last executing test programs: 4.901411192s ago: executing program 3 (id=4550): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000001600000018110000", @ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0xc, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 4.632990661s ago: executing program 3 (id=4554): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="05000000040000000800000003"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000001500000018110000", @ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000ac0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000580)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000340)='fdb_delete\x00', r1}, 0x18) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r2, 0x8924, &(0x7f0000000000)={'bridge_slave_0\x00', @random="010000201000"}) 3.990884113s ago: executing program 0 (id=4562): bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x14, 0x6, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0xc82, 0x0, 0x0, 0x0, 0x16}, [@alu={0x7, 0x1, 0x4, 0x0, 0x6, 0x8, 0xfffffffffffffffc}, @map_idx={0x18, 0xb, 0x5, 0x0, 0x2}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000000c0), 0x48) bpf$MAP_LOOKUP_ELEM(0x5, &(0x7f00000000c0)={r0, &(0x7f0000000000), &(0x7f0000000040)=""/73}, 0x70) 3.868535884s ago: executing program 0 (id=4564): r0 = socket$packet(0x11, 0x2, 0x300) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x1, 0x31, 0xffffffffffffffff, 0x8871b000) getsockopt$packet_int(r0, 0x107, 0x12, 0x0, &(0x7f0000001600)) 3.749830154s ago: executing program 0 (id=4568): r0 = socket$xdp(0x2c, 0x3, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f0000000080)=0x1, 0x4) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$XDP_RX_RING(r0, 0x11b, 0x2, &(0x7f0000001980)=0x100, 0x4) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000580)={'batadv_slave_1\x00', 0x0}) setsockopt$XDP_UMEM_FILL_RING(r0, 0x11b, 0x5, &(0x7f0000000300)=0x1, 0x4) bind$xdp(r0, &(0x7f0000000100)={0x2c, 0x0, r2}, 0x10) mmap$xdp(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x6, 0x11, r0, 0x100000000) 2.404027375s ago: executing program 3 (id=4574): getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="06000000040000"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000004000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f9ffffffb703000000080000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000500)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x1, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000040)='sched_switch\x00', r1}, 0x10) bpf$MAP_CREATE(0x600000000000000, &(0x7f0000000580)=ANY=[@ANYBLOB="0f00000004000000040000000200020000000000", @ANYRES32=0x1, @ANYBLOB="fdffffff0000000000000000fbffffff00000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000004"], 0x48) 2.402761971s ago: executing program 0 (id=4575): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a00000004000000fd0f000007"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000880)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x20702, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0xca58c30f81b6079f}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0xa802, 0x0) close(r3) socket$netlink(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', @broadcast}) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x129, 0x0, 0xfffffffd, {0x0, 0x0, 0x0, r5, {0x1, 0xd}, {}, {0x8, 0xfff1}}}, 0x24}}, 0x40004) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r1}, 0x10) recvmsg(r6, &(0x7f0000000b40)={0x0, 0x0, &(0x7f0000001200)=[{&(0x7f00000004c0)=""/230, 0xe6}, {&(0x7f0000000600)=""/177, 0xb1}, {&(0x7f00000006c0)=""/164, 0xa4}, {&(0x7f0000000a40)=""/203, 0xcb}, {&(0x7f0000002ac0)=""/4096, 0x1000}, {&(0x7f00000003c0)=""/124, 0x7c}, {&(0x7f0000000200)=""/9, 0x9}, {&(0x7f00000008c0)=""/85, 0x55}], 0x8}, 0x2140) 2.358349013s ago: executing program 1 (id=4576): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x7, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000000000000850000008600000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x24, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000480)='kfree\x00', r1}, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_JOIN_MESH(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="01030000000000000000320000000c009900000000000000000005001801"], 0x40}}, 0x0) 2.275582122s ago: executing program 1 (id=4579): syz_emit_ethernet(0x42, &(0x7f0000000180)={@local, @remote, @void, {@ipv4={0x800, @dccp={{0x9, 0x4, 0x0, 0x1, 0x34, 0x65, 0x0, 0x4, 0x21, 0x0, @private=0xa010101, @dev={0xac, 0x14, 0x14, 0xc}, {[@generic={0x83, 0x8, "a464e654cfb7"}, @cipso={0x86, 0x6, 0x2}]}}, {{0x4e21, 0x4e22, 0x4, 0x1, 0x5, 0x0, 0x0, 0x4, 0x0, "9cc7e8", 0x3, "94125f"}}}}}}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000380)='memory.events\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='memory.events\x00', 0x7a05, 0x1700) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="09000000fd3f1400e27f00000100000000000000", @ANYRES32, @ANYBLOB='\x00'/19, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000000000000000000000000000000000000000000bc6cd4062708c70e4a6eb10691eb591e98dad78c27e01a67e4"], 0x48) bpf$MAP_GET_NEXT_KEY(0x3, &(0x7f00000000c0)={r0, &(0x7f0000000180), 0x0}, 0x20) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000380)=ANY=[@ANYBLOB="1400000042000501"], 0x14}, 0x1, 0x0, 0x0, 0x68840}, 0x4) recvmmsg(r1, &(0x7f0000000000)=[{{0x0, 0x0, 0x0}}], 0x1, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xd, 0x8, &(0x7f0000003900)=ANY=[@ANYBLOB="620af8ff0c200021bfa100000000000007010000f8ffffffb702000003000000bd120000000000008500000006000000b70000000000000095000000000000003faf4f1e7f2aa3d9b18ed81c0c869b51ec6c0af4e0e4a9446c7670568982b4e020f698393aa0f3881f9c24aa56f15199fad0093c59d66b5ece9f36c70d0f13905ea23c22624c9f87f9793f50bb546040677b0c5077da80fb982c1e9400e693146cea484a415b76966118b64f751a0f241b07080008002d75593a286cecc93e64c227c95aa0b784625704f07a72c234664c0af9360a1f7a5e6b607130c89f18c0c1089d8b853289e01aa27ae8b09e00e79ab20b0b8e1148f49faf2ad0000000000000006fa03c6468972089b302d7bf6023cdcedb5e0125ebbc08dee510cb2364149215108333719acd97cfa107d40224edc5465a932b77e74e802a0d42bc6099ad2300000080006ef6c1ff0900000000000010c63a949e8b7955394ffa82b8e942c89112f4ab87b1bfeda7be586602d985430cea0162ab3fcf4591c926abfb0767192302000000b0eea24492a660583eecb42cbcd3de3a83209da17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c95c25a573dc2edcaea2b1a52496dfcaf99431412fd134a996382a1a04d5bb924cfe5f3185418d605ffff9c4d2ec7c32f2095e63c80aff9fa740b5b7632f32030916f89c6dad7603f2ba2a790d62d6faec2fed44da4928b30142ba11de6c5d50b83bae613402216b5054d1e7c13b1355d6f4a8245ffa4997da9c77af4c0eb97fca585ec6bf5af51d564beb6d952aab9c70764b0a8a7583c90b3433b809bdb9fbd48bc873495cbff8a326eea31ae4e0f7505ebf6c9d13330ca005ace1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223a0eb4fa39f6b5c02e6d6d90756ff57902a8f57000000009700cf0b4b8bc2294133000000000000000000030000000000000000000000000010008bc0d9559711e6e8861c46495ba585a4b2d02edc3e28dd271c896249ed85b980680b00002b435ac15fc0288d9b2a169cdcacc413038dafb7a2c8cb482bac0ac502d9ba96ffffff7f0000100000000000007d5ad897ef3b7cda42013d53046da21b40216e14ba2d6ad5656bfff17addaedab25b30002abbba7fa725f38400be7c1f001b2cd317902f19e385be9e48dccff729433282830689da6b53b263339863297771429d120000003341bf4abacac95900fca0493cf29b33dcc9ffffffffffffffd39fec2271ff01589646efd1cf870cd7bb2366fde41f94290c2a5ff870ce41fd3467decb05cfd9fcb32c8ed1dbd9d10a64c1083d5e71b5565b1768ee58969c41595229df17bcad70fb4021428ce970275d13b78100788f11f76161d46ea3abe0fa4d30dc94ef241875f3b4ce0232fcea69c271d7fa29822aea68a660e717a04becff0f719197724f4fce1093b62d7e8c7123d8ec571be54c72d978cf906df0042e36acd37d7f9e119f2c06f815312e0cfe222a06f56dd022c074eb8a322fb0bf47c0a8d154b405c37feaf3dd95f6ef2ae582786105c7df8be5877050c91301bb997316dbf17866fb84d4173731efe895ff2e1c5560926e90109b598502d3e959efc71f665c4d75cf2458e3546c1c776da64fb5abee0acfd235f2f4632c9062ece84c99a061887a20639b41c8c12ee86c50804042b3fb5aac518a75f9e7d7101d5e186c489b3a06fb99e0aa7f23a054de2f4d92d6bd72ee2c9fdc75aaaf1e3e483b4ad05573af40326993947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f54c2d3335457acf37331766e472391e358c3b377327ac9ecc34f24c9ae153ec60ac0694dc55bff9f5f45f90400000000000000d6b2c5ea1393fdf24285bf16b99c9cc0ad1857216f1a985f369191ae954febb3df464bfe0f7f3ee9afe7befb89d2777399f5874c553aeb3729cffe86e66964ae09bb6d163118e4cbe024fd4500f8ff0700000000cc9d8046c216c1f895778cb25122a2a9f9b444aeadea2a40da8daccf080842a486721737390cbf3a74cb2003016f1514216bdf57d2a40d40b51ab63e96ec8485b3b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde8a168c3f5db2fea6f26e4a4304e50c349f4f9ecee27defc93871c5f99b355b72d538ba4958ea8e4aa37094191e10096e7e60fc3541a2c905a1a95e9571bf38ae1981c4238ecaee6f75cd0a6881bd1517a8250ddc8674152f94e3a409e2a3bce109b60000000000000000d6d5210d7503000000a87a27602b81f76386f1535bef1497f92186086e29c6bc5a1fad6ec9a31137abf9a404abde7750898b1bd627e873f8703be8672d70d1ab57075228a9f46ed9bd1f08fb8191bbab2dc51de3a61f0868afc4294859323e6c257a45319f18101288d139bd3da20fed05a8fe64680b0a3fc22dd70400000000946912d6c98cd1a9fbe1e7d58c08acaf30235b918a31d2eca55f74a23641f61f2d5b308cf0d031b0c7f0ced69993e9960ff5f76015e6009556237badf4e7965bbe2777e808fcba821aa8e8c5c39609ff854352cb4900000000000000000000000000c1fee30a3f7a85d1b29e58c77685efc0ceb1c8e5729c66418d169fc03aa188546b3ad2a182068e1e3a0e2505bc7f41019645466a53f1c96e0d4b3bc19faa5449209b083dbd334b47f067bbab40743b2a42010082008df75cf43f8ecc8d3726602111b40e761fd21081920382f14d12ca3c3431ee97471c7868dcda7eaa69eb7f7f80572fdd11bb1d0d1280fbc22bf73468788df51710d7d31c632fc5ed1762eb0b428ee751c47d8e894f745a868404a0bf35f0121008b722b1eaa6aedfa1bf2e7ccb2d61d5d76331945ecefa26b8471d42645288d7226bbd9ccd628ab84875f2c50ba891cea592b0430a537a395dc73bda367bf12cb7d81691a5fe8c47be395656a297e9df0e71f96756ea5cce7daac4be290159f6bcd75f0dda9de5532e71ae9e48b0ed0254a83100000000f6fbb869604d51a36a54c832e45b2569dc0d90b075225fde44c4e0973171ad47d6b0fdf9743af932cd6db49a47613808bad959710300000000000000832d0a45fa4242e24c7e800003c9e8095e02985f28e678f66422436f949e2ab8f162d7e3f855e378f4a1f40b0c6fb2d4b205a800b6d713acebc5b014e61a543a5a194f9ac18d76b5440e3b1a569e7397f6cafa86966d7ba19e720413267a6ccea9c439671d2c680f2753ca184eeeb843450368acb4383a01d25eb3d1e23e0f2645d1cdfa9fa410632f95a5f622f851c66ee7e30393cd7a4d67ff2a49c4f93c0984b5c2d4523497e4d64f95f08493564a1df87111c9bf3194fef97dcecc467ace45feeb685c5870d05f88a0f463db88d377442e1349acaf766218b54a9d624778e1c4e064c98e494198276eb2df7766411bef0ebb5000000000006065d635b0b7a00ee767221d8af9753387e0cd8d718f54a29df6eba3bd4c440e6e2172e3fcc01b8babb757b5c59217b80d0db3ba582814a604e4ef7a803e9ca7c85b35c9b93a9e0885e238b44ae1c2e64cce3b27083b8246829e64056000302bffff15405bd5f2eba20000000000000000000000000000000000009a9823fd8fbc5aa16509945ed032b48ea12d8e0588dc52702e4084913a06d468d0928bad76d697e1f85ab030e788d38788ee5b5428d4a971cc97db9fd231088e570735ce129e7e77fc2777692664a1488fd8d6dff4dad618fd54f529d4555c6507009ee69dd1bc55258789b24052137e9637f3efbab71720f88c3c44b3b7486f979e8a3174b531f573fe0e5239c000be2733c49546f6e8a9175ec6f14dbf72cac91643b2fd99c29eca28a3c2e60d5e5b8795fae16a7c3ea57e728eca35eaf0155a39f97580e079175426c088a0208040982a0000000000000000000000000051ceaaf0159fe61f2eade7603d0a7a56fb09cd119ac06adb6597155ae47846892bb423c024d8cbe9240b71ec6dc2124d3a19e2d714b273d95d1d3aa737cb04a33615ff2a730e51067d5d675d7122361c37c61a43b5afd865b60d4cae891b73220f17d25985a7f76834995e53a93a1c7b9eef267df691ca983a0b15bda7f6c5c1ca7aa50261a3089a1ebf0734c9b07e8951ff023263ad5aed8cfb49b49e128c697724c057d22c5df5aef27ce3db11d5ad5527d149d076e1a87e2df27c0cb8a67ad026bf953e88f10447e125c2c0f1aebee1f3390a9e3ddad4e2a6e0f6e4569fdefa19e870e04acf9493b963f98e23cfc665e4f465fa3f801e1957c399e45f61d3459b1c606204368bb931345af2823c487d2fd99db6ea6e008e7ffa06ca861551189d155bd077a79fe2c7e961352e56824f727d21d41eae78bfec4a2d7a7edbc8ef958c5ea599f7c25bf71c2340558aa12fdd24a88aaad5921aee7dae6a2f3009d9cb43ab4898d0f0aa565431b6abe585d75db04d1c9ba0b9de4ae8b0d3132bc6810cc9a693979f55174a72e1df9fdef35bc470f9e6e591982757f45c52c645d891bf63bb21fb66926ebe1a8525611fc3e8bb8795c36dc2a86b5ab46ff33cc74f61751b2dae92676db85c8d0c721b7ea4544bf51c95c86fcac1f434d09d1ee4928aafe23de66fed972e0dddfb33f64e48701b049239e7f552d816441d11c4c2647c014462344359198d97c4b6e9ed31ca18987b64de079b2bed641e8a92f13ca70844c65cb423d01950b0ebf44bd28e09c05d9ae5dd689fb880fb18d042219f5ac60c3a03b085abf3e8e3efc842a8d328733461f04c99607061c65ed14c61322a5ac2d371a95b8ad867ec92d13a4fa4ae033a09673866cd77f4bcdaaa05207166b19a8758d8855400d8c6a7242dc207251e8797eca24ea4f487663e60f2f5e1f1424958fd148f846830e88a42d93e1fe9c0b4a4a268921738938aa9f3cb3811ac87c54c8ebc8bcfb4613cc3a997ff1579edbd4ade8020e3ad001b072b1a751b588ac4639f35a58e00a50c0270608c7a7f10132b1c25b9ea81232fbef665f6212f875b2a0000000000000000000000000000cf7b6c4ba9bec153d6834bfef080df374703a8ff56a63ec1fe5f2e05a79e3cace7283dd68d41e94420c325fe4dae144fde5ec25a87d625cab20753a77b323fa3783c8b675859b9012647885a242adfee2fe812ecbe5191e0a15142f7349e7627cc39d724e2e34e7a24154f26ae3125b36d0504965295d0453902ac7079b11a3a1e655e482331e3dc35b2e7e4e3ea99064fe5b9c8ae0ca3e5fd653f3286a99d81ce4eba765c38d097391ad4babac38ce5b4344e24a361cd54e5"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x1e00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)=@newnexthop={0x40, 0x68, 0x1, 0x100004, 0x7ffffffd, {}, [@NHA_GROUP={0xc, 0x2, [{0x1, 0x15}]}, @NHA_RES_GROUP={0x14, 0xc, 0x0, 0x1, [@NHA_RES_GROUP_BUCKETS={0x6, 0x1, 0x3fd4}, @NHA_RES_GROUP_IDLE_TIMER={0x8, 0x2, 0x821}]}, @NHA_GROUP_TYPE={0x6, 0x3, 0x1}]}, 0x40}, 0x1, 0x0, 0x0, 0x4008018}, 0x4000080) 2.090102567s ago: executing program 4 (id=4582): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000780)=ANY=[@ANYBLOB="160000000000000004000000ff"], 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x42}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r1}, 0x10) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb010018000000000000003c0000003c000000020000000000000002000004080000000000000003000000000000000000000003000000000000000000000000000002000000000000000000000004"], 0x0, 0x56}, 0x28) 2.018166528s ago: executing program 4 (id=4583): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r0, 0x29, 0x4b, &(0x7f0000000100)=0x401, 0x4) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000000180)=0x20800001, 0x4) bind$inet6(r1, 0x0, 0x0) bind$inet6(r0, &(0x7f0000000140)={0xa, 0x4e22, 0x3, @private0={0xfc, 0x0, '\x00', 0xff}, 0xa}, 0x1c) 1.971514977s ago: executing program 4 (id=4584): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a00000004000000ff0f000007"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000000000000000000000000600850000009e"], 0x0}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x3, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000100)='br_fdb_add\x00', r1}, 0x10) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'bridge0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="280000001c000100000000000000000007000000", @ANYRES32=r4, @ANYBLOB="4000aa000a0002"], 0x28}}, 0x0) 1.762005503s ago: executing program 3 (id=4585): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="02000000040000000800000006"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000700000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000001b80)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000005c0)={&(0x7f0000000080)='kfree\x00', r1}, 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000180)={'syzkaller0\x00', 0x7101}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xc1842, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x709000, 0x0) close(r4) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r5) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) ioctl$SIOCSIFHWADDR(r5, 0x8943, &(0x7f0000000100)={'syzkaller0\x00'}) ioctl$SIOCSIFHWADDR(r4, 0x8943, &(0x7f0000002280)={'syzkaller0\x00', @random="110000000002"}) 997.23916ms ago: executing program 2 (id=4590): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000080000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_skb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0b00000005000000000400000d00000001"], 0x48) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f00000004c0)={r0, &(0x7f0000000340), &(0x7f00000005c0)=""/155}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x4, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='sys_enter\x00', r1}, 0x18) r2 = epoll_create1(0x0) epoll_wait(r2, &(0x7f0000002a80)=[{}], 0x1, 0xffff0001) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r3, &(0x7f0000000080)={0x9d32f4b2e0c65377}) 867.790073ms ago: executing program 2 (id=4591): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000004850000006d00000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r1}, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000006c0)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="1b00000000000700000005000000180001801400020073797a5f74756e0000000000000000000c00038008000380"], 0x38}}, 0x0) 792.334427ms ago: executing program 2 (id=4592): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) listen(r0, 0x3) syz_emit_ethernet(0x3e, &(0x7f0000000680)={@local, @link_local, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x6, 0x0, @rand_addr=0x64010101, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x7, 0xc2, 0x0, 0x0, 0x0, {[@exp_fastopen={0xfe, 0x7, 0xf989, "c45738"}]}}}}}}}, 0x0) 703.232637ms ago: executing program 2 (id=4593): bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="1e0000000000000004000000ff"], 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="500000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000008200000300012800b00010065727370616e000020000280060018007d000000040012000500160002"], 0x50}}, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r1, 0x2000000, 0xe, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x3800, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x16, 0x0, 0x4, 0x5, 0x0, 0x1}, 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b7040000000000008500000057"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x18}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000880)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r3}, 0x10) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000008000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000058"], 0x0}, 0x90) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x20, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={&(0x7f0000000000)='tlb_flush\x00', r4}, 0x10) r5 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'bridge0\x00', 0x0}) r7 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x503, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x14615}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macsec={{0xb}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r6}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4001}, 0x0) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000080)={r1, r6, 0x25, 0x3, @void}, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000000340)) sendmsg$nl_route_sched(r0, &(0x7f00000004c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000400)={0x0}, 0x1, 0x0, 0x0, 0x40}, 0x4000010) socket(0x18, 0x800, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f0000000300)='sched_switch\x00', r9}, 0x10) r10 = syz_genetlink_get_family_id$wireguard(0x0, 0xffffffffffffffff) sendmsg$WG_CMD_SET_DEVICE(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000b80)={0x30, r10, 0x1, 0x70ad28, 0x0, {}, [@WGDEVICE_A_IFNAME={0x14, 0x2, 'wg2\x00'}, @WGDEVICE_A_FLAGS={0x8, 0x5, 0x1}]}, 0x30}, 0x1, 0x0, 0x0, 0x4004840}, 0x40000) 381.020853ms ago: executing program 1 (id=4594): ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(0xffffffffffffffff, 0x8983, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00'}, 0x10) socket$nl_route(0x10, 0x3, 0x0) openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/tcp_wmem\x00', 0x1, 0x0) r0 = socket$unix(0x1, 0x5, 0x0) r1 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) connect$can_bcm(r1, &(0x7f00000000c0)={0x1d, r2}, 0x10) sendmsg$can_bcm(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)=ANY=[@ANYBLOB="0100000003ece1e40ad8871461ab0800", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=r0, @ANYBLOB="3bf81bb9f9"], 0x20000600}, 0x1, 0x0, 0x0, 0x40000}, 0x0) 353.831161ms ago: executing program 4 (id=4595): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1e000000000000000500000006"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000008c0)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x20}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000040)='mm_page_alloc\x00', r1}, 0x10) r2 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r2, 0x11b, 0x3, &(0x7f0000000380)=0x20000, 0x4) 278.296425ms ago: executing program 0 (id=4596): r0 = socket$packet(0x11, 0x3, 0x300) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="4c000000100039042abd70000000000000000000", @ANYRES32=r2, @ANYBLOB="01180200031100002c0012800e00010069703665727370616e0000001800028008001500a8bc0d00040012"], 0x4c}}, 0x0) sendto$packet(r0, &(0x7f0000000480)="7eeb99b6f78c67515ea2f0d01d76", 0xe, 0x4004011, &(0x7f0000000140)={0x11, 0x86dd, r2, 0x1, 0x6, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}, 0x14) 278.052687ms ago: executing program 3 (id=4597): syz_emit_ethernet(0x4e, &(0x7f0000000ac0)={@broadcast, @remote, @val={@val={0x88a8, 0x6, 0x1, 0x3}, {0x8100, 0x4, 0x0, 0x3}}, {@mpls_uc={0x8847, {[], @ipv6=@dccp_packet={0x3, 0x6, "86fb73", 0x10, 0x21, 0xff, @local, @empty, {[], {{0x4e24, 0x4e23, 0x4, 0x1, 0xf, 0x0, 0x0, 0x2, 0x7, "faf1c7", 0x4, "c8dace"}}}}}}}}, 0x0) 270.653082ms ago: executing program 1 (id=4598): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) listen(r0, 0xfff) syz_emit_ethernet(0x4a, &(0x7f00000004c0)={@local, @empty, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "0a8435", 0x14, 0x6, 0x0, @remote, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x2}}}}}}}, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000540)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaa0086dd600a3ff200140600fe8000000000000000000000000000bbfe8000004c00000000000000000000aa00004e22", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB='P'], 0x0) 216.622605ms ago: executing program 2 (id=4599): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=@base={0x16, 0x0, 0x4, 0x1}, 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0}, 0x90) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000008000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008"], 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000580)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000200)='fdb_delete\x00', r1}, 0x10) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x8, '\x00', 0x0, @fallback=0xe, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000280)={&(0x7f0000000200)='fdb_delete\x00', r2}, 0x18) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r3, 0x8924, &(0x7f0000000000)={'bridge_slave_0\x00', @random="010000201000"}) 150.346981ms ago: executing program 3 (id=4600): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800001965ba917c62e1e6902300000000000000", @ANYRES32, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000f00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000002020097b1af8ff00000000bfa1000000000000070100"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r1 = socket$netlink(0x10, 0x3, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000340)='sched_kthread_stop_ret\x00', r0}, 0x10) sendmsg$nl_route(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=ANY=[@ANYBLOB="4000000010001fff000000000000000000060000", @ANYRES32=0x0, @ANYBLOB="0000000000000000180012800e0001007769726567756172640000000400028008000a00b8"], 0x40}}, 0x0) 149.110294ms ago: executing program 4 (id=4601): socket$inet_tcp(0x2, 0x1, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x11, 0xc, &(0x7f0000002e80)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000008200000095"], &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f0000000640)=0xffffffffffffffff, 0x4) 144.056264ms ago: executing program 0 (id=4602): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000140)={'pim6reg1\x00', 0x1}) bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000", @ANYRES32, @ANYBLOB="0000000000000000b70800000000396f7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000002400000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x35, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000940)={&(0x7f0000000640)='console\x00', r1}, 0x10) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000100)={'pim6reg1\x00', @broadcast}) 134.225807ms ago: executing program 1 (id=4603): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="16000000000000000400000001"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0}, 0x94) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000008000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008"], 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000a40)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000300)={&(0x7f0000000180)='workqueue_activate_work\x00', r1}, 0x10) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000300)={&(0x7f0000000180)='workqueue_activate_work\x00', r2}, 0x10) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff}) setsockopt$sock_attach_bpf(r3, 0x1, 0x1d, &(0x7f00000001c0), 0x4) 66.592327ms ago: executing program 2 (id=4604): bpf$ENABLE_STATS(0x20, 0x0, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000002010000850000004300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x12, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_GET_PROG_INFO(0xa, &(0x7f0000000740)={r1, 0x0, 0x0}, 0x10) 22.257802ms ago: executing program 4 (id=4605): syz_emit_ethernet(0x46, &(0x7f0000000200)={@link_local={0x3}, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x38, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x4, 0x0, 0x12, 0x0, 0x3f18, {0x5, 0x2, 0x0, 0x0, 0x0, 0x0, 0xfffd, 0x0, 0x1, 0x0, @loopback, @loopback}, "00186371ae9b1c03"}}}}}, 0x0) 0s ago: executing program 1 (id=4606): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000440)=ANY=[@ANYBLOB="24000000240035b90000000000000000070000000600040000ef00"], 0x24}}, 0x0) kernel console output (not intermixed with test programs): er [ 418.800959][T18170] tipc: Disabling bearer [ 418.877173][T18194] lo speed is unknown, defaulting to 1000 [ 419.085322][T18027] 8021q: adding VLAN 0 to HW filter on device bond0 [ 419.129470][T18027] 8021q: adding VLAN 0 to HW filter on device team0 [ 419.193595][ T7101] bridge0: port 1(bridge_slave_0) entered blocking state [ 419.200777][ T7101] bridge0: port 1(bridge_slave_0) entered forwarding state [ 419.256725][ T7101] bridge0: port 2(bridge_slave_1) entered blocking state [ 419.263934][ T7101] bridge0: port 2(bridge_slave_1) entered forwarding state [ 419.560955][T18203] lo speed is unknown, defaulting to 1000 [ 419.562486][T18194] syzkaller0 speed is unknown, defaulting to 1000 [ 419.697374][ T5880] Bluetooth: hci3: command tx timeout [ 419.931928][T18228] __nla_validate_parse: 8 callbacks suppressed [ 419.931945][T18228] netlink: 104 bytes leftover after parsing attributes in process `syz.4.3192'. [ 420.012721][T18027] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 420.091125][T18231] netlink: 36 bytes leftover after parsing attributes in process `syz.4.3193'. [ 420.128990][T18203] syzkaller0 speed is unknown, defaulting to 1000 [ 420.136069][T18231] netlink: 36 bytes leftover after parsing attributes in process `syz.4.3193'. [ 420.212986][T18231] netlink: 36 bytes leftover after parsing attributes in process `syz.4.3193'. [ 420.227425][T18231] netlink: 36 bytes leftover after parsing attributes in process `syz.4.3193'. [ 420.300369][T18231] netlink: 36 bytes leftover after parsing attributes in process `syz.4.3193'. [ 420.314495][T18231] netlink: 36 bytes leftover after parsing attributes in process `syz.4.3193'. [ 420.382686][T18231] netlink: 36 bytes leftover after parsing attributes in process `syz.4.3193'. [ 420.394295][T18231] netlink: 36 bytes leftover after parsing attributes in process `syz.4.3193'. [ 420.403463][T18231] netlink: 36 bytes leftover after parsing attributes in process `syz.4.3193'. [ 420.544493][T18027] veth0_vlan: entered promiscuous mode [ 420.570003][T18027] veth1_vlan: entered promiscuous mode [ 420.659516][T18027] veth0_macvtap: entered promiscuous mode [ 420.672635][T18027] veth1_macvtap: entered promiscuous mode [ 420.712922][T18027] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 420.733363][T18027] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 420.765730][T18246] veth1_macvtap: left promiscuous mode [ 420.771226][T18246] macsec0: entered promiscuous mode [ 420.777547][T18246] macsec0: entered allmulticast mode [ 420.863726][ T76] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 420.881121][T18245] lo speed is unknown, defaulting to 1000 [ 420.936453][T18246] veth1_macvtap: entered promiscuous mode [ 420.942360][T18246] veth1_macvtap: entered allmulticast mode [ 420.960231][T18246] macsec0: left promiscuous mode [ 420.976494][T18246] macsec0: left allmulticast mode [ 420.981555][T18246] veth1_macvtap: left allmulticast mode [ 421.018960][ T76] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 421.041005][ T76] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 421.111677][ T76] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 421.285627][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 421.296887][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 421.367379][T18245] syzkaller0 speed is unknown, defaulting to 1000 [ 421.416266][T18265] lo speed is unknown, defaulting to 1000 [ 421.652869][ T76] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 421.673127][ T76] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 421.774522][ T5880] Bluetooth: hci3: command tx timeout [ 421.998406][T18270] lo speed is unknown, defaulting to 1000 [ 422.385824][T18265] syzkaller0 speed is unknown, defaulting to 1000 [ 422.403497][T18270] syzkaller0 speed is unknown, defaulting to 1000 [ 423.077474][T18299] macsec1: entered promiscuous mode [ 423.082803][T18299] macsec1: entered allmulticast mode [ 423.613246][ T5948] IPVS: starting estimator thread 0... [ 423.723916][T18324] IPVS: using max 31 ests per chain, 74400 per kthread [ 423.841565][T18326] hsr0: entered promiscuous mode [ 423.894752][T18326] macsec2: entered promiscuous mode [ 424.136468][ T5184] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 424.157147][ T5184] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 424.174760][ T5184] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 424.197700][ T5184] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 424.212031][ T5184] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 424.461637][ T13] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 424.571078][T18337] lo speed is unknown, defaulting to 1000 [ 424.860221][ T13] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 424.961580][ T13] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 425.050056][ T13] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 425.076271][T18367] x_tables: ip_tables: udp match: only valid for protocol 17 [ 425.132595][T18337] syzkaller0 speed is unknown, defaulting to 1000 [ 425.379055][T18387] __nla_validate_parse: 28 callbacks suppressed [ 425.379073][T18387] netlink: 136 bytes leftover after parsing attributes in process `syz.2.3230'. [ 425.446937][ T13] tipc: Resetting bearer [ 426.114919][ T13] tipc: Disabling bearer [ 426.264367][ T5880] Bluetooth: hci1: command tx timeout [ 426.332382][ T13] bond0 (unregistering): left promiscuous mode [ 426.339585][ T13] bond_slave_0: left promiscuous mode [ 426.347408][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 426.357144][ T13] bond_slave_0: left allmulticast mode [ 426.362902][ T13] bond0 (unregistering): Released all slaves [ 426.375996][ T13] bond1 (unregistering): Released all slaves [ 426.388645][ T13] bond2 (unregistering): Released all slaves [ 426.486960][ T13] bond3 (unregistering): Released all slaves [ 426.620642][ T13] tipc: Left network mode [ 426.640901][T18337] chnl_net:caif_netlink_parms(): no params data found [ 426.665849][ T13] IPVS: stopping backup sync thread 15144 ... [ 426.723057][T18337] bridge0: port 1(bridge_slave_0) entered blocking state [ 426.730650][T18337] bridge0: port 1(bridge_slave_0) entered disabled state [ 426.740304][T18337] bridge_slave_0: entered allmulticast mode [ 426.748918][T18337] bridge_slave_0: entered promiscuous mode [ 426.762008][T18337] bridge0: port 2(bridge_slave_1) entered blocking state [ 426.769407][T18337] bridge0: port 2(bridge_slave_1) entered disabled state [ 426.777031][T18337] bridge_slave_1: entered allmulticast mode [ 426.784811][T18337] bridge_slave_1: entered promiscuous mode [ 426.822286][T18337] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 426.834749][T18337] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 426.892781][T18337] team0: Port device team_slave_0 added [ 426.901133][T18337] team0: Port device team_slave_1 added [ 426.945553][T18337] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 426.952502][T18337] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 426.978742][T18337] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 426.991651][T18337] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 426.999996][T18337] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 427.027766][T18337] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 427.092770][T18337] hsr_slave_0: entered promiscuous mode [ 427.099567][T18337] hsr_slave_1: entered promiscuous mode [ 427.107056][T18337] debugfs: 'hsr0' already exists in 'hsr' [ 427.112864][T18337] Cannot create hsr debugfs directory [ 427.616487][T18337] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 427.626806][T18337] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 427.643225][T18337] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 427.668306][T18337] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 427.817241][T18337] 8021q: adding VLAN 0 to HW filter on device bond0 [ 427.835152][ T13] veth1_to_team: left promiscuous mode [ 427.845255][ T13] hsr_slave_0: left promiscuous mode [ 427.851123][ T13] hsr_slave_1: left promiscuous mode [ 427.857494][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 428.164858][ T13] team0 (unregistering): Port device team_slave_1 removed [ 428.204614][ T13] team0 (unregistering): Port device team_slave_0 removed [ 428.335392][ T5880] Bluetooth: hci1: command tx timeout [ 428.533167][T18337] 8021q: adding VLAN 0 to HW filter on device team0 [ 428.552320][ T76] bridge0: port 1(bridge_slave_0) entered blocking state [ 428.559501][ T76] bridge0: port 1(bridge_slave_0) entered forwarding state [ 428.577856][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 428.585036][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 428.800970][T18337] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 428.839784][T18337] veth0_vlan: entered promiscuous mode [ 428.851729][T18337] veth1_vlan: entered promiscuous mode [ 428.879458][T18337] veth0_macvtap: entered promiscuous mode [ 428.888258][T18337] veth1_macvtap: entered promiscuous mode [ 428.907349][T18337] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 428.921699][T18337] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 428.936140][ T49] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 428.944925][ T49] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 428.956431][ T49] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 428.965588][ T49] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 429.028250][ T49] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 429.037498][ T49] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 429.060546][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 429.070258][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 430.359512][ T13] IPVS: stop unused estimator thread 0... [ 430.414416][ T5880] Bluetooth: hci1: command tx timeout [ 432.494054][ T5880] Bluetooth: hci1: command tx timeout [ 464.550803][T18411] netlink: 68 bytes leftover after parsing attributes in process `syz.0.3232'. [ 464.712272][T18424] bridge0: port 2(bridge_slave_1) entered disabled state [ 464.720002][T18424] bridge0: port 1(bridge_slave_0) entered disabled state [ 464.897520][T18424] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 465.001230][T18421] lo speed is unknown, defaulting to 1000 [ 465.022563][ T7101] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 465.052930][ T7101] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 465.072612][ T7101] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 465.094153][ T7101] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 465.383455][T18460] netlink: 'syz.0.3246': attribute type 12 has an invalid length. [ 465.478048][T18421] syzkaller0 speed is unknown, defaulting to 1000 [ 465.485653][T18465] tipc: Started in network mode [ 465.490544][T18465] tipc: Node identity ac14142f, cluster identity 4711 [ 465.497872][T18446] rdma_rxe: rxe_newlink: failed to add lo [ 465.504633][T18465] tipc: New replicast peer: 0.0.0.0 [ 465.510860][T18465] tipc: Enabled bearer , priority 10 [ 465.614352][T18465] netlink: 44 bytes leftover after parsing attributes in process `syz.0.3248'. [ 465.634047][T18465] tipc: Disabling bearer [ 465.721858][T18471] bridge_slave_0: left allmulticast mode [ 465.744655][T18471] bridge_slave_0: left promiscuous mode [ 465.759620][T18471] bridge0: port 1(bridge_slave_0) entered disabled state [ 465.844620][T18471] bridge_slave_1: left allmulticast mode [ 465.850301][T18471] bridge_slave_1: left promiscuous mode [ 465.859219][T18471] bridge0: port 2(bridge_slave_1) entered disabled state [ 465.879474][T18471] bond0: (slave bond_slave_0): Releasing backup interface [ 465.892683][T18471] bond0: (slave bond_slave_1): Releasing backup interface [ 465.935620][T18471] team0: Port device team_slave_0 removed [ 465.968624][T18471] team0: Port device team_slave_1 removed [ 465.976141][T18471] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 465.983770][T18471] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 466.006280][T18471] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 466.013668][T18471] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 466.025672][T18481] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3250'. [ 466.050714][T18471] team0: Port device geneve0 removed [ 466.121807][T18481] geneve2: entered promiscuous mode [ 466.127287][T18481] geneve2: entered allmulticast mode [ 466.632115][T18510] netlink: 'syz.0.3258': attribute type 2 has an invalid length. [ 466.749566][T18515] lo speed is unknown, defaulting to 1000 [ 466.854590][T18521] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3259'. [ 466.918898][T18521] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3259'. [ 467.071878][T18535] sctp: [Deprecated]: syz.3.3264 (pid 18535) Use of int in max_burst socket option. [ 467.071878][T18535] Use struct sctp_assoc_value instead [ 467.327101][T18549] tipc: Started in network mode [ 467.337015][T18549] tipc: Node identity 0e90ce375f4e, cluster identity 4711 [ 467.360110][T18549] tipc: Enabled bearer , priority 0 [ 467.397124][T18515] syzkaller0 speed is unknown, defaulting to 1000 [ 467.404816][T18550] syzkaller0: entered promiscuous mode [ 467.415787][T18550] syzkaller0: entered allmulticast mode [ 467.445753][T18549] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 467.637265][T18548] tipc: Resetting bearer [ 467.769403][T18569] bridge1: entered allmulticast mode [ 467.796937][T18569] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3272'. [ 468.204848][T18592] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3278'. [ 468.239949][T18586] veth3: entered promiscuous mode [ 468.282192][ T7101] tipc: Resetting bearer [ 468.446629][ T5978] tipc: Node number set to 1373556279 [ 468.483688][T18606] bridge_slave_0: left allmulticast mode [ 468.491767][T18606] bridge_slave_0: left promiscuous mode [ 468.498594][T18606] bridge0: port 1(bridge_slave_0) entered disabled state [ 468.545702][T18606] bridge_slave_1: left allmulticast mode [ 468.551376][T18606] bridge_slave_1: left promiscuous mode [ 468.567848][T18606] bridge0: port 2(bridge_slave_1) entered disabled state [ 468.593737][T18606] bond0: (slave bond_slave_0): Releasing backup interface [ 468.627523][T18606] bond0: (slave bond_slave_1): Releasing backup interface [ 468.660483][T18606] team0: Port device team_slave_0 removed [ 468.682737][T18606] team0: Port device team_slave_1 removed [ 468.697391][T18606] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 468.705087][T18606] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 468.716029][T18606] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 468.726059][T18606] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 468.737836][T18606] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 468.839915][T18619] lo speed is unknown, defaulting to 1000 [ 469.055067][T18619] syzkaller0 speed is unknown, defaulting to 1000 [ 469.288672][T18642] netlink: 277 bytes leftover after parsing attributes in process `syz.0.3292'. [ 469.775043][T18661] IPVS: length: 209 != 24 [ 469.862665][T18665] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3301'. [ 469.934720][T18665] tipc: Enabled bearer , priority 18 [ 470.016979][T18678] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3305'. [ 470.452924][T18705] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3312'. [ 470.472370][T18705] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3312'. [ 470.746374][T18712] lo speed is unknown, defaulting to 1000 [ 471.132736][T18712] syzkaller0 speed is unknown, defaulting to 1000 [ 471.261164][T18736] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3321'. [ 471.547579][T18747] netlink: 200 bytes leftover after parsing attributes in process `syz.3.3326'. [ 471.558481][T18752] netlink: 200 bytes leftover after parsing attributes in process `syz.3.3326'. [ 471.568897][T18753] netlink: 'syz.2.3327': attribute type 13 has an invalid length. [ 471.576848][T18753] netlink: 'syz.2.3327': attribute type 17 has an invalid length. [ 471.732146][T18755] netlink: 'syz.4.3328': attribute type 23 has an invalid length. [ 471.782716][T18753] 8021q: adding VLAN 0 to HW filter on device bond0 [ 471.793404][T18753] 8021q: adding VLAN 0 to HW filter on device team0 [ 471.807939][T18753] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 471.863656][T18759] netlink: 'syz.1.3330': attribute type 1 has an invalid length. [ 471.917559][T18759] netlink: 'syz.1.3330': attribute type 1 has an invalid length. [ 472.046502][T18768] FAULT_INJECTION: forcing a failure. [ 472.046502][T18768] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 472.073384][T18770] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3333'. [ 472.088112][T18768] CPU: 0 UID: 0 PID: 18768 Comm: syz.4.3332 Not tainted syzkaller #0 PREEMPT(full) [ 472.088136][T18768] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 472.088153][T18768] Call Trace: [ 472.088164][T18768] [ 472.088172][T18768] dump_stack_lvl+0x189/0x250 [ 472.088196][T18768] ? __pfx____ratelimit+0x10/0x10 [ 472.088221][T18768] ? __pfx_dump_stack_lvl+0x10/0x10 [ 472.088239][T18768] ? __pfx__printk+0x10/0x10 [ 472.088260][T18768] ? __might_fault+0xb0/0x130 [ 472.088293][T18768] should_fail_ex+0x414/0x560 [ 472.088320][T18768] _copy_from_user+0x2d/0xb0 [ 472.088341][T18768] ___sys_sendmsg+0x158/0x2a0 [ 472.088364][T18768] ? __pfx____sys_sendmsg+0x10/0x10 [ 472.088423][T18768] ? __fget_files+0x2a/0x420 [ 472.088444][T18768] ? __fget_files+0x3a0/0x420 [ 472.088475][T18768] __x64_sys_sendmsg+0x19b/0x260 [ 472.088498][T18768] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 472.088529][T18768] ? rcu_is_watching+0x15/0xb0 [ 472.088550][T18768] ? do_syscall_64+0xbe/0x3b0 [ 472.088571][T18768] do_syscall_64+0xfa/0x3b0 [ 472.088587][T18768] ? lockdep_hardirqs_on+0x9c/0x150 [ 472.088608][T18768] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 472.088625][T18768] ? clear_bhb_loop+0x60/0xb0 [ 472.088646][T18768] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 472.088662][T18768] RIP: 0033:0x7f13fcf8eec9 [ 472.088679][T18768] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 472.088694][T18768] RSP: 002b:00007f13fdf0b038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 472.088713][T18768] RAX: ffffffffffffffda RBX: 00007f13fd1e5fa0 RCX: 00007f13fcf8eec9 [ 472.088726][T18768] RDX: 0000000000000080 RSI: 0000200000000180 RDI: 0000000000000005 [ 472.088737][T18768] RBP: 00007f13fdf0b090 R08: 0000000000000000 R09: 0000000000000000 [ 472.088749][T18768] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 472.088759][T18768] R13: 00007f13fd1e6038 R14: 00007f13fd1e5fa0 R15: 00007ffc97b9c3b8 [ 472.088789][T18768] [ 472.363755][T18770] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3333'. [ 472.386803][T18767] 8021q: adding VLAN 0 to HW filter on device bond1 [ 472.473256][T18775] lo speed is unknown, defaulting to 1000 [ 472.496804][T18778] veth1_macvtap: left promiscuous mode [ 472.509248][T18782] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3336'. [ 472.541896][T18778] macsec0: entered promiscuous mode [ 472.566711][T18778] macsec0: entered allmulticast mode [ 472.595061][T18780] netlink: 'syz.2.3336': attribute type 15 has an invalid length. [ 472.890910][T18782] team0 (unregistering): Port device C removed [ 472.900144][T18782] team0 (unregistering): Port device team_slave_1 removed [ 472.924853][T18783] veth1_macvtap: entered promiscuous mode [ 472.931437][T18783] veth1_macvtap: entered allmulticast mode [ 472.938169][T18783] macsec0: left promiscuous mode [ 472.943349][T18783] macsec0: left allmulticast mode [ 472.948518][T18783] veth1_macvtap: left allmulticast mode [ 472.976456][T18792] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 473.071735][T18801] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci1/hci1:200/input11 [ 473.100294][T18792] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 473.155441][T18775] syzkaller0 speed is unknown, defaulting to 1000 [ 473.469516][T18808] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 473.547802][T18814] FAULT_INJECTION: forcing a failure. [ 473.547802][T18814] name failslab, interval 1, probability 0, space 0, times 1 [ 473.589413][T18814] CPU: 0 UID: 0 PID: 18814 Comm: syz.2.3344 Not tainted syzkaller #0 PREEMPT(full) [ 473.589438][T18814] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 473.589449][T18814] Call Trace: [ 473.589457][T18814] [ 473.589465][T18814] dump_stack_lvl+0x189/0x250 [ 473.589489][T18814] ? __pfx____ratelimit+0x10/0x10 [ 473.589510][T18814] ? __pfx_dump_stack_lvl+0x10/0x10 [ 473.589527][T18814] ? __pfx__printk+0x10/0x10 [ 473.589553][T18814] ? __pfx___might_resched+0x10/0x10 [ 473.589580][T18814] should_fail_ex+0x414/0x560 [ 473.589607][T18814] should_failslab+0xa8/0x100 [ 473.589629][T18814] kmem_cache_alloc_node_noprof+0x76/0x3c0 [ 473.589660][T18814] ? __alloc_skb+0x112/0x2d0 [ 473.589683][T18814] __alloc_skb+0x112/0x2d0 [ 473.589704][T18814] netlink_sendmsg+0x5c6/0xb30 [ 473.589733][T18814] ? __pfx_netlink_sendmsg+0x10/0x10 [ 473.589755][T18814] ? aa_sock_msg_perm+0xf1/0x1d0 [ 473.589780][T18814] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 473.589797][T18814] ? __pfx_netlink_sendmsg+0x10/0x10 [ 473.589816][T18814] __sock_sendmsg+0x219/0x270 [ 473.589841][T18814] ____sys_sendmsg+0x505/0x830 [ 473.589867][T18814] ? __pfx_____sys_sendmsg+0x10/0x10 [ 473.589897][T18814] ? import_iovec+0x74/0xa0 [ 473.589921][T18814] ___sys_sendmsg+0x21f/0x2a0 [ 473.589943][T18814] ? __pfx____sys_sendmsg+0x10/0x10 [ 473.589998][T18814] ? __fget_files+0x2a/0x420 [ 473.590017][T18814] ? __fget_files+0x3a0/0x420 [ 473.590047][T18814] __x64_sys_sendmsg+0x19b/0x260 [ 473.590068][T18814] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 473.590097][T18814] ? __pfx_ksys_write+0x10/0x10 [ 473.590113][T18814] ? rcu_is_watching+0x15/0xb0 [ 473.590134][T18814] ? do_syscall_64+0xbe/0x3b0 [ 473.590154][T18814] do_syscall_64+0xfa/0x3b0 [ 473.590168][T18814] ? lockdep_hardirqs_on+0x9c/0x150 [ 473.590188][T18814] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 473.590203][T18814] ? clear_bhb_loop+0x60/0xb0 [ 473.590223][T18814] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 473.590238][T18814] RIP: 0033:0x7f5f9cb8eec9 [ 473.590254][T18814] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 473.590268][T18814] RSP: 002b:00007f5f9da89038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 473.590286][T18814] RAX: ffffffffffffffda RBX: 00007f5f9cde5fa0 RCX: 00007f5f9cb8eec9 [ 473.590298][T18814] RDX: 0000000000000080 RSI: 0000200000000180 RDI: 0000000000000005 [ 473.590308][T18814] RBP: 00007f5f9da89090 R08: 0000000000000000 R09: 0000000000000000 [ 473.590318][T18814] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 473.590329][T18814] R13: 00007f5f9cde6038 R14: 00007f5f9cde5fa0 R15: 00007ffece279df8 [ 473.590357][T18814] [ 474.919936][T18860] __nla_validate_parse: 6 callbacks suppressed [ 474.919954][T18860] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3353'. [ 474.965291][T18859] netlink: 'syz.4.3355': attribute type 13 has an invalid length. [ 474.987471][T18859] netlink: 'syz.4.3355': attribute type 17 has an invalid length. [ 475.100733][T18861] lo speed is unknown, defaulting to 1000 [ 475.351567][T18861] syzkaller0 speed is unknown, defaulting to 1000 [ 476.174639][T18889] FAULT_INJECTION: forcing a failure. [ 476.174639][T18889] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 476.244335][T18889] CPU: 1 UID: 0 PID: 18889 Comm: syz.4.3360 Not tainted syzkaller #0 PREEMPT(full) [ 476.244360][T18889] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 476.244371][T18889] Call Trace: [ 476.244379][T18889] [ 476.244386][T18889] dump_stack_lvl+0x189/0x250 [ 476.244410][T18889] ? __pfx____ratelimit+0x10/0x10 [ 476.244434][T18889] ? __pfx_dump_stack_lvl+0x10/0x10 [ 476.244453][T18889] ? __pfx__printk+0x10/0x10 [ 476.244474][T18889] ? __might_fault+0xb0/0x130 [ 476.244506][T18889] should_fail_ex+0x414/0x560 [ 476.244534][T18889] _copy_from_iter+0x1de/0x1790 [ 476.244560][T18889] ? rcu_is_watching+0x15/0xb0 [ 476.244578][T18889] ? kmem_cache_alloc_node_noprof+0x217/0x3c0 [ 476.244600][T18889] ? __pfx__copy_from_iter+0x10/0x10 [ 476.244619][T18889] ? __build_skb_around+0x257/0x3e0 [ 476.244641][T18889] ? netlink_sendmsg+0x642/0xb30 [ 476.244659][T18889] ? skb_put+0x11b/0x210 [ 476.244681][T18889] netlink_sendmsg+0x6b2/0xb30 [ 476.244710][T18889] ? __pfx_netlink_sendmsg+0x10/0x10 [ 476.244732][T18889] ? aa_sock_msg_perm+0xf1/0x1d0 [ 476.244759][T18889] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 476.244776][T18889] ? __pfx_netlink_sendmsg+0x10/0x10 [ 476.244795][T18889] __sock_sendmsg+0x219/0x270 [ 476.244822][T18889] ____sys_sendmsg+0x505/0x830 [ 476.244848][T18889] ? __pfx_____sys_sendmsg+0x10/0x10 [ 476.244878][T18889] ? import_iovec+0x74/0xa0 [ 476.244901][T18889] ___sys_sendmsg+0x21f/0x2a0 [ 476.244924][T18889] ? __pfx____sys_sendmsg+0x10/0x10 [ 476.244980][T18889] ? __fget_files+0x2a/0x420 [ 476.245001][T18889] ? __fget_files+0x3a0/0x420 [ 476.245033][T18889] __x64_sys_sendmsg+0x19b/0x260 [ 476.245056][T18889] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 476.245087][T18889] ? __pfx_ksys_write+0x10/0x10 [ 476.245104][T18889] ? rcu_is_watching+0x15/0xb0 [ 476.245126][T18889] ? do_syscall_64+0xbe/0x3b0 [ 476.245146][T18889] do_syscall_64+0xfa/0x3b0 [ 476.245162][T18889] ? lockdep_hardirqs_on+0x9c/0x150 [ 476.245191][T18889] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 476.245207][T18889] ? clear_bhb_loop+0x60/0xb0 [ 476.245227][T18889] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 476.245243][T18889] RIP: 0033:0x7f13fcf8eec9 [ 476.245258][T18889] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 476.245271][T18889] RSP: 002b:00007f13fdeea038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 476.245290][T18889] RAX: ffffffffffffffda RBX: 00007f13fd1e6090 RCX: 00007f13fcf8eec9 [ 476.245303][T18889] RDX: 0000000000000080 RSI: 0000200000000180 RDI: 0000000000000005 [ 476.245314][T18889] RBP: 00007f13fdeea090 R08: 0000000000000000 R09: 0000000000000000 [ 476.245324][T18889] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 476.245338][T18889] R13: 00007f13fd1e6128 R14: 00007f13fd1e6090 R15: 00007ffc97b9c3b8 [ 476.245369][T18889] [ 476.554003][T18888] netlink: 104 bytes leftover after parsing attributes in process `syz.4.3360'. [ 476.576095][T18891] netlink: 104 bytes leftover after parsing attributes in process `syz.1.3361'. [ 476.885447][T18898] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3364'. [ 476.927146][T18895] lo speed is unknown, defaulting to 1000 [ 477.306137][T18895] syzkaller0 speed is unknown, defaulting to 1000 [ 477.470682][T18920] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3370'. [ 477.757522][T18928] netlink: 104 bytes leftover after parsing attributes in process `syz.2.3373'. [ 477.855328][T18931] FAULT_INJECTION: forcing a failure. [ 477.855328][T18931] name failslab, interval 1, probability 0, space 0, times 0 [ 477.878189][T18931] CPU: 1 UID: 0 PID: 18931 Comm: syz.2.3374 Not tainted syzkaller #0 PREEMPT(full) [ 477.878215][T18931] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 477.878225][T18931] Call Trace: [ 477.878233][T18931] [ 477.878240][T18931] dump_stack_lvl+0x189/0x250 [ 477.878264][T18931] ? __pfx____ratelimit+0x10/0x10 [ 477.878288][T18931] ? __pfx_dump_stack_lvl+0x10/0x10 [ 477.878307][T18931] ? __pfx__printk+0x10/0x10 [ 477.878330][T18931] ? __lock_acquire+0xab9/0xd20 [ 477.878362][T18931] should_fail_ex+0x414/0x560 [ 477.878390][T18931] should_failslab+0xa8/0x100 [ 477.878413][T18931] kmem_cache_alloc_noprof+0x73/0x3c0 [ 477.878433][T18931] ? skb_clone+0x212/0x3a0 [ 477.878458][T18931] skb_clone+0x212/0x3a0 [ 477.878482][T18931] __netlink_deliver_tap+0x404/0x850 [ 477.878514][T18931] ? netlink_deliver_tap+0x2e/0x1b0 [ 477.878535][T18931] netlink_deliver_tap+0x19c/0x1b0 [ 477.878558][T18931] netlink_unicast+0x7fa/0x9e0 [ 477.878585][T18931] ? __pfx_netlink_unicast+0x10/0x10 [ 477.878604][T18931] ? netlink_sendmsg+0x642/0xb30 [ 477.878621][T18931] ? skb_put+0x11b/0x210 [ 477.878643][T18931] netlink_sendmsg+0x805/0xb30 [ 477.878672][T18931] ? __pfx_netlink_sendmsg+0x10/0x10 [ 477.878695][T18931] ? aa_sock_msg_perm+0xf1/0x1d0 [ 477.878720][T18931] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 477.878737][T18931] ? __pfx_netlink_sendmsg+0x10/0x10 [ 477.878757][T18931] __sock_sendmsg+0x219/0x270 [ 477.878783][T18931] ____sys_sendmsg+0x505/0x830 [ 477.878810][T18931] ? __pfx_____sys_sendmsg+0x10/0x10 [ 477.878840][T18931] ? import_iovec+0x74/0xa0 [ 477.878865][T18931] ___sys_sendmsg+0x21f/0x2a0 [ 477.878888][T18931] ? __pfx____sys_sendmsg+0x10/0x10 [ 477.878947][T18931] ? __fget_files+0x2a/0x420 [ 477.878968][T18931] ? __fget_files+0x3a0/0x420 [ 477.878998][T18931] __x64_sys_sendmsg+0x19b/0x260 [ 477.879022][T18931] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 477.879052][T18931] ? __pfx_ksys_write+0x10/0x10 [ 477.879070][T18931] ? rcu_is_watching+0x15/0xb0 [ 477.879092][T18931] ? do_syscall_64+0xbe/0x3b0 [ 477.879113][T18931] do_syscall_64+0xfa/0x3b0 [ 477.879128][T18931] ? lockdep_hardirqs_on+0x9c/0x150 [ 477.879150][T18931] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 477.879167][T18931] ? clear_bhb_loop+0x60/0xb0 [ 477.879193][T18931] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 477.879210][T18931] RIP: 0033:0x7f5f9cb8eec9 [ 477.879225][T18931] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 477.879239][T18931] RSP: 002b:00007f5f9da89038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 477.879258][T18931] RAX: ffffffffffffffda RBX: 00007f5f9cde5fa0 RCX: 00007f5f9cb8eec9 [ 477.879271][T18931] RDX: 0000000000000080 RSI: 0000200000000180 RDI: 0000000000000005 [ 477.879281][T18931] RBP: 00007f5f9da89090 R08: 0000000000000000 R09: 0000000000000000 [ 477.879292][T18931] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 477.879302][T18931] R13: 00007f5f9cde6038 R14: 00007f5f9cde5fa0 R15: 00007ffece279df8 [ 477.879333][T18931] [ 477.880523][T18931] netlink: 104 bytes leftover after parsing attributes in process `syz.2.3374'. [ 478.894022][ T5184] Bluetooth: hci1: command 0x0405 tx timeout [ 479.002183][T18951] netlink: 104 bytes leftover after parsing attributes in process `syz.0.3381'. [ 479.403283][T18962] netlink: 104 bytes leftover after parsing attributes in process `syz.0.3385'. [ 479.412977][T18962] FAULT_INJECTION: forcing a failure. [ 479.412977][T18962] name failslab, interval 1, probability 0, space 0, times 0 [ 479.464065][T18962] CPU: 0 UID: 0 PID: 18962 Comm: syz.0.3385 Not tainted syzkaller #0 PREEMPT(full) [ 479.464091][T18962] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 479.464102][T18962] Call Trace: [ 479.464109][T18962] [ 479.464117][T18962] dump_stack_lvl+0x189/0x250 [ 479.464146][T18962] ? __pfx____ratelimit+0x10/0x10 [ 479.464170][T18962] ? __pfx_dump_stack_lvl+0x10/0x10 [ 479.464189][T18962] ? __pfx__printk+0x10/0x10 [ 479.464216][T18962] ? __pfx___might_resched+0x10/0x10 [ 479.464237][T18962] ? fs_reclaim_acquire+0x7d/0x100 [ 479.464264][T18962] should_fail_ex+0x414/0x560 [ 479.464292][T18962] should_failslab+0xa8/0x100 [ 479.464314][T18962] kmem_cache_alloc_node_noprof+0x76/0x3c0 [ 479.464334][T18962] ? __alloc_skb+0x112/0x2d0 [ 479.464357][T18962] __alloc_skb+0x112/0x2d0 [ 479.464381][T18962] netlink_ack+0x146/0xa50 [ 479.464400][T18962] ? rcu_is_watching+0x15/0xb0 [ 479.464416][T18962] ? trace_contention_end+0x39/0x120 [ 479.464446][T18962] netlink_rcv_skb+0x28c/0x470 [ 479.464466][T18962] ? __pfx_xfrm_user_rcv_msg+0x10/0x10 [ 479.464490][T18962] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 479.464525][T18962] ? netlink_deliver_tap+0x2e/0x1b0 [ 479.464542][T18962] ? netlink_deliver_tap+0x2e/0x1b0 [ 479.464562][T18962] xfrm_netlink_rcv+0x79/0x90 [ 479.464585][T18962] netlink_unicast+0x82f/0x9e0 [ 479.464612][T18962] ? __pfx_netlink_unicast+0x10/0x10 [ 479.464631][T18962] ? netlink_sendmsg+0x642/0xb30 [ 479.464647][T18962] ? skb_put+0x11b/0x210 [ 479.464669][T18962] netlink_sendmsg+0x805/0xb30 [ 479.464697][T18962] ? __pfx_netlink_sendmsg+0x10/0x10 [ 479.464719][T18962] ? aa_sock_msg_perm+0xf1/0x1d0 [ 479.464745][T18962] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 479.464761][T18962] ? __pfx_netlink_sendmsg+0x10/0x10 [ 479.464781][T18962] __sock_sendmsg+0x219/0x270 [ 479.464808][T18962] ____sys_sendmsg+0x505/0x830 [ 479.464835][T18962] ? __pfx_____sys_sendmsg+0x10/0x10 [ 479.464865][T18962] ? import_iovec+0x74/0xa0 [ 479.464888][T18962] ___sys_sendmsg+0x21f/0x2a0 [ 479.464912][T18962] ? __pfx____sys_sendmsg+0x10/0x10 [ 479.464972][T18962] ? __fget_files+0x2a/0x420 [ 479.464992][T18962] ? __fget_files+0x3a0/0x420 [ 479.465025][T18962] __x64_sys_sendmsg+0x19b/0x260 [ 479.465049][T18962] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 479.465083][T18962] ? __pfx_ksys_write+0x10/0x10 [ 479.465100][T18962] ? rcu_is_watching+0x15/0xb0 [ 479.465121][T18962] ? do_syscall_64+0xbe/0x3b0 [ 479.465147][T18962] do_syscall_64+0xfa/0x3b0 [ 479.465162][T18962] ? lockdep_hardirqs_on+0x9c/0x150 [ 479.465184][T18962] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 479.465201][T18962] ? clear_bhb_loop+0x60/0xb0 [ 479.465222][T18962] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 479.465238][T18962] RIP: 0033:0x7fd1a738eec9 [ 479.465254][T18962] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 479.465268][T18962] RSP: 002b:00007fd1a81c3038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 479.465287][T18962] RAX: ffffffffffffffda RBX: 00007fd1a75e5fa0 RCX: 00007fd1a738eec9 [ 479.465299][T18962] RDX: 0000000000000080 RSI: 0000200000000180 RDI: 0000000000000005 [ 479.465311][T18962] RBP: 00007fd1a81c3090 R08: 0000000000000000 R09: 0000000000000000 [ 479.465322][T18962] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 479.465332][T18962] R13: 00007fd1a75e6038 R14: 00007fd1a75e5fa0 R15: 00007ffe206d78d8 [ 479.465363][T18962] [ 480.250501][T18966] netlink: 'syz.3.3386': attribute type 1 has an invalid length. [ 480.306550][T18966] netlink: 'syz.3.3386': attribute type 2 has an invalid length. [ 481.458593][T19003] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3394'. [ 481.659196][T19003] xfrm1: entered promiscuous mode [ 481.665553][T19007] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3396'. [ 481.688509][T19003] xfrm1: entered allmulticast mode [ 481.761297][T19003] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3394'. [ 481.905633][T19015] netlink: 'syz.0.3398': attribute type 13 has an invalid length. [ 481.944347][T19015] gretap0: refused to change device tx_queue_len [ 481.951326][T19015] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 482.058272][T19025] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3401'. [ 482.113675][T19033] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3402'. [ 482.151696][T19033] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3402'. [ 482.162204][T19035] netlink: 104 bytes leftover after parsing attributes in process `syz.0.3403'. [ 482.167025][T19028] netlink: 1041 bytes leftover after parsing attributes in process `syz.3.3400'. [ 482.177306][T19035] FAULT_INJECTION: forcing a failure. [ 482.177306][T19035] name failslab, interval 1, probability 0, space 0, times 0 [ 482.217230][T19035] CPU: 1 UID: 0 PID: 19035 Comm: syz.0.3403 Not tainted syzkaller #0 PREEMPT(full) [ 482.217255][T19035] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 482.217264][T19035] Call Trace: [ 482.217272][T19035] [ 482.217280][T19035] dump_stack_lvl+0x189/0x250 [ 482.217304][T19035] ? __pfx____ratelimit+0x10/0x10 [ 482.217328][T19035] ? __pfx_dump_stack_lvl+0x10/0x10 [ 482.217346][T19035] ? __pfx__printk+0x10/0x10 [ 482.217364][T19035] ? xfrm_netlink_rcv+0x79/0x90 [ 482.217388][T19035] ? ____sys_sendmsg+0x505/0x830 [ 482.217407][T19035] ? __x64_sys_sendmsg+0x19b/0x260 [ 482.217438][T19035] should_fail_ex+0x414/0x560 [ 482.217466][T19035] should_failslab+0xa8/0x100 [ 482.217490][T19035] kmem_cache_alloc_noprof+0x73/0x3c0 [ 482.217510][T19035] ? skb_clone+0x212/0x3a0 [ 482.217535][T19035] skb_clone+0x212/0x3a0 [ 482.217559][T19035] __netlink_deliver_tap+0x404/0x850 [ 482.217592][T19035] ? netlink_deliver_tap+0x2e/0x1b0 [ 482.217611][T19035] netlink_deliver_tap+0x19c/0x1b0 [ 482.217631][T19035] netlink_sendskb+0x68/0x140 [ 482.217657][T19035] netlink_unicast+0x397/0x9e0 [ 482.217671][T19035] ? __asan_memcpy+0x40/0x70 [ 482.217698][T19035] ? __pfx_netlink_unicast+0x10/0x10 [ 482.217726][T19035] netlink_rcv_skb+0x28c/0x470 [ 482.217745][T19035] ? __pfx_xfrm_user_rcv_msg+0x10/0x10 [ 482.217770][T19035] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 482.217805][T19035] ? netlink_deliver_tap+0x2e/0x1b0 [ 482.217828][T19035] ? netlink_deliver_tap+0x2e/0x1b0 [ 482.217849][T19035] xfrm_netlink_rcv+0x79/0x90 [ 482.217872][T19035] netlink_unicast+0x82f/0x9e0 [ 482.217900][T19035] ? __pfx_netlink_unicast+0x10/0x10 [ 482.217919][T19035] ? netlink_sendmsg+0x642/0xb30 [ 482.217935][T19035] ? skb_put+0x11b/0x210 [ 482.217958][T19035] netlink_sendmsg+0x805/0xb30 [ 482.217987][T19035] ? __pfx_netlink_sendmsg+0x10/0x10 [ 482.218009][T19035] ? aa_sock_msg_perm+0xf1/0x1d0 [ 482.218035][T19035] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 482.218052][T19035] ? __pfx_netlink_sendmsg+0x10/0x10 [ 482.218071][T19035] __sock_sendmsg+0x219/0x270 [ 482.218098][T19035] ____sys_sendmsg+0x505/0x830 [ 482.218125][T19035] ? __pfx_____sys_sendmsg+0x10/0x10 [ 482.218156][T19035] ? import_iovec+0x74/0xa0 [ 482.218180][T19035] ___sys_sendmsg+0x21f/0x2a0 [ 482.218205][T19035] ? __pfx____sys_sendmsg+0x10/0x10 [ 482.218267][T19035] ? __fget_files+0x2a/0x420 [ 482.218287][T19035] ? __fget_files+0x3a0/0x420 [ 482.218320][T19035] __x64_sys_sendmsg+0x19b/0x260 [ 482.218344][T19035] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 482.218376][T19035] ? __pfx_ksys_write+0x10/0x10 [ 482.218393][T19035] ? rcu_is_watching+0x15/0xb0 [ 482.218415][T19035] ? do_syscall_64+0xbe/0x3b0 [ 482.218437][T19035] do_syscall_64+0xfa/0x3b0 [ 482.218452][T19035] ? lockdep_hardirqs_on+0x9c/0x150 [ 482.218473][T19035] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 482.218488][T19035] ? clear_bhb_loop+0x60/0xb0 [ 482.218508][T19035] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 482.218522][T19035] RIP: 0033:0x7fd1a738eec9 [ 482.218538][T19035] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 482.218551][T19035] RSP: 002b:00007fd1a81c3038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 482.218569][T19035] RAX: ffffffffffffffda RBX: 00007fd1a75e5fa0 RCX: 00007fd1a738eec9 [ 482.218581][T19035] RDX: 0000000000000080 RSI: 0000200000000180 RDI: 0000000000000005 [ 482.218591][T19035] RBP: 00007fd1a81c3090 R08: 0000000000000000 R09: 0000000000000000 [ 482.218602][T19035] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 482.218612][T19035] R13: 00007fd1a75e6038 R14: 00007fd1a75e5fa0 R15: 00007ffe206d78d8 [ 482.218643][T19035] [ 482.618404][T19040] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3404'. [ 482.714274][T19040] syzkaller1: entered allmulticast mode [ 482.856999][T19063] netlink: 104 bytes leftover after parsing attributes in process `syz.3.3411'. [ 483.269366][T19076] RDS: rds_bind could not find a transport for fc02::1, load rds_tcp or rds_rdma? [ 483.506201][T19087] syzkaller0 speed is unknown, defaulting to 1000 [ 483.515500][T19086] netlink: 'syz.2.3417': attribute type 1 has an invalid length. [ 483.651427][T19091] syzkaller0 speed is unknown, defaulting to 1000 [ 483.779262][T19089] bond1: entered promiscuous mode [ 483.823135][T19089] 8021q: adding VLAN 0 to HW filter on device bond1 [ 483.841100][T19105] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 483.865529][T19096] 8021q: adding VLAN 0 to HW filter on device bond1 [ 483.872497][T19096] bond1: (slave wireguard0): The slave device specified does not support setting the MAC address [ 483.885285][T19096] bond1: (slave wireguard0): Error -95 calling set_mac_address [ 483.966362][T19099] tipc: Started in network mode [ 483.971417][T19099] tipc: Node identity f2e938e30ca9, cluster identity 4711 [ 483.978905][T19099] tipc: Enabled bearer , priority 0 [ 483.989877][T19104] bridge_slave_1: left allmulticast mode [ 483.995701][T19104] bridge_slave_1: left promiscuous mode [ 484.001554][T19104] bridge0: port 2(bridge_slave_1) entered disabled state [ 484.017698][ T5184] Bluetooth: hci1: command 0x0405 tx timeout [ 484.029789][T19104] bridge_slave_0: left allmulticast mode [ 484.036156][T19104] bridge_slave_0: left promiscuous mode [ 484.042191][T19104] bridge0: port 1(bridge_slave_0) entered disabled state [ 484.153322][T19101] syzkaller0: entered promiscuous mode [ 484.158970][T19101] syzkaller0: entered allmulticast mode [ 484.172705][T19098] tipc: Resetting bearer [ 484.217252][T19098] tipc: Disabling bearer [ 484.352733][T19118] FAULT_INJECTION: forcing a failure. [ 484.352733][T19118] name failslab, interval 1, probability 0, space 0, times 0 [ 484.394153][T19118] CPU: 1 UID: 0 PID: 19118 Comm: syz.1.3427 Not tainted syzkaller #0 PREEMPT(full) [ 484.394178][T19118] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 484.394188][T19118] Call Trace: [ 484.394195][T19118] [ 484.394203][T19118] dump_stack_lvl+0x189/0x250 [ 484.394226][T19118] ? __pfx____ratelimit+0x10/0x10 [ 484.394248][T19118] ? __pfx_dump_stack_lvl+0x10/0x10 [ 484.394266][T19118] ? __pfx__printk+0x10/0x10 [ 484.394292][T19118] ? __pfx___might_resched+0x10/0x10 [ 484.394314][T19118] ? fs_reclaim_acquire+0x7d/0x100 [ 484.394341][T19118] should_fail_ex+0x414/0x560 [ 484.394368][T19118] should_failslab+0xa8/0x100 [ 484.394390][T19118] kmem_cache_alloc_node_noprof+0x76/0x3c0 [ 484.394410][T19118] ? __alloc_skb+0x112/0x2d0 [ 484.394435][T19118] __alloc_skb+0x112/0x2d0 [ 484.394457][T19118] netlink_ack+0x146/0xa50 [ 484.394476][T19118] ? rcu_is_watching+0x15/0xb0 [ 484.394493][T19118] ? trace_contention_end+0x39/0x120 [ 484.394521][T19118] netlink_rcv_skb+0x28c/0x470 [ 484.394540][T19118] ? __pfx_xfrm_user_rcv_msg+0x10/0x10 [ 484.394565][T19118] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 484.394599][T19118] ? netlink_deliver_tap+0x2e/0x1b0 [ 484.394616][T19118] ? netlink_deliver_tap+0x2e/0x1b0 [ 484.394637][T19118] xfrm_netlink_rcv+0x79/0x90 [ 484.394661][T19118] netlink_unicast+0x82f/0x9e0 [ 484.394695][T19118] ? __pfx_netlink_unicast+0x10/0x10 [ 484.394714][T19118] ? netlink_sendmsg+0x642/0xb30 [ 484.394729][T19118] ? skb_put+0x11b/0x210 [ 484.394752][T19118] netlink_sendmsg+0x805/0xb30 [ 484.394781][T19118] ? __pfx_netlink_sendmsg+0x10/0x10 [ 484.394803][T19118] ? aa_sock_msg_perm+0xf1/0x1d0 [ 484.394829][T19118] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 484.394846][T19118] ? __pfx_netlink_sendmsg+0x10/0x10 [ 484.394865][T19118] __sock_sendmsg+0x219/0x270 [ 484.394892][T19118] ____sys_sendmsg+0x505/0x830 [ 484.394918][T19118] ? __pfx_____sys_sendmsg+0x10/0x10 [ 484.394949][T19118] ? import_iovec+0x74/0xa0 [ 484.394972][T19118] ___sys_sendmsg+0x21f/0x2a0 [ 484.394993][T19118] ? __pfx____sys_sendmsg+0x10/0x10 [ 484.395051][T19118] ? __fget_files+0x2a/0x420 [ 484.395069][T19118] ? __fget_files+0x3a0/0x420 [ 484.395094][T19118] __x64_sys_sendmsg+0x19b/0x260 [ 484.395112][T19118] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 484.395136][T19118] ? __pfx_ksys_write+0x10/0x10 [ 484.395149][T19118] ? rcu_is_watching+0x15/0xb0 [ 484.395165][T19118] ? do_syscall_64+0xbe/0x3b0 [ 484.395181][T19118] do_syscall_64+0xfa/0x3b0 [ 484.395193][T19118] ? lockdep_hardirqs_on+0x9c/0x150 [ 484.395210][T19118] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 484.395223][T19118] ? clear_bhb_loop+0x60/0xb0 [ 484.395239][T19118] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 484.395251][T19118] RIP: 0033:0x7fdd2cf8eec9 [ 484.395264][T19118] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 484.395276][T19118] RSP: 002b:00007fdd2de09038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 484.395291][T19118] RAX: ffffffffffffffda RBX: 00007fdd2d1e5fa0 RCX: 00007fdd2cf8eec9 [ 484.395301][T19118] RDX: 0000000000000080 RSI: 0000200000000180 RDI: 0000000000000004 [ 484.395310][T19118] RBP: 00007fdd2de09090 R08: 0000000000000000 R09: 0000000000000000 [ 484.395318][T19118] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 484.395326][T19118] R13: 00007fdd2d1e6038 R14: 00007fdd2d1e5fa0 R15: 00007fff9a618908 [ 484.395349][T19118] [ 484.842075][T19123] tipc: Started in network mode [ 484.862284][T19123] tipc: Node identity ac14140f, cluster identity 4711 [ 484.869889][T19123] tipc: New replicast peer: 255.255.255.255 [ 484.876899][T19123] tipc: Enabled bearer , priority 10 [ 484.939406][T19125] netlink: 'syz.0.3429': attribute type 7 has an invalid length. [ 485.273242][T19159] netlink: 'syz.1.3439': attribute type 1 has an invalid length. [ 485.317342][T19159] bond1: entered promiscuous mode [ 485.322706][T19159] 8021q: adding VLAN 0 to HW filter on device bond1 [ 485.350457][T19159] 8021q: adding VLAN 0 to HW filter on device bond1 [ 485.357678][T19159] bond1: (slave wireguard0): The slave device specified does not support setting the MAC address [ 485.368440][T19159] bond1: (slave wireguard0): Setting fail_over_mac to active for active-backup mode [ 485.383361][T19159] bond1: (slave wireguard0): making interface the new active one [ 485.391521][T19159] wireguard0: entered promiscuous mode [ 485.403032][T19159] bond1: (slave wireguard0): Enslaving as an active interface with an up link [ 485.432912][T19168] bridge3: port 1(macvlan2) entered blocking state [ 485.440302][T19168] bridge3: port 1(macvlan2) entered disabled state [ 485.447807][T19168] macvlan2: entered allmulticast mode [ 485.462497][T19168] macvlan2: entered promiscuous mode [ 486.035944][T19202] FAULT_INJECTION: forcing a failure. [ 486.035944][T19202] name failslab, interval 1, probability 0, space 0, times 0 [ 486.049748][T19202] CPU: 1 UID: 0 PID: 19202 Comm: syz.3.3452 Not tainted syzkaller #0 PREEMPT(full) [ 486.049772][T19202] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 486.049783][T19202] Call Trace: [ 486.049790][T19202] [ 486.049797][T19202] dump_stack_lvl+0x189/0x250 [ 486.049821][T19202] ? __pfx____ratelimit+0x10/0x10 [ 486.049845][T19202] ? __pfx_dump_stack_lvl+0x10/0x10 [ 486.049864][T19202] ? __pfx__printk+0x10/0x10 [ 486.049881][T19202] ? xfrm_netlink_rcv+0x79/0x90 [ 486.049905][T19202] ? ____sys_sendmsg+0x505/0x830 [ 486.049923][T19202] ? __x64_sys_sendmsg+0x19b/0x260 [ 486.049953][T19202] should_fail_ex+0x414/0x560 [ 486.049981][T19202] should_failslab+0xa8/0x100 [ 486.050005][T19202] kmem_cache_alloc_noprof+0x73/0x3c0 [ 486.050024][T19202] ? skb_clone+0x212/0x3a0 [ 486.050049][T19202] skb_clone+0x212/0x3a0 [ 486.050074][T19202] __netlink_deliver_tap+0x404/0x850 [ 486.050107][T19202] ? netlink_deliver_tap+0x2e/0x1b0 [ 486.050127][T19202] netlink_deliver_tap+0x19c/0x1b0 [ 486.050147][T19202] netlink_sendskb+0x68/0x140 [ 486.050174][T19202] netlink_unicast+0x397/0x9e0 [ 486.050188][T19202] ? __asan_memcpy+0x40/0x70 [ 486.050215][T19202] ? __pfx_netlink_unicast+0x10/0x10 [ 486.050244][T19202] netlink_rcv_skb+0x28c/0x470 [ 486.050264][T19202] ? __pfx_xfrm_user_rcv_msg+0x10/0x10 [ 486.050288][T19202] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 486.050324][T19202] ? netlink_deliver_tap+0x2e/0x1b0 [ 486.050345][T19202] ? netlink_deliver_tap+0x2e/0x1b0 [ 486.050366][T19202] xfrm_netlink_rcv+0x79/0x90 [ 486.050389][T19202] netlink_unicast+0x82f/0x9e0 [ 486.050415][T19202] ? __pfx_netlink_unicast+0x10/0x10 [ 486.050433][T19202] ? netlink_sendmsg+0x642/0xb30 [ 486.050450][T19202] ? skb_put+0x11b/0x210 [ 486.050472][T19202] netlink_sendmsg+0x805/0xb30 [ 486.050500][T19202] ? __pfx_netlink_sendmsg+0x10/0x10 [ 486.050527][T19202] ? aa_sock_msg_perm+0xf1/0x1d0 [ 486.050553][T19202] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 486.050570][T19202] ? __pfx_netlink_sendmsg+0x10/0x10 [ 486.050590][T19202] __sock_sendmsg+0x219/0x270 [ 486.050617][T19202] ____sys_sendmsg+0x505/0x830 [ 486.050644][T19202] ? __pfx_____sys_sendmsg+0x10/0x10 [ 486.050675][T19202] ? import_iovec+0x74/0xa0 [ 486.050700][T19202] ___sys_sendmsg+0x21f/0x2a0 [ 486.050723][T19202] ? __pfx____sys_sendmsg+0x10/0x10 [ 486.050785][T19202] ? __fget_files+0x2a/0x420 [ 486.050806][T19202] ? __fget_files+0x3a0/0x420 [ 486.050840][T19202] __x64_sys_sendmsg+0x19b/0x260 [ 486.050864][T19202] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 486.050895][T19202] ? __pfx_ksys_write+0x10/0x10 [ 486.050912][T19202] ? rcu_is_watching+0x15/0xb0 [ 486.050933][T19202] ? do_syscall_64+0xbe/0x3b0 [ 486.050954][T19202] do_syscall_64+0xfa/0x3b0 [ 486.050969][T19202] ? lockdep_hardirqs_on+0x9c/0x150 [ 486.050992][T19202] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 486.051009][T19202] ? clear_bhb_loop+0x60/0xb0 [ 486.051030][T19202] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 486.051046][T19202] RIP: 0033:0x7fa522f8eec9 [ 486.051062][T19202] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 486.051076][T19202] RSP: 002b:00007fa523d4b038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 486.051095][T19202] RAX: ffffffffffffffda RBX: 00007fa5231e5fa0 RCX: 00007fa522f8eec9 [ 486.051108][T19202] RDX: 0000000000000080 RSI: 0000200000000180 RDI: 0000000000000004 [ 486.051119][T19202] RBP: 00007fa523d4b090 R08: 0000000000000000 R09: 0000000000000000 [ 486.051130][T19202] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 486.051140][T19202] R13: 00007fa5231e6038 R14: 00007fa5231e5fa0 R15: 00007ffeb7076da8 [ 486.051172][T19202] [ 486.454195][ T5996] tipc: Node number set to 2886997007 [ 486.567071][T19208] @ÿ: renamed from veth0_vlan (while UP) [ 486.592176][T19209] __nla_validate_parse: 16 callbacks suppressed [ 486.592196][T19209] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3454'. [ 486.689835][T19211] syzkaller0 speed is unknown, defaulting to 1000 [ 486.922505][T19214] syzkaller0 speed is unknown, defaulting to 1000 [ 487.028034][T19217] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3458'. [ 487.051596][T19227] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3459'. [ 487.245015][T19231] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3460'. [ 487.397936][T19226] syzkaller0 speed is unknown, defaulting to 1000 [ 487.418521][T19231] netlink: 596 bytes leftover after parsing attributes in process `syz.0.3460'. [ 487.642918][T19235] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3461'. [ 487.653159][T19235] nbd: nbd3 already in use [ 487.710734][T19240] netlink: 'syz.0.3462': attribute type 6 has an invalid length. [ 487.756366][T19245] llcp: llcp_sock_recvmsg: Recv datagram failed state 4 -11 0 [ 487.819231][T19247] unknown channel width for channel at 909000KHz? [ 487.919451][T19249] netlink: 'syz.3.3464': attribute type 5 has an invalid length. [ 487.923687][T19250] netlink: 104 bytes leftover after parsing attributes in process `syz.0.3465'. [ 487.933170][T19249] netlink: 44 bytes leftover after parsing attributes in process `syz.3.3464'. [ 487.948606][T19250] FAULT_INJECTION: forcing a failure. [ 487.948606][T19250] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 487.983984][T19250] CPU: 0 UID: 0 PID: 19250 Comm: syz.0.3465 Not tainted syzkaller #0 PREEMPT(full) [ 487.984011][T19250] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 487.984021][T19250] Call Trace: [ 487.984028][T19250] [ 487.984035][T19250] dump_stack_lvl+0x189/0x250 [ 487.984058][T19250] ? __pfx____ratelimit+0x10/0x10 [ 487.984079][T19250] ? __pfx_dump_stack_lvl+0x10/0x10 [ 487.984103][T19250] ? __pfx__printk+0x10/0x10 [ 487.984134][T19250] should_fail_ex+0x414/0x560 [ 487.984161][T19250] _copy_to_user+0x31/0xb0 [ 487.984185][T19250] simple_read_from_buffer+0xe1/0x170 [ 487.984211][T19250] proc_fail_nth_read+0x1b3/0x220 [ 487.984233][T19250] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 487.984254][T19250] ? rw_verify_area+0x2a6/0x4d0 [ 487.984270][T19250] ? __lock_acquire+0xab9/0xd20 [ 487.984289][T19250] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 487.984308][T19250] vfs_read+0x200/0xa30 [ 487.984326][T19250] ? fdget_pos+0x247/0x320 [ 487.984350][T19250] ? __pfx___mutex_lock+0x10/0x10 [ 487.984366][T19250] ? __pfx_vfs_read+0x10/0x10 [ 487.984385][T19250] ? __fget_files+0x2a/0x420 [ 487.984406][T19250] ? __fget_files+0x3a0/0x420 [ 487.984422][T19250] ? __fget_files+0x2a/0x420 [ 487.984445][T19250] ksys_read+0x145/0x250 [ 487.984462][T19250] ? __pfx_ksys_read+0x10/0x10 [ 487.984475][T19250] ? rcu_is_watching+0x15/0xb0 [ 487.984492][T19250] ? do_syscall_64+0xbe/0x3b0 [ 487.984508][T19250] do_syscall_64+0xfa/0x3b0 [ 487.984519][T19250] ? lockdep_hardirqs_on+0x9c/0x150 [ 487.984537][T19250] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 487.984550][T19250] ? clear_bhb_loop+0x60/0xb0 [ 487.984566][T19250] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 487.984578][T19250] RIP: 0033:0x7fd1a738d8dc [ 487.984591][T19250] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 487.984602][T19250] RSP: 002b:00007fd1a81c3030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 487.984617][T19250] RAX: ffffffffffffffda RBX: 00007fd1a75e5fa0 RCX: 00007fd1a738d8dc [ 487.984627][T19250] RDX: 000000000000000f RSI: 00007fd1a81c30a0 RDI: 0000000000000005 [ 487.984636][T19250] RBP: 00007fd1a81c3090 R08: 0000000000000000 R09: 0000000000000000 [ 487.984644][T19250] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 487.984651][T19250] R13: 00007fd1a75e6038 R14: 00007fd1a75e5fa0 R15: 00007ffe206d78d8 [ 487.984675][T19250] [ 488.441183][T19255] vxcan3: entered allmulticast mode [ 488.535383][T19260] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3468'. [ 488.602036][T19260] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3468'. [ 489.030792][T19275] syzkaller0 speed is unknown, defaulting to 1000 [ 489.072786][T19289] netlink: 'syz.0.3476': attribute type 1 has an invalid length. [ 489.138419][T19289] 8021q: adding VLAN 0 to HW filter on device bond1 [ 489.284410][ T76] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 489.298155][ T76] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 489.462673][T19304] syzkaller0 speed is unknown, defaulting to 1000 [ 489.552560][T19311] geneve2: entered promiscuous mode [ 490.123228][T19320] syzkaller0 speed is unknown, defaulting to 1000 [ 490.182222][T19332] vxcan5: entered allmulticast mode [ 490.321489][T19335] netlink: 'syz.1.3489': attribute type 7 has an invalid length. [ 490.342362][T19335] netlink: 'syz.1.3489': attribute type 8 has an invalid length. [ 490.687500][ T30] audit: type=1800 audit(1758848887.326:7): pid=19353 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.3494" name="@" dev="tmpfs" ino=527 res=0 errno=0 [ 490.792884][T19356] syzkaller0 speed is unknown, defaulting to 1000 [ 491.123743][T19377] netlink: 'syz.0.3499': attribute type 39 has an invalid length. [ 491.573358][T19403] syzkaller0 speed is unknown, defaulting to 1000 [ 491.692878][T19408] bond1: entered promiscuous mode [ 491.706953][T19408] bond1: entered allmulticast mode [ 491.712461][T19408] 8021q: adding VLAN 0 to HW filter on device bond1 [ 491.777022][T19423] __nla_validate_parse: 13 callbacks suppressed [ 491.777041][T19423] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3509'. [ 491.895181][T19425] bond0: (slave rose0): Error: Device is in use and cannot be enslaved [ 492.015903][T19427] syzkaller1: entered promiscuous mode [ 492.023162][T19435] netlink: 104 bytes leftover after parsing attributes in process `syz.2.3512'. [ 492.035949][T19427] syzkaller1: entered allmulticast mode [ 492.360518][T19455] netlink: 'syz.0.3516': attribute type 31 has an invalid length. [ 492.568265][T19468] vxcan3: entered allmulticast mode [ 493.070307][T19461] syzkaller0 speed is unknown, defaulting to 1000 [ 493.696683][T19507] syzkaller0 speed is unknown, defaulting to 1000 [ 493.824047][T19520] netlink: 32 bytes leftover after parsing attributes in process `syz.3.3530'. [ 493.955506][T19523] netlink: 104 bytes leftover after parsing attributes in process `syz.1.3532'. [ 494.521793][T19555] netlink: 360 bytes leftover after parsing attributes in process `syz.3.3543'. [ 494.638082][T19564] netlink: 'syz.3.3544': attribute type 12 has an invalid length. [ 494.649297][T19564] netlink: 'syz.3.3544': attribute type 29 has an invalid length. [ 494.658269][T19564] netlink: 148 bytes leftover after parsing attributes in process `syz.3.3544'. [ 494.758736][T19567] netlink: 104 bytes leftover after parsing attributes in process `syz.0.3545'. [ 494.760936][T19568] IPVS: set_ctl: invalid protocol: 137 224.0.0.1:20004 [ 495.236750][T19588] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3554'. [ 495.240221][T19584] syzkaller0 speed is unknown, defaulting to 1000 [ 495.518387][T19527] netlink: 104 bytes leftover after parsing attributes in process `syz.2.3534'. [ 495.619884][T19607] netlink: 'syz.1.3558': attribute type 10 has an invalid length. [ 495.682786][T19611] netlink: 104 bytes leftover after parsing attributes in process `syz.0.3560'. [ 495.809971][T19607] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 496.040409][T19626] syzkaller0 speed is unknown, defaulting to 1000 [ 496.277814][T19628] syz_tun: entered promiscuous mode [ 496.298891][T19628] bond0: entered promiscuous mode [ 496.315596][T19628] bond0: left promiscuous mode [ 496.328361][T19628] syz_tun: left promiscuous mode [ 496.854014][T19665] openvswitch: netlink: Key type 186 is out of range max 32 [ 496.910766][T19665] __nla_validate_parse: 75 callbacks suppressed [ 496.910783][T19665] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3575'. [ 497.017777][T19669] netlink: 104 bytes leftover after parsing attributes in process `syz.0.3576'. [ 497.192121][T19655] syzkaller0 speed is unknown, defaulting to 1000 [ 497.422666][T19681] syzkaller0 speed is unknown, defaulting to 1000 [ 497.918151][T19699] bridge_slave_0: left allmulticast mode [ 497.926895][T19699] bridge_slave_0: left promiscuous mode [ 497.933809][T19699] bridge0: port 1(bridge_slave_0) entered disabled state [ 497.947506][T19691] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 497.949029][T19699] bridge_slave_1: left allmulticast mode [ 497.969098][T19699] bridge_slave_1: left promiscuous mode [ 497.975012][T19699] bridge0: port 2(bridge_slave_1) entered disabled state [ 497.986356][T19691] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3581'. [ 497.999236][T19699] bond0: (slave bond_slave_0): Releasing backup interface [ 498.016314][T19699] bond0: (slave bond_slave_1): Releasing backup interface [ 498.056704][T19699] team0: Port device team_slave_0 removed [ 498.085618][T19699] team0: Port device team_slave_1 removed [ 498.092463][T19699] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 498.101909][T19699] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 498.111798][T19699] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 498.248026][T19712] ªªªªªB: renamed from dummy0 (while UP) [ 498.262557][T19714] Bluetooth: MGMT ver 1.23 [ 498.402235][T19722] netlink: 104 bytes leftover after parsing attributes in process `syz.1.3587'. [ 498.448791][T19720] syzkaller0 speed is unknown, defaulting to 1000 [ 499.179430][T19750] syzkaller0 speed is unknown, defaulting to 1000 [ 499.736002][T19770] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3596'. [ 499.857027][T19772] netlink: 14 bytes leftover after parsing attributes in process `syz.3.3596'. [ 499.910181][T19770] bond0: entered promiscuous mode [ 499.934755][T19770] bond_slave_0: entered promiscuous mode [ 499.943350][T19770] bond_slave_1: entered promiscuous mode [ 499.968523][T19770] batadv0: entered promiscuous mode [ 499.996305][T19770] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 500.006912][T19778] netlink: 104 bytes leftover after parsing attributes in process `syz.2.3599'. [ 500.137662][T19782] netlink: 248 bytes leftover after parsing attributes in process `syz.1.3600'. [ 500.207770][T19786] netlink: 76 bytes leftover after parsing attributes in process `syz.1.3600'. [ 500.303181][T19772] bond0 (unregistering): left promiscuous mode [ 500.309637][T19772] bond_slave_0: left promiscuous mode [ 500.322266][T19772] bond_slave_1: left promiscuous mode [ 500.384831][T19772] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 500.403236][T19772] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 500.442019][T19772] bond0 (unregistering): Released all slaves [ 500.555353][T19766] syzkaller0: entered promiscuous mode [ 500.560906][T19766] syzkaller0: entered allmulticast mode [ 500.772075][T19797] netlink: 'syz.3.3602': attribute type 9 has an invalid length. [ 500.784541][T19797] netlink: 224 bytes leftover after parsing attributes in process `syz.3.3602'. [ 502.472830][T19784] syzkaller0 speed is unknown, defaulting to 1000 [ 502.802698][T19802] syzkaller0 speed is unknown, defaulting to 1000 [ 503.151529][T19814] netlink: 100 bytes leftover after parsing attributes in process `syz.3.3606'. [ 503.232906][T19814] netlink: 36 bytes leftover after parsing attributes in process `syz.3.3606'. [ 503.416806][T19816] netlink: 32 bytes leftover after parsing attributes in process `syz.2.3607'. [ 503.755077][T19830] netlink: 104 bytes leftover after parsing attributes in process `syz.0.3611'. [ 504.064251][T19848] netlink: 104 bytes leftover after parsing attributes in process `syz.4.3617'. [ 504.141890][T19843] syzkaller0: entered promiscuous mode [ 504.147622][T19843] syzkaller0: entered allmulticast mode [ 504.456759][T19861] IPVS: set_ctl: invalid protocol: 44 10.1.1.1:20001 [ 504.464946][T19862] IPVS: set_ctl: invalid protocol: 44 10.1.1.1:20001 [ 504.472883][T19861] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3621'. [ 505.842194][T19845] syzkaller0 speed is unknown, defaulting to 1000 [ 505.882230][T19859] syzkaller0 speed is unknown, defaulting to 1000 [ 505.998249][T19877] netlink: 104 bytes leftover after parsing attributes in process `syz.1.3625'. [ 506.035444][T19875] only policy match revision 0 supported [ 506.035463][T19875] unable to load match [ 506.048626][T19875] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3624'. [ 506.062321][T19880] netlink: 'syz.2.3626': attribute type 1 has an invalid length. [ 506.212175][T19880] 8021q: adding VLAN 0 to HW filter on device bond2 [ 506.248287][T19887] 8021q: adding VLAN 0 to HW filter on device bond2 [ 506.256168][T19887] bond2: (slave vxcan3): The slave device specified does not support setting the MAC address [ 506.268100][T19887] bond2: (slave vxcan3): Error -95 calling set_mac_address [ 506.343015][T19888] veth3: entered promiscuous mode [ 506.392266][T19888] bond2: (slave veth3): Enslaving as an active interface with a down link [ 506.799269][T19925] netlink: 'syz.1.3637': attribute type 2 has an invalid length. [ 506.807496][T19925] netlink: 'syz.1.3637': attribute type 1 has an invalid length. [ 506.821308][T19925] netlink: 'syz.1.3637': attribute type 2 has an invalid length. [ 506.849292][T19925] netlink: 'syz.1.3637': attribute type 2 has an invalid length. [ 506.864091][T19925] netlink: 'syz.1.3637': attribute type 2 has an invalid length. [ 506.872223][T19926] netlink: 'syz.1.3637': attribute type 2 has an invalid length. [ 506.880283][T19926] netlink: 'syz.1.3637': attribute type 1 has an invalid length. [ 506.888236][T19926] netlink: 'syz.1.3637': attribute type 2 has an invalid length. [ 506.896074][T19926] netlink: 'syz.1.3637': attribute type 2 has an invalid length. [ 506.929493][T19931] netlink: 104 bytes leftover after parsing attributes in process `syz.4.3639'. [ 506.948341][T19935] veth0_macvtap: left promiscuous mode [ 507.022922][T19937] netlink: 35 bytes leftover after parsing attributes in process `syz.4.3641'. [ 507.451554][T19956] syzkaller0 speed is unknown, defaulting to 1000 [ 507.746947][T19980] syzkaller0 speed is unknown, defaulting to 1000 [ 508.437634][T20012] FAULT_INJECTION: forcing a failure. [ 508.437634][T20012] name failslab, interval 1, probability 0, space 0, times 0 [ 508.446848][T20011] __nla_validate_parse: 5 callbacks suppressed [ 508.446863][T20011] netlink: 36 bytes leftover after parsing attributes in process `syz.4.3660'. [ 508.473447][T20012] CPU: 1 UID: 0 PID: 20012 Comm: syz.2.3662 Not tainted syzkaller #0 PREEMPT(full) [ 508.473471][T20012] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 508.473481][T20012] Call Trace: [ 508.473488][T20012] [ 508.473497][T20012] dump_stack_lvl+0x189/0x250 [ 508.473520][T20012] ? __pfx____ratelimit+0x10/0x10 [ 508.473542][T20012] ? __pfx_dump_stack_lvl+0x10/0x10 [ 508.473558][T20012] ? __pfx__printk+0x10/0x10 [ 508.473584][T20012] ? __pfx___might_resched+0x10/0x10 [ 508.473610][T20012] should_fail_ex+0x414/0x560 [ 508.473635][T20012] should_failslab+0xa8/0x100 [ 508.473657][T20012] kmem_cache_alloc_node_noprof+0x76/0x3c0 [ 508.473678][T20012] ? __alloc_skb+0x112/0x2d0 [ 508.473700][T20012] __alloc_skb+0x112/0x2d0 [ 508.473722][T20012] netlink_sendmsg+0x5c6/0xb30 [ 508.473749][T20012] ? __pfx_netlink_sendmsg+0x10/0x10 [ 508.473772][T20012] ? aa_sock_msg_perm+0xf1/0x1d0 [ 508.473796][T20012] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 508.473811][T20012] ? __pfx_netlink_sendmsg+0x10/0x10 [ 508.473830][T20012] __sock_sendmsg+0x219/0x270 [ 508.473855][T20012] sock_write_iter+0x258/0x330 [ 508.473879][T20012] ? __pfx_sock_write_iter+0x10/0x10 [ 508.473924][T20012] do_iter_readv_writev+0x61c/0x8b0 [ 508.473951][T20012] ? __pfx_do_iter_readv_writev+0x10/0x10 [ 508.473969][T20012] ? common_file_perm+0x1b5/0x230 [ 508.473996][T20012] ? bpf_lsm_file_permission+0x9/0x20 [ 508.474013][T20012] ? security_file_permission+0x75/0x290 [ 508.474035][T20012] ? rw_verify_area+0x255/0x4d0 [ 508.474058][T20012] vfs_writev+0x31a/0x960 [ 508.474078][T20012] ? __lock_acquire+0xab9/0xd20 [ 508.474101][T20012] ? __pfx_vfs_writev+0x10/0x10 [ 508.474133][T20012] ? __fget_files+0x2a/0x420 [ 508.474159][T20012] ? __fget_files+0x3a0/0x420 [ 508.474179][T20012] ? __fget_files+0x2a/0x420 [ 508.474208][T20012] do_writev+0x14d/0x2d0 [ 508.474226][T20012] ? __pfx_do_writev+0x10/0x10 [ 508.474241][T20012] ? rcu_is_watching+0x15/0xb0 [ 508.474258][T20012] ? trace_sys_enter+0x25/0x100 [ 508.474292][T20012] do_syscall_64+0xfa/0x3b0 [ 508.474307][T20012] ? lockdep_hardirqs_on+0x9c/0x150 [ 508.474329][T20012] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 508.474346][T20012] ? clear_bhb_loop+0x60/0xb0 [ 508.474366][T20012] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 508.474382][T20012] RIP: 0033:0x7f5f9cb8eec9 [ 508.474397][T20012] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 508.474411][T20012] RSP: 002b:00007f5f9da89038 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 508.474429][T20012] RAX: ffffffffffffffda RBX: 00007f5f9cde5fa0 RCX: 00007f5f9cb8eec9 [ 508.474441][T20012] RDX: 0000000000000001 RSI: 0000200000000280 RDI: 0000000000000003 [ 508.474451][T20012] RBP: 00007f5f9da89090 R08: 0000000000000000 R09: 0000000000000000 [ 508.474461][T20012] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 508.474471][T20012] R13: 00007f5f9cde6038 R14: 00007f5f9cde5fa0 R15: 00007ffece279df8 [ 508.474500][T20012] [ 508.884788][ T5184] Bluetooth: hci5: command 0x0406 tx timeout [ 509.436081][T20029] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3666'. [ 509.748977][T20032] tipc: Enabled bearer , priority 0 [ 509.792691][T20034] netlink: 244 bytes leftover after parsing attributes in process `syz.3.3668'. [ 509.829126][T20055] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3667'. [ 509.999403][T20038] tipc: Resetting bearer [ 510.033687][T20038] team0: Port device vlan0 added [ 510.040031][T20045] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 510.075517][T20036] syzkaller0: entered promiscuous mode [ 510.089023][T20036] syzkaller0: entered allmulticast mode [ 510.110717][T20032] tipc: Resetting bearer [ 510.131180][T20060] vlan2: entered allmulticast mode [ 510.147986][T20060] bridge_slave_0: entered allmulticast mode [ 510.156502][T20064] netlink: 104 bytes leftover after parsing attributes in process `syz.1.3674'. [ 510.428846][T20061] xfrm1: left promiscuous mode [ 510.438059][T20061] xfrm1: left allmulticast mode [ 510.444980][T20061] bond1: left promiscuous mode [ 510.449948][T20061] bond1: left allmulticast mode [ 510.458136][T20061] veth3: left promiscuous mode [ 510.476530][T20030] tipc: Resetting bearer [ 510.500811][T20030] tipc: Disabling bearer [ 510.553136][T20073] syzkaller0: entered promiscuous mode [ 510.558757][T20073] syzkaller0: entered allmulticast mode [ 510.795527][T20092] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3680'. [ 510.848095][T20095] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3681'. [ 511.114739][T20102] syzkaller0 speed is unknown, defaulting to 1000 [ 511.269855][T20110] vxcan1: entered allmulticast mode [ 511.295610][T20111] wg1 speed is unknown, defaulting to 1000 [ 511.318154][T20111] wg1 speed is unknown, defaulting to 1000 [ 511.328555][T20111] wg1 speed is unknown, defaulting to 1000 [ 511.377687][T20111] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98 [ 511.449806][T20111] wg1 speed is unknown, defaulting to 1000 [ 511.779581][T20122] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3688'. [ 511.857020][T20111] wg1 speed is unknown, defaulting to 1000 [ 511.908863][T20111] wg1 speed is unknown, defaulting to 1000 [ 511.964637][T20111] wg1 speed is unknown, defaulting to 1000 [ 511.985749][T20111] wg1 speed is unknown, defaulting to 1000 [ 511.993412][T20111] wg1 speed is unknown, defaulting to 1000 [ 512.006551][T20111] wg1 speed is unknown, defaulting to 1000 [ 512.082347][T20111] wg1 speed is unknown, defaulting to 1000 [ 512.095789][T20111] wg1 speed is unknown, defaulting to 1000 [ 512.115819][T20111] wg1 speed is unknown, defaulting to 1000 [ 512.516329][T20146] netlink: 104 bytes leftover after parsing attributes in process `syz.1.3695'. [ 512.721423][T20159] FAULT_INJECTION: forcing a failure. [ 512.721423][T20159] name failslab, interval 1, probability 0, space 0, times 0 [ 512.737421][T20160] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3698'. [ 512.753903][T20159] CPU: 0 UID: 0 PID: 20159 Comm: syz.0.3699 Not tainted syzkaller #0 PREEMPT(full) [ 512.753928][T20159] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 512.753938][T20159] Call Trace: [ 512.753946][T20159] [ 512.753954][T20159] dump_stack_lvl+0x189/0x250 [ 512.753978][T20159] ? __pfx____ratelimit+0x10/0x10 [ 512.754001][T20159] ? __pfx_dump_stack_lvl+0x10/0x10 [ 512.754019][T20159] ? __pfx__printk+0x10/0x10 [ 512.754042][T20159] ? __lock_acquire+0xab9/0xd20 [ 512.754072][T20159] should_fail_ex+0x414/0x560 [ 512.754100][T20159] should_failslab+0xa8/0x100 [ 512.754124][T20159] kmem_cache_alloc_noprof+0x73/0x3c0 [ 512.754142][T20159] ? skb_clone+0x212/0x3a0 [ 512.754167][T20159] skb_clone+0x212/0x3a0 [ 512.754191][T20159] __netlink_deliver_tap+0x404/0x850 [ 512.754223][T20159] ? netlink_deliver_tap+0x2e/0x1b0 [ 512.754242][T20159] netlink_deliver_tap+0x19c/0x1b0 [ 512.754262][T20159] netlink_unicast+0x7fa/0x9e0 [ 512.754289][T20159] ? __pfx_netlink_unicast+0x10/0x10 [ 512.754307][T20159] ? netlink_sendmsg+0x642/0xb30 [ 512.754324][T20159] ? skb_put+0x11b/0x210 [ 512.754346][T20159] netlink_sendmsg+0x805/0xb30 [ 512.754375][T20159] ? __pfx_netlink_sendmsg+0x10/0x10 [ 512.754397][T20159] ? aa_sock_msg_perm+0xf1/0x1d0 [ 512.754422][T20159] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 512.754439][T20159] ? __pfx_netlink_sendmsg+0x10/0x10 [ 512.754458][T20159] __sock_sendmsg+0x219/0x270 [ 512.754482][T20159] sock_write_iter+0x258/0x330 [ 512.754505][T20159] ? __pfx_sock_write_iter+0x10/0x10 [ 512.754549][T20159] do_iter_readv_writev+0x61c/0x8b0 [ 512.754577][T20159] ? __pfx_do_iter_readv_writev+0x10/0x10 [ 512.754596][T20159] ? common_file_perm+0x1b5/0x230 [ 512.754622][T20159] ? bpf_lsm_file_permission+0x9/0x20 [ 512.754639][T20159] ? security_file_permission+0x75/0x290 [ 512.754661][T20159] ? rw_verify_area+0x255/0x4d0 [ 512.754685][T20159] vfs_writev+0x31a/0x960 [ 512.754706][T20159] ? __lock_acquire+0xab9/0xd20 [ 512.754728][T20159] ? __pfx_vfs_writev+0x10/0x10 [ 512.754760][T20159] ? __fget_files+0x2a/0x420 [ 512.754786][T20159] ? __fget_files+0x3a0/0x420 [ 512.754805][T20159] ? __fget_files+0x2a/0x420 [ 512.754836][T20159] do_writev+0x14d/0x2d0 [ 512.754854][T20159] ? __pfx_do_writev+0x10/0x10 [ 512.754874][T20159] ? rcu_is_watching+0x15/0xb0 [ 512.754895][T20159] ? do_syscall_64+0xbe/0x3b0 [ 512.754916][T20159] do_syscall_64+0xfa/0x3b0 [ 512.754930][T20159] ? lockdep_hardirqs_on+0x9c/0x150 [ 512.754951][T20159] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 512.754968][T20159] ? clear_bhb_loop+0x60/0xb0 [ 512.754988][T20159] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 512.755004][T20159] RIP: 0033:0x7fd1a738eec9 [ 512.755018][T20159] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 512.755033][T20159] RSP: 002b:00007fd1a81c3038 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 512.755051][T20159] RAX: ffffffffffffffda RBX: 00007fd1a75e5fa0 RCX: 00007fd1a738eec9 [ 512.755063][T20159] RDX: 0000000000000001 RSI: 0000200000000280 RDI: 0000000000000003 [ 512.755074][T20159] RBP: 00007fd1a81c3090 R08: 0000000000000000 R09: 0000000000000000 [ 512.755085][T20159] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 512.755095][T20159] R13: 00007fd1a75e6038 R14: 00007fd1a75e5fa0 R15: 00007ffe206d78d8 [ 512.755125][T20159] [ 513.461614][T20183] __nla_validate_parse: 1 callbacks suppressed [ 513.461631][T20183] netlink: 32 bytes leftover after parsing attributes in process `syz.2.3704'. [ 513.696078][ T5184] Bluetooth: hci2: command 0x0406 tx timeout [ 513.725514][T20199] validate_nla: 7 callbacks suppressed [ 513.725532][T20199] netlink: 'syz.3.3707': attribute type 3 has an invalid length. [ 513.773842][T20199] netlink: 132 bytes leftover after parsing attributes in process `syz.3.3707'. [ 513.782443][T20192] syzkaller0: entered promiscuous mode [ 513.794019][T20192] syzkaller0: entered allmulticast mode [ 513.830999][T20192] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3706'. [ 513.840828][T20200] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3706'. [ 513.910649][T20212] netlink: 64 bytes leftover after parsing attributes in process `syz.0.3712'. [ 513.975498][T20217] netlink: 'syz.0.3712': attribute type 1 has an invalid length. [ 513.987000][T20220] netlink: 72 bytes leftover after parsing attributes in process `syz.1.3711'. [ 514.010304][T20220] netlink: 64 bytes leftover after parsing attributes in process `syz.1.3711'. [ 515.458168][T20216] tipc: Enabling of bearer rejected, failed to enable media [ 515.489760][T20223] syzkaller0 speed is unknown, defaulting to 1000 [ 515.498125][T20223] wg1 speed is unknown, defaulting to 1000 [ 515.570834][T20240] vxcan3: entered allmulticast mode [ 515.600788][T20242] netlink: 'syz.4.3716': attribute type 39 has an invalid length. [ 516.057242][T20255] dvmrp8: entered allmulticast mode [ 516.094672][T20263] IPVS: sync thread started: state = BACKUP, mcast_ifn = tunl0, syncid = 3, id = 0 [ 516.270569][T20250] syzkaller0 speed is unknown, defaulting to 1000 [ 516.298683][T20241] dvmrp8: left allmulticast mode [ 516.342919][T20250] wg1 speed is unknown, defaulting to 1000 [ 516.581165][T20273] netlink: 232 bytes leftover after parsing attributes in process `syz.4.3722'. [ 517.639056][T20332] geneve2: entered promiscuous mode [ 518.051186][T20351] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3740'. [ 518.145982][T20343] syzkaller0 speed is unknown, defaulting to 1000 [ 518.183004][T20343] wg1 speed is unknown, defaulting to 1000 [ 518.221284][T20358] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3742'. [ 518.399082][T20360] netlink: 'syz.0.3744': attribute type 10 has an invalid length. [ 518.480350][T20363] syzkaller0 speed is unknown, defaulting to 1000 [ 518.489862][T20363] wg1 speed is unknown, defaulting to 1000 [ 518.536371][T20360] nr29: entered promiscuous mode [ 518.541383][T20360] nr29: entered allmulticast mode [ 518.547117][T20360] A link change request failed with some changes committed already. Interface nr29 may have been left with an inconsistent configuration, please check. [ 518.816655][T20375] syzkaller0 speed is unknown, defaulting to 1000 [ 518.825732][T20375] wg1 speed is unknown, defaulting to 1000 [ 519.041532][T20392] siw: device registration error -23 [ 519.235074][T20398] netlink: 'syz.2.3755': attribute type 7 has an invalid length. [ 519.242954][T20398] netlink: 'syz.2.3755': attribute type 8 has an invalid length. [ 519.274951][T20398] netlink: 'syz.2.3755': attribute type 12 has an invalid length. [ 522.028952][ T49] bond3 (unregistering): (slave gretap2): Releasing active interface [ 522.327443][ T49] team0: Port device bridge5 removed [ 522.719964][ T49] bond1 (unregistering): Released all slaves [ 522.732129][ T49] bond2 (unregistering): Released all slaves [ 522.745060][ T49] bond3 (unregistering): Released all slaves [ 522.759265][ T49] bond4 (unregistering): Released all slaves [ 522.857740][ T49] bond5 (unregistering): Released all slaves [ 522.872829][ T49] bond6 (unregistering): Released all slaves [ 522.885173][ T49] bond0 (unregistering): Released all slaves [ 524.423084][ T49] tipc: Left network mode [ 525.040455][ T49] hsr_slave_0: left promiscuous mode [ 525.046550][ T49] hsr_slave_1: left promiscuous mode [ 525.052382][ T49] batman_adv: batadv0: Removing interface: macvtap1 [ 525.105144][ T49] pimreg3 (unregistering): left allmulticast mode [ 525.136680][ T49] pim6reg99999999 (unregistering): left allmulticast mode [ 525.973088][ T49] IPVS: stop unused estimator thread 0... [ 539.294016][T20403] Bluetooth: hci0: command 0x0406 tx timeout [ 539.300505][T20403] Bluetooth: hci3: command 0x0406 tx timeout [ 547.455764][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 559.174773][T20413] tipc: Enabled bearer , priority 0 [ 559.183513][T20413] syzkaller0: entered promiscuous mode [ 559.189178][T20413] syzkaller0: entered allmulticast mode [ 559.226997][T20419] netlink: 'syz.2.3761': attribute type 1 has an invalid length. [ 559.265737][T20414] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 559.297715][T20423] tipc: Resetting bearer [ 559.311189][T20408] tipc: Resetting bearer [ 559.332660][T20408] tipc: Disabling bearer [ 559.368207][T20414] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 559.463076][T20414] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 559.486999][T20431] __nla_validate_parse: 1 callbacks suppressed [ 559.487015][T20431] netlink: 96 bytes leftover after parsing attributes in process `syz.2.3765'. [ 559.598845][T20414] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 559.706679][T20440] netlink: 'syz.2.3768': attribute type 1 has an invalid length. [ 559.733626][T20441] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3768'. [ 559.746537][ T13] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 559.761155][T20438] pim6reg1: entered allmulticast mode [ 559.795117][T20440] 8021q: adding VLAN 0 to HW filter on device bond3 [ 559.802825][ T13] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 559.833689][ T13] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 559.862659][ T13] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 559.882004][T20449] netlink: 'syz.2.3770': attribute type 1 has an invalid length. [ 560.020471][T20449] 8021q: adding VLAN 0 to HW filter on device bond4 [ 560.036946][T20449] netlink: 'syz.2.3770': attribute type 1 has an invalid length. [ 560.055041][T20449] netlink: 'syz.2.3770': attribute type 1 has an invalid length. [ 560.063471][T20449] netlink: 'syz.2.3770': attribute type 1 has an invalid length. [ 560.072258][T20449] netlink: 'syz.2.3770': attribute type 1 has an invalid length. [ 560.080697][T20449] netlink: 'syz.2.3770': attribute type 1 has an invalid length. [ 560.089530][T20449] netlink: 'syz.2.3770': attribute type 1 has an invalid length. [ 560.097903][T20449] netlink: 'syz.2.3770': attribute type 1 has an invalid length. [ 560.174531][T20457] syzkaller0 speed is unknown, defaulting to 1000 [ 560.183329][T20457] wg1 speed is unknown, defaulting to 1000 [ 560.184937][T20460] syzkaller0 speed is unknown, defaulting to 1000 [ 560.212941][T20460] wg1 speed is unknown, defaulting to 1000 [ 560.328146][T20469] syzkaller1: entered promiscuous mode [ 560.333646][T20469] syzkaller1: entered allmulticast mode [ 560.347326][T20469] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3775'. [ 560.624920][T20481] syzkaller0 speed is unknown, defaulting to 1000 [ 560.633305][T20481] wg1 speed is unknown, defaulting to 1000 [ 560.961026][T20499] netlink: 248 bytes leftover after parsing attributes in process `syz.2.3781'. [ 561.207159][T20505] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3782'. [ 561.249727][T20507] netlink: 40 bytes leftover after parsing attributes in process `syz.2.3783'. [ 561.259136][T20507] dummy0: entered promiscuous mode [ 561.269704][T20507] A link change request failed with some changes committed already. Interface dummy0 may have been left with an inconsistent configuration, please check. [ 561.391625][T20516] netlink: 52 bytes leftover after parsing attributes in process `syz.2.3785'. [ 561.518531][T20522] netlink: 40 bytes leftover after parsing attributes in process `syz.2.3786'. [ 561.547834][T20522] net veth1_virt_wifi virt_wifi0: entered promiscuous mode [ 561.556371][T20523] sctp: [Deprecated]: syz.1.3787 (pid 20523) Use of int in maxseg socket option. [ 561.556371][T20523] Use struct sctp_assoc_value instead [ 561.574413][T20522] net veth1_virt_wifi virt_wifi0: entered allmulticast mode [ 561.602873][T20522] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 561.659123][T20524] 8021q: adding VLAN 0 to HW filter on device bond5 [ 562.070830][T20550] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3794'. [ 562.481383][T20527] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 562.490364][T20545] netlink: 'syz.4.3792': attribute type 11 has an invalid length. [ 562.498866][T20545] netlink: 224 bytes leftover after parsing attributes in process `syz.4.3792'. [ 562.770480][T20566] syzkaller0 speed is unknown, defaulting to 1000 [ 562.785914][T20566] wg1 speed is unknown, defaulting to 1000 [ 563.437738][T20606] syzkaller0 speed is unknown, defaulting to 1000 [ 563.462057][T20606] wg1 speed is unknown, defaulting to 1000 [ 563.654128][ T30] audit: type=1800 audit(1758848960.296:8): pid=20616 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.3811" name="memory.events" dev="tmpfs" ino=998 res=0 errno=0 [ 564.098129][ T5184] Bluetooth: hci1: command 0x0405 tx timeout [ 564.352857][T20654] validate_nla: 69 callbacks suppressed [ 564.352876][T20654] netlink: 'syz.3.3826': attribute type 2 has an invalid length. [ 564.366488][T20654] netlink: 'syz.3.3826': attribute type 1 has an invalid length. [ 564.497379][T20659] __nla_validate_parse: 7 callbacks suppressed [ 564.497407][T20659] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3827'. [ 564.594536][T20658] netlink: 248 bytes leftover after parsing attributes in process `syz.3.3826'. [ 564.697761][T20667] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3830'. [ 564.723113][T20673] netlink: 'syz.0.3831': attribute type 1 has an invalid length. [ 564.753378][T20674] workqueue: Failed to create a rescuer kthread for wq "wg-crypt-wireguard%d": -EINTR [ 564.782342][T20673] workqueue: Failed to create a rescuer kthread for wq "bond2": -EINTR [ 564.876060][T20686] ip6erspan0: entered promiscuous mode [ 564.899603][T20686] netlink: 96 bytes leftover after parsing attributes in process `syz.2.3835'. [ 564.957979][T20689] netlink: 104 bytes leftover after parsing attributes in process `syz.4.3836'. [ 565.070298][T20692] netdevsim netdevsim4 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 565.081374][T20692] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 565.253559][T20692] netdevsim netdevsim4 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 565.265695][T20692] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 565.298672][T20698] syzkaller0 speed is unknown, defaulting to 1000 [ 565.319519][T20698] wg1 speed is unknown, defaulting to 1000 [ 565.350211][T20692] netdevsim netdevsim4 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 565.362705][T20692] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 565.397111][T20702] IPv6: addrconf: prefix option has invalid lifetime [ 565.529413][T20692] netdevsim netdevsim4 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 565.554940][T20692] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 565.889605][ T49] netdevsim netdevsim4 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 565.969541][ T49] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 565.984041][ T49] netdevsim netdevsim4 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 566.005660][ T49] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 566.050332][ T49] netdevsim netdevsim4 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 566.076339][ T49] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 566.106714][ T49] netdevsim netdevsim4 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 566.134037][ T49] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 566.295610][T20710] syzkaller0 speed is unknown, defaulting to 1000 [ 566.317911][T20722] netlink: 'syz.4.3844': attribute type 22 has an invalid length. [ 566.335635][T20710] wg1 speed is unknown, defaulting to 1000 [ 566.352551][T20722] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3844'. [ 566.407282][T20730] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3846'. [ 566.536173][T20722] netlink: 'syz.4.3844': attribute type 22 has an invalid length. [ 566.545077][T20722] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3844'. [ 567.088344][T20757] tipc: Enabling of bearer rejected, failed to enable media [ 567.199246][T20752] netlink: 'syz.3.3848': attribute type 10 has an invalid length. [ 567.258757][T20764] netlink: 388 bytes leftover after parsing attributes in process `syz.2.3852'. [ 567.321093][T20767] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3853'. [ 567.639112][T20787] Bluetooth: MGMT ver 1.23 [ 567.661043][T20790] netlink: 'syz.2.3858': attribute type 1 has an invalid length. [ 568.021867][T20804] syz.4.3863: vmalloc error: size 4198400, failed to allocated page array size 8200, mode:0x400dc2(GFP_KERNEL_ACCOUNT|__GFP_HIGHMEM|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 568.085408][T20804] CPU: 1 UID: 0 PID: 20804 Comm: syz.4.3863 Not tainted syzkaller #0 PREEMPT(full) [ 568.085434][T20804] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 568.085445][T20804] Call Trace: [ 568.085452][T20804] [ 568.085460][T20804] dump_stack_lvl+0x189/0x250 [ 568.085488][T20804] ? __pfx_dump_stack_lvl+0x10/0x10 [ 568.085507][T20804] ? __pfx__printk+0x10/0x10 [ 568.085528][T20804] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 568.085548][T20804] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 568.085569][T20804] ? cpuset_print_current_mems_allowed+0x2ee/0x360 [ 568.085591][T20804] warn_alloc+0x214/0x310 [ 568.085620][T20804] ? __pfx_warn_alloc+0x10/0x10 [ 568.085652][T20804] ? __get_vm_area_node+0x28f/0x300 [ 568.085674][T20804] ? hash_ipmark_create+0x3e6/0x1080 [ 568.085702][T20804] __vmalloc_node_range_noprof+0x67e/0x12f0 [ 568.085723][T20804] ? do_syscall_64+0xfa/0x3b0 [ 568.085772][T20804] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 568.085799][T20804] ? rcu_is_watching+0x15/0xb0 [ 568.085817][T20804] ? hash_ipmark_create+0x3e6/0x1080 [ 568.085838][T20804] ? hash_ipmark_create+0x3e6/0x1080 [ 568.085858][T20804] __kvmalloc_node_noprof+0x3b8/0x5f0 [ 568.085879][T20804] ? hash_ipmark_create+0x3e6/0x1080 [ 568.085902][T20804] ? hash_ipmark_create+0x387/0x1080 [ 568.085930][T20804] hash_ipmark_create+0x3e6/0x1080 [ 568.085962][T20804] ? __nla_parse+0x40/0x60 [ 568.085980][T20804] ? __pfx_hash_ipmark_create+0x10/0x10 [ 568.086004][T20804] ip_set_create+0xa97/0x1940 [ 568.086027][T20804] ? ip_set_create+0x4a2/0x1940 [ 568.086062][T20804] ? __pfx_ip_set_create+0x10/0x10 [ 568.086130][T20804] nfnetlink_rcv_msg+0xb4d/0x1130 [ 568.086155][T20804] ? nfnetlink_rcv_msg+0x20d/0x1130 [ 568.086198][T20804] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 568.086275][T20804] netlink_rcv_skb+0x208/0x470 [ 568.086295][T20804] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 568.086320][T20804] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 568.086351][T20804] ? bpf_lsm_capable+0x9/0x20 [ 568.086370][T20804] ? security_capable+0x7e/0x2e0 [ 568.086401][T20804] nfnetlink_rcv+0x282/0x2590 [ 568.086426][T20804] ? __dev_queue_xmit+0x27b/0x3b50 [ 568.086447][T20804] ? __dev_queue_xmit+0x1d79/0x3b50 [ 568.086477][T20804] ? __dev_queue_xmit+0x27b/0x3b50 [ 568.086509][T20804] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 568.086530][T20804] ? __pfx___dev_queue_xmit+0x10/0x10 [ 568.086564][T20804] ? ref_tracker_free+0x63a/0x7d0 [ 568.086586][T20804] ? __asan_memcpy+0x40/0x70 [ 568.086602][T20804] ? __pfx_ref_tracker_free+0x10/0x10 [ 568.086640][T20804] ? skb_clone+0x246/0x3a0 [ 568.086662][T20804] ? __netlink_deliver_tap+0x807/0x850 [ 568.086680][T20804] ? netlink_deliver_tap+0x2e/0x1b0 [ 568.086704][T20804] ? netlink_deliver_tap+0x2e/0x1b0 [ 568.086728][T20804] netlink_unicast+0x82f/0x9e0 [ 568.086754][T20804] ? __pfx_netlink_unicast+0x10/0x10 [ 568.086772][T20804] ? netlink_sendmsg+0x642/0xb30 [ 568.086788][T20804] ? skb_put+0x11b/0x210 [ 568.086810][T20804] netlink_sendmsg+0x805/0xb30 [ 568.086836][T20804] ? __pfx_netlink_sendmsg+0x10/0x10 [ 568.086859][T20804] ? aa_sock_msg_perm+0xf1/0x1d0 [ 568.086885][T20804] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 568.086901][T20804] ? __pfx_netlink_sendmsg+0x10/0x10 [ 568.086919][T20804] __sock_sendmsg+0x219/0x270 [ 568.086945][T20804] ____sys_sendmsg+0x505/0x830 [ 568.086972][T20804] ? __pfx_____sys_sendmsg+0x10/0x10 [ 568.087001][T20804] ? import_iovec+0x74/0xa0 [ 568.087026][T20804] ___sys_sendmsg+0x21f/0x2a0 [ 568.087049][T20804] ? __pfx____sys_sendmsg+0x10/0x10 [ 568.087117][T20804] ? __fget_files+0x2a/0x420 [ 568.087138][T20804] ? __fget_files+0x3a0/0x420 [ 568.087171][T20804] __x64_sys_sendmsg+0x19b/0x260 [ 568.087193][T20804] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 568.087225][T20804] ? rcu_is_watching+0x15/0xb0 [ 568.087247][T20804] ? do_syscall_64+0xbe/0x3b0 [ 568.087267][T20804] do_syscall_64+0xfa/0x3b0 [ 568.087282][T20804] ? lockdep_hardirqs_on+0x9c/0x150 [ 568.087304][T20804] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 568.087321][T20804] ? clear_bhb_loop+0x60/0xb0 [ 568.087342][T20804] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 568.087359][T20804] RIP: 0033:0x7f13fcf8eec9 [ 568.087375][T20804] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 568.087389][T20804] RSP: 002b:00007f13fdf0b038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 568.087409][T20804] RAX: ffffffffffffffda RBX: 00007f13fd1e5fa0 RCX: 00007f13fcf8eec9 [ 568.087422][T20804] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000003 [ 568.087433][T20804] RBP: 00007f13fd011f91 R08: 0000000000000000 R09: 0000000000000000 [ 568.087443][T20804] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 568.087453][T20804] R13: 00007f13fd1e6038 R14: 00007f13fd1e5fa0 R15: 00007ffc97b9c3b8 [ 568.087483][T20804] [ 568.087502][T20804] Mem-Info: [ 568.127607][T20804] active_anon:7612 inactive_anon:0 isolated_anon:0 [ 568.127607][T20804] active_file:3336 inactive_file:40077 isolated_file:0 [ 568.127607][T20804] unevictable:768 dirty:181 writeback:0 [ 568.127607][T20804] slab_reclaimable:13062 slab_unreclaimable:154492 [ 568.127607][T20804] mapped:30184 shmem:1360 pagetables:1137 [ 568.127607][T20804] sec_pagetables:0 bounce:0 [ 568.127607][T20804] kernel_misc_reclaimable:0 [ 568.127607][T20804] free:1207103 free_pcp:40065 free_cma:0 [ 568.265841][T20798] syzkaller0 speed is unknown, defaulting to 1000 [ 568.303833][T20804] Node 0 active_anon:30448kB inactive_anon:0kB active_file:13344kB inactive_file:160108kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:120736kB dirty:824kB writeback:0kB shmem:3904kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:13832kB pagetables:4504kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 568.341264][T20802] macvtap0: entered allmulticast mode [ 568.365521][T20804] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:48kB pagetables:144kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 568.377891][T20816] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 568.380116][T20804] Node 0 [ 568.464337][T20802] mac80211_hwsim hwsim60 wlan0: entered allmulticast mode [ 568.469164][T20804] DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 568.499128][T20823] x_tables: ip_tables: udp match: only valid for protocol 17 [ 568.753037][T20804] lowmem_reserve[]: 0 2499 2501 2501 2501 [ 568.759716][T20804] Node 0 DMA32 free:964808kB boost:0kB min:34264kB low:42828kB high:51392kB reserved_highatomic:0KB free_highatomic:0KB active_anon:30688kB inactive_anon:0kB active_file:13344kB inactive_file:158280kB unevictable:1536kB writepending:828kB present:3129332kB managed:2559904kB mlocked:0kB bounce:0kB free_pcp:152760kB local_pcp:64712kB free_cma:0kB [ 568.760483][T20802] mac80211_hwsim hwsim60 wlan0: left allmulticast mode [ 568.801074][T20804] lowmem_reserve[]: 0 0 1 1 1 [ 568.805949][T20804] Node 0 Normal free:16kB boost:0kB min:24kB low:28kB high:32kB reserved_highatomic:0KB free_highatomic:0KB active_anon:48kB inactive_anon:0kB active_file:0kB inactive_file:1828kB unevictable:0kB writepending:0kB present:1048580kB managed:1900kB mlocked:0kB bounce:0kB free_pcp:8kB local_pcp:0kB free_cma:0kB [ 568.837210][T20804] lowmem_reserve[]: 0 0 0 0 0 [ 568.841947][T20804] Node 1 Normal free:3897700kB boost:0kB min:55612kB low:69512kB high:83412kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB writepending:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:17700kB local_pcp:8780kB free_cma:0kB [ 568.874120][T20804] lowmem_reserve[]: 0 0 0 0 0 [ 568.878922][T20804] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 568.893454][T20804] Node 0 DMA32: 3696*4kB (UE) 1892*8kB (UME) 750*16kB (UME) 402*32kB (UME) 44*64kB (UE) 14*128kB (UME) 21*256kB (UME) 5*512kB (UME) 3*1024kB (UME) 11*2048kB (UME) 215*4096kB (M) = 973568kB [ 568.912820][T20804] Node 0 Normal: 0*4kB 0*8kB 1*16kB (M) 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 16kB [ 568.925541][T20804] Node 1 Normal: 217*4kB (UE) 52*8kB (UME) 44*16kB (UME) 97*32kB (UME) 28*64kB (UME) 7*128kB (UME) 7*256kB (UME) 4*512kB (UME) 1*1024kB (M) 1*2048kB (E) 948*4096kB (M) = 3897700kB [ 568.945642][T20804] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 568.955472][T20798] wg1 speed is unknown, defaulting to 1000 [ 568.962191][T20830] macvlan0: entered allmulticast mode [ 568.965176][T20804] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 569.016664][T20804] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 569.049790][T20804] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 569.072213][T20804] 44769 total pagecache pages [ 569.083627][T20804] 0 pages in swap cache [ 569.094178][T20804] Free swap = 124996kB [ 569.100318][T20804] Total swap = 124996kB [ 569.118248][T20804] 2097051 pages RAM [ 569.126523][T20804] 0 pages HighMem/MovableOnly [ 569.151054][T20804] 424985 pages reserved [ 569.180657][T20804] 0 pages cma reserved [ 569.353601][T20841] can: request_module (can-proto-0) failed. [ 569.576730][T20863] __nla_validate_parse: 6 callbacks suppressed [ 569.576746][T20863] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3875'. [ 569.611449][T20863] netlink: 'syz.0.3875': attribute type 1 has an invalid length. [ 569.770138][T20863] 8021q: adding VLAN 0 to HW filter on device bond2 [ 569.897528][T20877] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3879'. [ 569.976832][T20881] veth1_vlan: default FDB implementation only supports local addresses [ 570.726027][T20900] vxlan0: entered promiscuous mode [ 570.744281][T20900] vxlan0: entered allmulticast mode [ 570.759490][ T13] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 570.788464][ T13] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 570.802059][T20904] netlink: 'syz.1.3890': attribute type 1 has an invalid length. [ 570.816420][ T13] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 570.823997][T20904] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3890'. [ 570.848903][ T13] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 570.991613][T20911] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 571.244649][T20922] nbd: must specify a size in bytes for the device [ 572.423711][ T30] audit: type=1800 audit(1758848969.066:9): pid=20951 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.3905" name=03 dev="tmpfs" ino=685 res=0 errno=0 [ 572.494023][ T30] audit: type=1804 audit(1758848969.076:10): pid=20951 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.3.3905" name=03 dev="tmpfs" ino=685 res=1 errno=0 [ 572.639960][T20966] netlink: 'syz.3.3910': attribute type 13 has an invalid length. [ 572.669511][T20966] netlink: 'syz.3.3910': attribute type 17 has an invalid length. [ 572.818983][T20977] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3911'. [ 572.848433][T20976] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3913'. [ 572.865922][T20966] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 572.895184][T20973] veth0_to_team: Caught tx_queue_len zero misconfig [ 572.901939][T20973] sch_tbf: burst 0 is lower than device veth0_to_team mtu (1514) ! [ 572.911110][T20981] netlink: 40 bytes leftover after parsing attributes in process `syz.3.3910'. [ 572.998500][T20972] syzkaller0 speed is unknown, defaulting to 1000 [ 573.042112][T20972] wg1 speed is unknown, defaulting to 1000 [ 573.126510][T20988] netlink: 48 bytes leftover after parsing attributes in process `syz.2.3915'. [ 573.245408][T20988] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 573.411470][T20995] FAULT_INJECTION: forcing a failure. [ 573.411470][T20995] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 573.483976][T20995] CPU: 0 UID: 0 PID: 20995 Comm: syz.2.3917 Not tainted syzkaller #0 PREEMPT(full) [ 573.484005][T20995] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 573.484016][T20995] Call Trace: [ 573.484024][T20995] [ 573.484031][T20995] dump_stack_lvl+0x189/0x250 [ 573.484054][T20995] ? __pfx____ratelimit+0x10/0x10 [ 573.484078][T20995] ? __pfx_dump_stack_lvl+0x10/0x10 [ 573.484097][T20995] ? __pfx__printk+0x10/0x10 [ 573.484118][T20995] ? __might_fault+0xb0/0x130 [ 573.484149][T20995] should_fail_ex+0x414/0x560 [ 573.484176][T20995] _copy_from_iter+0x1de/0x1790 [ 573.484202][T20995] ? rcu_is_watching+0x15/0xb0 [ 573.484220][T20995] ? kmem_cache_alloc_node_noprof+0x217/0x3c0 [ 573.484243][T20995] ? __pfx__copy_from_iter+0x10/0x10 [ 573.484263][T20995] ? __build_skb_around+0x257/0x3e0 [ 573.484286][T20995] ? netlink_sendmsg+0x642/0xb30 [ 573.484302][T20995] ? skb_put+0x11b/0x210 [ 573.484324][T20995] netlink_sendmsg+0x6b2/0xb30 [ 573.484352][T20995] ? __pfx_netlink_sendmsg+0x10/0x10 [ 573.484373][T20995] ? aa_sock_msg_perm+0xf1/0x1d0 [ 573.484399][T20995] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 573.484416][T20995] ? __pfx_netlink_sendmsg+0x10/0x10 [ 573.484435][T20995] __sock_sendmsg+0x219/0x270 [ 573.484461][T20995] ____sys_sendmsg+0x505/0x830 [ 573.484487][T20995] ? __pfx_____sys_sendmsg+0x10/0x10 [ 573.484517][T20995] ? import_iovec+0x74/0xa0 [ 573.484540][T20995] ___sys_sendmsg+0x21f/0x2a0 [ 573.484563][T20995] ? __pfx____sys_sendmsg+0x10/0x10 [ 573.484627][T20995] ? __fget_files+0x2a/0x420 [ 573.484648][T20995] ? __fget_files+0x3a0/0x420 [ 573.484680][T20995] __x64_sys_sendmsg+0x19b/0x260 [ 573.484703][T20995] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 573.484733][T20995] ? __pfx_ksys_write+0x10/0x10 [ 573.484750][T20995] ? rcu_is_watching+0x15/0xb0 [ 573.484771][T20995] ? do_syscall_64+0xbe/0x3b0 [ 573.484790][T20995] do_syscall_64+0xfa/0x3b0 [ 573.484806][T20995] ? lockdep_hardirqs_on+0x9c/0x150 [ 573.484827][T20995] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 573.484844][T20995] ? clear_bhb_loop+0x60/0xb0 [ 573.484864][T20995] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 573.484880][T20995] RIP: 0033:0x7f5f9cb8eec9 [ 573.484895][T20995] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 573.484909][T20995] RSP: 002b:00007f5f9da89038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 573.484929][T20995] RAX: ffffffffffffffda RBX: 00007f5f9cde5fa0 RCX: 00007f5f9cb8eec9 [ 573.484941][T20995] RDX: 0000000000000000 RSI: 0000200000000680 RDI: 0000000000000003 [ 573.484953][T20995] RBP: 00007f5f9da89090 R08: 0000000000000000 R09: 0000000000000000 [ 573.484964][T20995] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 573.484974][T20995] R13: 00007f5f9cde6038 R14: 00007f5f9cde5fa0 R15: 00007ffece279df8 [ 573.485004][T20995] [ 574.211740][T21020] netlink: 'syz.1.3923': attribute type 10 has an invalid length. [ 574.223127][T21020] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3923'. [ 574.233984][T21020] netlink: 68 bytes leftover after parsing attributes in process `syz.1.3923'. [ 574.243711][T21020] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3923'. [ 574.441419][T21035] team0: No ports can be present during mode change [ 574.633493][T21048] __nla_validate_parse: 3 callbacks suppressed [ 574.633510][T21048] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3929'. [ 574.659679][T21050] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3930'. [ 574.670861][T21048] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3929'. [ 574.680466][T21048] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3929'. [ 574.690721][T21048] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3929'. [ 574.796019][T21056] !: renamed from dummy0 (while UP) [ 575.001834][T21060] syzkaller0 speed is unknown, defaulting to 1000 [ 575.035074][T21060] wg1 speed is unknown, defaulting to 1000 [ 575.818340][T21083] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3939'. [ 575.880762][T21084] netlink: 212408 bytes leftover after parsing attributes in process `syz.4.3939'. [ 575.897512][T21084] netlink: zone id is out of range [ 575.920920][T21084] netlink: zone id is out of range [ 575.946565][T21084] netlink: get zone limit has 8 unknown bytes [ 576.109988][T21090] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3941'. [ 576.307436][T21103] sock: sock_set_timeout: `syz.2.3945' (pid 21103) tries to set negative timeout [ 576.451720][T21114] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3949'. [ 576.502069][T21119] netlink: 32 bytes leftover after parsing attributes in process `syz.4.3950'. [ 577.107221][T21165] netlink: 'syz.3.3962': attribute type 1 has an invalid length. [ 577.126102][T21165] netlink: 'syz.3.3962': attribute type 1 has an invalid length. [ 577.339551][T21175] netlink: 'syz.1.3967': attribute type 12 has an invalid length. [ 577.573401][T21181] syzkaller0 speed is unknown, defaulting to 1000 [ 577.665917][T21181] wg1 speed is unknown, defaulting to 1000 [ 578.446794][T21207] bridge0: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 578.665414][T21227] syz_tun: entered promiscuous mode [ 578.671538][T21233] netlink: 'syz.3.3984': attribute type 8 has an invalid length. [ 578.708115][T21233] bond0: entered promiscuous mode [ 578.723574][T21233] bond0: left promiscuous mode [ 578.955823][T21242] netlink: 'syz.3.3986': attribute type 28 has an invalid length. [ 579.302873][T21251] syzkaller0 speed is unknown, defaulting to 1000 [ 579.312123][T21251] wg1 speed is unknown, defaulting to 1000 [ 579.683636][T21272] __nla_validate_parse: 13 callbacks suppressed [ 579.683652][T21272] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3996'. [ 579.840522][T21279] syzkaller0 speed is unknown, defaulting to 1000 [ 579.848803][T21279] wg1 speed is unknown, defaulting to 1000 [ 580.148881][T21292] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4002'. [ 580.237809][T21295] netdevsim netdevsim3 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 580.333607][T21295] netdevsim netdevsim3 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 580.412271][T21295] netdevsim netdevsim3 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 580.502788][T21295] netdevsim netdevsim3 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 580.577683][T21315] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4006'. [ 580.636054][T21312] netlink: 188 bytes leftover after parsing attributes in process `syz.1.4006'. [ 580.667847][ T76] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 580.685012][ T76] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 580.722093][ T12] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 580.784738][ T12] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 581.217830][T21304] delete_channel: no stack [ 581.322678][T21343] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4017'. [ 582.799115][T21347] kthread_run failed with err -4 [ 582.816374][T21330] netlink: 'syz.4.4012': attribute type 11 has an invalid length. [ 582.836668][T21352] netlink: 'syz.1.4018': attribute type 1 has an invalid length. [ 582.848744][T21352] netlink: 'syz.1.4018': attribute type 3 has an invalid length. [ 582.862808][T21352] netlink: 224 bytes leftover after parsing attributes in process `syz.1.4018'. [ 582.873331][T21352] NCSI netlink: No device for ifindex 246 [ 583.062292][T21367] batadv1: entered promiscuous mode [ 583.068857][T21367] batadv1: entered allmulticast mode [ 583.259666][T21379] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4025'. [ 583.375079][T21382] netlink: 830 bytes leftover after parsing attributes in process `syz.0.4026'. [ 583.504966][T21370] tipc: Resetting bearer [ 583.523399][T21370] tipc: Enabling of bearer rejected, already enabled [ 583.765490][T21398] netlink: 'syz.2.4031': attribute type 1 has an invalid length. [ 583.795625][T21398] netlink: 'syz.2.4031': attribute type 1 has an invalid length. [ 583.795924][T21358] tipc: Resetting bearer [ 583.803507][T21398] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4031'. [ 583.853459][T21398] block nbd4: shutting down sockets [ 584.526154][T21426] A link change request failed with some changes committed already. Interface batadv0 may have been left with an inconsistent configuration, please check. [ 584.577408][ T13] tipc: Resetting bearer [ 584.604878][T21428] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4039'. [ 584.756320][T21426] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 584.777166][ T5978] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 584.974034][ T5978] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 585.057513][T21444] syzkaller0 speed is unknown, defaulting to 1000 [ 585.066403][T21444] wg1 speed is unknown, defaulting to 1000 [ 585.305905][T21459] netlink: 224 bytes leftover after parsing attributes in process `syz.1.4045'. [ 585.320371][T21448] syzkaller0 speed is unknown, defaulting to 1000 [ 585.421924][T21448] wg1 speed is unknown, defaulting to 1000 [ 585.427991][T21459] netlink: 16 bytes leftover after parsing attributes in process `syz.1.4045'. [ 585.437333][T21459] tipc: Cannot configure node identity twice [ 585.598014][T21476] netlink: 44 bytes leftover after parsing attributes in process `syz.2.4050'. [ 585.636280][T21482] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 586.036590][T21511] netlink: 'syz.1.4060': attribute type 10 has an invalid length. [ 586.044987][T21511] netlink: 40 bytes leftover after parsing attributes in process `syz.1.4060'. [ 586.074146][T21511] ªªªªªB: entered promiscuous mode [ 586.080881][T21511] A link change request failed with some changes committed already. Interface ªªªªªB may have been left with an inconsistent configuration, please check. [ 586.207999][T21519] bridge0: entered allmulticast mode [ 586.307542][T21511] 8021q: adding VLAN 0 to HW filter on device bond2 [ 586.405093][T21520] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 586.436032][T21536] netlink: 'syz.4.4067': attribute type 10 has an invalid length. [ 586.456803][T21520] bond2: (slave macvlan2): Enslaving as a backup interface with an up link [ 586.477910][T21542] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4067'. [ 586.481394][T21541] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4064'. [ 586.515740][ T76] bond2: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 586.525779][T21528] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 586.562385][ T5948] wg1 speed is unknown, defaulting to 1000 [ 586.635516][ T7097] bond2: (slave macvlan2): link status up again after 0 ms [ 586.654847][ T7097] bond2: (slave macvlan2): failed to get link speed/duplex [ 586.837796][T21559] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4072'. [ 586.862641][T21560] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4072'. [ 586.871814][T21560] x_tables: (null)_tables: SNAT target: only valid in nat table, not syz0 [ 587.429917][T21597] netlink: 104 bytes leftover after parsing attributes in process `syz.3.4086'. [ 587.596919][T21603] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4088'. [ 587.715127][T21604] syzkaller0 speed is unknown, defaulting to 1000 [ 587.727430][T21604] wg1 speed is unknown, defaulting to 1000 [ 587.813022][T21607] vxcan5: entered allmulticast mode [ 588.344322][T21620] tipc: Enabling of bearer rejected, failed to enable media [ 588.505046][T21634] syzkaller0 speed is unknown, defaulting to 1000 [ 588.598173][T21634] wg1 speed is unknown, defaulting to 1000 [ 588.812354][T21636] syzkaller0 speed is unknown, defaulting to 1000 [ 588.858665][T21636] wg1 speed is unknown, defaulting to 1000 [ 588.881645][T21628] syzkaller0 speed is unknown, defaulting to 1000 [ 588.914866][T21628] wg1 speed is unknown, defaulting to 1000 [ 589.230574][T21652] nbd: must specify a size in bytes for the device [ 589.538706][T21664] pim6reg1: entered promiscuous mode [ 589.565679][T21664] pim6reg1: entered allmulticast mode [ 589.582775][T21668] pim6reg1: entered promiscuous mode [ 589.620437][T21668] pim6reg1: entered allmulticast mode [ 589.804343][ T13] net_ratelimit: 17 callbacks suppressed [ 589.804363][ T13] bond2: (slave macvlan2): failed to get link speed/duplex [ 589.924092][ T13] bond2: (slave macvlan2): failed to get link speed/duplex [ 590.054083][ T49] bond2: (slave macvlan2): failed to get link speed/duplex [ 590.164053][ T76] bond2: (slave macvlan2): failed to get link speed/duplex [ 590.293854][ T13] bond2: (slave macvlan2): failed to get link speed/duplex [ 590.403883][ T7097] bond2: (slave macvlan2): failed to get link speed/duplex [ 590.513842][ T49] bond2: (slave macvlan2): failed to get link speed/duplex [ 590.644236][ T7097] bond2: (slave macvlan2): failed to get link speed/duplex [ 590.774302][ T13] bond2: (slave macvlan2): failed to get link speed/duplex [ 590.890745][ T13] bond2: (slave macvlan2): failed to get link speed/duplex [ 591.553046][T21762] wg2: entered promiscuous mode [ 591.559517][T21762] wg2: entered allmulticast mode [ 592.129302][T21778] pim6reg1: entered promiscuous mode [ 592.146300][T21778] pim6reg1: entered allmulticast mode [ 596.264019][ T13] net_ratelimit: 10 callbacks suppressed [ 596.264037][ T13] bond2: (slave macvlan2): failed to get link speed/duplex [ 596.414407][ T49] bond2: (slave macvlan2): failed to get link speed/duplex [ 596.524065][ T49] bond2: (slave macvlan2): failed to get link speed/duplex [ 596.634227][ T13] bond2: (slave macvlan2): failed to get link speed/duplex [ 596.706886][T21885] sit0: entered promiscuous mode [ 596.731766][T21885] sit0: entered allmulticast mode [ 596.796153][ T49] bond2: (slave macvlan2): failed to get link speed/duplex [ 596.924299][ T49] bond2: (slave macvlan2): failed to get link speed/duplex [ 597.033836][ T3503] bond2: (slave macvlan2): failed to get link speed/duplex [ 597.155841][ T3503] bond2: (slave macvlan2): failed to get link speed/duplex [ 597.236001][T21899] pim6reg1: entered promiscuous mode [ 597.241330][T21899] pim6reg1: entered allmulticast mode [ 597.347407][ T49] bond2: (slave macvlan2): failed to get link speed/duplex [ 597.373163][T21907] veth0_vlan: entered allmulticast mode [ 597.484993][ T49] bond2: (slave macvlan2): failed to get link speed/duplex [ 597.835892][T21944] sctp: [Deprecated]: syz.2.4226 (pid 21944) Use of int in maxseg socket option. [ 597.835892][T21944] Use struct sctp_assoc_value instead [ 598.422484][T21968] __nla_validate_parse: 5 callbacks suppressed [ 598.422501][T21968] netlink: 20 bytes leftover after parsing attributes in process `syz.4.4241'. [ 598.455305][T21968] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4241'. [ 598.557864][T21974] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4244'. [ 598.943164][T21996] bridge1: trying to set multicast query interval below minimum, setting to 100 (1000ms) [ 599.171085][T22013] netlink: 28 bytes leftover after parsing attributes in process `syz.4.4263'. [ 599.548744][T22040] syzkaller0: entered promiscuous mode [ 599.555577][T22040] syzkaller0: entered allmulticast mode [ 601.344051][ T3503] net_ratelimit: 18 callbacks suppressed [ 601.344070][ T3503] bond2: (slave macvlan2): failed to get link speed/duplex [ 601.484309][ T12] bond2: (slave macvlan2): failed to get link speed/duplex [ 601.594265][ T12] bond2: (slave macvlan2): failed to get link speed/duplex [ 601.608659][T22045] infiniband syz1: set active [ 601.621202][T22045] infiniband syz1: added syz_tun [ 601.628973][T22045] syz1: rxe_create_cq: returned err = -12 [ 601.636082][T22045] infiniband syz1: Couldn't create ib_mad CQ [ 601.642629][T22045] infiniband syz1: Couldn't open port 1 [ 601.674998][T22045] RDS/IB: syz1: added [ 601.714405][ T12] bond2: (slave macvlan2): failed to get link speed/duplex [ 601.825090][ T2918] bond2: (slave macvlan2): failed to get link speed/duplex [ 601.934976][ T2918] bond2: (slave macvlan2): failed to get link speed/duplex [ 602.044485][ T3503] bond2: (slave macvlan2): failed to get link speed/duplex [ 602.164022][ T2918] bond2: (slave macvlan2): failed to get link speed/duplex [ 602.284322][ T12] bond2: (slave macvlan2): failed to get link speed/duplex [ 602.404398][ T7097] bond2: (slave macvlan2): failed to get link speed/duplex [ 602.444464][T22129] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4314'. [ 602.454829][T22129] netlink: 28 bytes leftover after parsing attributes in process `syz.3.4314'. [ 602.569403][T22135] netlink: 'syz.3.4316': attribute type 4 has an invalid length. [ 602.578134][T22135] netlink: 3657 bytes leftover after parsing attributes in process `syz.3.4316'. [ 603.176629][T22150] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 603.878483][T22182] netlink: 372 bytes leftover after parsing attributes in process `syz.2.4337'. [ 604.935161][T22230] netlink: 44 bytes leftover after parsing attributes in process `syz.3.4358'. [ 604.966307][T22230] netlink: 16 bytes leftover after parsing attributes in process `syz.3.4358'. [ 606.074435][T22218] netlink: 'syz.0.4355': attribute type 11 has an invalid length. [ 606.327848][T22247] netlink: 'syz.1.4365': attribute type 2 has an invalid length. [ 606.364231][ T76] net_ratelimit: 19 callbacks suppressed [ 606.364249][ T76] bond2: (slave macvlan2): failed to get link speed/duplex [ 606.498446][T22264] netlink: 256 bytes leftover after parsing attributes in process `syz.2.4372'. [ 606.505828][ T76] bond2: (slave macvlan2): failed to get link speed/duplex [ 606.539884][T22268] netlink: 32 bytes leftover after parsing attributes in process `syz.1.4373'. [ 606.604297][T22271] nbd: nbd2 already in use [ 606.610132][T22271] block nbd2: NBD_DISCONNECT [ 606.614893][T22271] block nbd2: Send disconnect failed -32 [ 606.620693][T22271] block nbd2: shutting down sockets [ 606.626109][ T7097] bond2: (slave macvlan2): failed to get link speed/duplex [ 606.754070][ T49] bond2: (slave macvlan2): failed to get link speed/duplex [ 606.882800][ T49] bond2: (slave macvlan2): failed to get link speed/duplex [ 606.977436][T22298] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4387'. [ 607.024366][ T49] bond2: (slave macvlan2): failed to get link speed/duplex [ 607.106834][T22306] netlink: 100 bytes leftover after parsing attributes in process `syz.4.4389'. [ 607.138658][T22306] netlink: 244 bytes leftover after parsing attributes in process `syz.4.4389'. [ 607.164137][ T7097] bond2: (slave macvlan2): failed to get link speed/duplex [ 607.296648][ T49] bond2: (slave macvlan2): failed to get link speed/duplex [ 607.331710][T22325] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4400'. [ 607.413981][ T49] bond2: (slave macvlan2): failed to get link speed/duplex [ 607.527289][ T49] bond2: (slave macvlan2): failed to get link speed/duplex [ 608.446638][T22406] syzkaller0 speed is unknown, defaulting to 1000 [ 608.467141][T22406] wg1 speed is unknown, defaulting to 1000 [ 608.752296][T22429] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4449'. [ 609.234776][T12870] IPVS: starting estimator thread 0... [ 609.237918][T22451] syzkaller0 speed is unknown, defaulting to 1000 [ 609.278364][T22456] hsr0: left promiscuous mode [ 609.289494][T22460] netlink: 'syz.0.4460': attribute type 16 has an invalid length. [ 609.315024][T22460] netlink: 'syz.0.4460': attribute type 17 has an invalid length. [ 609.328312][T22451] wg1 speed is unknown, defaulting to 1000 [ 609.344213][T22458] IPVS: using max 32 ests per chain, 76800 per kthread [ 610.213925][T22474] syzkaller0 speed is unknown, defaulting to 1000 [ 610.222076][T22474] wg1 speed is unknown, defaulting to 1000 [ 611.483188][ T3503] net_ratelimit: 29 callbacks suppressed [ 611.483205][ T3503] bond2: (slave macvlan2): failed to get link speed/duplex [ 611.544559][T22524] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4489'. [ 611.624374][ T76] bond2: (slave macvlan2): failed to get link speed/duplex [ 611.734461][ T12] bond2: (slave macvlan2): failed to get link speed/duplex [ 611.844062][ T76] bond2: (slave macvlan2): failed to get link speed/duplex [ 611.953877][ T76] bond2: (slave macvlan2): failed to get link speed/duplex [ 612.094234][ T3503] bond2: (slave macvlan2): failed to get link speed/duplex [ 612.204110][ T12] bond2: (slave macvlan2): failed to get link speed/duplex [ 612.323871][ T12] bond2: (slave macvlan2): failed to get link speed/duplex [ 612.471084][ T76] bond2: (slave macvlan2): failed to get link speed/duplex [ 612.609719][ T3503] bond2: (slave macvlan2): failed to get link speed/duplex [ 613.251704][T22590] netlink: 'syz.4.4520': attribute type 12 has an invalid length. [ 615.355603][T22658] tipc: Enabled bearer , priority 0 [ 615.426398][T22657] tipc: Resetting bearer [ 616.445719][ T5874] tipc: Node number set to 2588643229 [ 617.646770][T22657] tipc: Disabling bearer [ 617.663868][ T3503] net_ratelimit: 23 callbacks suppressed [ 617.663887][ T3503] bond2: (slave macvlan2): failed to get link speed/duplex [ 617.870337][T22720] syzkaller0: entered promiscuous mode [ 617.878993][T22720] syzkaller0: entered allmulticast mode [ 619.386712][T22765] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4593'. [ 619.704392][ T2918] bond2: (slave macvlan2): failed to get link speed/duplex [ 619.711830][T22742] bridge: RTM_NEWNEIGH with invalid ether address [ 619.769921][T22766] macsec1: entered allmulticast mode [ 619.783464][T22766] bridge0: entered allmulticast mode [ 619.824708][ T49] bond2: (slave macvlan2): failed to get link speed/duplex [ 619.866235][T22773] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4596'. [ 619.974369][ T2918] bond2: (slave macvlan2): failed to get link speed/duplex [ 620.077495][T22790] [ 620.080153][T22790] ============================= [ 620.085371][T22790] WARNING: suspicious RCU usage [ 620.090231][T22790] syzkaller #0 Not tainted [ 620.095085][T22790] ----------------------------- [ 620.101346][T22790] kernel/events/callchain.c:163 suspicious rcu_dereference_check() usage! [ 620.110192][T22790] [ 620.110192][T22790] other info that might help us debug this: [ 620.110192][T22790] [ 620.114321][ T2918] bond2: (slave macvlan2): failed to get link speed/duplex [ 620.120561][T22790] [ 620.120561][T22790] rcu_scheduler_active = 2, debug_locks = 1 [ 620.136507][T22790] 1 lock held by syz.2.4604/22790: [ 620.141624][T22790] #0: ffffffff8e13a2c0 (rcu_read_lock_trace){....}-{0:0}, at: rcu_read_lock_trace+0x38/0x80 [ 620.151868][T22790] [ 620.151868][T22790] stack backtrace: [ 620.158193][T22790] CPU: 1 UID: 0 PID: 22790 Comm: syz.2.4604 Not tainted syzkaller #0 PREEMPT(full) [ 620.158217][T22790] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 620.158229][T22790] Call Trace: [ 620.158236][T22790] [ 620.158245][T22790] dump_stack_lvl+0x189/0x250 [ 620.158273][T22790] ? __pfx_dump_stack_lvl+0x10/0x10 [ 620.158294][T22790] ? __pfx__printk+0x10/0x10 [ 620.158329][T22790] lockdep_rcu_suspicious+0x140/0x1d0 [ 620.158358][T22790] get_callchain_entry+0x2b6/0x3c0 [ 620.158385][T22790] get_perf_callchain+0xa1/0x6b0 [ 620.158414][T22790] ? __pfx_get_perf_callchain+0x10/0x10 [ 620.158444][T22790] ? preempt_schedule+0xae/0xc0 [ 620.158471][T22790] __bpf_get_stack+0x3fc/0xa60 [ 620.158506][T22790] ? __pfx___bpf_get_stack+0x10/0x10 [ 620.158529][T22790] ? __lock_acquire+0xab9/0xd20 [ 620.158559][T22790] bpf_get_stack+0x33/0x50 [ 620.158579][T22790] ? bpf_prog_b8a90dd1efcc4ad9+0x46/0x4e [ 620.158597][T22790] bpf_get_stack_raw_tp+0x1a9/0x220 [ 620.158623][T22790] bpf_prog_b8a90dd1efcc4ad9+0x46/0x4e [ 620.158639][T22790] bpf_prog_run_pin_on_cpu+0xbf/0x150 [ 620.158664][T22790] bpf_prog_test_run_syscall+0x312/0x4b0 [ 620.158687][T22790] ? __pfx_bpf_prog_test_run_syscall+0x10/0x10 [ 620.158707][T22790] ? __fget_files+0x2a/0x420 [ 620.158732][T22790] ? __pfx_bpf_prog_test_run_syscall+0x10/0x10 [ 620.158751][T22790] bpf_prog_test_run+0x2c7/0x340 [ 620.158776][T22790] __sys_bpf+0x581/0x870 [ 620.158797][T22790] ? __pfx___sys_bpf+0x10/0x10 [ 620.158833][T22790] ? rcu_is_watching+0x15/0xb0 [ 620.158852][T22790] __x64_sys_bpf+0x7c/0x90 [ 620.158868][T22790] do_syscall_64+0xfa/0x3b0 [ 620.158882][T22790] ? lockdep_hardirqs_on+0x9c/0x150 [ 620.158904][T22790] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 620.158921][T22790] ? clear_bhb_loop+0x60/0xb0 [ 620.158941][T22790] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 620.158957][T22790] RIP: 0033:0x7f5f9cb8eec9 [ 620.158970][T22790] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 620.158984][T22790] RSP: 002b:00007f5f9da89038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 620.159001][T22790] RAX: ffffffffffffffda RBX: 00007f5f9cde5fa0 RCX: 00007f5f9cb8eec9 [ 620.159013][T22790] RDX: 0000000000000010 RSI: 0000200000000740 RDI: 000000000000000a [ 620.159023][T22790] RBP: 00007f5f9cc11f91 R08: 0000000000000000 R09: 0000000000000000 [ 620.159032][T22790] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 620.159041][T22790] R13: 00007f5f9cde6038 R14: 00007f5f9cde5fa0 R15: 00007ffece279df8 [ 620.159068][T22790] [ 620.440290][T22794] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4606'. [ 620.444205][T22785] pim6reg1: entered promiscuous mode [ 620.454887][T22785] pim6reg1: entered allmulticast mode [ 620.526561][ T7097] bond2: (slave macvlan2): failed to get link speed/duplex [ 620.645051][ T49] bond2: (slave macvlan2): failed to get link speed/duplex [ 620.753873][ T7097] bond2: (slave macvlan2): failed to get link speed/duplex [ 620.863979][ T2918] bond2: (slave macvlan2): failed to get link speed/duplex [ 620.983949][ T12] bond2: (slave macvlan2): failed to get link speed/duplex [ 622.673890][ T7097] net_ratelimit: 14 callbacks suppressed [ 622.673911][ T7097] bond2: (slave macvlan2): failed to get link speed/duplex [ 622.794375][ T7097] bond2: (slave macvlan2): failed to get link speed/duplex [ 622.903909][ T7097] bond2: (slave macvlan2): failed to get link speed/duplex [ 623.014231][ T7097] bond2: (slave macvlan2): failed to get link speed/duplex [ 623.124316][ T49] bond2: (slave macvlan2): failed to get link speed/duplex [ 623.243848][ T3503] bond2: (slave macvlan2): failed to get link speed/duplex [ 623.353942][ T3503] bond2: (slave macvlan2): failed to get link speed/duplex [ 623.463921][ T7097] bond2: (slave macvlan2): failed to get link speed/duplex [ 623.573850][ T7097] bond2: (slave macvlan2): failed to get link speed/duplex [ 623.683843][ T7097] bond2: (slave macvlan2): failed to get link speed/duplex [ 627.704061][ T3503] net_ratelimit: 35 callbacks suppressed [ 627.704080][ T3503] bond2: (slave macvlan2): failed to get link speed/duplex [ 627.834059][ T12] bond2: (slave macvlan2): failed to get link speed/duplex [ 627.943984][ T12] bond2: (slave macvlan2): failed to get link speed/duplex [ 628.053870][ T12] bond2: (slave macvlan2): failed to get link speed/duplex [ 628.164046][ T12] bond2: (slave macvlan2): failed to get link speed/duplex [ 628.273893][ T3503] bond2: (slave macvlan2): failed to get link speed/duplex [ 628.383842][ T7097] bond2: (slave macvlan2): failed to get link speed/duplex [ 628.494396][ T3503] bond2: (slave macvlan2): failed to get link speed/duplex [ 628.603930][ T2918] bond2: (slave macvlan2): failed to get link speed/duplex [ 628.713965][ T2918] bond2: (slave macvlan2): failed to get link speed/duplex