593][ T4946] &root->kernfs_iattr_rwsem --> cpuhp_state_mutex --> &root->kernfs_rwsem [ 1549.525593][ T4946] [ 1549.540123][ T4946] Possible unsafe locking scenario: [ 1549.540123][ T4946] [ 1549.547627][ T4946] CPU0 CPU1 [ 1549.553068][ T4946] ---- ---- [ 1549.558566][ T4946] lock(&root->kernfs_rwsem); [ 1549.563431][ T4946] lock(cpuhp_state_mutex); [ 1549.570610][ T4946] lock(&root->kernfs_rwsem); [ 1549.577951][ T4946] lock(&root->kernfs_iattr_rwsem); [ 1549.583276][ T4946] [ 1549.583276][ T4946] *** DEADLOCK *** [ 1549.583276][ T4946] [ 1549.591450][ T4946] 4 locks held by kworker/u9:1/4946: [ 1549.596768][ T4946] #0: ffff88807fb9d140 ((wq_completion)hci5#2){+.+.}-{0:0}, at: process_scheduled_works+0xa35/0x1860 [ 1549.607803][ T4946] #1: ffffc90010297c40 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa70/0x1860 [ 1549.619880][ T4946] #2: ffff88804d0300b8 (&hdev->lock){+.+.}-{4:4}, at: hci_conn_complete_evt+0xcd/0x1290 [ 1549.629796][ T4946] #3: ffff88801be8d180 (&root->kernfs_rwsem){++++}-{4:4}, at: kernfs_add_one+0x41/0x5c0 [ 1549.639716][ T4946] [ 1549.639716][ T4946] stack backtrace: [ 1549.645661][ T4946] CPU: 1 UID: 0 PID: 4946 Comm: kworker/u9:1 Not tainted syzkaller #0 PREEMPT(full) [ 1549.645690][ T4946] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1549.645707][ T4946] Workqueue: hci5 hci_rx_work [ 1549.645746][ T4946] Call Trace: [ 1549.645755][ T4946] [ 1549.645766][ T4946] dump_stack_lvl+0xe8/0x150 [ 1549.645793][ T4946] print_circular_bug+0x2e1/0x300 [ 1549.645827][ T4946] check_noncircular+0x12e/0x150 [ 1549.645862][ T4946] __lock_acquire+0x15a5/0x2cf0 [ 1549.645892][ T4946] ? __lock_acquire+0x6b5/0x2cf0 [ 1549.645923][ T4946] ? kernfs_link_sibling+0x4ed/0x5c0 [ 1549.645954][ T4946] lock_acquire+0x106/0x350 [ 1549.645977][ T4946] ? kernfs_link_sibling+0x4ed/0x5c0 [ 1549.646017][ T4946] down_write+0x96/0x200 [ 1549.646038][ T4946] ? kernfs_link_sibling+0x4ed/0x5c0 [ 1549.646066][ T4946] ? __pfx_down_write+0x10/0x10 [ 1549.646086][ T4946] ? kernfs_root+0x1c/0x230 [ 1549.646112][ T4946] ? kernfs_root+0x1c/0x230 [ 1549.646141][ T4946] ? kernfs_root+0x1ea/0x230 [ 1549.646170][ T4946] kernfs_link_sibling+0x4ed/0x5c0 [ 1549.646208][ T4946] kernfs_add_one+0x1ca/0x5c0 [ 1549.646241][ T4946] kernfs_create_dir_ns+0xde/0x130 [ 1549.646276][ T4946] sysfs_create_dir_ns+0x12f/0x2a0 [ 1549.646306][ T4946] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 1549.646335][ T4946] ? do_raw_spin_unlock+0xf5/0x210 [ 1549.646371][ T4946] kobject_add_internal+0x62b/0xd00 [ 1549.646399][ T4946] kobject_add+0x163/0x240 [ 1549.646437][ T4946] ? __pfx_kobject_add+0x10/0x10 [ 1549.646471][ T4946] ? _raw_spin_unlock+0x28/0x50 [ 1549.646501][ T4946] ? get_device_parent+0x366/0x3a0 [ 1549.646529][ T4946] device_add+0x408/0xbb0 [ 1549.646557][ T4946] hci_conn_add_sysfs+0xd5/0x210 [ 1549.646591][ T4946] hci_conn_complete_evt+0x84e/0x1290 [ 1549.646643][ T4946] ? __pfx_hci_conn_complete_evt+0x10/0x10 [ 1549.646685][ T4946] hci_event_packet+0x6ab/0xef0 [ 1549.646722][ T4946] ? __pfx_hci_conn_complete_evt+0x10/0x10 [ 1549.646758][ T4946] ? __pfx_hci_event_packet+0x10/0x10 [ 1549.646794][ T4946] ? kcov_remote_start+0x49a/0x7a0 [ 1549.646829][ T4946] ? hci_send_to_monitor+0xe2/0x590 [ 1549.646859][ T4946] hci_rx_work+0x3ee/0x1040 [ 1549.646895][ T4946] ? process_scheduled_works+0xa70/0x1860 [ 1549.646919][ T4946] process_scheduled_works+0xb5d/0x1860 [ 1549.646960][ T4946] ? __pfx_process_scheduled_works+0x10/0x10 [ 1549.646987][ T4946] ? assign_work+0x3d5/0x5e0 [ 1549.647012][ T4946] worker_thread+0xa53/0xfc0 [ 1549.647051][ T4946] kthread+0x388/0x470 [ 1549.647080][ T4946] ? __pfx_worker_thread+0x10/0x10 [ 1549.647102][ T4946] ? __pfx_kthread+0x10/0x10 [ 1549.647132][ T4946] ret_from_fork+0x514/0xb70 [ 1549.647158][ T4946] ? __pfx_ret_from_fork+0x10/0x10 [ 1549.647181][ T4946] ? __switch_to+0xc79/0x1410 [ 1549.647216][ T4946] ? __pfx_kthread+0x10/0x10 [ 1549.647246][ T4946] ret_from_fork_asm+0x1a/0x30 [ 1549.647283][ T4946] SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 1550.226921][ C0] net_ratelimit: 13996 callbacks suppressed [ 1550.226941][ C0] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1550.245563][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1550.257846][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1550.270092][ C0] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1550.282394][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1550.294649][ C0] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1550.307002][ C0] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1550.319336][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1550.331588][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1550.343808][ C0] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1550.453890][T23452] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1500) ! [ 1550.718495][T23454] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1500) ! [ 1555.237001][ C0] net_ratelimit: 34642 callbacks suppressed [ 1555.237032][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1555.255270][ C0] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1555.267650][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1555.280466][ C0] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1555.293404][ C0] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1555.306193][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1555.318650][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1555.331090][ C0] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1555.343793][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1555.356395][ C0] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)