last executing test programs: 7.611038868s ago: executing program 0 (id=2380): mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_ADD_COUNTERS(r0, 0x0, 0x41, &(0x7f0000000fc0)=ANY=[@ANYBLOB="7261770200000000000000664900"/31], 0x48) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$kcm(0x11, 0x3, 0x0) r3 = socket$unix(0x1, 0x5, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r5, &(0x7f0000000040)={0x0, 0x5f, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB="5c0000000206030000000000000000000000000014000780080008400000000008001240ffffffe80500010006000000050005000200000005000400000000000900020073797a31000000000d000300686173683a6e6574"], 0x5c}}, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r6) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) ioctl$FS_IOC_SETFLAGS(r7, 0x40086602, &(0x7f0000000140)=0x20) ioctl$FS_IOC_RESVSP(r7, 0x40305829, &(0x7f0000000180)={0x1100, 0x0, 0x52, 0x11000}) r8 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r8, 0x29, 0x6, &(0x7f0000000000)={0x21, {{0x29, 0x0, 0x2000000, @local, 0x4}}}, 0x88) r9 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000200)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfc, {0x0, 0x0, 0x0, r10, {0xffe0, 0x10}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_cake={{0x9}, {0xc, 0x2, [@TCA_CAKE_FLOW_MODE={0x8, 0x5, 0xd94fd5c211a3c2ca}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x45004) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) setsockopt$sock_attach_bpf(r2, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r2, 0x0, 0x0) r11 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r11, 0x84, 0x6f, &(0x7f0000000140)={0x0, 0x10, &(0x7f0000000100)=[@in={0x2, 0x4e24, @private=0xa010101}]}, &(0x7f0000000180)=0x10) setsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r11, 0x84, 0xc, &(0x7f00000000c0), 0x4) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r11, 0x84, 0x1d, &(0x7f0000000200)={0x1, [0x0]}, &(0x7f0000000080)=0x8) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(r11, 0x84, 0x6c, &(0x7f00000008c0)={r12}, &(0x7f0000000340)=0x8) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a3c000000090a010400000000000000000100000008000740000000080900020073797a32000000000900010073797a3000000000080005400000000b4c0000000c0a010300000000000000000100000008000440000010000900010073797a300000000024000380200000800400018018000b80140001800c000100636f756e7465720004000280140000001000010000000000000000000000000a491aa6334eefea273d7d14e1106e5d906e513024885782e494ee4033e11048cb0e6033d1a6654b872748feacbe7da7bcbd7614e4d020e6a68964fd9ceaee9abbb2582d26fcb13b268c3aa8f5dce302457936bd4e4406a34e14251d095fc969bfe5d059f42c71043c66e155f0aead13064aa56498263f1aa56b6b02452653e199a2e545337916a32d4a3cd6ff6132a24e3d937442d1a3c1e3c94117fc90cc7435cf296befe71beabbae2b0580b890deca5b44a13168a9ddb93d"], 0xb0}}, 0x0) 6.977871129s ago: executing program 4 (id=2387): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) connect$can_bcm(r1, &(0x7f00000000c0)={0x1d, r2}, 0x10) sendmsg$can_bcm(r1, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000001bc0)={0x1, 0x0, 0x800, {0x0, 0x2710}, {0x77359400}, {}, 0x1, @can={{}, 0x8, 0x1, 0x0, 0x0, "d3b9dc735f668f61"}}, 0x48}, 0x1, 0x0, 0x0, 0x48485}, 0x0) sendmsg$can_bcm(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000022c0)=ANY=[@ANYBLOB="01000000670f00"/16, @ANYRES64=r0, @ANYRES64=0x0, @ANYRES64=r1, @ANYRES64=0x2710, @ANYBLOB="0000000001"], 0x80}, 0x1, 0x0, 0x0, 0xc081}, 0x11) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4) bind$inet6(r0, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @empty}, 0x1c) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(r3, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4) unshare(0x28040680) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000780)=ANY=[@ANYBLOB="b700000081000000bfa30000000000000703000003feffff720af0fff8ffffff71a4f0ff0000000072030000000000001d400500000000004704000001ed000072030200000000001d440000000000006b0a00fe000000007303000000000000b5000000000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f1a864a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fee5bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616236fd9aa58f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6a49964757cdf538f1ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a22048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b2875353193f82ade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c107571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840bd2951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a903792283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f6f096753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c2571f983e9673560000000000000000005a7b57f03ca91a01ba2e30ca99e8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca48568325b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d49030a8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d1abf3cb17b40ac9b10968f38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e1661261173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ec86a4555d89fe0120f64c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a003d2fbdc1f9be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d01c4b45294fbba468df3e1b393cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd84990453f006694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee077515d0a8811922929e085392ab3d1311b8243266d87047f601fa88a0da36b9f302e8262395174328f2482d14008de83070744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6432399f87a7a14245bbd796a09313b247b95d37ff40a404bdad74bd20000000000000000000099fef7cd7af3ce64a92f95d89d125b1e641240d7e5e27a3d1f7684448c3e3822d617e205061298b939a191be4b48e169bde2cae3accc5bd40a2968b59c93d35f8e42366fdef9a2abae1cf01ce68abff28861aac8302d268569dd42e194e330c7aaa54ebbcefd23f21ce8153b9926e12e925cb56119df72c7533a48d028ad0c74e2a9478fa3be18a1a2b65079cc1c7bc46dd12305a1ae9dd19e8d525206c0a728cfd42193abe8130bc01a2d61f3b39c64307f9c82b2807c9ff4a269841f3d7799ac04bdc590bb1c89b9c695f163e57343c9bfb59909433c9001c5f8b23e38534a538fc933cac6c2a92d038df638a0f226df9fb857bd414c2cd69985e8053e3dfa41614d7c74d04d8c2471041d17c730fad28395f8d4688898cd58b9d600c851626529bb58aa364b55e73f053450665e7b94ad1012fd7a8139166fd5e59c84f4ab279b1b99c028db4cb9680c8035f967db18de738844da7e260a830c1ffa49f5af3c15423a0e315acb82a3e89218cb314e68fda4d94aa1d815babc13b9fd336d205c5913ef67a41b9e320146ee9f566a28"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xfffffffffffffd00}, 0x48) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r7, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r7, 0x1, 0x8, &(0x7f0000000200), 0x4) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r8, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000600)={0x64, 0x0, 0x1, 0x401, 0x0, 0x1a14, {0x2}, [@CTA_TUPLE_ORIG={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @multicast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x24, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x8, 0x2, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TIMEOUT={0x8, 0x7, 0x1, 0x0, 0xffff639c}]}, 0x64}}, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB="3800000002011d04000000000000000002000000240001801400018008000100e000000108000200e00000010c000280050001"], 0x38}}, 0x0) sendmsg$nl_route(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000280)=ANY=[@ANYBLOB="50000000100001002cbd7000fedbdf2500000000", @ANYRES32=0x0, @ANYBLOB="10080400000000001c002b80080003001100000008000100", @ANYRES32, @ANYBLOB="0800080081d0386d", @ANYRES32=r4, @ANYBLOB="14003500626f6e645f736c6176655f3000000000"], 0x50}}, 0x0) bind$inet6(r3, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}, 0x1c) listen(r3, 0x0) listen(r0, 0x0) r9 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) ioctl$NILFS_IOCTL_DELETE_CHECKPOINT(r3, 0x40086e81, &(0x7f0000000040)=0x2) ioctl$sock_netrom_SIOCDELRT(r9, 0x890c, &(0x7f00000003c0)={0x1000000, @bcast, @bpq0, 0x1240, 'syz1\x00', @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0xff, 0x6, [@bcast, @null, @default, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default]}) 6.671498418s ago: executing program 0 (id=2391): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$gtp(&(0x7f0000000000), r0) r2 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), r2) getsockname$packet(r2, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=@newlink={0x38, 0x10, 0x437, 0x800000, 0x0, {0x0, 0x0, 0x0, r3, 0x504c3}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gtp={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GTP_FD0={0x8, 0x1, @udp6}]}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x2000c014}, 0x0) sendmsg$GTP_CMD_DELPDP(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01002cbd70000e0000000202ff0008000100", @ANYRES32=r3, @ANYBLOB="0800020001"], 0x24}, 0x1, 0x0, 0x0, 0x44800}, 0x20000000) socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_rx_ring(r4, 0x107, 0x5, &(0x7f0000000040)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x4bd1bfda, 0x0, 0x6}, 0x1c) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0xd, &(0x7f0000000100)=@req3={0x10000, 0x100000001, 0x10000, 0xfffffffe, 0xd00, 0x2}, 0x1c) r5 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="39000000140081ae10003c000500018311001f9f660fcf066505acb612f691f3bd3508abca1be6eeb89c44ebb37358582bdbb7d553b4e92155", 0x39}], 0x1}, 0x0) unshare(0x2c060000) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/mnt\x00') r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000001ac0)={&(0x7f0000000000)=ANY=[@ANYBLOB="200000002e00010026bdf000fcdbdf2504"], 0x20}, 0x1, 0x0, 0x0, 0x4000d}, 0x20000000) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='blkio.bfq.io_queued\x00', 0x275a, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB="5c0300002e00090027bd7000000000000400000048031180"], 0x35c}, 0x1, 0x0, 0x0, 0x42804}, 0x4000010) socket$nl_generic(0x10, 0x3, 0x10) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=ANY=[@ANYBLOB="200000002c00070127bd7000fcdbdf25097c00000804003200040003805fe867247ccab6b79bc03d4ec030d1cf7a7e901a9a523937121609f798a36545aa55edd624aae998082d76983f43f2ec1c582f9b38799f2e3b145dc7041f6c8ff9e68ffdd92f56bb82f7d187d215c60107d397a235998d5562b2d0fb9d8e2d50e66c17744466a300613908552b2932e3435cdd45dc5c26ac75486338190eda0665047c1eba4e978f8133ce84557964e599"], 0x20}, 0x1, 0x0, 0x0, 0xc000}, 0xc010) r9 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000080)={'bridge0\x00', 0x0}) sendmsg$nl_route(r9, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)=ANY=[@ANYBLOB="240000001d00070f000000000000000007000000", @ANYRES32=r10, @ANYBLOB="40002700060010"], 0x24}, 0x1, 0x0, 0x0, 0x800}, 0x0) r11 = syz_init_net_socket$llc(0x1a, 0x2, 0x0) sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r9, &(0x7f0000000440)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000400)={&(0x7f0000000380)={0x64, 0x0, 0x2, 0x70bd2a, 0x25dfdbff, {}, [@BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0xff}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x7f}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0xffffff40}, @BATADV_ATTR_VLANID={0x6}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_ORIG_ADDRESS={0xa}]}, 0x64}, 0x1, 0x0, 0x0, 0x40800}, 0x4090) ioctl$F2FS_IOC_START_ATOMIC_WRITE(r11, 0xf501, 0x0) 6.553861409s ago: executing program 2 (id=2393): sendmmsg$sock(0xffffffffffffffff, &(0x7f0000003b40), 0x0, 0x20000044) r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x6, &(0x7f0000000000)=0x40000000, 0x4) r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_PORT_GET(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000100)={0x64, r1, 0x1, 0xffffffff, 0x0, {0x37}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x73}}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x2}}}]}, 0x64}}, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000c80)=ANY=[@ANYBLOB], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, 0x0, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r6, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={0x20, 0x0, 0x9c3fa077fa966179, 0xfffffffd, 0x0, {{0x7e}, {@void, @val={0xc, 0x99, {0x916c, 0x14}}}}}, 0x20}, 0x1, 0x0, 0x0, 0x20008081}, 0x4000054) sendmsg$NL80211_CMD_RELOAD_REGDB(r6, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000340)={0x14, 0x0, 0x1, 0x70bd2d, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x20000000}, 0x20008004) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f00000002c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_MESH_CONFIG(0xffffffffffffffff, &(0x7f0000000680)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000640)={&(0x7f00000005c0)={0x58, 0x0, 0x200, 0x70bd26, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_MESH_CONFIG={0x2c, 0x23, 0x0, 0x1, [@NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL={0x6, 0xc, 0x7f}, @NL80211_MESHCONF_AUTO_OPEN_PLINKS={0x5}, @NL80211_MESHCONF_GATE_ANNOUNCEMENTS={0x5, 0x11, 0x1}, @NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES={0x5, 0x8, 0x4}, @NL80211_MESHCONF_AUTO_OPEN_PLINKS={0x5, 0x7, 0xd5}]}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r7}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x24}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x6}]}, 0x58}, 0x1, 0x0, 0x0, 0x40001}, 0x80) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000040)={{}, &(0x7f0000000280), &(0x7f0000000240)=r3}, 0x20) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x10, &(0x7f0000000bc0)=ANY=[@ANYBLOB="1808000000000000000000000000000018120000", @ANYRES32, @ANYBLOB="0000000000000000b703000000000000850000000c000000b7000000000000001801000000082c2500000000002120207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000700000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r4, 0x1, 0x32, &(0x7f00000000c0)=r8, 0x4) sendmsg$inet(r5, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000500)={0x6, 0x3, &(0x7f0000000200)=@framed, &(0x7f0000000280)='GPL\x00', 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x1f00}, 0x10}, 0x94) 6.124910923s ago: executing program 4 (id=2394): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0xa8442, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) r2 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000022c0)=@newtfilter={0x94, 0x2c, 0xd27, 0x170bd2b, 0x2, {0x0, 0x0, 0x0, r3, {0x0, 0x10}, {}, {0x8, 0xffe0}}, [@filter_kind_options=@f_flow={{0x9}, {0x64, 0x2, [@TCA_FLOW_MODE={0x8, 0x2, 0x1}, @TCA_FLOW_KEYS={0x8, 0x1, 0x1e3a9}, @TCA_FLOW_ACT={0x50, 0x9, 0x0, 0x1, [@m_csum={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_CSUM_PARMS={0x1c, 0x1, {{0x1003d1, 0x3, 0x20000000, 0x6, 0x6}, 0x68}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x1, 0x1}}}}]}]}}]}, 0x94}, 0x1, 0x0, 0x0, 0xc804}, 0x2) close(r1) socket$unix(0x1, 0x2, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @random="af75355d1696"}) r4 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r4, 0x107, 0xf, &(0x7f0000000600), 0x4) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r4, &(0x7f0000000280)={&(0x7f00000001c0)=@xdp={0x2c, 0x0, r6, 0x1c}, 0x80, &(0x7f0000000a80)=[{&(0x7f00000002c0)="27030200dc0f24000e00033c000c00000000ff840000000200000003125ce882cbf490d908f1523ffffe00032d9c2740e260a09c6911cda856d5ea9a141b", 0x3e}, {0x0}], 0x2}, 0x8bb3a301eb080b) 6.070026806s ago: executing program 4 (id=2395): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000001c0)=0x1000000, 0xc7) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0a00000005000000020000000700000000000000", @ANYRES32, @ANYBLOB, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) bind$inet6(r1, &(0x7f0000000dc0)={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x0, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) syz_emit_ethernet(0x2e, &(0x7f0000000200)={@local, @link_local, @val={@void, {0x8100, 0x1}}, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x300, 0x4e20, 0x8}}}}}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080000000000000", @ANYRES32, @ANYBLOB="000000e400"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB], 0x48) r2 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r2, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f0000000000)=0x80, 0x4) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r2, 0x10e, 0x4, &(0x7f0000000180)=0x10000800, 0x4) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=@newlink={0x44, 0x10, 0x421, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x20}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @gretap={{0xb}, {0x14, 0x2, 0x0, 0x1, [@IFLA_GRE_TOS={0x5, 0x9, 0x9}, @IFLA_GRE_PMTUDISC={0x5}]}}}]}, 0x44}}, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket$nl_xfrm(0x10, 0x3, 0x6) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000380)='memory.events\x00', 0x26e1, 0x0) r4 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r4, 0x10e, 0xc, &(0x7f0000000080)={0x4000, 0x110003, 0x0, 0x9}, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=ANY=[@ANYBLOB="1c000000160001f47efde4be701161000a000000040000800400", @ANYRES32=r4], 0x1c}}, 0x0) r5 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_NEW(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000300)={0x34, r5, 0x1, 0x0, 0x25dfdbff, {0x25}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x34}, 0x1, 0x0, 0x0, 0x41}, 0x24004804) r6 = socket$inet_mptcp(0x2, 0x1, 0x106) sendmmsg$inet(r6, &(0x7f0000004980)=[{{&(0x7f0000000000)={0x2, 0x4e24, @loopback}, 0x10, 0x0}}], 0x1, 0x20008000) socket(0x15, 0x5, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)={0x54, r8, 0x1, 0x0, 0x25dfdbfe, {0x3}, [@TIPC_NLA_BEARER={0x40, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xf}}}, {0x14, 0x2, @in={0x2, 0x4e24, @local}}}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x2400c085}, 0x40000000) 3.934488616s ago: executing program 3 (id=2396): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x300}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x4}}}, @IFLA_LINK={0x8}]}, 0x3c}, 0x1, 0x0, 0x500000000000000}, 0x884) 3.933800656s ago: executing program 2 (id=2397): ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, 0x0) r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) ioctl$sock_netrom_SIOCADDRT(r0, 0x890b, 0x0) ioctl$sock_netrom_SIOCADDRT(r0, 0x890b, &(0x7f00000001c0)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x2, 'syz0\x00', @bcast, 0x40005, 0x1, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @default]}) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x0, 0x10, &(0x7f0000000580)=ANY=[@ANYBLOB="18050000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r1, @ANYBLOB="0000000000000000b704000008000000850000007800000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @fallback=0x6, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f00000025c0), 0xffffffffffffffff) r4 = socket$nl_route(0x10, 0x3, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) unshare(0x20000400) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000300)=ANY=[@ANYBLOB="1c00000046000701fefffffffcdbdf25047c00000800018004"], 0x1c}}, 0xc000) r6 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r6, &(0x7f00000001c0)=@name={0x1e, 0x2, 0x1, {{0x0, 0x4}, 0x2}}, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000002680)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_VENDOR(r2, &(0x7f00000028c0)={0x0, 0x0, &(0x7f0000002880)={&(0x7f0000000140)=ANY=[@ANYBLOB="a21804c68dd1cc6ede6db2d76900666dc8bcf2478a4b226fae36a6a622fd4c53022ead04441d777522e62f6cac44cd8af93abcd9f9383bf5a7fd410e87e4ebe1d5", @ANYRES16=r3, @ANYBLOB="010029bd7000ffdbdf256700000008000300", @ANYRES32=r7, @ANYBLOB="0c00990010000000200000000800c300ffffff7f"], 0x30}, 0x1, 0x0, 0x0, 0x48000}, 0x20048016) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$nl802154(&(0x7f00000003c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r8, 0x8933, &(0x7f0000000000)={'wpan0\x00', 0x0}) r11 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_cipso(0x0, r11) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ieee802154(0x0, r11) sendmsg$IEEE802154_LLSEC_SETPARAMS(0xffffffffffffffff, 0x0, 0x0) sendmsg$IEEE802154_LLSEC_DEL_DEV(0xffffffffffffffff, 0x0, 0x40) sendmsg$NL802154_CMD_NEW_SEC_DEVKEY(r8, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000040)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010001000000000000001d00000008000300", @ANYRES32=r10, @ANYBLOB="18002f800600000000000000000000000000038000000500080000000000000000000100010000000000040003000000000001000200000000000100010001000000000005000100000000000000"], 0x34}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x6, 0x10, &(0x7f0000000580)=ANY=[], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 3.915738208s ago: executing program 1 (id=2398): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000e40), 0xffffffffffffffff) sendmsg$TIPC_CMD_ENABLE_BEARER(r0, &(0x7f0000000f00)={0x0, 0x0, &(0x7f0000000ec0)={&(0x7f0000000e80)={0x34, r1, 0x1, 0x70bd28, 0x25dfdbfb, {{}, {}, {0x18, 0x17, {0xe, 0x4, @l2={'eth', 0x3a, 'geneve1\x00'}}}}}, 0x34}, 0x1, 0x0, 0x0, 0x80d0}, 0x44) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=@getaddr={0x14, 0x16, 0x1, 0x70bd2a, 0x25dfdbff, {}, ["", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x480c0}, 0x20000000) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$L2TP_CMD_SESSION_MODIFY(r0, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x64, 0x0, 0x20, 0x70bd29, 0x25dfdbfc, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0xba}, @L2TP_ATTR_MTU={0x6}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0xff}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x6}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x10}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x3}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x6}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x6}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000000}, 0x4) sendmsg$NFT_BATCH(r3, &(0x7f000000de80)={0x0, 0x0, &(0x7f000000de40)={&(0x7f0000000040)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_DELTABLE={0x20, 0x2, 0xa, 0x301, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_TABLE_HANDLE={0xc, 0x4, 0x1, 0x0, 0x4}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x48}, 0x1, 0x0, 0x0, 0x8040}, 0x894) 3.884078636s ago: executing program 3 (id=2399): r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_RES_PD_GET(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)={0x18, 0x140e, 0x529, 0x70bd26, 0x25dfdbfe, "", [@RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x1}]}, 0x18}, 0x1, 0x0, 0x0, 0x24000850}, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000080)={0x60, 0x0, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x4c, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x3, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x8}}, {0x14, 0x2, @in={0x2, 0x4e22, @multicast2}}}}]}]}, 0x60}}, 0x0) sendmsg$TIPC_NL_KEY_SET(r1, &(0x7f0000000280)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000240)={&(0x7f0000000040)={0x12c, 0x0, 0x100, 0x70bd2d, 0x25dfdbfc, {}, [@TIPC_NLA_MON={0x4}, @TIPC_NLA_MON={0x54, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x4}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xffffff00}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xc59}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x401}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x1}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x6}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x4}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x9}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x4}]}, @TIPC_NLA_NET={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0x8}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x6}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x483}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0xd9e}]}, @TIPC_NLA_SOCK={0x4c, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x3}, @TIPC_NLA_SOCK_CON={0x3c, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x1000}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x80000001}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x9}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x8000}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0xc64e}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x4}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x881}]}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}]}, @TIPC_NLA_MON={0x14, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x5}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x80}]}, @TIPC_NLA_MON={0x2c, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x1}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x3}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x101}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x1}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x7}]}]}, 0x12c}, 0x1, 0x0, 0x0, 0x20008000}, 0x0) 3.814354702s ago: executing program 3 (id=2400): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x15, 0x0, &(0x7f0000000280)) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f00000000c0), r1) sendmsg$NLBL_CALIPSO_C_LISTALL(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)={0x14, r2, 0x3d810686a7d95765, 0x70bd2a, 0x25dfdb75}, 0x14}, 0x1, 0x0, 0x0, 0x4481}, 0x24004052) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@bloom_filter={0x1e, 0x0, 0x1, 0x7, 0x0, 0x1}, 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0}, 0x90) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x17, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r4, 0x2000000, 0xe, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xd, &(0x7f0000000040)=ANY=[@ANYRES16=r0, @ANYRES32, @ANYBLOB="0000000000000000b7080000000002007b8af8ff0000b213bfa200000000000007020000f8ffcbffb70300000000008500000001"], 0x0, 0x653, 0x30, 0x0, 0x0, 0x36, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) r6 = socket$alg(0x26, 0x5, 0x0) bind$alg(r6, &(0x7f0000000200)={0x26, 'aead\x00', 0x0, 0x0, 'ccm(aes)\x00'}, 0x58) r7 = socket$inet(0x2, 0x802, 0x1) connect$inet(r7, &(0x7f00000000c0)={0x2, 0x0, @empty}, 0x10) write(r7, &(0x7f0000000080)="08008edf773c8000", 0xfd) setsockopt$ALG_SET_AEAD_AUTHSIZE(r6, 0x117, 0x5, 0x0, 0x6) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_DESTROY(r9, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c0000000306010200000000000000000700000a0500010007"], 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x40814) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001400)}, 0x0) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r10, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000780)=ANY=[@ANYBLOB="580000000206030000000000000000000300000705000100070000000900020073797a31000000000c00078008001240000000050500050002000000050004000100000011000300686173683a69702c706f727400"], 0x58}, 0x1, 0x0, 0x0, 0x4000}, 0x20004000) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r11, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=ANY=[@ANYBLOB="50000000090601020000000000000000020000840900020073797a31000000000500010007000000280007800c00018008000140fffffff70500070088000000060004404e22000006000540"], 0x50}, 0x1, 0x0, 0x0, 0x10000082}, 0x90) sendmsg$ETHTOOL_MSG_PAUSE_SET(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f0000000080)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r5, @ANYBLOB="0100000010651fbe347b2c2b00000c000180080001"], 0x20}}, 0x0) unshare(0x400) readv(0xffffffffffffffff, 0x0, 0x0) 3.742999315s ago: executing program 0 (id=2401): mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_ADD_COUNTERS(r0, 0x0, 0x41, &(0x7f0000000fc0)=ANY=[@ANYBLOB="7261770200000000000000664900"/31], 0x48) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$kcm(0x11, 0x3, 0x0) r3 = socket$unix(0x1, 0x5, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r5, &(0x7f0000000040)={0x0, 0x5f, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB="5c0000000206030000000000000000000000000014000780080008400000000008001240ffffffe80500010006000000050005000200000005000400000000000900020073797a31000000000d000300686173683a6e6574"], 0x5c}}, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r6) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) ioctl$FS_IOC_SETFLAGS(r7, 0x40086602, &(0x7f0000000140)=0x20) ioctl$FS_IOC_RESVSP(r7, 0x40305829, &(0x7f0000000180)={0x1100, 0x0, 0x52, 0x11000}) r8 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r8, 0x29, 0x6, &(0x7f0000000000)={0x21, {{0x29, 0x0, 0x2000000, @local, 0x4}}}, 0x88) r9 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000200)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfc, {0x0, 0x0, 0x0, r10, {0xffe0, 0x10}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_cake={{0x9}, {0xc, 0x2, [@TCA_CAKE_FLOW_MODE={0x8, 0x5, 0xd94fd5c211a3c2ca}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x45004) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) setsockopt$sock_attach_bpf(r2, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r2, 0x0, 0x0) r11 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r11, 0x84, 0x6f, &(0x7f0000000140)={0x0, 0x10, &(0x7f0000000100)=[@in={0x2, 0x4e24, @private=0xa010101}]}, &(0x7f0000000180)=0x10) setsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r11, 0x84, 0xc, &(0x7f00000000c0), 0x4) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r11, 0x84, 0x1d, &(0x7f0000000200)={0x1, [0x0]}, &(0x7f0000000080)=0x8) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(r11, 0x84, 0x6c, &(0x7f00000008c0)={r12}, &(0x7f0000000340)=0x8) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a3c000000090a010400000000000000000100000008000740000000080900020073797a32000000000900010073797a3000000000080005400000000b4c0000000c0a010300000000000000000100000008000440000010000900010073797a300000000024000380200000800400018018000b80140001800c000100636f756e7465720004000280140000001000010000000000000000000000000a491aa6334eefea273d7d14e1106e5d906e513024885782e494ee4033e11048cb0e6033d1a6654b872748feacbe7da7bcbd7614e4d020e6a68964fd9ceaee9abbb2582d26fcb13b268c3aa8f5dce302457936bd4e4406a34e14251d095fc969bfe5d059f42c71043c66e155f0aead13064aa56498263f1aa56b6b02452653e199a2e545337916a32d4a3cd6ff6132a24e3d937442d1a3c1e3c94117fc90cc7435cf296befe71beabbae2b0580b890deca5b44a13168a9ddb93d"], 0xb0}}, 0x0) 3.734958272s ago: executing program 4 (id=2402): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x6, 0x10, &(0x7f0000000040)=@framed={{0x18, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, [@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r0}, {0x7, 0x0, 0xb, 0x4}, {0x85, 0x0, 0x0, 0x95}}]}, &(0x7f0000000200)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000440)={r1, 0xfffff000, 0xe, 0x0, &(0x7f0000000000)="619ff1e3c70400d5721ff59fe864", 0x0, 0x0, 0x7000000, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xa000000}, 0x50) 3.706275031s ago: executing program 1 (id=2403): r0 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000002c0)={0x0}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) 3.662656849s ago: executing program 2 (id=2404): r0 = socket(0x10, 0x3, 0x0) gettid() sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000740)=@newlink={0x54, 0x10, 0x403, 0x70bd26, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, 0xf5a7ab78bfb4530e}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macsec={{0xb}, {0x4}}}, @IFLA_IFNAME={0x14, 0x3, 'macsec0\x00'}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FLAGS={0x8, 0x3, 0xd}]}]}, 0x54}}, 0x8000000) 3.583189177s ago: executing program 1 (id=2405): r0 = socket$inet6(0xa, 0x1, 0x8010800000000084) sendmmsg$inet6(r0, &(0x7f0000000040)=[{{&(0x7f0000000000)={0xa, 0x0, 0x0, @private0}, 0x1c, &(0x7f0000000600)=[{&(0x7f00000000c0)='/', 0x1}], 0x1}}, {{&(0x7f0000000400)={0xa, 0x201, 0xff00, @private0}, 0x1c, &(0x7f00000002c0)=[{&(0x7f0000000d00)='[', 0x4d0}], 0x21, 0x0, 0xfc}}], 0x2, 0x4008040) 3.554301771s ago: executing program 2 (id=2406): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x15, 0x0, &(0x7f0000000280)) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f00000000c0), r1) sendmsg$NLBL_CALIPSO_C_LISTALL(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)={0x14, r2, 0x3d810686a7d95765, 0x70bd2a, 0x25dfdb75}, 0x14}, 0x1, 0x0, 0x0, 0x4481}, 0x24004052) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@bloom_filter={0x1e, 0x0, 0x1, 0x7, 0x0, 0x1}, 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0}, 0x90) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x17, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r4, 0x2000000, 0xe, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xd, &(0x7f0000000040)=ANY=[@ANYRES16=r0, @ANYRES32, @ANYBLOB="0000000000000000b7080000000002007b8af8ff0000b213bfa200000000000007020000f8ffcbffb70300000000008500000001"], 0x0, 0x653, 0x30, 0x0, 0x0, 0x36, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) r6 = socket$alg(0x26, 0x5, 0x0) bind$alg(r6, &(0x7f0000000200)={0x26, 'aead\x00', 0x0, 0x0, 'ccm(aes)\x00'}, 0x58) r7 = socket$inet(0x2, 0x802, 0x1) connect$inet(r7, &(0x7f00000000c0)={0x2, 0x0, @empty}, 0x10) write(r7, &(0x7f0000000080)="08008edf773c8000", 0xfd) setsockopt$ALG_SET_AEAD_AUTHSIZE(r6, 0x117, 0x5, 0x0, 0x6) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_DESTROY(r9, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c0000000306010200000000000000000700000a0500010007"], 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x40814) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001400)}, 0x0) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r10, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000780)=ANY=[@ANYBLOB="580000000206030000000000000000000300000705000100070000000900020073797a31000000000c00078008001240000000050500050002000000050004000100000011000300686173683a69702c706f727400"], 0x58}, 0x1, 0x0, 0x0, 0x4000}, 0x20004000) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r11, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=ANY=[@ANYBLOB="50000000090601020000000000000000020000840900020073797a31000000000500010007000000280007800c00018008000140fffffff70500070088000000060004404e22000006000540"], 0x50}, 0x1, 0x0, 0x0, 0x10000082}, 0x90) sendmsg$ETHTOOL_MSG_PAUSE_SET(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f0000000080)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r5, @ANYBLOB="0100000010651fbe347b2c2b00000c000180080001"], 0x20}}, 0x0) unshare(0x400) readv(0xffffffffffffffff, 0x0, 0x0) 3.506614691s ago: executing program 4 (id=2407): r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r3, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) recvmsg$unix(r2, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) recvmsg$unix(r4, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000900), 0x100}, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001dc0)=""/4096, 0x1000}, 0x0) r5 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r1) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r5, @ANYBLOB="010026bd7000fcdbdf250200000008000100", @ANYRES32=r6], 0x1c}}, 0x840) write$nci(r0, &(0x7f0000000300)=@NCI_OP_RF_INTF_ACTIVATED_NTF={0x1, 0x1, 0x3, 0x5, 0x2, @v={0x2, 0x2, 0x5, 0x6, 0x7, 0x9, 0x9, {0x3, 0x0, "697c214a765d0f34"}, 0xe, 0x6, 0x80, 0x0, 0x88, "37449dcddcb777f6bdaf82c9fea09ebbacb957f3d1ce5da4645706fdf754687d202a50729fd27e740cfa604c555129816601061ca94304fcf0a78a3a1ce30b4cd32c6158d59aa4968dc505c8e968cd79971743bfc0d1736134f752c907898c265615e6d37a9b28b6de93936e7865e523a0ed51225ccb07d33b36faebf55b638d79d44674074f0b56"}}, 0xa1) 3.430206389s ago: executing program 1 (id=2408): sendmmsg$sock(0xffffffffffffffff, &(0x7f0000003b40), 0x0, 0x20000044) r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x6, &(0x7f0000000000)=0x40000000, 0x4) r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_PORT_GET(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000100)={0x64, r1, 0x1, 0xffffffff, 0x0, {0x37}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x73}}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x2}}}]}, 0x64}}, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000c80)=ANY=[@ANYBLOB="06000000040000"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, 0x0, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r6, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={0x20, 0x0, 0x9c3fa077fa966179, 0xfffffffd, 0x0, {{0x7e}, {@void, @val={0xc, 0x99, {0x916c, 0x14}}}}}, 0x20}, 0x1, 0x0, 0x0, 0x20008081}, 0x4000054) sendmsg$NL80211_CMD_RELOAD_REGDB(r6, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000340)={0x14, 0x0, 0x1, 0x70bd2d, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x20000000}, 0x20008004) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f00000002c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_MESH_CONFIG(0xffffffffffffffff, &(0x7f0000000680)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000640)={&(0x7f00000005c0)={0x58, 0x0, 0x200, 0x70bd26, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_MESH_CONFIG={0x2c, 0x23, 0x0, 0x1, [@NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL={0x6, 0xc, 0x7f}, @NL80211_MESHCONF_AUTO_OPEN_PLINKS={0x5}, @NL80211_MESHCONF_GATE_ANNOUNCEMENTS={0x5, 0x11, 0x1}, @NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES={0x5, 0x8, 0x4}, @NL80211_MESHCONF_AUTO_OPEN_PLINKS={0x5, 0x7, 0xd5}]}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r7}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x24}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x6}]}, 0x58}, 0x1, 0x0, 0x0, 0x40001}, 0x80) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000040)={{}, &(0x7f0000000280), &(0x7f0000000240)=r3}, 0x20) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x10, &(0x7f0000000bc0)=ANY=[@ANYBLOB="1808000000000000000000000000000018120000", @ANYRES32, @ANYBLOB="0000000000000000b703000000000000850000000c000000b7000000000000001801000000082c2500000000002120207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000700000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r4, 0x1, 0x32, &(0x7f00000000c0)=r8, 0x4) sendmsg$inet(r5, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000500)={0x6, 0x3, &(0x7f0000000200)=@framed, &(0x7f0000000280)='GPL\x00', 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x1f00}, 0x10}, 0x94) 2.788769958s ago: executing program 3 (id=2409): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$gtp(&(0x7f0000000000), r0) r2 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), r2) getsockname$packet(r2, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=@newlink={0x38, 0x10, 0x437, 0x800000, 0x0, {0x0, 0x0, 0x0, r3, 0x504c3}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gtp={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GTP_FD0={0x8, 0x1, @udp6}]}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x2000c014}, 0x0) sendmsg$GTP_CMD_DELPDP(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01002cbd70000e0000000202ff0008000100", @ANYRES32=r3, @ANYBLOB="0800020001"], 0x24}, 0x1, 0x0, 0x0, 0x44800}, 0x20000000) socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_rx_ring(r4, 0x107, 0x5, &(0x7f0000000040)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x4bd1bfda, 0x0, 0x6}, 0x1c) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0xd, &(0x7f0000000100)=@req3={0x10000, 0x100000001, 0x10000, 0xfffffffe, 0xd00, 0x2}, 0x1c) r5 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="39000000140081ae10003c000500018311001f9f660fcf066505acb612f691f3bd3508abca1be6eeb89c44ebb37358582bdbb7d553b4e92155", 0x39}], 0x1}, 0x0) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/mnt\x00') r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000001ac0)={&(0x7f0000000000)=ANY=[@ANYBLOB="200000002e00010026bdf000fcdbdf2504"], 0x20}, 0x1, 0x0, 0x0, 0x4000d}, 0x20000000) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='blkio.bfq.io_queued\x00', 0x275a, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB="5c0300002e00090027bd7000000000000400000048031180"], 0x35c}, 0x1, 0x0, 0x0, 0x42804}, 0x4000010) socket$nl_generic(0x10, 0x3, 0x10) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=ANY=[@ANYBLOB="200000002c00070127bd7000fcdbdf25097c00000804003200040003805fe867247ccab6b79bc03d4ec030d1cf7a7e901a9a523937121609f798a36545aa55edd624aae998082d76983f43f2ec1c582f9b38799f2e3b145dc7041f6c8ff9e68ffdd92f56bb82f7d187d215c60107d397a235998d5562b2d0fb9d8e2d50e66c17744466a300613908552b2932e3435cdd45dc5c26ac75486338190eda0665047c1eba4e978f8133ce84557964e599"], 0x20}, 0x1, 0x0, 0x0, 0xc000}, 0xc010) r9 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000080)={'bridge0\x00', 0x0}) sendmsg$nl_route(r9, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)=ANY=[@ANYBLOB="240000001d00070f000000000000000007000000", @ANYRES32=r10, @ANYBLOB="40002700060010"], 0x24}, 0x1, 0x0, 0x0, 0x800}, 0x0) r11 = syz_init_net_socket$llc(0x1a, 0x2, 0x0) sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r9, &(0x7f0000000440)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000400)={&(0x7f0000000380)={0x64, 0x0, 0x2, 0x70bd2a, 0x25dfdbff, {}, [@BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0xff}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x7f}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0xffffff40}, @BATADV_ATTR_VLANID={0x6}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_ORIG_ADDRESS={0xa}]}, 0x64}, 0x1, 0x0, 0x0, 0x40800}, 0x4090) ioctl$F2FS_IOC_START_ATOMIC_WRITE(r11, 0xf501, 0x0) 2.706511758s ago: executing program 0 (id=2410): r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_RES_PD_GET(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)={0x18, 0x140e, 0x529, 0x70bd26, 0x25dfdbfe, "", [@RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x1}]}, 0x18}, 0x1, 0x0, 0x0, 0x24000850}, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000080)={0x60, 0x0, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x4c, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x3, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x8}}, {0x14, 0x2, @in={0x2, 0x4e22, @multicast2}}}}]}]}, 0x60}}, 0x0) sendmsg$TIPC_NL_KEY_SET(r1, &(0x7f0000000280)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000240)={&(0x7f0000000040)={0x12c, 0x0, 0x100, 0x70bd2d, 0x25dfdbfc, {}, [@TIPC_NLA_MON={0x4}, @TIPC_NLA_MON={0x54, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x4}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xffffff00}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xc59}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x401}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x1}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x6}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x4}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x9}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x4}]}, @TIPC_NLA_NET={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0x8}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x6}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x483}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0xd9e}]}, @TIPC_NLA_SOCK={0x4c, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x3}, @TIPC_NLA_SOCK_CON={0x3c, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x1000}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x80000001}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x9}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x8000}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0xc64e}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x4}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x881}]}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}]}, @TIPC_NLA_MON={0x14, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x5}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x80}]}, @TIPC_NLA_MON={0x2c, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x1}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x3}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x101}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x1}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x7}]}]}, 0x12c}, 0x1, 0x0, 0x0, 0x20008000}, 0x0) 2.621411642s ago: executing program 0 (id=2411): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000001c0)=0x1000000, 0xc7) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0a00000005000000020000000700000000000000", @ANYRES32, @ANYBLOB, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) bind$inet6(r1, &(0x7f0000000dc0)={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x0, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) syz_emit_ethernet(0x2a, &(0x7f0000000e00)={@local, @link_local, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x300, 0x4e20, 0x8}}}}}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080000000000000", @ANYRES32, @ANYBLOB="000000e400"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB], 0x48) r2 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r2, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f0000000000)=0x80, 0x4) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r2, 0x10e, 0x4, &(0x7f0000000180)=0x10000800, 0x4) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=@newlink={0x44, 0x10, 0x421, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x20}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @gretap={{0xb}, {0x14, 0x2, 0x0, 0x1, [@IFLA_GRE_TOS={0x5, 0x9, 0x9}, @IFLA_GRE_PMTUDISC={0x5}]}}}]}, 0x44}}, 0x0) r4 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_NEW(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000300)={0x34, r4, 0x1, 0x0, 0x25dfdbff, {0x25}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x34}, 0x1, 0x0, 0x0, 0x41}, 0x24004804) r5 = socket$inet_mptcp(0x2, 0x1, 0x106) sendmmsg$inet(r5, &(0x7f0000004980), 0x0, 0x20008000) socket(0x15, 0x5, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)={0x54, r7, 0x1, 0x0, 0x25dfdbfe, {0x3}, [@TIPC_NLA_BEARER={0x40, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xf}}}, {0x14, 0x2, @in={0x2, 0x4e24, @local}}}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x2400c085}, 0x40000000) 2.255931715s ago: executing program 2 (id=2412): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$gtp(&(0x7f0000000000), r0) r2 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), r2) getsockname$packet(r2, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=@newlink={0x38, 0x10, 0x437, 0x800000, 0x0, {0x0, 0x0, 0x0, r3, 0x504c3}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gtp={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GTP_FD0={0x8, 0x1, @udp6}]}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x2000c014}, 0x0) sendmsg$GTP_CMD_DELPDP(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01002cbd70000e0000000202ff0008000100", @ANYRES32=r3, @ANYBLOB="0800020001"], 0x24}, 0x1, 0x0, 0x0, 0x44800}, 0x20000000) socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_rx_ring(r4, 0x107, 0x5, &(0x7f0000000040)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x4bd1bfda, 0x0, 0x6}, 0x1c) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0xd, &(0x7f0000000100)=@req3={0x10000, 0x100000001, 0x10000, 0xfffffffe, 0xd00, 0x2}, 0x1c) r5 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="39000000140081ae10003c000500018311001f9f660fcf066505acb612f691f3bd3508abca1be6eeb89c44ebb37358582bdbb7d553b4e92155", 0x39}], 0x1}, 0x0) unshare(0x2c060000) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/mnt\x00') r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000001ac0)={&(0x7f0000000000)=ANY=[@ANYBLOB="200000002e00010026bdf000fcdbdf2504"], 0x20}, 0x1, 0x0, 0x0, 0x4000d}, 0x20000000) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='blkio.bfq.io_queued\x00', 0x275a, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB="5c0300002e00090027bd7000000000000400000048031180"], 0x35c}, 0x1, 0x0, 0x0, 0x42804}, 0x4000010) socket$nl_generic(0x10, 0x3, 0x10) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=ANY=[@ANYBLOB="200000002c00070127bd7000fcdbdf25097c00000804003200040003805fe867247ccab6b79bc03d4ec030d1cf7a7e901a9a523937121609f798a36545aa55edd624aae998082d76983f43f2ec1c582f9b38799f2e3b145dc7041f6c8ff9e68ffdd92f56bb82f7d187d215c60107d397a235998d5562b2d0fb9d8e2d50e66c17744466a300613908552b2932e3435cdd45dc5c26ac75486338190eda0665047c1eba4e978f8133ce84557964e599"], 0x20}, 0x1, 0x0, 0x0, 0xc000}, 0xc010) r9 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000080)={'bridge0\x00', 0x0}) sendmsg$nl_route(r9, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)=ANY=[@ANYBLOB="240000001d00070f000000000000000007000000", @ANYRES32=r10, @ANYBLOB="40002700060010"], 0x24}, 0x1, 0x0, 0x0, 0x800}, 0x0) r11 = syz_init_net_socket$llc(0x1a, 0x2, 0x0) sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r9, &(0x7f0000000440)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000400)={&(0x7f0000000380)={0x64, 0x0, 0x2, 0x70bd2a, 0x25dfdbff, {}, [@BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0xff}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x7f}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0xffffff40}, @BATADV_ATTR_VLANID={0x6}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_ORIG_ADDRESS={0xa}]}, 0x64}, 0x1, 0x0, 0x0, 0x40800}, 0x4090) ioctl$F2FS_IOC_START_ATOMIC_WRITE(r11, 0xf501, 0x0) 373.982059ms ago: executing program 1 (id=2413): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000001c0)=0x1000000, 0xc7) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0a00000005000000020000000700000000000000", @ANYRES32, @ANYBLOB, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) bind$inet6(r1, &(0x7f0000000dc0)={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x0, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) syz_emit_ethernet(0x2e, &(0x7f0000000200)={@local, @link_local, @val={@void, {0x8100, 0x1}}, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x300, 0x4e20, 0x8}}}}}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080000000000000", @ANYRES32, @ANYBLOB="000000e400"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB], 0x48) r2 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r2, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f0000000000)=0x80, 0x4) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r2, 0x10e, 0x4, &(0x7f0000000180)=0x10000800, 0x4) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=@newlink={0x44, 0x10, 0x421, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x20}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @gretap={{0xb}, {0x14, 0x2, 0x0, 0x1, [@IFLA_GRE_TOS={0x5, 0x9, 0x9}, @IFLA_GRE_PMTUDISC={0x5}]}}}]}, 0x44}}, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket$nl_xfrm(0x10, 0x3, 0x6) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000380)='memory.events\x00', 0x26e1, 0x0) r4 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r4, 0x10e, 0xc, &(0x7f0000000080)={0x4000, 0x110003, 0x0, 0x9}, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=ANY=[@ANYBLOB="1c000000160001f47efde4be701161000a000000040000800400", @ANYRES32=r4], 0x1c}}, 0x0) r5 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_NEW(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000300)={0x34, r5, 0x1, 0x0, 0x25dfdbff, {0x25}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x34}, 0x1, 0x0, 0x0, 0x41}, 0x24004804) r6 = socket$inet_mptcp(0x2, 0x1, 0x106) sendmmsg$inet(r6, &(0x7f0000004980)=[{{&(0x7f0000000000)={0x2, 0x4e24, @loopback}, 0x10, 0x0}}], 0x1, 0x20008000) socket(0x15, 0x5, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)={0x54, r8, 0x1, 0x0, 0x25dfdbfe, {0x3}, [@TIPC_NLA_BEARER={0x40, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xf}}}, {0x14, 0x2, @in={0x2, 0x4e24, @local}}}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x2400c085}, 0x40000000) 350.800197ms ago: executing program 4 (id=2414): r0 = socket(0x1d, 0x2, 0x6) r1 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000005d00)={0x114, 0x2f, 0x1, 0x0, 0x25dfdbfc, "", [@nested={0x101, 0xf2, 0x0, 0x1, [@typed={0xc, 0x18, 0x0, 0x0, @u64=0xfac08}, @typed={0x14, 0x1, 0x0, 0x0, @ipv6=@ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x16}}}, @generic="50bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076eb43d9621dc08c029d1608a46cf26fbe816b89f7cb81bff81a8b9482565856555ee923c65973deb0a99b962bc0fe94a3fcae3697bd7b85b3a682167c43dbf137115a40ebddcad74875ec58e9a3ddb9ad02a078cf0d972df9e99f079767734f69ce475f00ac64337803f5eb4e5842f4d98fe3fa370d47eb640dc5061dc35817c8a66c", @typed={0x4, 0xe9}]}]}, 0x114}], 0x1, 0x0, 0x0, 0x1}, 0x0) bind$inet(r0, &(0x7f00000000c0)={0x1d, 0x4e20, @loopback}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'rose0\x00', 0x102}) socket$inet_icmp(0x2, 0x2, 0x1) ioctl$TUNSETQUEUE(r2, 0x400454d9, &(0x7f0000000000)={'geneve1\x00', 0x400}) openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) socket$inet6(0xa, 0x2, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000380)=@raw={'raw\x00', 0x3c1, 0x3, 0x318, 0x168, 0x6c, 0x0, 0x168, 0x0, 0x248, 0x258, 0x258, 0x248, 0x258, 0x3, 0x0, {[{{@ipv6={@rand_addr=' \x01\x00', @private0, [], [], 'wlan1\x00', 'ip6gre0\x00', {}, {}, 0x11, 0x0, 0x0, 0x48}, 0x0, 0x100, 0x168, 0x0, {}, [@common=@inet=@l2tp={{0x30}, {0x0, 0x0, 0x2, 0x0, 0x5}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0xfffffffd, 'netbios-ns\x00', 'syz1\x00'}}}, {{@ipv6={@dev, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, [], [], 'netdevsim0\x00', 'lo\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}], {{'\x00', 0x0, 0xa8, 0xd0, 0x0, {0x0, 0x2001}}, {0x28}}}}, 0x378) r4 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r4, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r5 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_bt_hidp_HIDPCONNADD(r5, 0x400448c8, &(0x7f0000000400)={r4, r4, 0x6, 0x0, 0x0, 0x9, 0xfd, 0xc48, 0x1012, 0xc3, 0x1, 0x7, 'syz0\x00'}) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) r6 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_bt_hidp_HIDPCONNDEL(r6, 0x400448c9, &(0x7f0000000000)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}) 251.662319ms ago: executing program 3 (id=2415): r0 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000002c0)={0x0}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) 202.46905ms ago: executing program 0 (id=2416): r0 = socket(0x1d, 0x2, 0x6) r1 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000005d00)={0x114, 0x2f, 0x1, 0x0, 0x25dfdbfc, "", [@nested={0x101, 0xf2, 0x0, 0x1, [@typed={0xc, 0x18, 0x0, 0x0, @u64=0xfac08}, @typed={0x14, 0x1, 0x0, 0x0, @ipv6=@ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x16}}}, @generic="50bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076eb43d9621dc08c029d1608a46cf26fbe816b89f7cb81bff81a8b9482565856555ee923c65973deb0a99b962bc0fe94a3fcae3697bd7b85b3a682167c43dbf137115a40ebddcad74875ec58e9a3ddb9ad02a078cf0d972df9e99f079767734f69ce475f00ac64337803f5eb4e5842f4d98fe3fa370d47eb640dc5061dc35817c8a66c", @typed={0x4, 0xe9}]}]}, 0x114}], 0x1, 0x0, 0x0, 0x1}, 0x0) bind$inet(r0, &(0x7f00000000c0)={0x1d, 0x4e20, @loopback}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'rose0\x00', 0x102}) socket$inet_icmp(0x2, 0x2, 0x1) ioctl$TUNSETQUEUE(r2, 0x400454d9, &(0x7f0000000000)={'geneve1\x00', 0x400}) openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) socket$inet6(0xa, 0x2, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000380)=@raw={'raw\x00', 0x3c1, 0x3, 0x318, 0x168, 0x6c, 0x0, 0x168, 0x0, 0x248, 0x258, 0x258, 0x248, 0x258, 0x3, 0x0, {[{{@ipv6={@rand_addr=' \x01\x00', @private0, [], [], 'wlan1\x00', 'ip6gre0\x00', {}, {}, 0x11, 0x0, 0x0, 0x48}, 0x0, 0x100, 0x168, 0x0, {}, [@common=@inet=@l2tp={{0x30}, {0x0, 0x0, 0x2, 0x0, 0x5}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0xfffffffd, 'netbios-ns\x00', 'syz1\x00'}}}, {{@ipv6={@dev, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, [], [], 'netdevsim0\x00', 'lo\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}], {{'\x00', 0x0, 0xa8, 0xd0, 0x0, {0x0, 0x2001}}, {0x28}}}}, 0x378) socket(0x840000000002, 0x3, 0x100) connect$bt_l2cap(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r4 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_bt_hidp_HIDPCONNADD(r4, 0x400448c8, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff, 0x6, 0x0, 0x0, 0x9, 0xfd, 0xc48, 0x1012, 0xc3, 0x1, 0x7, 'syz0\x00'}) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) r5 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_bt_hidp_HIDPCONNDEL(r5, 0x400448c9, &(0x7f0000000000)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}) 157.686991ms ago: executing program 3 (id=2417): r0 = socket$inet(0x2, 0x3, 0xa) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000480)=@raw={'raw\x00', 0x8, 0x3, 0x338, 0x0, 0xe138, 0x198, 0x1c0, 0x198, 0x2a0, 0x358, 0x358, 0x2a0, 0x358, 0x3, 0x0, {[{{@ip={@broadcast, @loopback, 0x0, 0x0, '\x00', 'veth0_to_bond\x00', {}, {}, 0x21}, 0x0, 0x158, 0x1c0, 0x0, {}, [@common=@unspec=@string={{0xc0}, {0x0, 0x0, 'fsm\x00', "0d000400000000000e000004fff0cf81dfd28c89544e14cd3e01dd24289831867846c88621039b284c3ff45c42995560a99952bed40cf5a8c1df6cdbdb7e2378d5afd35f4c16827f55b3af494e39e8fb330200000000000032b6a99a8d87298e88a94cb519f5c17631af916a0002000000000000000000000000000000000049", 0x8}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x4, 0x1800, 0x0, 0x0, 'snmp_trap\x00', 'syz0\x00', {0xfffffffffffffffc}}}}, {{@uncond, 0x0, 0x98, 0xe0, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'syz0\x00'}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x398) 5.033163ms ago: executing program 1 (id=2418): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x15, 0x0, &(0x7f0000000280)) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f00000000c0), r1) sendmsg$NLBL_CALIPSO_C_LISTALL(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)={0x14, r2, 0x3d810686a7d95765, 0x70bd2a, 0x25dfdb75}, 0x14}, 0x1, 0x0, 0x0, 0x4481}, 0x24004052) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@bloom_filter={0x1e, 0x0, 0x1, 0x7, 0x0, 0x1}, 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0}, 0x90) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x17, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r4, 0x2000000, 0xe, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xd, &(0x7f0000000040)=ANY=[@ANYRES16=r0, @ANYRES32, @ANYBLOB="0000000000000000b7080000000002007b8af8ff0000b213bfa200000000000007020000f8ffcbffb70300000000008500000001"], 0x0, 0x653, 0x30, 0x0, 0x0, 0x36, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) r6 = socket$alg(0x26, 0x5, 0x0) bind$alg(r6, &(0x7f0000000200)={0x26, 'aead\x00', 0x0, 0x0, 'ccm(aes)\x00'}, 0x58) r7 = socket$inet(0x2, 0x802, 0x1) connect$inet(r7, &(0x7f00000000c0)={0x2, 0x0, @empty}, 0x10) write(r7, &(0x7f0000000080)="08008edf773c8000", 0xfd) setsockopt$ALG_SET_AEAD_AUTHSIZE(r6, 0x117, 0x5, 0x0, 0x6) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_DESTROY(r9, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c0000000306010200000000000000000700000a0500010007"], 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x40814) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001400)}, 0x0) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r10, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000780)=ANY=[@ANYBLOB="580000000206030000000000000000000300000705000100070000000900020073797a31000000000c00078008001240000000050500050002000000050004000100000011000300686173683a69702c706f727400"], 0x58}, 0x1, 0x0, 0x0, 0x4000}, 0x20004000) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r11, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=ANY=[@ANYBLOB="50000000090601020000000000000000020000840900020073797a31000000000500010007000000280007800c00018008000140fffffff70500070088000000060004404e22000006000540"], 0x50}, 0x1, 0x0, 0x0, 0x10000082}, 0x90) sendmsg$ETHTOOL_MSG_PAUSE_SET(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f0000000080)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r5, @ANYBLOB="0100000010651fbe347b2c2b00000c000180080001"], 0x20}}, 0x0) r12 = syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/mnt\x00') readv(r12, 0x0, 0x0) 0s ago: executing program 2 (id=2419): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x15, 0x0, &(0x7f0000000280)) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f00000000c0), r1) sendmsg$NLBL_CALIPSO_C_LISTALL(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)={0x14, r2, 0x3d810686a7d95765, 0x70bd2a, 0x25dfdb75}, 0x14}, 0x1, 0x0, 0x0, 0x4481}, 0x24004052) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@bloom_filter={0x1e, 0x0, 0x1, 0x7, 0x0, 0x1}, 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0}, 0x90) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x17, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r4, 0x2000000, 0xe, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xd, &(0x7f0000000040)=ANY=[@ANYRES16=r0, @ANYRES32, @ANYBLOB="0000000000000000b7080000000002007b8af8ff0000b213bfa200000000000007020000f8ffcbffb70300000000008500000001"], 0x0, 0x653, 0x30, 0x0, 0x0, 0x36, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) r6 = socket$alg(0x26, 0x5, 0x0) bind$alg(r6, &(0x7f0000000200)={0x26, 'aead\x00', 0x0, 0x0, 'ccm(aes)\x00'}, 0x58) r7 = socket$inet(0x2, 0x802, 0x1) connect$inet(r7, &(0x7f00000000c0)={0x2, 0x0, @empty}, 0x10) write(r7, &(0x7f0000000080)="08008edf773c8000", 0xfd) setsockopt$ALG_SET_AEAD_AUTHSIZE(r6, 0x117, 0x5, 0x0, 0x6) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_DESTROY(r9, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c0000000306010200000000000000000700000a0500010007"], 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x40814) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001400)}, 0x0) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r10, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000780)=ANY=[@ANYBLOB="580000000206030000000000000000000300000705000100070000000900020073797a31000000000c00078008001240000000050500050002000000050004000100000011000300686173683a69702c706f727400"], 0x58}, 0x1, 0x0, 0x0, 0x4000}, 0x20004000) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r11, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=ANY=[@ANYBLOB="50000000090601020000000000000000020000840900020073797a31000000000500010007000000280007800c00018008000140fffffff70500070088000000060004404e22000006000540"], 0x50}, 0x1, 0x0, 0x0, 0x10000082}, 0x90) sendmsg$ETHTOOL_MSG_PAUSE_SET(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f0000000080)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r5, @ANYBLOB="0100000010651fbe347b2c2b00000c000180080001"], 0x20}}, 0x0) r12 = syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/mnt\x00') readv(r12, 0x0, 0x0) kernel console output (not intermixed with test programs): 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 241.594492][T11524] RSP: 002b:00007ff0bd4c5028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 241.594513][T11524] RAX: ffffffffffffffda RBX: 00007ff0bc816090 RCX: 00007ff0bc59c819 [ 241.594526][T11524] RDX: 00000000040001af RSI: 0000200000000a40 RDI: 0000000000000007 [ 241.594538][T11524] RBP: 00007ff0bd4c5090 R08: 0000000000000000 R09: 0000000000000000 [ 241.594549][T11524] R10: 0000000000012122 R11: 0000000000000246 R12: 0000000000000001 [ 241.594560][T11524] R13: 00007ff0bc816128 R14: 00007ff0bc816090 R15: 00007fff80790c58 [ 241.594588][T11524] [ 241.934393][T11533] xt_hashlimit: invalid rate [ 241.985582][T11538] syzkaller1: entered promiscuous mode [ 241.991471][T11538] syzkaller1: entered allmulticast mode [ 242.078507][T11542] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1620'. [ 242.279120][T11550] x_tables: ip6_tables: rpfilter match: used from hooks FORWARD, but only valid from PREROUTING [ 242.502766][T11557] syzkaller1: entered promiscuous mode [ 242.508352][T11557] syzkaller1: entered allmulticast mode [ 242.716295][T11566] A link change request failed with some changes committed already. Interface macsec0 may have been left with an inconsistent configuration, please check. [ 242.852600][T11568] syzkaller0: entered promiscuous mode [ 242.865304][T11568] syzkaller0: entered allmulticast mode [ 242.990303][T11575] netlink: 32 bytes leftover after parsing attributes in process `syz.3.1633'. [ 243.537107][T11598] FAULT_INJECTION: forcing a failure. [ 243.537107][T11598] name failslab, interval 1, probability 0, space 0, times 0 [ 243.559966][T11598] CPU: 0 UID: 0 PID: 11598 Comm: syz.0.1641 Not tainted syzkaller #0 PREEMPT(full) [ 243.559992][T11598] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 243.560003][T11598] Call Trace: [ 243.560011][T11598] [ 243.560018][T11598] dump_stack_lvl+0xe8/0x150 [ 243.560047][T11598] should_fail_ex+0x412/0x560 [ 243.560076][T11598] should_failslab+0xa8/0x100 [ 243.560096][T11598] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 243.560121][T11598] ? __alloc_skb+0x186/0x7d0 [ 243.560143][T11598] ? __alloc_skb+0x1d0/0x7d0 [ 243.560162][T11598] ? __local_bh_enable_ip+0xd0/0x130 [ 243.560189][T11598] __alloc_skb+0x1d0/0x7d0 [ 243.560211][T11598] ? netlink_ack_tlv_len+0x6c/0x210 [ 243.560236][T11598] netlink_ack+0x146/0xa50 [ 243.560257][T11598] ? kasan_quarantine_put+0xbb/0x1f0 [ 243.560280][T11598] ? lockdep_hardirqs_on+0x7a/0x110 [ 243.560307][T11598] ? nfnetlink_rcv+0x260f/0x27b0 [ 243.560332][T11598] nfnetlink_rcv+0x251a/0x27b0 [ 243.560384][T11598] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 243.560446][T11598] ? netlink_deliver_tap+0x2e/0x1b0 [ 243.560490][T11598] ? netlink_deliver_tap+0x2e/0x1b0 [ 243.560513][T11598] ? netlink_deliver_tap+0x2e/0x1b0 [ 243.560540][T11598] netlink_unicast+0x75c/0x8e0 [ 243.560571][T11598] netlink_sendmsg+0x813/0xb40 [ 243.560603][T11598] ? __pfx_netlink_sendmsg+0x10/0x10 [ 243.560630][T11598] ? aa_sock_msg_perm+0xf1/0x1b0 [ 243.560654][T11598] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 243.560682][T11598] ____sys_sendmsg+0x972/0x9f0 [ 243.560706][T11598] ? __might_fault+0xaf/0x130 [ 243.560735][T11598] ? __pfx_____sys_sendmsg+0x10/0x10 [ 243.560768][T11598] ? import_iovec+0x73/0xa0 [ 243.560790][T11598] ___sys_sendmsg+0x2a5/0x360 [ 243.560814][T11598] ? __lock_acquire+0x6b5/0x2cf0 [ 243.560840][T11598] ? __pfx____sys_sendmsg+0x10/0x10 [ 243.560896][T11598] ? __fget_files+0x2a/0x420 [ 243.560918][T11598] ? __fget_files+0x3a0/0x420 [ 243.560949][T11598] __x64_sys_sendmsg+0x1bd/0x2a0 [ 243.560977][T11598] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 243.561011][T11598] ? __pfx_ksys_write+0x10/0x10 [ 243.561042][T11598] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 243.561062][T11598] do_syscall_64+0x15f/0xf80 [ 243.561081][T11598] ? trace_irq_disable+0x3b/0x140 [ 243.561100][T11598] ? clear_bhb_loop+0x40/0x90 [ 243.561122][T11598] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 243.561139][T11598] RIP: 0033:0x7fa27bf9c819 [ 243.561157][T11598] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 243.561172][T11598] RSP: 002b:00007fa27cea6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 243.561192][T11598] RAX: ffffffffffffffda RBX: 00007fa27c215fa0 RCX: 00007fa27bf9c819 [ 243.561204][T11598] RDX: 0000000000000894 RSI: 000020000000de80 RDI: 0000000000000003 [ 243.561216][T11598] RBP: 00007fa27cea6090 R08: 0000000000000000 R09: 0000000000000000 [ 243.561226][T11598] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 243.561236][T11598] R13: 00007fa27c216038 R14: 00007fa27c215fa0 R15: 00007ffd38b23ef8 [ 243.561265][T11598] [ 244.020908][T11610] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1644'. [ 244.083755][T11612] A link change request failed with some changes committed already. Interface veth0_vlan may have been left with an inconsistent configuration, please check. [ 244.660892][T11638] x_tables: duplicate underflow at hook 4 [ 244.716205][T11640] geneve2: entered promiscuous mode [ 244.846281][T11643] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1654'. [ 244.873581][T11643] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1654'. [ 245.500446][T11675] netdevsim netdevsim1 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 245.537942][T11675] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 245.676333][T11675] netdevsim netdevsim1 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 245.770094][T11705] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1666'. [ 245.776205][T11675] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 246.084588][T11675] netdevsim netdevsim1 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 246.098937][T11675] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 246.218216][T11675] netdevsim netdevsim1 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 246.248286][T11675] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 246.405428][T11727] sch_tbf: burst 0 is lower than device tunl0 mtu (1480) ! [ 246.517074][ T3484] netdevsim netdevsim1 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 246.542203][ T3484] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 246.605988][T11731] xt_CT: No such helper "snmp_trap" [ 246.621995][ T3484] netdevsim netdevsim1 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 246.635938][ T3484] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 246.766915][ T33] netdevsim netdevsim1 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 246.785390][ T33] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 246.835759][ T3484] netdevsim netdevsim1 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 246.851874][ T3484] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 246.928869][T11746] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1681'. [ 246.950251][T11747] x_tables: ip6_tables: rpfilter match: used from hooks FORWARD, but only valid from PREROUTING [ 247.017773][T11752] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1681'. [ 247.034266][T11751] x_tables: duplicate underflow at hook 4 [ 247.083359][T11754] netlink: 'syz.4.1685': attribute type 1 has an invalid length. [ 247.510863][T11776] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1693'. [ 247.995357][T11783] netlink: 256 bytes leftover after parsing attributes in process `syz.4.1695'. [ 248.004907][T11783] unsupported nlmsg_type 40 [ 248.602966][T11807] A link change request failed with some changes committed already. Interface macsec0 may have been left with an inconsistent configuration, please check. [ 248.668166][T11809] xt_addrtype: input interface limitation not valid in POSTROUTING and OUTPUT [ 249.333449][T11817] sch_tbf: burst 0 is lower than device tunl0 mtu (1480) ! [ 249.724830][T11827] syzkaller1: entered allmulticast mode [ 250.508548][T11830] FAULT_INJECTION: forcing a failure. [ 250.508548][T11830] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 250.522298][T11830] CPU: 0 UID: 0 PID: 11830 Comm: syz.3.1707 Not tainted syzkaller #0 PREEMPT(full) [ 250.522322][T11830] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 250.522333][T11830] Call Trace: [ 250.522340][T11830] [ 250.522347][T11830] dump_stack_lvl+0xe8/0x150 [ 250.522378][T11830] should_fail_ex+0x412/0x560 [ 250.522405][T11830] _copy_from_user+0x2d/0xb0 [ 250.522438][T11830] __sys_bpf+0x229/0x950 [ 250.522451][T11830] ? __pfx___sys_bpf+0x10/0x10 [ 250.522469][T11830] ? ksys_write+0x242/0x270 [ 250.522485][T11830] ? __pfx_ksys_write+0x10/0x10 [ 250.522501][T11830] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 250.522512][T11830] __x64_sys_bpf+0x7c/0x90 [ 250.522521][T11830] do_syscall_64+0x15f/0xf80 [ 250.522534][T11830] ? trace_irq_disable+0x3b/0x140 [ 250.522544][T11830] ? clear_bhb_loop+0x40/0x90 [ 250.522556][T11830] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 250.522566][T11830] RIP: 0033:0x7ff0bc59c819 [ 250.522577][T11830] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 250.522585][T11830] RSP: 002b:00007ff0bd4e6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 250.522598][T11830] RAX: ffffffffffffffda RBX: 00007ff0bc815fa0 RCX: 00007ff0bc59c819 [ 250.522605][T11830] RDX: 0000000000000050 RSI: 0000200000000440 RDI: 000000000000000a [ 250.522611][T11830] RBP: 00007ff0bd4e6090 R08: 0000000000000000 R09: 0000000000000000 [ 250.522617][T11830] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 250.522623][T11830] R13: 00007ff0bc816038 R14: 00007ff0bc815fa0 R15: 00007fff80790c58 [ 250.522639][T11830] [ 251.061058][T11785] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 251.071544][T11820] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1705'. [ 251.215907][T11822] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1705'. [ 251.231446][T11838] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1710'. [ 251.248319][T11838] vlan2: entered promiscuous mode [ 251.395120][T11846] x_tables: duplicate underflow at hook 4 [ 251.566558][T11855] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1715'. [ 251.576788][T11857] sch_tbf: burst 0 is lower than device tunl0 mtu (1480) ! [ 251.661051][T11860] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1718'. [ 251.718243][T11855] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1715'. [ 251.919888][T11880] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1723'. [ 251.936739][T11880] vlan2: entered promiscuous mode [ 252.002113][T11882] syzkaller1: entered promiscuous mode [ 252.020541][T11882] syzkaller1: entered allmulticast mode [ 252.089529][T11886] netlink: 'syz.4.1726': attribute type 1 has an invalid length. [ 252.198783][T11891] FAULT_INJECTION: forcing a failure. [ 252.198783][T11891] name failslab, interval 1, probability 0, space 0, times 0 [ 252.211947][T11891] CPU: 1 UID: 0 PID: 11891 Comm: syz.3.1728 Not tainted syzkaller #0 PREEMPT(full) [ 252.211972][T11891] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 252.211982][T11891] Call Trace: [ 252.211990][T11891] [ 252.211998][T11891] dump_stack_lvl+0xe8/0x150 [ 252.212028][T11891] should_fail_ex+0x412/0x560 [ 252.212058][T11891] should_failslab+0xa8/0x100 [ 252.212077][T11891] __kmalloc_noprof+0xe8/0x760 [ 252.212103][T11891] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 252.212133][T11891] tomoyo_realpath_from_path+0xe3/0x5d0 [ 252.212160][T11891] ? tomoyo_domain+0xd7/0x130 [ 252.212190][T11891] ? tomoyo_path_number_perm+0x219/0x630 [ 252.212211][T11891] tomoyo_path_number_perm+0x246/0x630 [ 252.212234][T11891] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 252.212252][T11891] ? __lock_acquire+0x6b5/0x2cf0 [ 252.212290][T11891] ? __mutex_unlock_slowpath+0x1be/0x6f0 [ 252.212331][T11891] ? __fget_files+0x2a/0x420 [ 252.212356][T11891] ? __fget_files+0x2a/0x420 [ 252.212376][T11891] ? __fget_files+0x3a0/0x420 [ 252.212396][T11891] ? __fget_files+0x2a/0x420 [ 252.212422][T11891] security_file_ioctl+0xc3/0x2a0 [ 252.212445][T11891] __se_sys_ioctl+0x47/0x170 [ 252.212461][T11891] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 252.212489][T11891] do_syscall_64+0x15f/0xf80 [ 252.212509][T11891] ? trace_irq_disable+0x3b/0x140 [ 252.212528][T11891] ? clear_bhb_loop+0x40/0x90 [ 252.212550][T11891] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 252.212567][T11891] RIP: 0033:0x7ff0bc59c819 [ 252.212583][T11891] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 252.212599][T11891] RSP: 002b:00007ff0bd4e6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 252.212619][T11891] RAX: ffffffffffffffda RBX: 00007ff0bc815fa0 RCX: 00007ff0bc59c819 [ 252.212632][T11891] RDX: 00002000000003c0 RSI: 000000000000890c RDI: 0000000000000004 [ 252.212644][T11891] RBP: 00007ff0bd4e6090 R08: 0000000000000000 R09: 0000000000000000 [ 252.212655][T11891] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 252.212666][T11891] R13: 00007ff0bc816038 R14: 00007ff0bc815fa0 R15: 00007fff80790c58 [ 252.212697][T11891] [ 252.212704][T11891] ERROR: Out of memory at tomoyo_realpath_from_path. [ 252.975439][T11925] FAULT_INJECTION: forcing a failure. [ 252.975439][T11925] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 252.988735][T11925] CPU: 1 UID: 0 PID: 11925 Comm: syz.3.1737 Not tainted syzkaller #0 PREEMPT(full) [ 252.988759][T11925] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 252.988767][T11925] Call Trace: [ 252.988772][T11925] [ 252.988776][T11925] dump_stack_lvl+0xe8/0x150 [ 252.988795][T11925] should_fail_ex+0x412/0x560 [ 252.988812][T11925] _copy_from_user+0x2d/0xb0 [ 252.988823][T11925] ___sys_recvmsg+0x175/0x590 [ 252.988837][T11925] ? __pfx____sys_recvmsg+0x10/0x10 [ 252.988849][T11925] ? __fget_files+0x2a/0x420 [ 252.988876][T11925] do_recvmmsg+0x334/0x800 [ 252.988890][T11925] ? __pfx_do_recvmmsg+0x10/0x10 [ 252.988905][T11925] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 252.988927][T11925] __x64_sys_recvmmsg+0x198/0x250 [ 252.988938][T11925] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 252.988952][T11925] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 252.988970][T11925] do_syscall_64+0x15f/0xf80 [ 252.988989][T11925] ? trace_irq_disable+0x3b/0x140 [ 252.989008][T11925] ? clear_bhb_loop+0x40/0x90 [ 252.989028][T11925] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 252.989045][T11925] RIP: 0033:0x7ff0bc59c819 [ 252.989062][T11925] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 252.989076][T11925] RSP: 002b:00007ff0bd4c5028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 252.989095][T11925] RAX: ffffffffffffffda RBX: 00007ff0bc816090 RCX: 00007ff0bc59c819 [ 252.989108][T11925] RDX: 00000000040001af RSI: 0000200000000a40 RDI: 0000000000000007 [ 252.989114][T11925] RBP: 00007ff0bd4c5090 R08: 0000000000000000 R09: 0000000000000000 [ 252.989120][T11925] R10: 0000000000012122 R11: 0000000000000246 R12: 0000000000000001 [ 252.989127][T11925] R13: 00007ff0bc816128 R14: 00007ff0bc816090 R15: 00007fff80790c58 [ 252.989142][T11925] [ 254.744751][T11864] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 254.756705][T11907] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1732'. [ 254.850832][T11937] A link change request failed with some changes committed already. Interface macsec0 may have been left with an inconsistent configuration, please check. [ 254.950385][T11919] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1732'. [ 254.961729][T11941] sch_tbf: burst 0 is lower than device tunl0 mtu (1480) ! [ 254.977464][T11942] netlink: 'syz.2.1743': attribute type 21 has an invalid length. [ 255.016974][T11942] netlink: 36 bytes leftover after parsing attributes in process `syz.2.1743'. [ 255.139883][T11945] x_tables: ip6_tables: rpfilter match: used from hooks FORWARD, but only valid from PREROUTING [ 255.601270][T11973] syzkaller0: entered promiscuous mode [ 255.612825][T11971] xt_CT: No such helper "snmp_trap" [ 255.639945][T11973] syzkaller0: entered allmulticast mode [ 255.858536][T11984] netdevsim netdevsim1 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 255.868689][T11984] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 255.943884][T11984] netdevsim netdevsim1 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 255.956447][ T1298] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.962950][ T1298] ieee802154 phy1 wpan1: encryption failed: -22 [ 255.977856][T11984] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 256.060977][T11991] vlan4: entered promiscuous mode [ 256.066900][T11991] dummy0: entered promiscuous mode [ 256.105833][T11984] netdevsim netdevsim1 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 256.122539][T11984] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 256.234477][T11984] netdevsim netdevsim1 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 256.246580][T11984] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 256.247015][T11990] __nla_validate_parse: 2 callbacks suppressed [ 256.247030][T11990] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1755'. [ 256.312168][T11997] netlink: 36 bytes leftover after parsing attributes in process `syz.4.1760'. [ 256.328355][T11999] netlink: 'syz.4.1760': attribute type 10 has an invalid length. [ 256.337410][T11999] netlink: 228 bytes leftover after parsing attributes in process `syz.4.1760'. [ 256.391167][T11998] netlink: 'syz.4.1760': attribute type 1 has an invalid length. [ 256.907344][T11999] smc: removing net device wlan0 with user defined pnetid SYZ0 [ 257.140368][ T1520] netdevsim netdevsim1 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 257.167423][ T1520] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 257.260288][ T1520] netdevsim netdevsim1 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 257.282411][ T1520] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 257.298501][T12043] x_tables: ip6_tables: rpfilter match: used from hooks FORWARD, but only valid from PREROUTING [ 257.340060][T12044] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1769'. [ 257.351617][ T1520] netdevsim netdevsim1 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 257.363267][ T1520] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 257.442393][ T33] netdevsim netdevsim1 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 257.471969][ T33] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 257.526214][T12053] syzkaller1: entered promiscuous mode [ 257.544774][T12053] syzkaller1: entered allmulticast mode [ 257.664564][T12058] FAULT_INJECTION: forcing a failure. [ 257.664564][T12058] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 257.689921][T12058] CPU: 1 UID: 0 PID: 12058 Comm: syz.3.1773 Not tainted syzkaller #0 PREEMPT(full) [ 257.689948][T12058] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 257.689959][T12058] Call Trace: [ 257.689966][T12058] [ 257.689974][T12058] dump_stack_lvl+0xe8/0x150 [ 257.690005][T12058] should_fail_ex+0x412/0x560 [ 257.690035][T12058] _copy_from_user+0x2d/0xb0 [ 257.690055][T12058] bpf_test_init+0xd8/0x150 [ 257.690083][T12058] bpf_prog_test_run_xdp+0x529/0x1160 [ 257.690123][T12058] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 257.690153][T12058] ? __fget_files+0x2a/0x420 [ 257.690180][T12058] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 257.690206][T12058] bpf_prog_test_run+0x2c7/0x340 [ 257.690231][T12058] __sys_bpf+0x643/0x950 [ 257.690253][T12058] ? __pfx___sys_bpf+0x10/0x10 [ 257.690287][T12058] ? ksys_write+0x242/0x270 [ 257.690314][T12058] ? __pfx_ksys_write+0x10/0x10 [ 257.690343][T12058] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 257.690363][T12058] __x64_sys_bpf+0x7c/0x90 [ 257.690382][T12058] do_syscall_64+0x15f/0xf80 [ 257.690403][T12058] ? trace_irq_disable+0x3b/0x140 [ 257.690422][T12058] ? clear_bhb_loop+0x40/0x90 [ 257.690444][T12058] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 257.690462][T12058] RIP: 0033:0x7ff0bc59c819 [ 257.690479][T12058] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 257.690495][T12058] RSP: 002b:00007ff0bd4e6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 257.690515][T12058] RAX: ffffffffffffffda RBX: 00007ff0bc815fa0 RCX: 00007ff0bc59c819 [ 257.690528][T12058] RDX: 0000000000000050 RSI: 0000200000000440 RDI: 000000000000000a [ 257.690540][T12058] RBP: 00007ff0bd4e6090 R08: 0000000000000000 R09: 0000000000000000 [ 257.690551][T12058] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 257.690562][T12058] R13: 00007ff0bc816038 R14: 00007ff0bc815fa0 R15: 00007fff80790c58 [ 257.690592][T12058] [ 257.959490][T12056] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1772'. [ 258.065621][T12056] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1772'. [ 258.130940][ T30] audit: type=1800 audit(1776790944.404:6): pid=12070 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.1777" name="blkio.bfq.time_recursive" dev="tmpfs" ino=1746 res=0 errno=0 [ 258.241532][T12076] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1779'. [ 258.263951][T12074] mac80211_hwsim hwsim7 syzkaller0: entered promiscuous mode [ 258.311828][T12074] mac80211_hwsim hwsim7 syzkaller0: entered allmulticast mode [ 258.363331][T12076] vlan2: entered promiscuous mode [ 258.569668][T12082] 8021q: adding VLAN 0 to HW filter on device bond0 [ 258.630222][T12089] bond0: (slave ip6gretap1): Enslaving as a backup interface with an up link [ 258.671646][ T3507] bond0: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 258.861160][ T3484] bond0: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 258.890443][T12112] A link change request failed with some changes committed already. Interface macsec0 may have been left with an inconsistent configuration, please check. [ 258.968569][T12115] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1791'. [ 259.052527][T12123] FAULT_INJECTION: forcing a failure. [ 259.052527][T12123] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 259.086185][T12123] CPU: 0 UID: 0 PID: 12123 Comm: syz.0.1793 Not tainted syzkaller #0 PREEMPT(full) [ 259.086209][T12123] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 259.086220][T12123] Call Trace: [ 259.086227][T12123] [ 259.086235][T12123] dump_stack_lvl+0xe8/0x150 [ 259.086261][T12123] should_fail_ex+0x412/0x560 [ 259.086286][T12123] _copy_to_user+0x31/0xb0 [ 259.086302][T12123] simple_read_from_buffer+0xe1/0x170 [ 259.086327][T12123] proc_fail_nth_read+0x1bb/0x230 [ 259.086352][T12123] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 259.086372][T12123] ? rw_verify_area+0x2a6/0x4d0 [ 259.086391][T12123] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 259.086412][T12123] vfs_read+0x20c/0xa70 [ 259.086437][T12123] ? __pfx___mutex_lock+0x10/0x10 [ 259.086457][T12123] ? __pfx_vfs_read+0x10/0x10 [ 259.086478][T12123] ? __fget_files+0x2a/0x420 [ 259.086501][T12123] ? __fget_files+0x3a0/0x420 [ 259.086521][T12123] ? __fget_files+0x2a/0x420 [ 259.086546][T12123] ksys_read+0x150/0x270 [ 259.086567][T12123] ? __pfx_ksys_read+0x10/0x10 [ 259.086586][T12123] ? __pfx_sock_ioctl+0x10/0x10 [ 259.086609][T12123] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 259.086625][T12123] do_syscall_64+0x15f/0xf80 [ 259.086642][T12123] ? trace_irq_disable+0x3b/0x140 [ 259.086659][T12123] ? clear_bhb_loop+0x40/0x90 [ 259.086677][T12123] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 259.086693][T12123] RIP: 0033:0x7fa27bf5d04e [ 259.086709][T12123] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 259.086722][T12123] RSP: 002b:00007fa27cea5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 259.086748][T12123] RAX: ffffffffffffffda RBX: 00007fa27cea66c0 RCX: 00007fa27bf5d04e [ 259.086759][T12123] RDX: 000000000000000f RSI: 00007fa27cea60a0 RDI: 0000000000000003 [ 259.086769][T12123] RBP: 00007fa27cea6090 R08: 0000000000000000 R09: 0000000000000000 [ 259.086777][T12123] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 259.086785][T12123] R13: 00007fa27c216038 R14: 00007fa27c215fa0 R15: 00007ffd38b23ef8 [ 259.086809][T12123] [ 259.497383][T12124] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1791'. [ 259.517619][T12139] netlink: 'syz.1.1795': attribute type 39 has an invalid length. [ 259.721500][T12146] syzkaller0: entered promiscuous mode [ 259.739085][T12146] syzkaller0: entered allmulticast mode [ 259.816813][T12154] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1799'. [ 260.848724][T12190] FAULT_INJECTION: forcing a failure. [ 260.848724][T12190] name failslab, interval 1, probability 0, space 0, times 0 [ 260.892114][T12190] CPU: 0 UID: 0 PID: 12190 Comm: syz.3.1804 Not tainted syzkaller #0 PREEMPT(full) [ 260.892140][T12190] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 260.892152][T12190] Call Trace: [ 260.892158][T12190] [ 260.892166][T12190] dump_stack_lvl+0xe8/0x150 [ 260.892197][T12190] should_fail_ex+0x412/0x560 [ 260.892227][T12190] should_failslab+0xa8/0x100 [ 260.892248][T12190] __kvmalloc_node_noprof+0x178/0x8a0 [ 260.892266][T12190] ? bpf_test_run_xdp_live+0x223/0x1cf0 [ 260.892301][T12190] ? __kvmalloc_node_noprof+0x393/0x8a0 [ 260.892322][T12190] bpf_test_run_xdp_live+0x223/0x1cf0 [ 260.892348][T12190] ? arch_stack_walk+0xfb/0x150 [ 260.892379][T12190] ? __pfx_stack_trace_save+0x10/0x10 [ 260.892402][T12190] ? stack_depot_save_flags+0x33/0x810 [ 260.892435][T12190] ? __pfx_bpf_test_run_xdp_live+0x10/0x10 [ 260.892457][T12190] ? bpf_test_init+0x9f/0x150 [ 260.892477][T12190] ? bpf_prog_test_run_xdp+0x529/0x1160 [ 260.892500][T12190] ? bpf_prog_test_run+0x2c7/0x340 [ 260.892519][T12190] ? __sys_bpf+0x643/0x950 [ 260.892535][T12190] ? __x64_sys_bpf+0x7c/0x90 [ 260.892582][T12190] ? __might_fault+0xaf/0x130 [ 260.892606][T12190] ? __might_fault+0xaf/0x130 [ 260.892634][T12190] ? __pfx_xdp_test_run_init_page+0x10/0x10 [ 260.892669][T12190] ? _copy_from_user+0x94/0xb0 [ 260.892687][T12190] ? bpf_test_init+0x113/0x150 [ 260.892709][T12190] ? xdp_convert_md_to_buff+0x5b/0x330 [ 260.892735][T12190] bpf_prog_test_run_xdp+0x81c/0x1160 [ 260.892774][T12190] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 260.892804][T12190] ? __fget_files+0x2a/0x420 [ 260.892831][T12190] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 260.892857][T12190] bpf_prog_test_run+0x2c7/0x340 [ 260.892881][T12190] __sys_bpf+0x643/0x950 [ 260.892903][T12190] ? __pfx___sys_bpf+0x10/0x10 [ 260.892936][T12190] ? ksys_write+0x242/0x270 [ 260.892963][T12190] ? __pfx_ksys_write+0x10/0x10 [ 260.892991][T12190] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 260.893011][T12190] __x64_sys_bpf+0x7c/0x90 [ 260.893029][T12190] do_syscall_64+0x15f/0xf80 [ 260.893050][T12190] ? trace_irq_disable+0x3b/0x140 [ 260.893068][T12190] ? clear_bhb_loop+0x40/0x90 [ 260.893090][T12190] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 260.893108][T12190] RIP: 0033:0x7ff0bc59c819 [ 260.893125][T12190] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 260.893140][T12190] RSP: 002b:00007ff0bd4e6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 260.893160][T12190] RAX: ffffffffffffffda RBX: 00007ff0bc815fa0 RCX: 00007ff0bc59c819 [ 260.893173][T12190] RDX: 0000000000000050 RSI: 0000200000000440 RDI: 000000000000000a [ 260.893185][T12190] RBP: 00007ff0bd4e6090 R08: 0000000000000000 R09: 0000000000000000 [ 260.893196][T12190] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 260.893207][T12190] R13: 00007ff0bc816038 R14: 00007ff0bc815fa0 R15: 00007fff80790c58 [ 260.893236][T12190] [ 261.318492][T12199] x_tables: duplicate underflow at hook 4 [ 261.451912][T12205] __nla_validate_parse: 1 callbacks suppressed [ 261.451932][T12205] netlink: 52 bytes leftover after parsing attributes in process `syz.0.1808'. [ 261.479167][T12205] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1808'. [ 261.544364][T12210] netlink: 1084 bytes leftover after parsing attributes in process `syz.3.1810'. [ 261.614653][T12214] syzkaller0: entered promiscuous mode [ 261.635964][T12214] syzkaller0: entered allmulticast mode [ 261.652868][T12210] syzkaller0: entered promiscuous mode [ 261.658459][T12210] syzkaller0: entered allmulticast mode [ 261.690349][T12210] tc action pedit offset must be on 32 bit boundaries [ 261.698006][T12210] tc action pedit offset must be on 32 bit boundaries [ 261.704847][T12210] tc action pedit offset must be on 32 bit boundaries [ 261.711651][T12210] tc action pedit offset must be on 32 bit boundaries [ 261.718435][T12210] tc action pedit offset must be on 32 bit boundaries [ 261.725253][T12210] tc action pedit offset must be on 32 bit boundaries [ 261.732060][T12210] tc action pedit offset must be on 32 bit boundaries [ 261.738854][T12210] tc action pedit offset must be on 32 bit boundaries [ 261.745684][T12210] tc action pedit offset must be on 32 bit boundaries [ 261.752495][T12210] tc action pedit offset must be on 32 bit boundaries [ 261.759343][T12210] TC_ACT_REPEAT abuse ? [ 261.940981][T12227] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1815'. [ 262.130490][T12241] A link change request failed with some changes committed already. Interface macsec0 may have been left with an inconsistent configuration, please check. [ 262.338721][T12245] FAULT_INJECTION: forcing a failure. [ 262.338721][T12245] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 262.352879][T12245] CPU: 1 UID: 0 PID: 12245 Comm: syz.3.1821 Not tainted syzkaller #0 PREEMPT(full) [ 262.352903][T12245] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 262.352914][T12245] Call Trace: [ 262.352921][T12245] [ 262.352928][T12245] dump_stack_lvl+0xe8/0x150 [ 262.352959][T12245] should_fail_ex+0x412/0x560 [ 262.352988][T12245] _copy_from_user+0x2d/0xb0 [ 262.353007][T12245] ___sys_recvmsg+0x175/0x590 [ 262.353031][T12245] ? __pfx____sys_recvmsg+0x10/0x10 [ 262.353053][T12245] ? __fget_files+0x2a/0x420 [ 262.353104][T12245] do_recvmmsg+0x334/0x800 [ 262.353129][T12245] ? __pfx_do_recvmmsg+0x10/0x10 [ 262.353165][T12245] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 262.353204][T12245] __x64_sys_recvmmsg+0x198/0x250 [ 262.353225][T12245] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 262.353251][T12245] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 262.353271][T12245] do_syscall_64+0x15f/0xf80 [ 262.353292][T12245] ? trace_irq_disable+0x3b/0x140 [ 262.353311][T12245] ? clear_bhb_loop+0x40/0x90 [ 262.353336][T12245] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 262.353354][T12245] RIP: 0033:0x7ff0bc59c819 [ 262.353370][T12245] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 262.353386][T12245] RSP: 002b:00007ff0bd4c5028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 262.353405][T12245] RAX: ffffffffffffffda RBX: 00007ff0bc816090 RCX: 00007ff0bc59c819 [ 262.353418][T12245] RDX: 00000000040001af RSI: 0000200000000a40 RDI: 0000000000000007 [ 262.353430][T12245] RBP: 00007ff0bd4c5090 R08: 0000000000000000 R09: 0000000000000000 [ 262.353441][T12245] R10: 0000000000012122 R11: 0000000000000246 R12: 0000000000000001 [ 262.353453][T12245] R13: 00007ff0bc816128 R14: 00007ff0bc816090 R15: 00007fff80790c58 [ 262.353482][T12245] [ 263.094795][T12248] syzkaller1: entered promiscuous mode [ 263.101245][T12248] syzkaller1: entered allmulticast mode [ 263.115719][T12248] tap0: tun_chr_ioctl cmd 1074025677 [ 263.121294][T12248] tap0: linktype set to 776 [ 263.566574][T12185] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 263.578688][T12212] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1809'. [ 263.686787][T12221] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1809'. [ 263.914412][T12271] netdevsim netdevsim3 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 263.991149][T12274] tipc: Enabling of bearer rejected, already enabled [ 264.040361][T12271] netdevsim netdevsim3 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 264.050354][T12277] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1831'. [ 264.116729][T12288] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1834'. [ 264.158028][T12271] netdevsim netdevsim3 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 264.327466][T12271] netdevsim netdevsim3 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 264.434474][T12298] netlink: 'syz.4.1837': attribute type 18 has an invalid length. [ 264.442823][T12298] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1837'. [ 264.469923][T12298] netlink: 'syz.4.1837': attribute type 18 has an invalid length. [ 264.486497][T12298] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1837'. [ 264.562108][ T3484] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 264.634573][ T57] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 264.797852][ T33] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 264.864101][ T3507] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 265.181985][T12321] xt_CT: No such helper "snmp_trap" [ 266.153225][T12375] netlink: 'syz.3.1862': attribute type 21 has an invalid length. [ 266.177235][T12376] vlan2: entered promiscuous mode [ 266.293105][ T3507] netdevsim netdevsim3 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 266.314632][ T3507] netdevsim netdevsim3 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 266.340912][ T3507] netdevsim netdevsim3 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 266.404832][ T3507] netdevsim netdevsim3 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 266.500786][T12382] syzkaller0: entered promiscuous mode [ 266.562446][T12386] __nla_validate_parse: 14 callbacks suppressed [ 266.562464][T12386] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1867'. [ 266.692679][T12384] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1866'. [ 266.993569][T12396] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1866'. [ 267.228810][T12407] pim6reg99999991: entered allmulticast mode [ 267.251480][T12413] bond2: option mode: unable to set because the bond device has slaves [ 267.251800][T12415] FAULT_INJECTION: forcing a failure. [ 267.251800][T12415] name failslab, interval 1, probability 0, space 0, times 0 [ 267.319292][T12415] CPU: 0 UID: 0 PID: 12415 Comm: syz.4.1877 Not tainted syzkaller #0 PREEMPT(full) [ 267.319315][T12415] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 267.319324][T12415] Call Trace: [ 267.319331][T12415] [ 267.319337][T12415] dump_stack_lvl+0xe8/0x150 [ 267.319365][T12415] should_fail_ex+0x412/0x560 [ 267.319393][T12415] should_failslab+0xa8/0x100 [ 267.319412][T12415] __kvmalloc_node_noprof+0x178/0x8a0 [ 267.319430][T12415] ? page_pool_create_percpu+0x2dd/0xb80 [ 267.319451][T12415] ? page_pool_create_percpu+0xaf/0xb80 [ 267.319474][T12415] page_pool_create_percpu+0x2dd/0xb80 [ 267.319494][T12415] ? __kvmalloc_node_noprof+0x393/0x8a0 [ 267.319516][T12415] bpf_test_run_xdp_live+0x23d/0x1cf0 [ 267.319540][T12415] ? arch_stack_walk+0xfb/0x150 [ 267.319569][T12415] ? __pfx_stack_trace_save+0x10/0x10 [ 267.319601][T12415] ? stack_depot_save_flags+0x33/0x810 [ 267.319631][T12415] ? __pfx_bpf_test_run_xdp_live+0x10/0x10 [ 267.319654][T12415] ? bpf_test_init+0x9f/0x150 [ 267.319673][T12415] ? bpf_prog_test_run_xdp+0x529/0x1160 [ 267.319695][T12415] ? bpf_prog_test_run+0x2c7/0x340 [ 267.319713][T12415] ? __sys_bpf+0x643/0x950 [ 267.319730][T12415] ? __x64_sys_bpf+0x7c/0x90 [ 267.319776][T12415] ? __might_fault+0xaf/0x130 [ 267.319800][T12415] ? __might_fault+0xaf/0x130 [ 267.319825][T12415] ? __pfx_xdp_test_run_init_page+0x10/0x10 [ 267.319859][T12415] ? _copy_from_user+0x94/0xb0 [ 267.319878][T12415] ? bpf_test_init+0x113/0x150 [ 267.319900][T12415] ? xdp_convert_md_to_buff+0x5b/0x330 [ 267.319925][T12415] bpf_prog_test_run_xdp+0x81c/0x1160 [ 267.319962][T12415] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 267.319989][T12415] ? __fget_files+0x2a/0x420 [ 267.320015][T12415] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 267.320041][T12415] bpf_prog_test_run+0x2c7/0x340 [ 267.320065][T12415] __sys_bpf+0x643/0x950 [ 267.320086][T12415] ? __pfx___sys_bpf+0x10/0x10 [ 267.320119][T12415] ? ksys_write+0x242/0x270 [ 267.320145][T12415] ? __pfx_ksys_write+0x10/0x10 [ 267.320173][T12415] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 267.320192][T12415] __x64_sys_bpf+0x7c/0x90 [ 267.320208][T12415] do_syscall_64+0x15f/0xf80 [ 267.320228][T12415] ? trace_irq_disable+0x3b/0x140 [ 267.320247][T12415] ? clear_bhb_loop+0x40/0x90 [ 267.320267][T12415] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 267.320284][T12415] RIP: 0033:0x7fe267d9c819 [ 267.320304][T12415] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 267.320319][T12415] RSP: 002b:00007fe268d14028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 267.320338][T12415] RAX: ffffffffffffffda RBX: 00007fe268015fa0 RCX: 00007fe267d9c819 [ 267.320349][T12415] RDX: 0000000000000050 RSI: 0000200000000440 RDI: 000000000000000a [ 267.320360][T12415] RBP: 00007fe268d14090 R08: 0000000000000000 R09: 0000000000000000 [ 267.320370][T12415] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 267.320380][T12415] R13: 00007fe268016038 R14: 00007fe268015fa0 R15: 00007ffc35e1a658 [ 267.320408][T12415] [ 267.320484][T12415] page_pool_create_percpu() gave up with errno -12 [ 267.325668][T12418] x_tables: ip6_tables: rpfilter match: used from hooks FORWARD, but only valid from PREROUTING [ 267.796845][T12438] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1883'. [ 268.299993][T12444] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1885'. [ 268.397179][T12447] FAULT_INJECTION: forcing a failure. [ 268.397179][T12447] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 268.422403][T12447] CPU: 1 UID: 0 PID: 12447 Comm: syz.2.1884 Not tainted syzkaller #0 PREEMPT(full) [ 268.422429][T12447] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 268.422440][T12447] Call Trace: [ 268.422447][T12447] [ 268.422455][T12447] dump_stack_lvl+0xe8/0x150 [ 268.422485][T12447] should_fail_ex+0x412/0x560 [ 268.422521][T12447] _copy_from_user+0x2d/0xb0 [ 268.422541][T12447] ___sys_recvmsg+0x175/0x590 [ 268.422565][T12447] ? __pfx____sys_recvmsg+0x10/0x10 [ 268.422587][T12447] ? __fget_files+0x2a/0x420 [ 268.422638][T12447] do_recvmmsg+0x334/0x800 [ 268.422663][T12447] ? __pfx_do_recvmmsg+0x10/0x10 [ 268.422692][T12447] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 268.422731][T12447] __x64_sys_recvmmsg+0x198/0x250 [ 268.422751][T12447] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 268.422778][T12447] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 268.422797][T12447] do_syscall_64+0x15f/0xf80 [ 268.422817][T12447] ? trace_irq_disable+0x3b/0x140 [ 268.422836][T12447] ? clear_bhb_loop+0x40/0x90 [ 268.422858][T12447] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 268.422875][T12447] RIP: 0033:0x7f300a79c819 [ 268.422892][T12447] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 268.422905][T12447] RSP: 002b:00007f300b643028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 268.422925][T12447] RAX: ffffffffffffffda RBX: 00007f300aa16090 RCX: 00007f300a79c819 [ 268.422938][T12447] RDX: 00000000040001af RSI: 0000200000000a40 RDI: 0000000000000007 [ 268.422949][T12447] RBP: 00007f300b643090 R08: 0000000000000000 R09: 0000000000000000 [ 268.422960][T12447] R10: 0000000000012122 R11: 0000000000000246 R12: 0000000000000002 [ 268.422971][T12447] R13: 00007f300aa16128 R14: 00007f300aa16090 R15: 00007ffe6c95f598 [ 268.423000][T12447] [ 268.868577][T12458] x_tables: duplicate underflow at hook 4 [ 269.334217][T12474] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1898'. [ 269.387844][T12476] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1899'. [ 269.471979][T12478] xt_CT: No such helper "snmp_trap" [ 269.609480][T12487] warn_alloc: 7 callbacks suppressed [ 269.609497][T12487] syz.3.1902: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 269.649097][T12487] CPU: 0 UID: 0 PID: 12487 Comm: syz.3.1902 Not tainted syzkaller #0 PREEMPT(full) [ 269.649123][T12487] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 269.649136][T12487] Call Trace: [ 269.649144][T12487] [ 269.649152][T12487] dump_stack_lvl+0xe8/0x150 [ 269.649186][T12487] warn_alloc+0x249/0x340 [ 269.649219][T12487] ? stack_trace_save+0xa9/0x100 [ 269.649246][T12487] ? __pfx_warn_alloc+0x10/0x10 [ 269.649282][T12487] ? kasan_save_track+0x4f/0x80 [ 269.649316][T12487] ? kasan_save_track+0x3e/0x80 [ 269.649344][T12487] ? __kasan_kmalloc+0x93/0xb0 [ 269.649360][T12487] ? __kmalloc_cache_noprof+0x31c/0x660 [ 269.649389][T12487] ? xskq_create+0x56/0x170 [ 269.649410][T12487] ? xsk_setsockopt+0x54c/0x990 [ 269.649426][T12487] ? do_sock_setsockopt+0x17c/0x1b0 [ 269.649453][T12487] ? __x64_sys_setsockopt+0x13d/0x1b0 [ 269.649481][T12487] ? do_syscall_64+0x15f/0xf80 [ 269.649509][T12487] __vmalloc_node_range_noprof+0x132/0x1730 [ 269.649569][T12487] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 269.649607][T12487] ? __kasan_kmalloc+0x93/0xb0 [ 269.649632][T12487] vmalloc_user_noprof+0xad/0xe0 [ 269.649661][T12487] ? xskq_create+0xbf/0x170 [ 269.649683][T12487] xskq_create+0xbf/0x170 [ 269.649707][T12487] xsk_init_queue+0x8a/0xe0 [ 269.649730][T12487] xsk_setsockopt+0x54c/0x990 [ 269.649753][T12487] ? __pfx_xsk_setsockopt+0x10/0x10 [ 269.649772][T12487] ? __pfx_aa_sk_perm+0x10/0x10 [ 269.649802][T12487] ? aa_sock_opt_perm+0xff/0x1a0 [ 269.649831][T12487] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 269.649860][T12487] ? __pfx_xsk_setsockopt+0x10/0x10 [ 269.649881][T12487] do_sock_setsockopt+0x17c/0x1b0 [ 269.649915][T12487] __x64_sys_setsockopt+0x13d/0x1b0 [ 269.649946][T12487] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 269.649967][T12487] do_syscall_64+0x15f/0xf80 [ 269.649991][T12487] ? trace_irq_disable+0x3b/0x140 [ 269.650013][T12487] ? clear_bhb_loop+0x40/0x90 [ 269.650038][T12487] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 269.650058][T12487] RIP: 0033:0x7ff0bc59c819 [ 269.650077][T12487] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 269.650095][T12487] RSP: 002b:00007ff0bd4e6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 269.650116][T12487] RAX: ffffffffffffffda RBX: 00007ff0bc815fa0 RCX: 00007ff0bc59c819 [ 269.650131][T12487] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000003 [ 269.650142][T12487] RBP: 00007ff0bc632c91 R08: 0000000000000004 R09: 0000000000000000 [ 269.650154][T12487] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 269.650167][T12487] R13: 00007ff0bc816038 R14: 00007ff0bc815fa0 R15: 00007fff80790c58 [ 269.650200][T12487] [ 269.650221][T12487] Mem-Info: [ 269.933006][T12487] active_anon:7405 inactive_anon:0 isolated_anon:0 [ 269.933006][T12487] active_file:3581 inactive_file:40017 isolated_file:0 [ 269.933006][T12487] unevictable:799 dirty:251 writeback:0 [ 269.933006][T12487] slab_reclaimable:12161 slab_unreclaimable:113941 [ 269.933006][T12487] mapped:29957 shmem:1436 pagetables:1478 [ 269.933006][T12487] sec_pagetables:0 bounce:0 [ 269.933006][T12487] kernel_misc_reclaimable:0 [ 269.933006][T12487] free:1308187 free_pcp:9964 free_cma:0 [ 269.980799][T12487] Node 0 active_anon:29720kB inactive_anon:0kB active_file:14324kB inactive_file:159864kB unevictable:1660kB isolated(anon):0kB isolated(file):0kB mapped:119828kB dirty:1004kB writeback:0kB shmem:4208kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:14208kB pagetables:5784kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 270.029385][T12487] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:96kB pagetables:128kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 270.075359][T12487] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 270.126373][T12487] lowmem_reserve[]: 0 2491 2492 2492 2492 [ 270.138264][T12502] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1906'. [ 270.140366][T12487] Node 0 DMA32 free:1268368kB boost:0kB min:34184kB low:42728kB high:51272kB reserved_highatomic:0KB free_highatomic:0KB active_anon:31936kB inactive_anon:0kB active_file:14324kB inactive_file:159864kB unevictable:3928kB writepending:1028kB zspages:0kB present:3129332kB managed:2551528kB mlocked:2412kB bounce:0kB free_pcp:37028kB local_pcp:17172kB free_cma:0kB [ 270.171603][T12502] netlink: 'syz.4.1906': attribute type 7 has an invalid length. [ 270.197137][T12502] netlink: 'syz.4.1906': attribute type 8 has an invalid length. [ 270.205595][T12502] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1906'. [ 270.215407][T12487] lowmem_reserve[]: 0 0 0 0 0 [ 270.232609][T12487] Node 0 Normal free:0kB boost:0kB min:8kB low:8kB high:8kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:612kB mlocked:0kB bounce:0kB free_pcp:4kB local_pcp:4kB free_cma:0kB [ 270.307791][T12487] lowmem_reserve[]: 0 0 0 0 0 [ 270.334060][T12487] Node 1 Normal free:3949040kB boost:0kB min:55708kB low:69632kB high:83556kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB writepending:0kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:1004kB local_pcp:0kB free_cma:0kB [ 270.420776][T12487] lowmem_reserve[]: 0 0 0 0 0 [ 270.448208][T12487] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 270.468463][T12506] syzkaller0: entered promiscuous mode [ 270.488038][T12506] syzkaller0: entered allmulticast mode [ 270.498177][T12487] Node 0 DMA32: 5418*4kB (UM) 3855*8kB (UM) 1517*16kB (UME) 330*32kB (UM) 360*64kB (UME) 354*128kB (UME) 364*256kB (UME) 195*512kB (UME) 128*1024kB (U) 84*2048kB (UME) 149*4096kB (UM) = 1262128kB [ 270.514306][T12511] netlink: 5 bytes leftover after parsing attributes in process `syz.2.1910'. [ 270.553837][T12487] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 270.592432][T12487] Node 1 Normal: 0*4kB 2*8kB (UM) 2*16kB (UM) 2*32kB (UM) 2*64kB (UM) 6*128kB (UM) 2*256kB (M) 4*512kB (UM) 1*1024kB (M) 2*2048kB (U) 962*4096kB (M) = 3949040kB [ 270.637628][T12487] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 270.657613][T12487] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 270.678885][T12487] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 270.698742][T12487] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 270.718117][T12487] 45622 total pagecache pages [ 270.728147][T12487] 0 pages in swap cache [ 270.736991][T12487] Free swap = 124996kB [ 270.746031][T12487] Total swap = 124996kB [ 270.755315][T12487] 2097051 pages RAM [ 270.767422][T12487] 0 pages HighMem/MovableOnly [ 270.779922][T12487] 427401 pages reserved [ 270.791468][T12487] 0 pages cma reserved [ 271.015712][T12520] x_tables: duplicate underflow at hook 4 [ 272.900379][T12543] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 272.917118][T12546] workqueue: Failed to create a rescuer kthread for wq "bond6": -EINTR [ 273.044692][T12549] __nla_validate_parse: 1 callbacks suppressed [ 273.044710][T12549] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1919'. [ 273.163002][T12555] A link change request failed with some changes committed already. Interface macsec0 may have been left with an inconsistent configuration, please check. [ 273.169649][T12558] netlink: 'syz.2.1922': attribute type 10 has an invalid length. [ 273.266729][T12552] xt_CT: No such helper "snmp_trap" [ 273.313000][T12561] sch_tbf: burst 0 is lower than device tunl0 mtu (129) ! [ 273.394803][T12566] x_tables: ip6_tables: rpfilter match: used from hooks FORWARD, but only valid from PREROUTING [ 273.516636][T12574] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 273.606162][T12572] syzkaller0: entered promiscuous mode [ 273.611915][T12572] syzkaller0: entered allmulticast mode [ 273.887736][T12591] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1933'. [ 275.394979][T12594] bond0: option mode: unable to set because the bond device has slaves [ 275.658248][T12610] netlink: 132 bytes leftover after parsing attributes in process `syz.1.1940'. [ 275.681339][T12612] A link change request failed with some changes committed already. Interface macsec0 may have been left with an inconsistent configuration, please check. [ 275.849094][T12618] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1945'. [ 275.940605][T12622] xt_CT: No such helper "snmp_trap" [ 276.091253][T12625] syzkaller0: entered promiscuous mode [ 276.096902][T12625] syzkaller0: entered allmulticast mode [ 276.185655][T12637] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1949'. [ 277.897437][T12644] sch_tbf: burst 0 is lower than device tunl0 mtu (129) ! [ 277.916947][T12649] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1956'. [ 277.932313][T12649] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1956'. [ 278.052058][T12653] FAULT_INJECTION: forcing a failure. [ 278.052058][T12653] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 278.112701][T12661] x_tables: duplicate underflow at hook 4 [ 278.121092][T12653] CPU: 1 UID: 0 PID: 12653 Comm: syz.1.1954 Not tainted syzkaller #0 PREEMPT(full) [ 278.121113][T12653] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 278.121124][T12653] Call Trace: [ 278.121131][T12653] [ 278.121139][T12653] dump_stack_lvl+0xe8/0x150 [ 278.121168][T12653] should_fail_ex+0x412/0x560 [ 278.121198][T12653] _copy_from_user+0x2d/0xb0 [ 278.121216][T12653] ___sys_recvmsg+0x175/0x590 [ 278.121240][T12653] ? __pfx____sys_recvmsg+0x10/0x10 [ 278.121262][T12653] ? __fget_files+0x2a/0x420 [ 278.121308][T12653] do_recvmmsg+0x334/0x800 [ 278.121333][T12653] ? __pfx_do_recvmmsg+0x10/0x10 [ 278.121361][T12653] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 278.121397][T12653] __x64_sys_recvmmsg+0x198/0x250 [ 278.121418][T12653] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 278.121444][T12653] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 278.121463][T12653] do_syscall_64+0x15f/0xf80 [ 278.121483][T12653] ? trace_irq_disable+0x3b/0x140 [ 278.121502][T12653] ? clear_bhb_loop+0x40/0x90 [ 278.121524][T12653] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 278.121542][T12653] RIP: 0033:0x7f4caf59c819 [ 278.121559][T12653] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 278.121574][T12653] RSP: 002b:00007f4cb04a8028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 278.121593][T12653] RAX: ffffffffffffffda RBX: 00007f4caf816090 RCX: 00007f4caf59c819 [ 278.121605][T12653] RDX: 00000000040001af RSI: 0000200000000a40 RDI: 0000000000000007 [ 278.121616][T12653] RBP: 00007f4cb04a8090 R08: 0000000000000000 R09: 0000000000000000 [ 278.121627][T12653] R10: 0000000000012122 R11: 0000000000000246 R12: 0000000000000002 [ 278.121645][T12653] R13: 00007f4caf816128 R14: 00007f4caf816090 R15: 00007ffcbf8d46d8 [ 278.121674][T12653] [ 278.339565][T12666] syzkaller0: entered promiscuous mode [ 278.341368][T12667] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1961'. [ 278.438368][T12670] syzkaller0: entered promiscuous mode [ 278.444435][T12670] syzkaller0: entered allmulticast mode [ 278.617971][T12677] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1966'. [ 278.772231][T12682] tipc: Enabling of bearer rejected, already enabled [ 278.967526][T12697] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1974'. [ 279.208135][T12700] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1975'. [ 279.280772][T12703] x_tables: ip6_tables: rpfilter match: used from hooks FORWARD, but only valid from PREROUTING [ 279.408303][T12709] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1978'. [ 279.499191][T12711] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1980'. [ 279.635329][T12719] sch_tbf: burst 0 is lower than device tunl0 mtu (129) ! [ 279.647239][T12711] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1980'. [ 279.987246][T12730] syzkaller0: entered promiscuous mode [ 280.006623][T12730] syzkaller0: entered allmulticast mode [ 280.028245][T12727] sock: sock_set_timeout: `syz.3.1985' (pid 12727) tries to set negative timeout [ 280.099571][T12730] syzkaller1: entered promiscuous mode [ 280.117018][T12730] syzkaller1: entered allmulticast mode [ 280.632072][T12770] x_tables: duplicate underflow at hook 4 [ 280.845823][T12779] FAULT_INJECTION: forcing a failure. [ 280.845823][T12779] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 280.859628][T12779] CPU: 0 UID: 0 PID: 12779 Comm: syz.2.1998 Not tainted syzkaller #0 PREEMPT(full) [ 280.859656][T12779] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 280.859667][T12779] Call Trace: [ 280.859674][T12779] [ 280.859680][T12779] dump_stack_lvl+0xe8/0x150 [ 280.859701][T12779] should_fail_ex+0x412/0x560 [ 280.859718][T12779] _copy_from_user+0x2d/0xb0 [ 280.859730][T12779] ___sys_recvmsg+0x175/0x590 [ 280.859743][T12779] ? __pfx____sys_recvmsg+0x10/0x10 [ 280.859755][T12779] ? __fget_files+0x2a/0x420 [ 280.859782][T12779] do_recvmmsg+0x334/0x800 [ 280.859795][T12779] ? __pfx_do_recvmmsg+0x10/0x10 [ 280.859810][T12779] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 280.859832][T12779] __x64_sys_recvmmsg+0x198/0x250 [ 280.859843][T12779] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 280.859857][T12779] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 280.859868][T12779] do_syscall_64+0x15f/0xf80 [ 280.859880][T12779] ? trace_irq_disable+0x3b/0x140 [ 280.859891][T12779] ? clear_bhb_loop+0x40/0x90 [ 280.859903][T12779] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 280.859912][T12779] RIP: 0033:0x7f300a79c819 [ 280.859923][T12779] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 280.859932][T12779] RSP: 002b:00007f300b643028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 280.859944][T12779] RAX: ffffffffffffffda RBX: 00007f300aa16090 RCX: 00007f300a79c819 [ 280.859952][T12779] RDX: 00000000040001af RSI: 0000200000000a40 RDI: 0000000000000007 [ 280.859958][T12779] RBP: 00007f300b643090 R08: 0000000000000000 R09: 0000000000000000 [ 280.859964][T12779] R10: 0000000000012122 R11: 0000000000000246 R12: 0000000000000002 [ 280.859970][T12779] R13: 00007f300aa16128 R14: 00007f300aa16090 R15: 00007ffe6c95f598 [ 280.859985][T12779] [ 281.618435][T12783] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2000'. [ 283.238439][T12750] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 283.270063][T12766] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1994'. [ 283.371157][T12790] FAULT_INJECTION: forcing a failure. [ 283.371157][T12790] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 283.393216][T12790] CPU: 0 UID: 0 PID: 12790 Comm: syz.2.2003 Not tainted syzkaller #0 PREEMPT(full) [ 283.393238][T12790] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 283.393249][T12790] Call Trace: [ 283.393257][T12790] [ 283.393264][T12790] dump_stack_lvl+0xe8/0x150 [ 283.393295][T12790] should_fail_ex+0x412/0x560 [ 283.393324][T12790] _copy_to_user+0x31/0xb0 [ 283.393344][T12790] simple_read_from_buffer+0xe1/0x170 [ 283.393371][T12790] proc_fail_nth_read+0x1bb/0x230 [ 283.393398][T12790] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 283.393424][T12790] ? rw_verify_area+0x2a6/0x4d0 [ 283.393447][T12790] ? __fget_files+0x2a/0x420 [ 283.393466][T12790] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 283.393490][T12790] vfs_read+0x20c/0xa70 [ 283.393520][T12790] ? __pfx___mutex_lock+0x10/0x10 [ 283.393543][T12790] ? __pfx_vfs_read+0x10/0x10 [ 283.393568][T12790] ? __fget_files+0x2a/0x420 [ 283.393592][T12790] ? __fget_files+0x3a0/0x420 [ 283.393611][T12790] ? __fget_files+0x2a/0x420 [ 283.393640][T12790] ksys_read+0x150/0x270 [ 283.393666][T12790] ? __pfx_ksys_read+0x10/0x10 [ 283.393703][T12790] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 283.393722][T12790] do_syscall_64+0x15f/0xf80 [ 283.393741][T12790] ? trace_irq_disable+0x3b/0x140 [ 283.393760][T12790] ? clear_bhb_loop+0x40/0x90 [ 283.393783][T12790] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 283.393800][T12790] RIP: 0033:0x7f300a75d04e [ 283.393817][T12790] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 283.393832][T12790] RSP: 002b:00007f300b663fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 283.393851][T12790] RAX: ffffffffffffffda RBX: 00007f300b6646c0 RCX: 00007f300a75d04e [ 283.393864][T12790] RDX: 000000000000000f RSI: 00007f300b6640a0 RDI: 0000000000000005 [ 283.393875][T12790] RBP: 00007f300b664090 R08: 0000000000000000 R09: 0000000000000000 [ 283.393885][T12790] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 283.393896][T12790] R13: 00007f300aa16038 R14: 00007f300aa15fa0 R15: 00007ffe6c95f598 [ 283.393926][T12790] [ 283.626090][T12798] syzkaller0: entered promiscuous mode [ 283.674088][T12773] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1994'. [ 283.833310][T12807] x_tables: ip6_tables: rpfilter match: used from hooks FORWARD, but only valid from PREROUTING [ 284.000050][T12814] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2010'. [ 284.044760][T12814] vlan4: entered promiscuous mode [ 284.391744][T12827] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2017'. [ 284.520169][T12832] x_tables: duplicate underflow at hook 4 [ 284.597596][T12827] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2017'. [ 284.759255][T12844] sctp: [Deprecated]: syz.0.2022 (pid 12844) Use of int in max_burst socket option deprecated. [ 284.759255][T12844] Use struct sctp_assoc_value instead [ 284.770393][T12842] IPVS: Error connecting to the multicast addr [ 284.876435][T12846] syzkaller0: entered promiscuous mode [ 284.882112][T12846] syzkaller0: entered allmulticast mode [ 285.103261][T12856] bond0: option mode: unable to set because the bond device has slaves [ 286.041304][T12895] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2045'. [ 286.063701][T12896] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2035'. [ 286.072646][T12896] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2035'. [ 287.054411][T12897] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2045'. [ 287.129945][T12902] sch_tbf: burst 0 is lower than device tunl0 mtu (1480) ! [ 287.261217][T12908] sch_tbf: burst 0 is lower than device tunl0 mtu (1480) ! [ 287.276622][T12911] netlink: 32 bytes leftover after parsing attributes in process `syz.0.2042'. [ 287.575404][T12926] syz.1.2049: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 287.632621][T12926] CPU: 0 UID: 0 PID: 12926 Comm: syz.1.2049 Not tainted syzkaller #0 PREEMPT(full) [ 287.632648][T12926] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 287.632661][T12926] Call Trace: [ 287.632668][T12926] [ 287.632677][T12926] dump_stack_lvl+0xe8/0x150 [ 287.632712][T12926] warn_alloc+0x249/0x340 [ 287.632744][T12926] ? stack_trace_save+0xa9/0x100 [ 287.632770][T12926] ? __pfx_warn_alloc+0x10/0x10 [ 287.632807][T12926] ? kasan_save_track+0x4f/0x80 [ 287.632835][T12926] ? kasan_save_track+0x3e/0x80 [ 287.632862][T12926] ? __kasan_kmalloc+0x93/0xb0 [ 287.632879][T12926] ? __kmalloc_cache_noprof+0x31c/0x660 [ 287.632907][T12926] ? xskq_create+0x56/0x170 [ 287.632927][T12926] ? xsk_setsockopt+0x54c/0x990 [ 287.632944][T12926] ? do_sock_setsockopt+0x17c/0x1b0 [ 287.632972][T12926] ? __x64_sys_setsockopt+0x13d/0x1b0 [ 287.632998][T12926] ? do_syscall_64+0x15f/0xf80 [ 287.633027][T12926] __vmalloc_node_range_noprof+0x132/0x1730 [ 287.633089][T12926] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 287.633126][T12926] ? __kasan_kmalloc+0x93/0xb0 [ 287.633151][T12926] vmalloc_user_noprof+0xad/0xe0 [ 287.633180][T12926] ? xskq_create+0xbf/0x170 [ 287.633202][T12926] xskq_create+0xbf/0x170 [ 287.633227][T12926] xsk_init_queue+0x8a/0xe0 [ 287.633250][T12926] xsk_setsockopt+0x54c/0x990 [ 287.633272][T12926] ? __pfx_xsk_setsockopt+0x10/0x10 [ 287.633291][T12926] ? __pfx_aa_sk_perm+0x10/0x10 [ 287.633319][T12926] ? aa_sock_opt_perm+0xff/0x1a0 [ 287.633348][T12926] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 287.633378][T12926] ? __pfx_xsk_setsockopt+0x10/0x10 [ 287.633396][T12926] do_sock_setsockopt+0x17c/0x1b0 [ 287.633431][T12926] __x64_sys_setsockopt+0x13d/0x1b0 [ 287.633463][T12926] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 287.633485][T12926] do_syscall_64+0x15f/0xf80 [ 287.633509][T12926] ? trace_irq_disable+0x3b/0x140 [ 287.633531][T12926] ? clear_bhb_loop+0x40/0x90 [ 287.633557][T12926] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 287.633577][T12926] RIP: 0033:0x7f4caf59c819 [ 287.633606][T12926] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 287.633624][T12926] RSP: 002b:00007f4cb04c9028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 287.633646][T12926] RAX: ffffffffffffffda RBX: 00007f4caf815fa0 RCX: 00007f4caf59c819 [ 287.633662][T12926] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000003 [ 287.633675][T12926] RBP: 00007f4caf632c91 R08: 0000000000000004 R09: 0000000000000000 [ 287.633688][T12926] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 287.633702][T12926] R13: 00007f4caf816038 R14: 00007f4caf815fa0 R15: 00007ffcbf8d46d8 [ 287.633735][T12926] [ 287.633755][T12926] Mem-Info: [ 287.937731][T12926] active_anon:10199 inactive_anon:0 isolated_anon:0 [ 287.937731][T12926] active_file:3581 inactive_file:40023 isolated_file:0 [ 287.937731][T12926] unevictable:768 dirty:263 writeback:0 [ 287.937731][T12926] slab_reclaimable:12479 slab_unreclaimable:117771 [ 287.937731][T12926] mapped:34819 shmem:4223 pagetables:1477 [ 287.937731][T12926] sec_pagetables:0 bounce:0 [ 287.937731][T12926] kernel_misc_reclaimable:0 [ 287.937731][T12926] free:1303931 free_pcp:7695 free_cma:0 [ 287.983902][T12926] Node 0 active_anon:40896kB inactive_anon:0kB active_file:14324kB inactive_file:159888kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:143576kB dirty:1052kB writeback:0kB shmem:15356kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:14472kB pagetables:5780kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 288.047396][T12926] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:96kB pagetables:128kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 288.082071][T12926] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 288.116360][T12926] lowmem_reserve[]: 0 2491 2492 2492 2492 [ 288.122551][T12926] Node 0 DMA32 free:1250248kB boost:0kB min:34184kB low:42728kB high:51272kB reserved_highatomic:0KB free_highatomic:0KB active_anon:40944kB inactive_anon:0kB active_file:14324kB inactive_file:159888kB unevictable:1536kB writepending:1056kB zspages:0kB present:3129332kB managed:2551528kB mlocked:0kB bounce:0kB free_pcp:31592kB local_pcp:11916kB free_cma:0kB [ 288.190924][T12926] lowmem_reserve[]: 0 0 0 0 0 [ 288.195871][T12926] Node 0 Normal free:0kB boost:0kB min:8kB low:8kB high:8kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:612kB mlocked:0kB bounce:0kB free_pcp:4kB local_pcp:0kB free_cma:0kB [ 288.225763][T12926] lowmem_reserve[]: 0 0 0 0 0 [ 288.235130][T12926] Node 1 Normal free:3950044kB boost:0kB min:55708kB low:69632kB high:83556kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB writepending:0kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 288.267313][T12926] lowmem_reserve[]: 0 0 0 0 0 [ 288.272560][T12926] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 288.285739][T12926] Node 0 DMA32: 5524*4kB (U) 3419*8kB (U) 1720*16kB (UME) 271*32kB (UME) 362*64kB (UM) 396*128kB (UME) 402*256kB (UME) 201*512kB (UM) 144*1024kB (U) 98*2048kB (UME) 131*4096kB (UM) = 1250056kB [ 288.305960][T12926] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 288.317901][T12926] Node 1 Normal: 1*4kB (U) 7*8kB (UM) 12*16kB (UM) 7*32kB (UM) 8*64kB (UM) 8*128kB (UM) 2*256kB (M) 4*512kB (UM) 1*1024kB (M) 2*2048kB (U) 962*4096kB (M) = 3950044kB [ 288.335204][T12926] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 288.348227][T12926] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 288.376287][T12926] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 288.399432][T12926] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 288.420210][T12926] 49843 total pagecache pages [ 288.430542][T12926] 0 pages in swap cache [ 288.440443][T12926] Free swap = 124996kB [ 288.455385][T12926] Total swap = 124996kB [ 288.469025][T12926] 2097051 pages RAM [ 288.472915][T12926] 0 pages HighMem/MovableOnly [ 288.483047][T12926] 427401 pages reserved [ 288.494331][T12926] 0 pages cma reserved [ 288.646715][T12959] sch_tbf: burst 0 is lower than device tunl0 mtu (129) ! [ 288.883973][T12971] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2061'. [ 290.014834][T13004] x_tables: ip6_tables: rpfilter match: used from hooks FORWARD, but only valid from PREROUTING [ 290.620290][T12942] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 290.878711][T13042] syzkaller1: entered promiscuous mode [ 290.900981][T13042] syzkaller1: entered allmulticast mode [ 291.013802][T13047] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2085'. [ 291.084319][T13049] x_tables: duplicate underflow at hook 4 [ 291.167604][T13053] syzkaller0: entered promiscuous mode [ 291.173900][T13053] syzkaller0: entered allmulticast mode [ 291.319621][T13057] netlink: 'syz.1.2090': attribute type 1 has an invalid length. [ 291.327721][T13057] netlink: 224 bytes leftover after parsing attributes in process `syz.1.2090'. [ 291.372443][T13057] xt_CT: You must specify a L4 protocol and not use inversions on it [ 291.441947][T13057] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input14 [ 291.653598][T13065] tipc: Enabling of bearer rejected, failed to enable media [ 291.950695][T13085] netlink: 'syz.3.2101': attribute type 1 has an invalid length. [ 291.968029][T13085] netlink: 224 bytes leftover after parsing attributes in process `syz.3.2101'. [ 291.988845][T13080] FAULT_INJECTION: forcing a failure. [ 291.988845][T13080] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 292.009888][T13085] NCSI netlink: No device for ifindex 0 [ 292.045791][T13080] CPU: 0 UID: 0 PID: 13080 Comm: syz.4.2097 Not tainted syzkaller #0 PREEMPT(full) [ 292.045813][T13080] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 292.045823][T13080] Call Trace: [ 292.045830][T13080] [ 292.045836][T13080] dump_stack_lvl+0xe8/0x150 [ 292.045876][T13080] should_fail_ex+0x412/0x560 [ 292.045904][T13080] _copy_from_user+0x2d/0xb0 [ 292.045924][T13080] ___sys_recvmsg+0x175/0x590 [ 292.045947][T13080] ? __pfx____sys_recvmsg+0x10/0x10 [ 292.045969][T13080] ? __fget_files+0x2a/0x420 [ 292.046017][T13080] do_recvmmsg+0x334/0x800 [ 292.046043][T13080] ? __pfx_do_recvmmsg+0x10/0x10 [ 292.046071][T13080] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 292.046109][T13080] __x64_sys_recvmmsg+0x198/0x250 [ 292.046128][T13080] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 292.046153][T13080] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 292.046172][T13080] do_syscall_64+0x15f/0xf80 [ 292.046192][T13080] ? trace_irq_disable+0x3b/0x140 [ 292.046214][T13080] ? clear_bhb_loop+0x40/0x90 [ 292.046234][T13080] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 292.046251][T13080] RIP: 0033:0x7fe267d9c819 [ 292.046268][T13080] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 292.046281][T13080] RSP: 002b:00007fe268cf3028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 292.046300][T13080] RAX: ffffffffffffffda RBX: 00007fe268016090 RCX: 00007fe267d9c819 [ 292.046313][T13080] RDX: 00000000040001af RSI: 0000200000000a40 RDI: 0000000000000007 [ 292.046324][T13080] RBP: 00007fe268cf3090 R08: 0000000000000000 R09: 0000000000000000 [ 292.046334][T13080] R10: 0000000000012122 R11: 0000000000000246 R12: 0000000000000002 [ 292.046345][T13080] R13: 00007fe268016128 R14: 00007fe268016090 R15: 00007ffc35e1a658 [ 292.046371][T13080] [ 292.353147][T13099] netlink: 'syz.2.2105': attribute type 1 has an invalid length. [ 292.373365][T13099] netlink: 224 bytes leftover after parsing attributes in process `syz.2.2105'. [ 292.484440][T13103] tipc: Enabling of bearer rejected, failed to enable media [ 292.500972][T13099] xt_CT: You must specify a L4 protocol and not use inversions on it [ 292.544161][T13099] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input15 [ 292.609344][ T8765] udevd[8765]: setting owner of /dev/input/mouse1 to uid=0, gid=104 failed: No such file or directory [ 292.862374][T13119] syzkaller1: entered promiscuous mode [ 292.871035][T13119] syzkaller1: entered allmulticast mode [ 292.891802][T13121] x_tables: duplicate underflow at hook 4 [ 292.959221][T13125] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2116'. [ 293.237194][T13140] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2120'. [ 293.822715][T13167] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable [ 293.881425][T13167] netlink: 'syz.3.2131': attribute type 39 has an invalid length. [ 294.017566][T13180] x_tables: ip6_tables: rpfilter match: used from hooks FORWARD, but only valid from PREROUTING [ 294.070067][T13175] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2131'. [ 294.530170][T13200] x_tables: duplicate underflow at hook 4 [ 294.582526][T13204] IPv6: NLM_F_CREATE should be specified when creating new route [ 294.735631][T13206] syzkaller1: entered promiscuous mode [ 294.752991][T13206] syzkaller1: entered allmulticast mode [ 294.786059][T13213] x_tables: ip_tables: CT.2 target: invalid size 72 (kernel) != (user) 0 [ 294.806723][T13215] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2149'. [ 294.836724][T13218] syzkaller0: entered promiscuous mode [ 294.859118][T13215] vlan2: entered promiscuous mode [ 294.995247][T13223] sch_tbf: burst 0 is lower than device tunl0 mtu (1480) ! [ 295.175285][T13233] FAULT_INJECTION: forcing a failure. [ 295.175285][T13233] name failslab, interval 1, probability 0, space 0, times 0 [ 295.211631][T13233] CPU: 1 UID: 0 PID: 13233 Comm: syz.1.2156 Not tainted syzkaller #0 PREEMPT(full) [ 295.211654][T13233] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 295.211666][T13233] Call Trace: [ 295.211673][T13233] [ 295.211681][T13233] dump_stack_lvl+0xe8/0x150 [ 295.211710][T13233] should_fail_ex+0x412/0x560 [ 295.211737][T13233] should_failslab+0xa8/0x100 [ 295.211762][T13233] __kmalloc_noprof+0xe8/0x760 [ 295.211788][T13233] ? bpf_test_init+0x9f/0x150 [ 295.211815][T13233] bpf_test_init+0x9f/0x150 [ 295.211843][T13233] bpf_prog_test_run_xdp+0x529/0x1160 [ 295.211883][T13233] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 295.211912][T13233] ? __fget_files+0x2a/0x420 [ 295.211939][T13233] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 295.211964][T13233] bpf_prog_test_run+0x2c7/0x340 [ 295.211988][T13233] __sys_bpf+0x643/0x950 [ 295.212010][T13233] ? __pfx___sys_bpf+0x10/0x10 [ 295.212044][T13233] ? ksys_write+0x242/0x270 [ 295.212070][T13233] ? __pfx_ksys_write+0x10/0x10 [ 295.212098][T13233] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 295.212118][T13233] __x64_sys_bpf+0x7c/0x90 [ 295.212136][T13233] do_syscall_64+0x15f/0xf80 [ 295.212157][T13233] ? trace_irq_disable+0x3b/0x140 [ 295.212175][T13233] ? clear_bhb_loop+0x40/0x90 [ 295.212197][T13233] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 295.212214][T13233] RIP: 0033:0x7f4caf59c819 [ 295.212231][T13233] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 295.212246][T13233] RSP: 002b:00007f4cb04c9028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 295.212266][T13233] RAX: ffffffffffffffda RBX: 00007f4caf815fa0 RCX: 00007f4caf59c819 [ 295.212279][T13233] RDX: 0000000000000050 RSI: 0000200000000000 RDI: 000000000000000a [ 295.212291][T13233] RBP: 00007f4cb04c9090 R08: 0000000000000000 R09: 0000000000000000 [ 295.212302][T13233] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 295.212312][T13233] R13: 00007f4caf816038 R14: 00007f4caf815fa0 R15: 00007ffcbf8d46d8 [ 295.212341][T13233] [ 295.241964][T13234] syzkaller1: entered promiscuous mode [ 295.466689][T13234] syzkaller1: entered allmulticast mode [ 295.478899][T13247] FAULT_INJECTION: forcing a failure. [ 295.478899][T13247] name failslab, interval 1, probability 0, space 0, times 0 [ 295.497441][T13247] CPU: 1 UID: 0 PID: 13247 Comm: syz.4.2162 Not tainted syzkaller #0 PREEMPT(full) [ 295.497486][T13247] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 295.497497][T13247] Call Trace: [ 295.497505][T13247] [ 295.497512][T13247] dump_stack_lvl+0xe8/0x150 [ 295.497541][T13247] should_fail_ex+0x412/0x560 [ 295.497570][T13247] should_failslab+0xa8/0x100 [ 295.497592][T13247] __kmalloc_noprof+0xe8/0x760 [ 295.497617][T13247] ? tomoyo_encode+0x28b/0x550 [ 295.497646][T13247] tomoyo_encode+0x28b/0x550 [ 295.497676][T13247] tomoyo_realpath_from_path+0x58d/0x5d0 [ 295.497701][T13247] ? tomoyo_domain+0xd7/0x130 [ 295.497729][T13247] ? tomoyo_path_number_perm+0x219/0x630 [ 295.497749][T13247] tomoyo_path_number_perm+0x246/0x630 [ 295.497770][T13247] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 295.497788][T13247] ? __lock_acquire+0x6b5/0x2cf0 [ 295.497823][T13247] ? __mutex_unlock_slowpath+0x1be/0x6f0 [ 295.497865][T13247] ? __fget_files+0x2a/0x420 [ 295.497889][T13247] ? __fget_files+0x2a/0x420 [ 295.497908][T13247] ? __fget_files+0x3a0/0x420 [ 295.497928][T13247] ? __fget_files+0x2a/0x420 [ 295.497951][T13247] security_file_ioctl+0xc3/0x2a0 [ 295.497972][T13247] __se_sys_ioctl+0x47/0x170 [ 295.497988][T13247] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 295.498008][T13247] do_syscall_64+0x15f/0xf80 [ 295.498028][T13247] ? trace_irq_disable+0x3b/0x140 [ 295.498047][T13247] ? clear_bhb_loop+0x40/0x90 [ 295.498069][T13247] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 295.498085][T13247] RIP: 0033:0x7fe267d9c819 [ 295.498102][T13247] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 295.498117][T13247] RSP: 002b:00007fe268d14028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 295.498137][T13247] RAX: ffffffffffffffda RBX: 00007fe268015fa0 RCX: 00007fe267d9c819 [ 295.498150][T13247] RDX: 00002000000003c0 RSI: 000000000000890c RDI: 0000000000000004 [ 295.498162][T13247] RBP: 00007fe268d14090 R08: 0000000000000000 R09: 0000000000000000 [ 295.498172][T13247] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 295.498183][T13247] R13: 00007fe268016038 R14: 00007fe268015fa0 R15: 00007ffc35e1a658 [ 295.498214][T13247] [ 295.498517][T13247] ERROR: Out of memory at tomoyo_realpath_from_path. [ 295.857280][T13252] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2163'. [ 296.144930][T13273] netlink: 'syz.2.2169': attribute type 61 has an invalid length. [ 296.207435][T13276] netlink: 68 bytes leftover after parsing attributes in process `syz.3.2170'. [ 296.330366][T13278] syzkaller0: entered promiscuous mode [ 296.335988][T13278] syzkaller0: entered allmulticast mode [ 297.191611][T13291] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2174'. [ 297.205478][T13291] vlan2: entered promiscuous mode [ 298.888228][T13266] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 298.898914][T13271] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2168'. [ 298.980335][T13274] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2168'. [ 298.996364][T13292] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2184'. [ 299.080315][T13295] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2184'. [ 299.145515][T13304] mac80211_hwsim hwsim7 syzkaller0: left allmulticast mode [ 299.237914][T13306] syzkaller1: entered promiscuous mode [ 299.250349][T13306] syzkaller1: entered allmulticast mode [ 299.312372][T13312] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2182'. [ 299.319667][T13315] syz.4.2183: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 299.348518][T13315] CPU: 0 UID: 0 PID: 13315 Comm: syz.4.2183 Not tainted syzkaller #0 PREEMPT(full) [ 299.348545][T13315] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 299.348558][T13315] Call Trace: [ 299.348567][T13315] [ 299.348576][T13315] dump_stack_lvl+0xe8/0x150 [ 299.348611][T13315] warn_alloc+0x249/0x340 [ 299.348644][T13315] ? stack_trace_save+0xa9/0x100 [ 299.348672][T13315] ? __pfx_warn_alloc+0x10/0x10 [ 299.348710][T13315] ? kasan_save_track+0x4f/0x80 [ 299.348737][T13315] ? kasan_save_track+0x3e/0x80 [ 299.348763][T13315] ? __kasan_kmalloc+0x93/0xb0 [ 299.348780][T13315] ? __kmalloc_cache_noprof+0x31c/0x660 [ 299.348812][T13315] ? xskq_create+0x56/0x170 [ 299.348832][T13315] ? xsk_setsockopt+0x54c/0x990 [ 299.348850][T13315] ? do_sock_setsockopt+0x17c/0x1b0 [ 299.348877][T13315] ? __x64_sys_setsockopt+0x13d/0x1b0 [ 299.348904][T13315] ? do_syscall_64+0x15f/0xf80 [ 299.348932][T13315] __vmalloc_node_range_noprof+0x132/0x1730 [ 299.348990][T13315] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 299.349025][T13315] ? __kasan_kmalloc+0x93/0xb0 [ 299.349047][T13315] vmalloc_user_noprof+0xad/0xe0 [ 299.349076][T13315] ? xskq_create+0xbf/0x170 [ 299.349095][T13315] xskq_create+0xbf/0x170 [ 299.349119][T13315] xsk_init_queue+0x8a/0xe0 [ 299.349142][T13315] xsk_setsockopt+0x54c/0x990 [ 299.349161][T13315] ? __pfx_xsk_setsockopt+0x10/0x10 [ 299.349181][T13315] ? __pfx_aa_sk_perm+0x10/0x10 [ 299.349210][T13315] ? aa_sock_opt_perm+0xff/0x1a0 [ 299.349237][T13315] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 299.349265][T13315] ? __pfx_xsk_setsockopt+0x10/0x10 [ 299.349292][T13315] do_sock_setsockopt+0x17c/0x1b0 [ 299.349325][T13315] __x64_sys_setsockopt+0x13d/0x1b0 [ 299.349354][T13315] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 299.349375][T13315] do_syscall_64+0x15f/0xf80 [ 299.349399][T13315] ? trace_irq_disable+0x3b/0x140 [ 299.349419][T13315] ? clear_bhb_loop+0x40/0x90 [ 299.349444][T13315] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 299.349465][T13315] RIP: 0033:0x7fe267d9c819 [ 299.349483][T13315] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 299.349501][T13315] RSP: 002b:00007fe268d14028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 299.349523][T13315] RAX: ffffffffffffffda RBX: 00007fe268015fa0 RCX: 00007fe267d9c819 [ 299.349539][T13315] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000003 [ 299.349551][T13315] RBP: 00007fe267e32c91 R08: 0000000000000004 R09: 0000000000000000 [ 299.349564][T13315] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 299.349577][T13315] R13: 00007fe268016038 R14: 00007fe268015fa0 R15: 00007ffc35e1a658 [ 299.349611][T13315] [ 299.638316][T13315] Mem-Info: [ 299.641786][T13315] active_anon:7344 inactive_anon:0 isolated_anon:0 [ 299.641786][T13315] active_file:3581 inactive_file:40027 isolated_file:0 [ 299.641786][T13315] unevictable:768 dirty:200 writeback:0 [ 299.641786][T13315] slab_reclaimable:12544 slab_unreclaimable:117287 [ 299.641786][T13315] mapped:29977 shmem:1373 pagetables:1489 [ 299.641786][T13315] sec_pagetables:0 bounce:0 [ 299.641786][T13315] kernel_misc_reclaimable:0 [ 299.641786][T13315] free:1305105 free_pcp:9875 free_cma:0 [ 299.688385][T13315] Node 0 active_anon:29376kB inactive_anon:0kB active_file:14324kB inactive_file:159904kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:119908kB dirty:800kB writeback:0kB shmem:3956kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:14088kB pagetables:5828kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 299.721053][T13315] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:96kB pagetables:128kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 299.751585][T13315] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 299.783845][T13315] lowmem_reserve[]: 0 2491 2492 2492 2492 [ 299.789743][T13315] Node 0 DMA32 free:1255016kB boost:0kB min:34184kB low:42728kB high:51272kB reserved_highatomic:0KB free_highatomic:0KB active_anon:29376kB inactive_anon:0kB active_file:14324kB inactive_file:159904kB unevictable:1536kB writepending:800kB zspages:0kB present:3129332kB managed:2551528kB mlocked:0kB bounce:0kB free_pcp:39384kB local_pcp:20028kB free_cma:0kB [ 299.823533][T13315] lowmem_reserve[]: 0 0 0 0 0 [ 299.828280][T13315] Node 0 Normal free:0kB boost:0kB min:8kB low:8kB high:8kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:612kB mlocked:0kB bounce:0kB free_pcp:4kB local_pcp:4kB free_cma:0kB [ 299.875586][T13315] lowmem_reserve[]: 0 0 0 0 0 [ 299.881553][T13315] Node 1 Normal free:3950044kB boost:0kB min:55708kB low:69632kB high:83556kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB writepending:0kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 299.914840][T13315] lowmem_reserve[]: 0 0 0 0 0 [ 299.919722][T13315] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 299.932906][T13315] Node 0 DMA32: 6620*4kB (UME) 3843*8kB (UM) 1776*16kB (UM) 579*32kB (UME) 420*64kB (UME) 425*128kB (UME) 414*256kB (UME) 211*512kB (UME) 155*1024kB (UE) 104*2048kB (UM) 118*4096kB (UM) = 1254504kB [ 299.953543][T13315] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 299.973778][T13315] Node 1 Normal: 1*4kB (U) 7*8kB (UM) 12*16kB (UM) 7*32kB (UM) 8*64kB (UM) 8*128kB (UM) 2*256kB (M) 4*512kB (UM) 1*1024kB (M) 2*2048kB (U) 962*4096kB (M) = 3950044kB [ 299.990976][T13315] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 300.002309][T13315] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 300.011810][T13315] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 300.025234][T13315] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 300.035146][T13315] 45029 total pagecache pages [ 300.039965][T13315] 0 pages in swap cache [ 300.044144][T13315] Free swap = 124996kB [ 300.048374][T13315] Total swap = 124996kB [ 300.052910][T13315] 2097051 pages RAM [ 300.056800][T13315] 0 pages HighMem/MovableOnly [ 300.061651][T13315] 427401 pages reserved [ 300.066168][T13315] 0 pages cma reserved [ 300.992885][T13345] syzkaller0: entered promiscuous mode [ 300.998725][T13345] syzkaller0: entered allmulticast mode [ 301.281297][T13350] xt_CT: You must specify a L4 protocol and not use inversions on it [ 301.301840][T13350] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input16 [ 302.597435][T13354] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 302.718854][T13360] xt_CT: You must specify a L4 protocol and not use inversions on it [ 302.868617][T13321] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 302.889049][T13347] netlink: 'syz.4.2194': attribute type 1 has an invalid length. [ 302.909281][T13347] netlink: 224 bytes leftover after parsing attributes in process `syz.4.2194'. [ 302.938716][T13359] netlink: 'syz.3.2196': attribute type 1 has an invalid length. [ 302.965691][T13359] netlink: 224 bytes leftover after parsing attributes in process `syz.3.2196'. [ 303.093130][T13367] netlink: 'syz.2.2198': attribute type 1 has an invalid length. [ 303.107431][T13367] netlink: 224 bytes leftover after parsing attributes in process `syz.2.2198'. [ 303.137792][T13367] NCSI netlink: No device for ifindex 0 [ 303.148190][T13369] FAULT_INJECTION: forcing a failure. [ 303.148190][T13369] name failslab, interval 1, probability 0, space 0, times 0 [ 303.174611][T13369] CPU: 1 UID: 0 PID: 13369 Comm: syz.0.2199 Not tainted syzkaller #0 PREEMPT(full) [ 303.174634][T13369] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 303.174645][T13369] Call Trace: [ 303.174652][T13369] [ 303.174668][T13369] dump_stack_lvl+0xe8/0x150 [ 303.174698][T13369] should_fail_ex+0x412/0x560 [ 303.174728][T13369] should_failslab+0xa8/0x100 [ 303.174750][T13369] __kvmalloc_node_noprof+0x178/0x8a0 [ 303.174768][T13369] ? bpf_test_run_xdp_live+0x1f2/0x1cf0 [ 303.174801][T13369] bpf_test_run_xdp_live+0x1f2/0x1cf0 [ 303.174832][T13369] ? bpf_dispatcher_change_prog+0xae0/0xd70 [ 303.174871][T13369] ? __pfx_autoremove_wake_function+0x10/0x10 [ 303.174895][T13369] ? __pfx_bpf_test_run_xdp_live+0x10/0x10 [ 303.174940][T13369] ? 0xffffffffa02019f8 [ 303.174955][T13369] ? 0xffffffffa02074a8 [ 303.174994][T13369] ? __pfx_xdp_test_run_init_page+0x10/0x10 [ 303.175029][T13369] ? _copy_from_user+0x94/0xb0 [ 303.175048][T13369] ? bpf_test_init+0x113/0x150 [ 303.175069][T13369] ? xdp_convert_md_to_buff+0x5b/0x330 [ 303.175096][T13369] bpf_prog_test_run_xdp+0x81c/0x1160 [ 303.175135][T13369] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 303.175165][T13369] ? __fget_files+0x2a/0x420 [ 303.175192][T13369] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 303.175217][T13369] bpf_prog_test_run+0x2c7/0x340 [ 303.175242][T13369] __sys_bpf+0x643/0x950 [ 303.175264][T13369] ? __pfx___sys_bpf+0x10/0x10 [ 303.175302][T13369] ? rcu_is_watching+0x15/0xb0 [ 303.175333][T13369] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 303.175352][T13369] __x64_sys_bpf+0x7c/0x90 [ 303.175370][T13369] do_syscall_64+0x15f/0xf80 [ 303.175391][T13369] ? trace_irq_disable+0x3b/0x140 [ 303.175410][T13369] ? clear_bhb_loop+0x40/0x90 [ 303.175432][T13369] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 303.175449][T13369] RIP: 0033:0x7fa27bf9c819 [ 303.175465][T13369] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 303.175480][T13369] RSP: 002b:00007fa27cea6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 303.175500][T13369] RAX: ffffffffffffffda RBX: 00007fa27c215fa0 RCX: 00007fa27bf9c819 [ 303.175512][T13369] RDX: 0000000000000050 RSI: 0000200000000000 RDI: 000000000000000a [ 303.175524][T13369] RBP: 00007fa27cea6090 R08: 0000000000000000 R09: 0000000000000000 [ 303.175535][T13369] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 303.175545][T13369] R13: 00007fa27c216038 R14: 00007fa27c215fa0 R15: 00007ffd38b23ef8 [ 303.175574][T13369] [ 303.504197][T13379] FAULT_INJECTION: forcing a failure. [ 303.504197][T13379] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 303.554062][T13379] CPU: 0 UID: 0 PID: 13379 Comm: syz.1.2203 Not tainted syzkaller #0 PREEMPT(full) [ 303.554086][T13379] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 303.554096][T13379] Call Trace: [ 303.554104][T13379] [ 303.554111][T13379] dump_stack_lvl+0xe8/0x150 [ 303.554141][T13379] should_fail_ex+0x412/0x560 [ 303.554171][T13379] _copy_to_user+0x31/0xb0 [ 303.554197][T13379] simple_read_from_buffer+0xe1/0x170 [ 303.554225][T13379] proc_fail_nth_read+0x1bb/0x230 [ 303.554252][T13379] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 303.554276][T13379] ? rw_verify_area+0x2a6/0x4d0 [ 303.554297][T13379] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 303.554320][T13379] vfs_read+0x20c/0xa70 [ 303.554348][T13379] ? __pfx___mutex_lock+0x10/0x10 [ 303.554370][T13379] ? __pfx_vfs_read+0x10/0x10 [ 303.554396][T13379] ? __fget_files+0x2a/0x420 [ 303.554421][T13379] ? __fget_files+0x3a0/0x420 [ 303.554442][T13379] ? __fget_files+0x2a/0x420 [ 303.554473][T13379] ksys_read+0x150/0x270 [ 303.554499][T13379] ? __pfx_ksys_read+0x10/0x10 [ 303.554521][T13379] ? __pfx_sock_ioctl+0x10/0x10 [ 303.554546][T13379] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 303.554566][T13379] do_syscall_64+0x15f/0xf80 [ 303.554587][T13379] ? trace_irq_disable+0x3b/0x140 [ 303.554607][T13379] ? clear_bhb_loop+0x40/0x90 [ 303.554628][T13379] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 303.554646][T13379] RIP: 0033:0x7f4caf55d04e [ 303.554663][T13379] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 303.554677][T13379] RSP: 002b:00007f4cb04c8fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 303.554696][T13379] RAX: ffffffffffffffda RBX: 00007f4cb04c96c0 RCX: 00007f4caf55d04e [ 303.554709][T13379] RDX: 000000000000000f RSI: 00007f4cb04c90a0 RDI: 0000000000000003 [ 303.554719][T13379] RBP: 00007f4cb04c9090 R08: 0000000000000000 R09: 0000000000000000 [ 303.554729][T13379] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 303.554739][T13379] R13: 00007f4caf816038 R14: 00007f4caf815fa0 R15: 00007ffcbf8d46d8 [ 303.554769][T13379] [ 303.810483][T13382] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2204'. [ 303.867554][T13384] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2204'. [ 303.971328][T13391] netlink: 44 bytes leftover after parsing attributes in process `syz.3.2202'. [ 304.097405][T13396] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2207'. [ 304.122722][T13387] syzkaller0: entered promiscuous mode [ 304.128215][T13387] syzkaller0: entered allmulticast mode [ 304.343927][T13403] ipt_rpfilter: unknown options [ 304.362710][T13403] netlink: 'syz.4.2209': attribute type 1 has an invalid length. [ 305.997442][T13403] workqueue: Failed to create a rescuer kthread for wq "bond6": -EINTR [ 306.010066][T13411] netdevsim netdevsim3 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 306.028865][T13411] netdevsim netdevsim3 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 306.045306][T13412] tipc: Enabling of bearer rejected, already enabled [ 306.120309][T13411] netdevsim netdevsim3 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 306.133015][T13411] netdevsim netdevsim3 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 306.166872][T13424] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2212'. [ 306.228805][T13411] netdevsim netdevsim3 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 306.240162][T13411] netdevsim netdevsim3 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 306.324330][T13411] netdevsim netdevsim3 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 306.337105][T13411] netdevsim netdevsim3 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 306.440056][T13424] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2212'. [ 306.473066][T13436] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2214'. [ 306.491223][ T1520] netdevsim netdevsim3 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 306.505558][ T1520] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 306.557289][ T1520] netdevsim netdevsim3 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 306.566276][ T1520] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 306.607515][ T1520] netdevsim netdevsim3 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 306.627292][ T1520] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 306.713602][T13449] netlink: 'syz.2.2221': attribute type 18 has an invalid length. [ 306.724981][ T1520] netdevsim netdevsim3 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 306.733880][T13449] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2221'. [ 306.743353][ T1520] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 306.768037][T13430] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2214'. [ 306.810163][ T33] netdevsim netdevsim2 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 306.819432][ T33] netdevsim netdevsim2 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 306.829841][T13449] netlink: 'syz.2.2221': attribute type 18 has an invalid length. [ 306.842920][ T33] netdevsim netdevsim2 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 306.857337][T13449] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2221'. [ 306.870040][ T33] netdevsim netdevsim2 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 307.010751][T13457] mac80211_hwsim hwsim7 syzkaller0: entered allmulticast mode [ 307.199834][T13464] ipt_rpfilter: unknown options [ 307.220535][T13464] netlink: 'syz.3.2224': attribute type 1 has an invalid length. [ 307.335458][T13466] FAULT_INJECTION: forcing a failure. [ 307.335458][T13466] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 307.345270][T13464] 8021q: adding VLAN 0 to HW filter on device bond3 [ 307.367563][T13466] CPU: 0 UID: 0 PID: 13466 Comm: syz.4.2225 Not tainted syzkaller #0 PREEMPT(full) [ 307.367588][T13466] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 307.367600][T13466] Call Trace: [ 307.367607][T13466] [ 307.367615][T13466] dump_stack_lvl+0xe8/0x150 [ 307.367646][T13466] should_fail_ex+0x412/0x560 [ 307.367676][T13466] _copy_from_user+0x2d/0xb0 [ 307.367695][T13466] ___sys_recvmsg+0x175/0x590 [ 307.367720][T13466] ? __pfx____sys_recvmsg+0x10/0x10 [ 307.367745][T13466] ? __fget_files+0x2a/0x420 [ 307.367792][T13466] do_recvmmsg+0x334/0x800 [ 307.367816][T13466] ? __pfx_do_recvmmsg+0x10/0x10 [ 307.367844][T13466] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 307.367883][T13466] __x64_sys_recvmmsg+0x198/0x250 [ 307.367904][T13466] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 307.367931][T13466] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 307.367950][T13466] do_syscall_64+0x15f/0xf80 [ 307.367970][T13466] ? trace_irq_disable+0x3b/0x140 [ 307.367990][T13466] ? clear_bhb_loop+0x40/0x90 [ 307.368012][T13466] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 307.368030][T13466] RIP: 0033:0x7fe267d9c819 [ 307.368046][T13466] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 307.368061][T13466] RSP: 002b:00007fe268cf3028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 307.368081][T13466] RAX: ffffffffffffffda RBX: 00007fe268016090 RCX: 00007fe267d9c819 [ 307.368094][T13466] RDX: 00000000040001af RSI: 0000200000000a40 RDI: 0000000000000007 [ 307.368106][T13466] RBP: 00007fe268cf3090 R08: 0000000000000000 R09: 0000000000000000 [ 307.368117][T13466] R10: 0000000000012122 R11: 0000000000000246 R12: 0000000000000002 [ 307.368128][T13466] R13: 00007fe268016128 R14: 00007fe268016090 R15: 00007ffc35e1a658 [ 307.368157][T13466] [ 307.550064][T13464] bond3: (slave gretap2): making interface the new active one [ 307.558767][T13464] bond3: (slave gretap2): Enslaving as an active interface with an up link [ 307.726429][T13472] netlink: 'syz.0.2226': attribute type 1 has an invalid length. [ 307.816357][T13470] netlink: 64134 bytes leftover after parsing attributes in process `syz.0.2226'. [ 307.902783][T13487] netlink: 'syz.3.2230': attribute type 1 has an invalid length. [ 307.911699][T13487] netlink: 224 bytes leftover after parsing attributes in process `syz.3.2230'. [ 307.945638][T13490] netlink: 'syz.2.2232': attribute type 1 has an invalid length. [ 307.954161][T13490] netlink: 224 bytes leftover after parsing attributes in process `syz.2.2232'. [ 307.998344][T13487] xt_CT: You must specify a L4 protocol and not use inversions on it [ 308.012125][T13490] xt_CT: You must specify a L4 protocol and not use inversions on it [ 308.064766][T13487] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input17 [ 308.067695][T13492] netdevsim netdevsim1 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 308.102178][T13492] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 308.143619][T13493] tipc: Enabling of bearer rejected, already enabled [ 308.185821][T13492] netdevsim netdevsim1 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 308.196259][T13492] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 308.262271][T13492] netdevsim netdevsim1 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 308.279131][T13492] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 308.426775][T13492] netdevsim netdevsim1 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 308.461447][T13492] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 308.708326][T13522] IPVS: set_ctl: invalid protocol: 2 0.0.0.0:20005 [ 308.716868][T11697] netdevsim netdevsim1 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 308.735720][T11697] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 308.788191][ T57] netdevsim netdevsim1 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 308.804762][ T57] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 308.892375][ T57] netdevsim netdevsim1 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 308.920620][ T57] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 308.985739][T13529] Bluetooth: MGMT ver 1.23 [ 309.005110][ T3507] netdevsim netdevsim1 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 309.015220][ T3507] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 309.036748][T13536] syzkaller0: entered promiscuous mode [ 309.078438][T13536] syzkaller0: entered allmulticast mode [ 309.153651][T13544] __nla_validate_parse: 3 callbacks suppressed [ 309.153669][T13544] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2248'. [ 309.189289][T13544] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2248'. [ 309.537719][T13566] bond0: option mode: unable to set because the bond device has slaves [ 311.924974][T13538] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 312.263084][T13588] netlink: 64 bytes leftover after parsing attributes in process `syz.3.2268'. [ 312.273851][T13586] syzkaller0: entered promiscuous mode [ 312.291107][T13586] syzkaller0: entered allmulticast mode [ 312.476456][T13594] tipc: Enabling of bearer rejected, already enabled [ 313.122637][T13620] FAULT_INJECTION: forcing a failure. [ 313.122637][T13620] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 313.135938][T13620] CPU: 1 UID: 0 PID: 13620 Comm: syz.4.2278 Not tainted syzkaller #0 PREEMPT(full) [ 313.135952][T13620] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 313.135958][T13620] Call Trace: [ 313.135964][T13620] [ 313.135968][T13620] dump_stack_lvl+0xe8/0x150 [ 313.135989][T13620] should_fail_ex+0x412/0x560 [ 313.136006][T13620] _copy_from_user+0x2d/0xb0 [ 313.136017][T13620] __sys_bpf+0x229/0x950 [ 313.136030][T13620] ? __pfx___sys_bpf+0x10/0x10 [ 313.136048][T13620] ? ksys_write+0x242/0x270 [ 313.136065][T13620] ? __pfx_ksys_write+0x10/0x10 [ 313.136080][T13620] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 313.136099][T13620] __x64_sys_bpf+0x7c/0x90 [ 313.136117][T13620] do_syscall_64+0x15f/0xf80 [ 313.136137][T13620] ? trace_irq_disable+0x3b/0x140 [ 313.136156][T13620] ? clear_bhb_loop+0x40/0x90 [ 313.136178][T13620] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 313.136192][T13620] RIP: 0033:0x7fe267d9c819 [ 313.136202][T13620] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 313.136211][T13620] RSP: 002b:00007fe268d14028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 313.136223][T13620] RAX: ffffffffffffffda RBX: 00007fe268015fa0 RCX: 00007fe267d9c819 [ 313.136230][T13620] RDX: 0000000000000050 RSI: 0000200000000280 RDI: 000000000000000a [ 313.136237][T13620] RBP: 00007fe268d14090 R08: 0000000000000000 R09: 0000000000000000 [ 313.136243][T13620] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 313.136249][T13620] R13: 00007fe268016038 R14: 00007fe268015fa0 R15: 00007ffc35e1a658 [ 313.136264][T13620] [ 313.506711][T13631] netlink: 'syz.1.2281': attribute type 1 has an invalid length. [ 313.552341][T13631] 8021q: adding VLAN 0 to HW filter on device bond5 [ 313.601111][T13631] bond5: (slave veth7): Enslaving as an active interface with an up link [ 313.699636][T13640] xt_CT: You must specify a L4 protocol and not use inversions on it [ 313.722575][T13640] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input18 [ 313.772351][T13641] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 313.781102][T13641] bond5: (slave batadv0): Enslaving as an active interface with an up link [ 315.619768][T13613] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 315.695631][T13635] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2283'. [ 315.767216][T13638] netlink: 'syz.2.2285': attribute type 1 has an invalid length. [ 315.776854][T13638] netlink: 224 bytes leftover after parsing attributes in process `syz.2.2285'. [ 315.784999][T13650] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2287'. [ 315.884356][T13653] syzkaller0: entered promiscuous mode [ 315.893086][T13643] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2283'. [ 315.907043][T13631] netlink: 'syz.1.2281': attribute type 1 has an invalid length. [ 316.593870][T13688] 8021q: adding VLAN 0 to HW filter on device bond2 [ 316.697816][T13688] bond2: (slave ip6gretap1): Enslaving as a backup interface with an up link [ 316.711929][ T3484] bond2: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 316.849196][ T3484] bond2: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 317.382969][ T1298] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.389756][ T1298] ieee802154 phy1 wpan1: encryption failed: -22 [ 317.627542][T13728] A link change request failed with some changes committed already. Interface macsec0 may have been left with an inconsistent configuration, please check. [ 319.276251][T13680] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 319.435948][T13735] netlink: 'syz.0.2314': attribute type 1 has an invalid length. [ 319.444244][T13735] netlink: 224 bytes leftover after parsing attributes in process `syz.0.2314'. [ 319.473819][T13735] xt_CT: You must specify a L4 protocol and not use inversions on it [ 319.496285][T13740] netlink: 'syz.2.2315': attribute type 1 has an invalid length. [ 319.509299][T13742] sch_tbf: burst 0 is lower than device tunl0 mtu (129) ! [ 319.521487][T13740] netlink: 224 bytes leftover after parsing attributes in process `syz.2.2315'. [ 319.644158][T13740] xt_CT: You must specify a L4 protocol and not use inversions on it [ 319.931794][T13765] netlink: 56 bytes leftover after parsing attributes in process `syz.2.2322'. [ 321.026157][T13805] x_tables: ip_tables: recent.0 match: invalid size 216 (kernel) != (user) 4096 [ 321.138567][T13813] A link change request failed with some changes committed already. Interface macsec0 may have been left with an inconsistent configuration, please check. [ 321.329791][T13825] sch_tbf: burst 0 is lower than device tunl0 mtu (68) ! [ 321.391967][T13828] Bluetooth: MGMT ver 1.23 [ 321.415965][T13830] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2340'. [ 321.457481][T13831] pim6reg99999991: entered allmulticast mode [ 322.368016][T13836] warn_alloc: 1 callbacks suppressed [ 322.368033][T13836] syz.3.2342: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 322.388607][T13836] CPU: 1 UID: 0 PID: 13836 Comm: syz.3.2342 Not tainted syzkaller #0 PREEMPT(full) [ 322.388631][T13836] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 322.388645][T13836] Call Trace: [ 322.388653][T13836] [ 322.388662][T13836] dump_stack_lvl+0xe8/0x150 [ 322.388700][T13836] warn_alloc+0x249/0x340 [ 322.388732][T13836] ? stack_trace_save+0xa9/0x100 [ 322.388758][T13836] ? __pfx_warn_alloc+0x10/0x10 [ 322.388794][T13836] ? kasan_save_track+0x4f/0x80 [ 322.388820][T13836] ? kasan_save_track+0x3e/0x80 [ 322.388846][T13836] ? __kasan_kmalloc+0x93/0xb0 [ 322.388863][T13836] ? __kmalloc_cache_noprof+0x31c/0x660 [ 322.388890][T13836] ? xskq_create+0x56/0x170 [ 322.388911][T13836] ? xsk_setsockopt+0x54c/0x990 [ 322.388932][T13836] ? do_sock_setsockopt+0x17c/0x1b0 [ 322.388957][T13836] ? __x64_sys_setsockopt+0x13d/0x1b0 [ 322.388984][T13836] ? do_syscall_64+0x15f/0xf80 [ 322.389010][T13836] __vmalloc_node_range_noprof+0x132/0x1730 [ 322.389068][T13836] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 322.389105][T13836] ? __kasan_kmalloc+0x93/0xb0 [ 322.389126][T13836] vmalloc_user_noprof+0xad/0xe0 [ 322.389155][T13836] ? xskq_create+0xbf/0x170 [ 322.389177][T13836] xskq_create+0xbf/0x170 [ 322.389197][T13836] xsk_init_queue+0x8a/0xe0 [ 322.389219][T13836] xsk_setsockopt+0x54c/0x990 [ 322.389240][T13836] ? __pfx_xsk_setsockopt+0x10/0x10 [ 322.389258][T13836] ? __pfx_aa_sk_perm+0x10/0x10 [ 322.389286][T13836] ? aa_sock_opt_perm+0xff/0x1a0 [ 322.389311][T13836] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 322.389339][T13836] ? __pfx_xsk_setsockopt+0x10/0x10 [ 322.389359][T13836] do_sock_setsockopt+0x17c/0x1b0 [ 322.389392][T13836] __x64_sys_setsockopt+0x13d/0x1b0 [ 322.389421][T13836] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 322.389442][T13836] do_syscall_64+0x15f/0xf80 [ 322.389463][T13836] ? trace_irq_disable+0x3b/0x140 [ 322.389484][T13836] ? clear_bhb_loop+0x40/0x90 [ 322.389505][T13836] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 322.389525][T13836] RIP: 0033:0x7ff0bc59c819 [ 322.389555][T13836] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 322.389571][T13836] RSP: 002b:00007ff0bd4e6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 322.389592][T13836] RAX: ffffffffffffffda RBX: 00007ff0bc815fa0 RCX: 00007ff0bc59c819 [ 322.389606][T13836] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000003 [ 322.389619][T13836] RBP: 00007ff0bc632c91 R08: 0000000000000004 R09: 0000000000000000 [ 322.389631][T13836] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 322.389643][T13836] R13: 00007ff0bc816038 R14: 00007ff0bc815fa0 R15: 00007fff80790c58 [ 322.389674][T13836] [ 322.657856][T13836] Mem-Info: [ 322.661998][T13836] active_anon:7403 inactive_anon:0 isolated_anon:0 [ 322.661998][T13836] active_file:3581 inactive_file:40037 isolated_file:0 [ 322.661998][T13836] unevictable:768 dirty:219 writeback:0 [ 322.661998][T13836] slab_reclaimable:13037 slab_unreclaimable:121014 [ 322.661998][T13836] mapped:31023 shmem:1373 pagetables:1475 [ 322.661998][T13836] sec_pagetables:0 bounce:0 [ 322.661998][T13836] kernel_misc_reclaimable:0 [ 322.661998][T13836] free:1294619 free_pcp:14233 free_cma:0 [ 322.708974][T13836] Node 0 active_anon:29612kB inactive_anon:0kB active_file:14324kB inactive_file:159944kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:124092kB dirty:872kB writeback:0kB shmem:3956kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:14312kB pagetables:5772kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 322.741527][T13836] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:4kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:96kB pagetables:128kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 322.772720][T13836] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 322.803384][T13836] lowmem_reserve[]: 0 2491 2492 2492 2492 [ 322.809284][T13836] Node 0 DMA32 free:1224120kB boost:0kB min:34184kB low:42728kB high:51272kB reserved_highatomic:0KB free_highatomic:0KB active_anon:29520kB inactive_anon:0kB active_file:14324kB inactive_file:159944kB unevictable:1536kB writepending:872kB zspages:0kB present:3129332kB managed:2551528kB mlocked:0kB bounce:0kB free_pcp:53300kB local_pcp:20824kB free_cma:0kB [ 322.843849][T13836] lowmem_reserve[]: 0 0 0 0 0 [ 322.848582][T13836] Node 0 Normal free:0kB boost:0kB min:8kB low:8kB high:8kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:612kB mlocked:0kB bounce:0kB free_pcp:4kB local_pcp:4kB free_cma:0kB [ 322.878056][T13836] lowmem_reserve[]: 0 0 0 0 0 [ 322.883214][T13836] Node 1 Normal free:3950040kB boost:0kB min:55708kB low:69632kB high:83556kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB writepending:4kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 322.915727][T13836] lowmem_reserve[]: 0 0 0 0 0 [ 322.920560][T13836] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 322.933391][T13836] Node 0 DMA32: 4074*4kB (UM) 3854*8kB (UME) 1878*16kB (UME) 114*32kB (UME) 362*64kB (UME) 447*128kB (UM) 430*256kB (UME) 223*512kB (UME) 163*1024kB (UE) 112*2048kB (UME) 108*4096kB (UM) = 1224120kB [ 322.953215][T13836] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 322.964755][T13836] Node 1 Normal: 0*4kB 7*8kB (UM) 12*16kB (UM) 7*32kB (UM) 8*64kB (UM) 8*128kB (UM) 2*256kB (M) 4*512kB (UM) 1*1024kB (M) 2*2048kB (U) 962*4096kB (M) = 3950040kB [ 322.981559][T13780] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 322.990954][T13836] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 323.012616][T13836] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 323.038812][T13836] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 323.063782][T13836] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 323.116757][T13836] 44987 total pagecache pages [ 323.141044][T13836] 0 pages in swap cache [ 323.164059][T13836] Free swap = 124996kB [ 323.179276][T13836] Total swap = 124996kB [ 323.210568][T13836] 2097051 pages RAM [ 323.217620][T13845] netlink: 'syz.4.2344': attribute type 1 has an invalid length. [ 323.227056][T13836] 0 pages HighMem/MovableOnly [ 323.232932][T13836] 427401 pages reserved [ 323.252334][T13836] 0 pages cma reserved [ 323.255187][T13845] netlink: 224 bytes leftover after parsing attributes in process `syz.4.2344'. [ 323.276612][T13847] netlink: 224 bytes leftover after parsing attributes in process `syz.1.2345'. [ 323.295660][T13847] openvswitch: netlink: Key type 310 is out of range max 32 [ 323.371323][T13853] syzkaller0: entered promiscuous mode [ 323.378465][T13855] xt_CT: You must specify a L4 protocol and not use inversions on it [ 323.564745][T13861] netdevsim netdevsim2 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 323.582639][T13861] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 323.672905][T13867] tipc: Enabling of bearer rejected, already enabled [ 323.707286][T13867] FAULT_INJECTION: forcing a failure. [ 323.707286][T13867] name failslab, interval 1, probability 0, space 0, times 0 [ 323.728393][T13861] netdevsim netdevsim2 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 323.759882][T13861] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 323.767896][T13867] CPU: 0 UID: 0 PID: 13867 Comm: syz.2.2349 Not tainted syzkaller #0 PREEMPT(full) [ 323.767920][T13867] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 323.767931][T13867] Call Trace: [ 323.767939][T13867] [ 323.767946][T13867] dump_stack_lvl+0xe8/0x150 [ 323.767976][T13867] should_fail_ex+0x412/0x560 [ 323.768005][T13867] should_failslab+0xa8/0x100 [ 323.768026][T13867] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 323.768052][T13867] ? __alloc_skb+0x1d0/0x7d0 [ 323.768073][T13867] ? __local_bh_enable_ip+0xd0/0x130 [ 323.768101][T13867] __alloc_skb+0x1d0/0x7d0 [ 323.768123][T13867] ? netlink_ack_tlv_len+0x6c/0x210 [ 323.768149][T13867] netlink_ack+0x146/0xa50 [ 323.768169][T13867] ? __pfx_genl_rcv_msg+0x10/0x10 [ 323.768203][T13867] netlink_rcv_skb+0x2b6/0x4b0 [ 323.768227][T13867] ? __pfx_genl_rcv_msg+0x10/0x10 [ 323.768248][T13867] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 323.768286][T13867] ? down_read+0x270/0x2e0 [ 323.768307][T13867] ? genl_rcv+0xd/0x40 [ 323.768327][T13867] genl_rcv+0x28/0x40 [ 323.768342][T13867] netlink_unicast+0x75c/0x8e0 [ 323.768373][T13867] netlink_sendmsg+0x813/0xb40 [ 323.768405][T13867] ? __pfx_netlink_sendmsg+0x10/0x10 [ 323.768432][T13867] ? aa_sock_msg_perm+0xf1/0x1b0 [ 323.768456][T13867] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 323.768484][T13867] ____sys_sendmsg+0x972/0x9f0 [ 323.768508][T13867] ? __might_fault+0xaf/0x130 [ 323.768536][T13867] ? __pfx_____sys_sendmsg+0x10/0x10 [ 323.768569][T13867] ? import_iovec+0x73/0xa0 [ 323.768595][T13867] ___sys_sendmsg+0x2a5/0x360 [ 323.768623][T13867] ? __lock_acquire+0x6b5/0x2cf0 [ 323.768648][T13867] ? __pfx____sys_sendmsg+0x10/0x10 [ 323.768707][T13867] ? __fget_files+0x2a/0x420 [ 323.768727][T13867] ? __fget_files+0x3a0/0x420 [ 323.768757][T13867] __x64_sys_sendmsg+0x1bd/0x2a0 [ 323.768784][T13867] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 323.768822][T13867] ? __pfx_ksys_write+0x10/0x10 [ 323.768854][T13867] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 323.768873][T13867] do_syscall_64+0x15f/0xf80 [ 323.768893][T13867] ? trace_irq_disable+0x3b/0x140 [ 323.768911][T13867] ? clear_bhb_loop+0x40/0x90 [ 323.768932][T13867] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 323.768949][T13867] RIP: 0033:0x7f300a79c819 [ 323.768966][T13867] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 323.768980][T13867] RSP: 002b:00007f300b622028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 323.768999][T13867] RAX: ffffffffffffffda RBX: 00007f300aa16180 RCX: 00007f300a79c819 [ 323.769012][T13867] RDX: 0000000040000000 RSI: 0000200000000100 RDI: 000000000000000d [ 323.769023][T13867] RBP: 00007f300b622090 R08: 0000000000000000 R09: 0000000000000000 [ 323.769034][T13867] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 323.769045][T13867] R13: 00007f300aa16218 R14: 00007f300aa16180 R15: 00007ffe6c95f598 [ 323.769074][T13867] [ 323.811028][T13874] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2353'. [ 324.133348][T13861] netdevsim netdevsim2 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 324.145435][T13861] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 324.211856][T13885] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2353'. [ 324.221010][T13885] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2353'. [ 324.249315][T13861] netdevsim netdevsim2 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 324.260565][T13861] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 324.465578][ T3507] netdevsim netdevsim2 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 324.479081][ T3507] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 324.502590][ T3507] netdevsim netdevsim2 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 324.514515][T13901] netlink: 'syz.3.2356': attribute type 1 has an invalid length. [ 324.523213][ T3507] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 324.651168][T13901] 8021q: adding VLAN 0 to HW filter on device bond4 [ 324.682078][T13913] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2356'. [ 324.693285][ T3507] netdevsim netdevsim2 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 324.702439][ T3507] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 324.740144][T13904] bond4: (slave veth11): Enslaving as an active interface with a down link [ 324.788184][T13907] bond4: (slave veth13): Enslaving as an active interface with a down link [ 324.811714][T13913] bond4: (slave bridge2): Enslaving as an active interface with a down link [ 324.823675][ T3507] netdevsim netdevsim2 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 324.839730][ T3507] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 325.023831][T13928] syzkaller0: entered promiscuous mode [ 325.130163][T13932] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2366'. [ 325.186987][T13932] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2366'. [ 325.196479][T13932] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2366'. [ 327.444605][T13902] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 327.626134][T13951] openvswitch: netlink: Duplicate or invalid key (type 0). [ 327.654616][T13951] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 327.702953][T13957] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2374'. [ 327.794609][T13962] netlink: 'syz.3.2376': attribute type 4 has an invalid length. [ 327.804985][T13964] bridge0: entered allmulticast mode [ 328.057125][T13974] xt_TCPMSS: Only works on TCP SYN packets [ 328.095257][T13974] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2381'. [ 328.117948][T13974] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2381'. [ 328.348743][T13984] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2384'. [ 328.358640][T13984] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2384'. [ 328.371787][T13983] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2383'. [ 328.554030][T13992] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2386'. [ 328.614310][T13995] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2387'. [ 328.826416][T14004] x_tables: ip6_tables: rpfilter match: used from hooks FORWARD, but only valid from PREROUTING [ 329.422745][T14017] mac80211_hwsim hwsim7 syzkaller0: left allmulticast mode [ 331.461876][T13994] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 331.516036][T14001] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2386'. [ 331.528769][T14011] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2391'. [ 331.717556][T14028] tipc: Enabled bearer , priority 14 [ 331.883845][T14037] A link change request failed with some changes committed already. Interface macsec0 may have been left with an inconsistent configuration, please check. [ 335.045624][T14055] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 335.056117][T14063] __nla_validate_parse: 2 callbacks suppressed [ 335.056135][T14063] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2409'. [ 335.221845][T14069] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2409'. [ 335.233377][T14074] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2412'. [ 335.336027][T14084] xt_CT: You must specify a L4 protocol and not use inversions on it [ 335.371598][T14084] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input19 [ 335.405543][T14076] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2412'. [ 335.429239][T14082] netlink: 'syz.4.2414': attribute type 1 has an invalid length. [ 335.440454][T14089] xt_CT: You must specify a L4 protocol and not use inversions on it [ 335.471977][T14082] netlink: 224 bytes leftover after parsing attributes in process `syz.4.2414'. [ 335.474061][T14091] xt_CT: No such helper "snmp_trap" [ 335.487482][T14087] netlink: 'syz.0.2416': attribute type 1 has an invalid length. [ 335.543460][T14089] Oops: general protection fault, probably for non-canonical address 0xdffffc000000005e: 0000 [#1] SMP KASAN PTI [ 335.545171][T14087] netlink: 224 bytes leftover after parsing attributes in process `syz.0.2416'. [ 335.555388][T14089] KASAN: null-ptr-deref in range [0x00000000000002f0-0x00000000000002f7] [ 335.555410][T14089] CPU: 0 UID: 0 PID: 14089 Comm: syz.0.2416 Not tainted syzkaller #0 PREEMPT(full) [ 335.555433][T14089] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 335.555446][T14089] RIP: 0010:__mutex_lock+0x14e/0x1550 [ 335.555477][T14089] Code: 20 15 49 9a 48 c1 e8 03 42 0f b6 04 30 84 c0 0f 85 3e 12 00 00 83 3d 70 88 94 0e 00 75 23 49 8d 7c 24 58 48 89 f8 48 c1 e8 03 <42> 80 3c 30 00 74 05 e8 56 9e 7c f6 4d 39 64 24 58 0f 85 6a 11 00 [ 335.555496][T14089] RSP: 0018:ffffc90002ea77c0 EFLAGS: 00010202 [ 335.623264][T14089] RAX: 000000000000005e RBX: 0000000000000000 RCX: ffffffff9a491503 [ 335.631269][T14089] RDX: 0000000000000000 RSI: ffffffff8e22a119 RDI: 00000000000002f0 [ 335.639248][T14089] RBP: ffffc90002ea7980 R08: ffffc90002ea78e7 R09: 0000000000000000 [ 335.647212][T14089] R10: ffffc90002ea78c0 R11: fffff520005d4f1d R12: 0000000000000298 [ 335.655174][T14089] R13: 0000000000000000 R14: dffffc0000000000 R15: 1ffff920005d4f10 [ 335.663136][T14089] FS: 00007fa27ce856c0(0000) GS:ffff888125245000(0000) knlGS:0000000000000000 [ 335.672054][T14089] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 335.678624][T14089] CR2: 00007f300a9eb4b8 CR3: 0000000081310000 CR4: 00000000003526f0 [ 335.686590][T14089] Call Trace: [ 335.689863][T14089] [ 335.692783][T14089] ? wake_up_q+0x99/0xd0 [ 335.697030][T14089] ? preempt_schedule_thunk+0x16/0x30 [ 335.702410][T14089] ? preempt_schedule_common+0x82/0xd0 [ 335.707888][T14089] ? l2cap_unregister_user+0x36/0x170 [ 335.713271][T14089] ? __pfx___mutex_lock+0x10/0x10 [ 335.718297][T14089] ? __up_read+0x2fe/0x6b0 [ 335.722707][T14089] ? __pfx___up_read+0x10/0x10 [ 335.727478][T14089] ? hidp_session_find+0xce/0x100 [ 335.732494][T14089] l2cap_unregister_user+0x36/0x170 [ 335.737695][T14089] hidp_connection_del+0xb0/0x170 [ 335.742717][T14089] hidp_sock_ioctl+0x3ab/0x650 [ 335.747476][T14089] ? __pfx_hidp_sock_ioctl+0x10/0x10 [ 335.752770][T14089] ? do_vfs_ioctl+0x1166/0x1530 [ 335.757613][T14089] sock_do_ioctl+0x101/0x320 [ 335.762198][T14089] ? __pfx_sock_do_ioctl+0x10/0x10 [ 335.767325][T14089] ? do_futex+0x333/0x420 [ 335.771658][T14089] sock_ioctl+0x5c6/0x7f0 [ 335.775979][T14089] ? __pfx_sock_ioctl+0x10/0x10 [ 335.780851][T14089] ? __fget_files+0x2a/0x420 [ 335.785445][T14089] ? __fget_files+0x3a0/0x420 [ 335.790112][T14089] ? __fget_files+0x2a/0x420 [ 335.794696][T14089] ? bpf_lsm_file_ioctl+0x9/0x20 [ 335.799623][T14089] ? __pfx_sock_ioctl+0x10/0x10 [ 335.804479][T14089] __se_sys_ioctl+0xfc/0x170 [ 335.809066][T14089] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 335.815140][T14089] do_syscall_64+0x15f/0xf80 [ 335.819721][T14089] ? trace_irq_disable+0x3b/0x140 [ 335.824735][T14089] ? clear_bhb_loop+0x40/0x90 [ 335.829398][T14089] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 335.835278][T14089] RIP: 0033:0x7fa27bf9c819 [ 335.839681][T14089] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 335.859286][T14089] RSP: 002b:00007fa27ce85028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 335.867694][T14089] RAX: ffffffffffffffda RBX: 00007fa27c216090 RCX: 00007fa27bf9c819 [ 335.875674][T14089] RDX: 0000200000000000 RSI: 00000000400448c9 RDI: 000000000000000e [ 335.883635][T14089] RBP: 00007fa27c032c91 R08: 0000000000000000 R09: 0000000000000000 [ 335.891590][T14089] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 335.899557][T14089] R13: 00007fa27c216128 R14: 00007fa27c216090 R15: 00007ffd38b23ef8 [ 335.907522][T14089] [ 335.910541][T14089] Modules linked in: [ 335.916104][T14089] ---[ end trace 0000000000000000 ]--- [ 335.946768][T14089] RIP: 0010:__mutex_lock+0x14e/0x1550 [ 335.971337][T14089] Code: 20 15 49 9a 48 c1 e8 03 42 0f b6 04 30 84 c0 0f 85 3e 12 00 00 83 3d 70 88 94 0e 00 75 23 49 8d 7c 24 58 48 89 f8 48 c1 e8 03 <42> 80 3c 30 00 74 05 e8 56 9e 7c f6 4d 39 64 24 58 0f 85 6a 11 00 [ 336.020073][T14089] RSP: 0018:ffffc90002ea77c0 EFLAGS: 00010202 [ 336.031806][T14089] RAX: 000000000000005e RBX: 0000000000000000 RCX: ffffffff9a491503 [ 336.049372][T14089] RDX: 0000000000000000 RSI: ffffffff8e22a119 RDI: 00000000000002f0 [ 336.098188][T14089] RBP: ffffc90002ea7980 R08: ffffc90002ea78e7 R09: 0000000000000000 [ 336.112915][T14089] R10: ffffc90002ea78c0 R11: fffff520005d4f1d R12: 0000000000000298 [ 336.121229][T14089] R13: 0000000000000000 R14: dffffc0000000000 R15: 1ffff920005d4f10 [ 336.130384][T14089] FS: 00007fa27ce856c0(0000) GS:ffff888125245000(0000) knlGS:0000000000000000 [ 336.139809][T14089] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 336.146463][T14089] CR2: 0000001b30b10ff8 CR3: 0000000081310000 CR4: 00000000003526f0 [ 336.155137][T14089] Kernel panic - not syncing: Fatal exception [ 336.161539][T14089] Kernel Offset: disabled [ 336.165847][T14089] Rebooting in 86400 seconds..