last executing test programs: 6.072098629s ago: executing program 1 (id=7002): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt(r0, 0x84, 0x11, &(0x7f0000000040)="020c0000098011e8", 0x8) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_SWAP(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)={0x34, 0x6, 0x6, 0x301, 0x0, 0x0, {0x5, 0x0, 0x8}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_SETNAME2={0x9, 0x3, 'syz0\x00'}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000}, 0x4008000) r2 = socket$tipc(0x1e, 0x2, 0x0) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) bind$tipc(r3, &(0x7f0000000200)=@name={0x1e, 0x2, 0x1, {{0x42, 0x102}}}, 0x9) bind$tipc(r2, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0x2}}, 0x10) r4 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r4, &(0x7f00000000c0)=@nameseq={0x1e, 0x1, 0x0, {0x42}}, 0x10) bind$tipc(r4, &(0x7f0000000180)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x2, 0x3}}, 0x10) bind$tipc(r2, &(0x7f0000000100)=@name={0x1e, 0x2, 0x0, {{0x42, 0x20000003}}}, 0x10) r5 = socket(0x40000000015, 0x5, 0x0) connect$inet(r5, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$SO_RDS_TRANSPORT(r5, 0x114, 0x8, &(0x7f00000008c0)=0x2, 0x4) setsockopt$sock_int(r5, 0x1, 0x8, &(0x7f00006dbffc), 0x4) bind$inet(r5, &(0x7f0000000340)={0x2, 0x4e20, @loopback}, 0x57) sendmsg$xdp(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000200)="0000000000aa303e97380e90231bdbdaf6a4bd866226b7cdb7c26858c4e4fd703be2f51ed6ddc4a47116ec2db75c7042a22491af0ffea4174a9de3350c0a498396b28c7d1784d04aa38922721cb7816094cb82950fd012efd26d", 0x5a}, {&(0x7f0000000900)="0f198d5aa5caa1c55b84b414797cbdd4e8c576a921a070fc828060506683fd1106a961ac55b5b8ea3342ca7de5559ca2c14e05e42aed8ba14b2c78cb540f71a817d80fbf1945a046ebda494a8048a106a4d49d7f214735ada53397db3b203885ce39ee48d69465935eade21ce36e61826c52c82f038341d9bab5687c740ed3c18897094e7e1391eb84a4052e03c0c7c39ae86d454938f65e284620b99481c33d9f5e5b7a6c0d7548723f55b213c76be37f40c850c38e265758ebd8238257a146d6eced16fd658a784c928fea7a841db1a7fd6520442dae5fc0d3a3d3a5f16fcf6fe4f062ecdad7d0f3c6cd339339533c0ef28ad1e2729907094c3de93c1b1b00ad6df89507000000fb7565d3a8e9eaea020ed173c2179fb03e0944460989240a689c7fe795d310be4e7a6b778a903280dbf426b39c3603c49049980767e31edb997f59785184cbd7b9070400000073c745f71db0906cb51780f908fa61634af8ac85d9f04f3dff0a948e81cd3229a59aaeb00995358155343e3239588a0383e4df109d5ca24276d0d83a27d0e9bf681c1bbea12a6f3c20ad50f63430333bb327eb6ae32fe8809065bce26d2dc2fbb2b48d404637d61fd86852e0e1b6ccc6f75b1107aaa5f60ef45f94e953b3f213c3cb4ca4c716565078c666f84e1a99bb4cb5c7190648132f6ff1f6cb79b93f20752753c938da6241607a742361d995188b23cb4b8269e98e822585695962620673433748e476f7cc3e37db88639c525ff3a502c82c283b00aecfe7734ab369e1ed7c75e27a5a333641817baa3ea37844e20e6266c5095abf9d47ca5f8ad93f1a4d8795daec222ada00d65cf91425fae7939ceaa8d94ec1ab5082e1d251c27b3132119b350e81771f3733be232ffb90c03a818bf458aac3314007c3e35d5e4bed6b897608b01e7e26a54433e5f5c74a2ee3c2fc50067be05a677f122b7dba7010830b879a41b579d44158fb89ea05761d2d369853bea84dfb8081ed7b891dcb3bb3361534fdc5252e4964aed936ad2838e7af14fc65c7c1c6d44c6256f2462ae83cfd6a6b2651da607fe79d345e5080098e9e6e7482cc5c267e00d8d09dcde70b60fe6220fe9530547201664db91cf1885ecc2f106b66cd99131523c99f6102ddd7403791b3a7ac59b256cc4c938fe01740ae4f19b5204ca305b1666b0c2a7e5015d6d530995843adfbac3954306d4cd82257d4d2c3283d45dbae43548fed9879328f114f7c8238ac955391b24614d91be1701ae07c170a9c299fcf3d0ac4cea07e88fbf66b697883af17a06ac3f9954eb2fbd20f101802cd023fc48c5d464c16059cc9dce8558c5322ac7612db0e2725427628c2c41a21f0d2f3962e32f710bf9e216ff1694e8d88c8a81328744b36d9ef9f08c0ea3ccd4f8729e2f00a048162834a95", 0x3f1}, {&(0x7f00000003c0)="128b9306006d4810e5ac5040ad9201847839fc378469d5765b9cc241840896c1498194a7197b45d74a8532b82037b02c9e6045c361eb", 0x36}], 0x3}, 0x0) setsockopt$RDS_CONG_MONITOR(r5, 0x114, 0x6, &(0x7f0000000680)=0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x32, 0xffffffffffffffff, 0x0) sendmsg$NL80211_CMD_JOIN_MESH(r5, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x40) recvmmsg(r5, &(0x7f0000006f00)=[{{0x0, 0x0, 0x0}, 0x81}, {{0x0, 0x0, 0x0}, 0x1}], 0x2, 0x60000100, 0x0) bind$tipc(r4, &(0x7f0000000440)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x2, 0x3}}, 0x10) r6 = socket$kcm(0x10, 0x2, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000014800)={0x0, 0x0, &(0x7f00000147c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="f80000001600010025bd7000ffdbdf2500000000000000000000ffff64010100ff"], 0xf8}, 0x1, 0x0, 0x0, 0x880}, 0x48000) write$cgroup_subtree(r6, &(0x7f0000000000)=ANY=[@ANYBLOB="33fe00004a00530c8e5eb88edc5a9c0e0a9b80"], 0xfe33) bind$tipc(r2, 0x0, 0x0) r7 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_INITMSG(r7, 0x84, 0x2, &(0x7f00000000c0)={0xfffc, 0xc}, 0x8) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r7, 0x84, 0x7b, &(0x7f0000000080)={0x0, 0xa7c}, &(0x7f0000000100)=0x8) 5.808016724s ago: executing program 1 (id=7006): r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, 0x0, 0x101) syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/ipc\x00') unshare(0x6a040000) r1 = socket(0x8, 0x3, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$packet(0x11, 0x3, 0x300) ioctl$SIOCGSTAMPNS(r3, 0x8907, 0x0) recvmmsg(r3, &(0x7f00000021c0)=[{{0x0, 0x0, 0x0}, 0x9}], 0x1, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX_802154(r2, 0x8933, &(0x7f0000000180)={'wpan0\x00'}) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r2, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000}, 0x40000) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(0x0, 0xffffffffffffffff) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$IMGETCOUNT(r1, 0x61d8, &(0x7f0000000000)) 5.167479942s ago: executing program 1 (id=7012): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_ctr_aes256\x00'}, 0x58) (async) r1 = socket$packet(0x11, 0x2, 0x300) getsockname$packet(r1, &(0x7f00000001c0), &(0x7f0000000200)=0x14) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000400)="fa", 0x1) sendmsg$NFC_CMD_FW_DOWNLOAD(0xffffffffffffffff, 0x0, 0x880) (async) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="640000000206010800000000000000000000000014000780080011400000000005001500340db7490500010006000000050005000a00000005000400000000000900020073797a300000000016000300686173683a6e65742c706f72742c6e6574"], 0x64}}, 0x0) (async) sendmsg$NFT_BATCH(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_NEWRULE={0x68, 0x6, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x3c, 0x4, 0x0, 0x1, [{0x38, 0x1, 0x0, 0x1, @byteorder={{0xe}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_BYTEORDER_SREG={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_BYTEORDER_DREG={0x8}, @NFTA_BYTEORDER_LEN={0x8, 0x4, 0x1, 0x0, 0x2}, @NFTA_BYTEORDER_LEN={0x8, 0x4, 0x1, 0x0, 0xd}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x90}, 0x1, 0x0, 0x0, 0x20044054}, 0x0) (async) r3 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) r4 = socket$inet6_sctp(0xa, 0x0, 0x84) (async) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000180)={'team_slave_1\x00', 0x0}) r7 = socket$nl_generic(0x10, 0x3, 0x10) (async) r8 = syz_genetlink_get_family_id$team(&(0x7f00000044c0), 0xffffffffffffffff) (async) r9 = socket(0x2, 0x80805, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f00000002c0)) (async) ioctl$IOCTL_GET_NCIDEV_IDX(r3, 0x0, &(0x7f00000003c0)=0x0) sendmsg$NFC_CMD_DEV_DOWN(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x80180000}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x24, 0x0, 0x10, 0x70bd2c, 0x25dfdbfd, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r10}, @NFC_ATTR_DEVICE_INDEX={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004804}, 0x91) sendmmsg$inet(r9, &(0x7f00000008c0)=[{{&(0x7f0000000300)={0x2, 0x4e23, @private=0xa010102}, 0x10, &(0x7f0000001740)=[{&(0x7f0000000200)='\f', 0x1}], 0x1}}, {{&(0x7f0000000540)={0x2, 0x4e23, @private=0xa010101}, 0x10, &(0x7f0000001c80)=[{&(0x7f0000000980)='\x00S', 0x2}], 0x1}}, {{&(0x7f0000000240)={0x2, 0x4e1e, @private=0xa010102}, 0x10, &(0x7f0000000880)=[{&(0x7f0000000340)="062b", 0x2}], 0x1}}], 0x3, 0x4000800) getsockopt$inet_sctp_SCTP_MAX_BURST(r9, 0x84, 0xc, &(0x7f0000000100)=@assoc_value={0x0}, &(0x7f0000000000)=0x8) setsockopt$inet_sctp_SCTP_CONTEXT(r3, 0x84, 0x11, &(0x7f0000000080)={r11, 0x53f}, 0x8) (async) ioctl$ifreq_SIOCGIFINDEX_team(r7, 0x8933, &(0x7f0000004700)={'team0\x00', 0x0}) (async) r13 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r13, 0x8933, &(0x7f0000000200)={'batadv0\x00', 0x0}) sendmsg$nl_route(r13, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=@newlink={0x40, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x21}, [@IFLA_MASTER={0x8, 0xa, r14}, @IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gretap={{0xb}, {0x8, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}]}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x20040000}, 0x0) (async) setsockopt$inet6_MCAST_LEAVE_GROUP(r4, 0x29, 0x2d, &(0x7f0000000240)={0x1000000b, {{0xa, 0x4e22, 0x8, @local, 0x7}}}, 0x88) (async) sendmsg$TEAM_CMD_OPTIONS_SET(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001700)={0x5c, r8, 0x405, 0x70bd2f, 0x25dfdbff, {}, [{{0x8, 0x1, r12}, {0x40, 0x2, 0x0, 0x1, [{0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r6}}}]}}]}, 0x5c}, 0x1, 0x0, 0x0, 0x4000401}, 0x400e8c0) 5.040477696s ago: executing program 1 (id=7014): r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="180000000200000000"], &(0x7f0000000040)='syzkaller\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000840)={r0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x54, 0x0, &(0x7f00000007c0)="a16df52369c20b709852e85a9260c28a3e1c3241b0420185201fef937cda13abd95775cfb2060ea2504951ecff2552916d4702457b50783932c3d98b97d7321c7022018ed4c76c692f0b00c1b02ce137005a62e9", 0x2, 0x0, 0x5}, 0x50) 4.931442945s ago: executing program 1 (id=7015): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001100)=ANY=[@ANYBLOB="ec000000210001000000000000000000e0000001000000000000000000000000ac14142e0000000000000000000000000000030000000000020080802e000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000009c0011000a01010100000000000000000a0000007f000001000000000000000000000000fc0200000000000000000000000000010000000000000000000000000000000100030000000000000a000a000a0101010000000000000000000000007f000001000000000000000000000000ac141439000000000000000000000000ac14142c0000000000000000000000003c"], 0xec}, 0x1, 0x0, 0x0, 0xc000}, 0x4020800) 4.791423551s ago: executing program 1 (id=7017): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0x10, &(0x7f0000000480)=ANY=[@ANYRESDEC], 0x0, 0x0, 0xffffffc0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x16, 0xc, 0x0, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$inet_icmp(0x2, 0x2, 0x1) bpf$MAP_CREATE(0x0, &(0x7f0000003940)=ANY=[@ANYBLOB="2100000000000000000000000000100000040000", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00j\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000020000000000000000000000020000000000000000"], 0x48) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x101801, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'pimreg\x00', 0x3}) ioctl$TUNSETLINK(r1, 0x400454cd, 0x1) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x6, 0xe, &(0x7f0000000000)=ANY=[], &(0x7f0000000580)='syzkaller\x00', 0x6, 0x1b, &(0x7f00000003c0)=""/27, 0x40f00, 0x20, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000380), 0x0, 0x10, 0x1}, 0x94) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r2, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r2, 0x0) getsockopt$inet6_mreq(r2, 0x29, 0x15, &(0x7f0000000180)={@initdev, 0x0}, &(0x7f0000000380)=0x14) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000340)={'ip6_vti0\x00', &(0x7f0000000040)={'syztnl1\x00', r3, 0x2f, 0x6, 0x5, 0x5, 0x1, @empty, @mcast1, 0x40, 0x80, 0xa, 0xa}}) getsockopt$PNPIPE_INITSTATE(r2, 0x113, 0x4, &(0x7f0000000400), &(0x7f0000000440)=0x4) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0xe, 0x4, &(0x7f0000000200)=ANY=[@ANYRES32=0x0], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x10, '\x00', r4, @sk_skb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r2}, 0x94) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000009a40)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000010000040900010073797a3000000000400000001b0a01080000000000000000010000000900030073797a320000000014000480080002400000000008000140000000000900010073797a30"], 0xd8}}, 0x80) 3.024864924s ago: executing program 2 (id=7034): syz_emit_ethernet(0x82, &(0x7f0000000140)={@broadcast, @random="1704b45adbde", @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x74, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0xe0, 0x0, 0xe000, {0x16, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11, 0x0, @empty=0xac1414aa, @rand_addr, {[@lsrr={0x83, 0x3}, @rr={0x7, 0x3}, @timestamp_prespec={0x44, 0x3c, 0x0, 0x3, 0x0, [{@private=0xa010188, 0x3}, {@private}, {@local}, {@remote}, {@private}, {@dev}, {@private}]}]}}}}}}}, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r0, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r0, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x60, &(0x7f00000003c0)={'filter\x00', 0x104, 0x4, 0x3f0, 0x0, 0xe8, 0xe8, 0x308, 0x308, 0x308, 0x4, 0x0, {[{{@arp={@remote, @multicast2, 0xff000000, 0x0, 0x0, 0x0, {@mac=@local}, {@empty, {[0x0, 0x0, 0x0, 0xff]}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'ip6_vti0\x00', 'macvlan0\x00'}, 0xc0, 0xe8}, @unspec=@NFQUEUE3={0x28, 'NFQUEUE\x00', 0x3, {0x0, 0x5, 0x2}}}, {{@arp={@local, @multicast2, 0x0, 0x0, 0x0, 0xe, {@mac=@broadcast}, {@empty, {[0x0, 0x0, 0x0, 0x0, 0x0, 0xff]}}, 0x0, 0x0, 0x0, 0x2000, 0x0, 0x0, 'pimreg\x00', 'veth0\x00'}, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @empty, @broadcast, @rand_addr=0x64010102, 0x2, 0x1}}}, {{@arp={@dev={0xac, 0x14, 0x14, 0x34}, @local, 0xffffff00, 0xffffff00, 0x6, 0x8, {@mac=@multicast, {[0x0, 0xff, 0x0, 0x0, 0x0, 0xff]}}, {@mac=@multicast, {[0x0, 0xff, 0x0, 0xff]}}, 0x2, 0x5, 0x797b, 0x78, 0x96a4, 0x7, 'dvmrp1\x00', 'wlan1\x00', {}, {0xff}}, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@local, @empty, @remote, @loopback, 0x8, 0xffffffff}}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x440) r2 = socket$igmp6(0xa, 0x3, 0x2) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x24, 0x10, 0x701, 0x0, 0x0, {0xa}, [@typed={0x6, 0x1, 0x0, 0x0, @str='!\x00'}, @typed={0x8, 0xa, 0x0, 0x0, @fd=r3}]}, 0x24}}, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000980)=@raw={'raw\x00', 0x8, 0x3, 0x4c0, 0x190, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x3f0, 0xffffffff, 0xffffffff, 0x3f0, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [0x0, 0x0, 0x0, 0xff0000ff], [], 'veth0_macvtap\x00', 'dvmrp1\x00', {}, {}, 0x0, 0x0, 0x2}, 0x0, 0x128, 0x190, 0x0, {}, [@common=@unspec=@addrtype1={{0x28}, {0x81, 0x600, 0x9}}, @common=@inet=@hashlimit1={{0x58}, {'bond_slave_1\x00', {0x29, 0x1ff, 0x6, 0xb0e6, 0x10001, 0x84e, 0xfffffffb, 0x18, 0x8}, {0x1}}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x18, 0x800, 0x93, 0x6, 'netbios-ns\x00', 'syz0\x00', {0x6}}}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'erspan0\x00', 'gre0\x00'}, 0x0, 0x1f8, 0x260, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@recent0={{0xf8}, {0xffff, 0x40, 0x10, 0x1, 'syz0\x00', 0xa}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x1, 0x8, 0x2, 0x8, 'pptp\x00', 'syz1\x00', {0x5a}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x520) 2.790857893s ago: executing program 2 (id=7038): r0 = socket$kcm(0x11, 0xa, 0x300) ioctl$SIOCSIFHWADDR(r0, 0x8b04, &(0x7f0000000040)={'wlan1\x00', @random="c3000e000300"}) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) r3 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000600), 0xffffffffffffffff) sendmsg$WG_CMD_SET_DEVICE(0xffffffffffffffff, &(0x7f0000001000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000640)=ANY=[@ANYBLOB="d4000000", @ANYRES16=r3, @ANYBLOB="0100000000000000000001000000ac000880a8000080800009801c00008006000100020000000e000200ac1414aa05000300020000001c0000800600010002000000080002007f00000105000300030000001c0000800600010002000000080002000a010102050003000300000028000080060001000a00000014000200fc010000000000000000000000000000050003000300000024000100000000000000000000000000000000000000000000000000000000000000000014000200776731"], 0xd4}, 0x1, 0x0, 0x0, 0x4084}, 0x20008040) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) socket$unix(0x1, 0x1, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000540)=ANY=[@ANYBLOB="fc0000001900010029bd7000fbdbdf25ac1e0101000000000000000000000000ffffffff00000000000000000000000000000000000000000200000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000001000080000000000000000000000000000000000000000000000000000000000200000000000000fdffffffefffffff00000000000000001000000000000000050000000000000000000000002000000000000000000000000000000000000001000202000000004400050000000000000000000000ffff0a010100000004d63c"], 0xfc}, 0x1, 0x0, 0x0, 0x20000004}, 0x0) r5 = socket$kcm(0xf, 0x3, 0x2) sendmsg$inet(r5, &(0x7f00000000c0)={0x0, 0xfe, &(0x7f0000000000)=[{&(0x7f0000000040)="0207000902000000e4a17c45c8d260c9", 0x10}], 0x1}, 0x0) socket$kcm(0xa, 0x2, 0x88) getsockname$packet(r2, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r6, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000) sendmsg$nl_route(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="20070000e9ffffffffbc7000fcdbdf2512200101", @ANYRES32=r6, @ANYBLOB="08000200ac1414aa"], 0x20}}, 0x40000c0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=@newlink={0x3c, 0x10, 0x503, 0x70bd29, 0x700, {0x0, 0x0, 0x0, 0x0, 0x0, 0x1006}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @vcan={{0x9}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x440b0) 2.783326611s ago: executing program 3 (id=7039): r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, 0x0, 0x101) syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/ipc\x00') unshare(0x6a040000) r1 = socket(0x8, 0x3, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$packet(0x11, 0x3, 0x300) ioctl$SIOCGSTAMPNS(r3, 0x8907, 0x0) recvmmsg(r3, &(0x7f00000021c0)=[{{0x0, 0x0, 0x0}, 0x9}], 0x1, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX_802154(r2, 0x8933, &(0x7f0000000180)={'wpan0\x00'}) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r2, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000}, 0x40000) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(0x0, 0xffffffffffffffff) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$IMGETCOUNT(r1, 0x61d8, &(0x7f0000000000)) 2.688623029s ago: executing program 0 (id=7040): r0 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) (async) getsockopt$inet_sctp_SCTP_AUTOCLOSE(r0, 0x84, 0x4, &(0x7f0000000040), &(0x7f00000000c0)=0x4) (async) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)={0x34, 0x2, 0x3, 0x301, 0x0, 0x0, {0x2, 0x0, 0x6}, [@NFQA_CFG_MASK={0x8, 0x4, 0x1, 0x0, 0x3f}, @NFQA_CFG_FLAGS={0x8, 0x5, 0x1, 0x0, 0x7}, @NFQA_CFG_CMD={0x8, 0x1, {0x1, 0x0, 0x1e}}, @NFQA_CFG_QUEUE_MAXLEN={0x8, 0x3, 0x1, 0x0, 0x3}]}, 0x34}, 0x1, 0x0, 0x0, 0x6000048}, 0x0) (async) sendmsg$nl_route_sched(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000340)=@newqdisc={0x78, 0x24, 0xd0f, 0x0, 0x0, {0x60, 0x0, 0x0, r2, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_blackhole={0xe}, @TCA_STAB={0x44, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x3, 0x3, 0x4, 0x4000, 0x2, 0x401, 0x1}}, {0x4}}, {{0x1c, 0x1, {0xe, 0xe, 0x8, 0x5, 0x0, 0x7}}, {0x4}}]}]}, 0x78}}, 0x0) 2.558757305s ago: executing program 0 (id=7042): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)=@newlink={0x28, 0x10, 0x801, 0xfffffffd, 0x8000000, {0x0, 0x0, 0x0, 0x0, 0x0, 0x20421}, [@IFLA_GROUP={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x4040000}, 0x8024) r1 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r1, 0x29, 0x2e, &(0x7f0000000080)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x4e20, 0xfffffffe, @empty, 0x8}}}, 0x108) sendmsg$IPVS_CMD_SET_DEST(r1, 0x0, 0x44000) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x54, 0x10, 0x1, 0x0, 0x0, {0x6, 0x0, 0x8100, 0x0, {0xc3}, {}, {0xe, 0xd}}, [@TCA_RATE={0x6}, @TCA_STAB={0x28, 0x8, 0x0, 0x1, [{{0x1c, 0x11, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}}, {0x8, 0x1b, [0x0, 0x0]}}]}]}, 0x54}}, 0x17) 2.360379124s ago: executing program 4 (id=7044): r0 = socket$pptp(0x18, 0x1, 0x2) setsockopt$sock_void(r0, 0x1, 0x3f, 0x0, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000001c0), r2) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r4, 0x8933, &(0x7f0000000340)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(0xffffffffffffffff, 0x0, 0x8000) sendmsg$IEEE802154_SET_MACPARAMS(r1, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000bc0)={&(0x7f0000000040)={0x2c, r3, 0x1, 0x70bd29, 0x25dfdbff, {}, [@IEEE802154_ATTR_CCA_MODE={0x5, 0x23, 0xc2}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r5}, @IEEE802154_ATTR_TXPOWER={0x5, 0x21, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x81}, 0x0) r6 = socket(0xa, 0x1, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000340)={'lo\x00', 0x0}) setsockopt$TIPC_MCAST_BROADCAST(r6, 0x10f, 0x85) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=@bridge_delneigh={0x3c, 0x1c, 0xc07, 0x70bd2b, 0x25dfdbfb, {0x2, 0x0, 0x0, r8, 0x40, 0x20, 0xa}, [@NDA_DST_IPV6={0x14, 0x1, @loopback}, @NDA_LLADDR={0xa, 0x2, @local}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x20024090) socket$pptp(0x18, 0x1, 0x2) (async) setsockopt$sock_void(r0, 0x1, 0x3f, 0x0, 0x0) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$ieee802154(&(0x7f00000001c0), r2) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$nl802154(0x0, 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_802154(r4, 0x8933, &(0x7f0000000340)={'wpan0\x00'}) (async) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(0xffffffffffffffff, 0x0, 0x8000) (async) sendmsg$IEEE802154_SET_MACPARAMS(r1, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000bc0)={&(0x7f0000000040)={0x2c, r3, 0x1, 0x70bd29, 0x25dfdbff, {}, [@IEEE802154_ATTR_CCA_MODE={0x5, 0x23, 0xc2}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r5}, @IEEE802154_ATTR_TXPOWER={0x5, 0x21, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x81}, 0x0) (async) socket(0xa, 0x1, 0x0) (async) socket$netlink(0x10, 0x3, 0x0) (async) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000340)={'lo\x00'}) (async) setsockopt$TIPC_MCAST_BROADCAST(r6, 0x10f, 0x85) (async) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=@bridge_delneigh={0x3c, 0x1c, 0xc07, 0x70bd2b, 0x25dfdbfb, {0x2, 0x0, 0x0, r8, 0x40, 0x20, 0xa}, [@NDA_DST_IPV6={0x14, 0x1, @loopback}, @NDA_LLADDR={0xa, 0x2, @local}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x20024090) (async) 2.058102924s ago: executing program 4 (id=7045): unshare(0x2020600) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000900)={&(0x7f0000000040)=ANY=[@ANYBLOB="3800000040000701feffffff00000000017c0000040042801c0001800600060088a80000100004002524298d275c232f262d2b00040002"], 0x38}, 0x1, 0x0, 0x0, 0x48815}, 0xc000) r2 = openat$cgroup_int(r0, &(0x7f0000000080)='hugetlb.2MB.rsvd.max_usage_in_bytes\x00', 0x2, 0x0) pread64(r2, &(0x7f00000000c0)=""/244, 0xf4, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'sit0\x00', 0x0}) ioctl$sock_inet6_SIOCSIFDSTADDR(r3, 0x8918, &(0x7f0000000080)={@mcast2, 0x0, r4}) setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000480)={@in={{0x2, 0x4e24, @multicast2}}, 0x0, 0x0, 0x34, 0x0, "bb02a3c364ca41d6357e544508474004000b42a201ecffffffffffffff8a0e2f964e0000c534a632ab6193fcf19b2df3ee0500faa4ff1f56c54dc46d8b6d2ccd00a0cf0a007bbe00"}, 0xd8) r5 = socket$kcm(0x23, 0x5, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) socket(0x10, 0x803, 0x0) socket$unix(0x1, 0x1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000680)) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0xfffffffffffffffd, 0x9323, 0xfffffffffffffffe, 0x0, 0x2}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x9, 0x0, 0x0, 0x7fffffff, 0x2}, 0x0, 0x0) setsockopt$sock_int(r5, 0x1, 0x6, &(0x7f0000000240)=0x6, 0x4) bind(r5, &(0x7f0000000400)=@phonet={0x23, 0xe, 0x10, 0x2}, 0x80) write$tun(r6, &(0x7f0000000380)=ANY=[@ANYBLOB="1c0000f500000000000000862dfdff000000"], 0x78) 2.052591575s ago: executing program 0 (id=7046): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000000000071120b000600000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8}, 0x94) 1.836496297s ago: executing program 3 (id=7047): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="300000001900010000000000000000001c140000fe000001000000001400120011"], 0x30}}, 0x0) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) accept4$netrom(0xffffffffffffffff, &(0x7f00000001c0)={{}, [@netrom, @default, @bcast, @null, @bcast, @rose, @bcast, @bcast]}, &(0x7f0000000240)=0x48, 0x81800) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={0x0, 0x14}, 0x1, 0x0, 0x0, 0x8000}, 0x40) getsockname$packet(r1, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_PROTOCOL_FEATURES(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2a0820}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x14, r3, 0x800, 0x70bd2a, 0x25dfdbfc, {}, ["", "", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x5000}, 0x200000c4) sendmsg$NL80211_CMD_GET_FTM_RESPONDER_STATS(r1, &(0x7f00000004c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x20, r3, 0x800, 0x70bd25, 0x25dfdbfd, {{}, {@void, @val={0xc, 0x99, {0x80000000, 0x1f}}}}, [""]}, 0x20}, 0x1, 0x0, 0x0, 0x40080}, 0x40000) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)=ANY=[@ANYBLOB="400000001000370400"/20, @ANYRES32=r2, @ANYBLOB="83040100011402002000128008000100736974001400028008000100ac1414aa0500050001"], 0x40}, 0x1, 0x0, 0x0, 0x20048044}, 0x24008000) connect$qrtr(r1, &(0x7f0000000280)={0x2a, 0x1, 0x7ffe}, 0xc) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='blkio.bfq.dequeue\x00', 0x275a, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) ioctl$FICLONERANGE(r5, 0x4020940d, &(0x7f0000000000)={{r4}, 0x2a, 0x80000007ff, 0x2}) r6 = accept4$netrom(r5, &(0x7f0000000340)={{0x3, @bcast}, [@rose, @default, @bcast, @netrom, @default, @default, @rose, @rose]}, &(0x7f0000000300)=0x30, 0x80800) bind$netrom(r6, &(0x7f0000000140)={{0x3, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, 0x8}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null, @bcast, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast]}, 0x48) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000040)={&(0x7f0000000080)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x1c, 0x1c, 0x2, [@func_proto={0x0, 0x2, 0x0, 0xd, 0x0, [{0x9, 0x5}, {0x10, 0x1}]}]}}, &(0x7f0000000f40)=""/4089, 0x36, 0xff9, 0x7}, 0x28) pipe(&(0x7f00000000c0)) 1.757330029s ago: executing program 2 (id=7048): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="4c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000002c00128009000100626f6e64000000001c00028005001d0000000000050001"], 0x4c}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="6000000010000108fdfffffffddbdf2500000000", @ANYRES32=0x0, @ANYBLOB="000000042104020008001b000000000038001a8004002d"], 0x60}, 0x1, 0x0, 0x0, 0x4040080}, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@newlink={0x54, 0x10, 0x439, 0x0, 0x0, {0x0, 0x0, 0xe403, 0x0, 0x0, 0x10000}, [@IFLA_LINKINFO={0x34, 0x12, 0x0, 0x1, @sit={{0x8}, {0x28, 0x2, 0x0, 0x1, [@IFLA_IPTUN_6RD_RELAY_PREFIX={0x8, 0xc, 0x80000000}, @IFLA_IPTUN_REMOTE={0x8, 0x3, @dev}, @IFLA_IPTUN_6RD_PREFIX={0x14, 0xb, @mcast2}]}}}]}, 0x54}}, 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r0, 0x1) getsockopt$inet_sctp6_SCTP_PR_STREAM_STATUS(r2, 0x84, 0x74, &(0x7f0000000280)=""/70, &(0x7f0000000300)=0x46) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f0000000180)={0x0, @in={{0x2, 0x4e21, @local}}}, &(0x7f0000000100)=0x84) setsockopt$inet_sctp6_SCTP_AUTH_DEACTIVATE_KEY(r2, 0x84, 0x23, &(0x7f0000000240)={r3, 0xa}, 0x8) 1.749642223s ago: executing program 0 (id=7049): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=@newtfilter={0x50, 0x2c, 0xd3f, 0x70bd29, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0xfff3, 0xffe0}, {}, {0x7, 0x2}}, [@filter_kind_options=@f_flower={{0xb}, {0x20, 0x2, [@TCA_FLOWER_KEY_ENC_IPV6_SRC={0x14, 0x1f, @ipv4={'\x00', '\xff\xff', @multicast1}}, @TCA_FLOWER_KEY_ENC_IP_TOS={0x5, 0x50, 0x9}]}}]}, 0x50}, 0x1, 0x0, 0x0, 0x8848}, 0x20004804) r0 = accept$unix(0xffffffffffffffff, 0x0, &(0x7f0000000040)) accept$unix(r0, 0x0, &(0x7f0000000080)) socket(0x2, 0x80805, 0x0) (async) r1 = socket(0x2, 0x80805, 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r2, 0x0) (async) shutdown(r2, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) (async) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r1, 0x84, 0x1b, &(0x7f0000000240)={r3}, &(0x7f0000000280)=0x8) (async) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r1, 0x84, 0x1b, &(0x7f0000000240)={r3}, &(0x7f0000000280)=0x8) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) (async) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) syz_emit_ethernet(0x7a, &(0x7f00000005c0)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, @local, @void, {@ipv6={0x86dd, @gre_packet={0x1, 0x6, "0961d3", 0x44, 0x2f, 0xff, @private1={0xfc, 0x1, '\x00', 0x1}, @loopback, {[], {{0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x880b, 0x0, 0x3}, {0x1}, {0x0, 0x0, 0x1, 0x1}, {0x8, 0x88be, 0x1, {{0x6, 0x1, 0x8, 0x3, 0x0, 0x0, 0x3, 0x2}, 0x1, {0x9}}}, {0x8, 0x22eb, 0x4, {{0x1, 0x2, 0x1, 0x3, 0x1, 0x3, 0x7, 0x6}, 0x2, {0x9, 0xe, 0x0, 0x0, 0x1, 0x0, 0x3, 0x1}}}}}}}}}, 0x0) r5 = socket$inet6(0xa, 0x5, 0x0) setsockopt$inet_int(r5, 0x0, 0xf, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r5, 0x84, 0x64, &(0x7f0000000240)=[@in={0x2, 0x4e23, @empty}, @in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1a}}], 0x20) (async) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r5, 0x84, 0x64, &(0x7f0000000240)=[@in={0x2, 0x4e23, @empty}, @in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1a}}], 0x20) r6 = socket$kcm(0x2, 0xa, 0x2) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) r8 = socket$inet6_sctp(0xa, 0x5, 0x84) r9 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r9, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r8, 0x84, 0x7c, &(0x7f0000000240)={r10, 0xf8b9, 0x9}, 0x8) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000000100)={0x81, 0x2, 0x200, 0x1, 0xfff, 0xff, 0x4, 0x9, r10}, &(0x7f0000000380)=0x20) (async) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000000100)={0x81, 0x2, 0x200, 0x1, 0xfff, 0xff, 0x4, 0x9, r10}, &(0x7f0000000380)=0x20) socket$unix(0x1, 0x2, 0x0) (async) r11 = socket$unix(0x1, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r11, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) r13 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r13, &(0x7f0000000200)={0x1d, r12}, 0x10) (async) connect$can_bcm(r13, &(0x7f0000000200)={0x1d, r12}, 0x10) sendmsg$can_bcm(r13, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)=ANY=[@ANYBLOB="01000000f9fe68ca7e4d5d5bdbe70000", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=r12, @ANYRES64=r11, @ANYBLOB="3bf81bb9e9"], 0x20000600}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) listen(r6, 0x9) sendmsg$nl_xfrm(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newsa={0x1a8, 0x10, 0x1, 0x70bd2b, 0x0, {{@in6=@private1, @in6=@mcast1, 0x4e20, 0xecdf, 0x0, 0x200}, {@in=@broadcast, 0x0, 0x32}, @in=@rand_addr=0x64010100, {0xfffffffffffffffe, 0x5, 0x0, 0x0, 0x0, 0xfffffffffffffffc}, {0x8, 0x400800, 0x0, 0x400}, {}, 0x0, 0x3507, 0xa, 0x4, 0x0, 0x2c}, [@algo_crypt={0x6a, 0x2, {{'cbc(aes)\x00'}, 0x110, "e0fad3f10cd30000000000000100074f9ab5514af6917ce9485b9aab05c8c649849e"}}, @algo_auth_trunc={0x4c, 0x14, {{'hmac(sha256)\x00'}, 0x0, 0xc0}}]}, 0x1a8}}, 0x4050) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) (async) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r4, &(0x7f0000000280)={@val={0x6f01, 0x800}, @val={0x1, 0x0, 0x27, 0x0, 0x27}, @mpls={[], @ipv4=@tcp={{0x6, 0x4, 0x0, 0x0, 0x29, 0x0, 0x0, 0x0, 0x84, 0x0, @empty=0x3fffff20, @local}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x5, 0xb, 0x0, 0x0, 0x0, 0x18, {[@window={0x9, 0xfffffffffffffec4}, @timestamp={0x5, 0x2}, @generic={0x0, 0x2, "d58838068b91"}]}}}}}}, 0xfd6c) 1.60363516s ago: executing program 3 (id=7050): getsockopt$inet_sctp6_SCTP_STATUS(0xffffffffffffffff, 0x84, 0xe, &(0x7f0000000280)={0x0, 0x99, 0xb, 0x4, 0x5, 0x1ff, 0xfb9d, 0x9, {0x0, @in={{0x2, 0x4e22, @private=0xa010100}}, 0x81, 0x2, 0x80000001, 0x4b, 0x9}}, 0x0) r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000040900010073797a30000000009c000000090a010400000000000000000700000308000a40000000000900020073797a30000000000900010073797a3000000000080005400000000d58001280200001800e000100636f6e6e6c696d69740000000c0002800800014000000008200001800e000100636f6e6e6c696d69740000000c000280080001400000000014000180090001006cdbf80789f3f947dd000280080003"], 0xe4}}, 0x20050840) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704020180fc5409000c00", 0x33fe0}], 0x1}, 0x0) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f00000002c0)=[@in={0x2, 0x4e23, @empty}], 0x10) sendto$inet6(r1, &(0x7f0000000000)="f7", 0x1, 0x8081, &(0x7f0000000140)={0xa, 0x4e23, 0x0, @loopback, 0x4}, 0x1c) setsockopt$inet_sctp6_SCTP_RECVRCVINFO(r1, 0x84, 0x20, &(0x7f0000000180)=0xb, 0x4) recvmmsg(r1, &(0x7f0000004180)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000002b40)}, 0xddd5}], 0x1, 0x22, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0xd, 0xb, &(0x7f0000000200)=ANY=[@ANYBLOB="18000000060000000000000000000000180900002020702500000000002020207b1af8ff00000000bda004000000000027000000f8ffffffb702000008000000b7030000000004002500f8ff0600000095"], &(0x7f00000001c0)='syzkaller\x00', 0x2, 0x0, 0x0, 0x0, 0x28}, 0x94) 1.522674764s ago: executing program 4 (id=7051): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0), 0x101a00, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r3 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x70bd28, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0x9}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0x10001, 0x1, 0x3, 0x8, 0xffffffc0}, 0x4, 0x1, 0x8, 0x0, 0x3, 0x0, 0x16, 0x13, 0x3, 0xca, {0x0, 0x8, 0x3, 0x5, 0x84, 0x8}}}}]}, 0x78}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001380)=@newchain={0x24, 0x64, 0x1, 0x70bd28, 0x25dfdbfc, {0x0, 0x0, 0x0, r4, {0x10, 0x1}, {0xe, 0x9}, {0x5, 0x3}}}, 0x24}, 0x1, 0x0, 0x0, 0x44851}, 0x20040054) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r6, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0xd}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x48, 0x2, {{0x3, 0x3, 0x6361, 0x7, 0xffffffff, 0x4000005}, [@TCA_NETEM_SLOT={0x2c, 0xc, {0x4, 0x100000001, 0x20ecd5b9, 0x7, 0x4, 0x148}}]}}}]}, 0x78}, 0x1, 0x0, 0x0, 0x40088c1}, 0x40004) sendmsg$nl_route_sched(r5, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000080)=@newqdisc={0x30, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbff, {0x0, 0x0, 0x0, r6, {0x0, 0x8}, {0x5, 0xb}, {0xfff3, 0xfffe}}, [@qdisc_kind_options=@q_hhf={{0x8}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x240040e0}, 0x40000) r7 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r7, &(0x7f00000005c0)="bad330fbc9b55400040000ea0756", 0x5ea, 0x40, &(0x7f00000001c0)={0x11, 0x8100, r6, 0x1, 0xd8, 0x6, @multicast}, 0x14) 1.469311116s ago: executing program 2 (id=7052): bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[], 0x50) (async) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[], 0x50) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'veth0_vlan\x00', 0x0}) setsockopt$packet_drop_memb(r1, 0x107, 0x2, &(0x7f0000000080)={r2, 0x1, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, 0x10) (async) setsockopt$packet_drop_memb(r1, 0x107, 0x2, &(0x7f0000000080)={r2, 0x1, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x10100}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {0x4}, {0x6, 0x0, 0xa}, {}, {}, {0x85, 0x0, 0x0, 0x33}}]}, &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0xa, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc641}, 0x94) (async) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x10100}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {0x4}, {0x6, 0x0, 0xa}, {}, {}, {0x85, 0x0, 0x0, 0x33}}]}, &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0xa, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc641}, 0x94) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r4 = socket(0x400000000010, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r6, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}}, 0x0) r7 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) (async) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r9 = openat$tun(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) close(r9) socket$unix(0x1, 0x2, 0x0) (async) socket$unix(0x1, 0x2, 0x0) ioctl$SIOCSIFHWADDR(r9, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) (async) ioctl$SIOCSIFHWADDR(r9, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) socket$kcm(0x11, 0x3, 0x0) (async) r10 = socket$kcm(0x11, 0x3, 0x0) r11 = socket(0x400000000010, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) (async) r12 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r12, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r11, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000022c0)=@newtfilter={0xe8c, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r13, {0x5, 0x4}, {}, {0x8}}, [@filter_kind_options=@f_matchall={{0xd}, {0xe58, 0x2, [@TCA_MATCHALL_ACT={0xe54, 0x2, [@m_pedit={0xe50, 0x1, 0x0, 0x0, {{0xa}, {0xe24, 0x2, 0x0, 0x1, [@TCA_PEDIT_PARMS_EX={0xe20, 0x4, {{{0x800, 0x2, 0x10000000, 0x10000, 0x40}, 0x8, 0x5}, [{0x3, 0x8, 0x2, 0x80000001, 0x2, 0x200}, {0xff, 0x7, 0x101, 0x8, 0x810, 0xffffffff}, {0x5, 0x8, 0xfff, 0x2, 0xffffffff, 0xb93}, {0x6, 0x4, 0x3, 0xfffffff0, 0x4, 0x6}, {0xd3d4, 0x2, 0x4, 0x6, 0x101, 0x10}, {0x9, 0x40, 0x6, 0x80000000, 0x6, 0x10001}, {0x4, 0x9, 0x100, 0x300000, 0x7, 0x2}, {0x5796, 0xffff, 0xd44b, 0x8, 0x1, 0x37a}, {0x6, 0x3, 0x1, 0x80000001, 0x3f, 0x14}, {0x4, 0x9e9c, 0x60, 0x7, 0x0, 0x1}, {0xffe00000, 0x1, 0x8000, 0x4, 0x3, 0x7}, {0x101, 0x9, 0x400, 0x3, 0x9, 0x3}, {0xce9, 0xfffffffb, 0x4, 0xae5e, 0x3ff, 0x2}, {0x3, 0x5, 0x6, 0x4, 0x197d, 0xfb56}, {0x2, 0xe42, 0xf3, 0x0, 0x6, 0x101}, {0x4, 0x5, 0x74d77b97, 0xfffffd8b, 0x0, 0x1}, {0x7fff, 0x5b, 0xb3a, 0x6, 0x2, 0xb5e}, {0x4c5be96a, 0x6, 0x2, 0x5, 0xd2a1, 0xbe47}, {0x6, 0x7, 0x9, 0x4, 0x3, 0x1}, {0x3, 0x8, 0x7, 0x4, 0x95, 0x3}, {0x6, 0x5, 0x2, 0x7fffffff, 0x8, 0xff}, {0x1, 0x71, 0x800000, 0xcf55, 0x3, 0x9}, {0x7933, 0x6e20, 0x6, 0x81, 0x2, 0x8}, {0xff, 0x8001, 0xff, 0x10001, 0x5, 0x5}, {0x6, 0x37, 0x0, 0x6, 0xed, 0x5}, {0xce, 0xa6, 0x4, 0x2, 0x10000, 0x800}, {0x200, 0x5, 0x6, 0x5, 0x9, 0x9}, {0x8, 0xdd8, 0x8, 0x8, 0x5}, {0x3, 0x3, 0xa, 0x6, 0x9, 0x9}, {0x9, 0x4, 0x9d42, 0x4, 0x1, 0xfffffffb}, {0x8c, 0x6b8, 0x6, 0x2, 0x800002, 0xfffffffe}, {0x3, 0x811, 0x9, 0x5, 0x4}, {0x3, 0x80000001, 0x400, 0x2, 0x0, 0x8001}, {0xfffffe01, 0x2, 0x8, 0x2, 0x8, 0x8}, {0x0, 0x22, 0x5, 0x3, 0x401, 0x5}, {0xa, 0xfff, 0x101, 0x5, 0xfffffc01, 0x800}, {0x4, 0x5, 0x0, 0x0, 0xdb, 0x3d04b554}, {0x5, 0x9, 0xfffffffa, 0x1, 0x0, 0xffffff01}, {0x8, 0x7, 0x8, 0x99f, 0x9, 0x3}, {0x5, 0x252, 0x8000, 0xffff8001, 0xb, 0x900}, {0x4, 0x3, 0x3, 0x21, 0x7, 0x7}, {0xfffffffb, 0x8a1, 0x2, 0x7, 0x0, 0x4}, {0x0, 0x7fff, 0x2, 0xfffff399, 0x9, 0xe756}, {0xfff, 0xc, 0x4, 0x8, 0x2, 0xe}, {0x6, 0x4, 0x6, 0x1, 0x80, 0x980}, {0x23ae789, 0xc, 0x4, 0x7, 0x200, 0x4}, {0x5, 0xe, 0x2, 0x9, 0x0, 0xf3}, {0x0, 0x9, 0x2, 0x4, 0x3, 0x4}, {0x8, 0x4, 0x5, 0xfffffffd, 0x400, 0x7f}, {0x9, 0x80, 0x6e6b, 0x6, 0x203}, {0x371cf7fc, 0x7, 0x2, 0x1ff, 0xfffffffa, 0x6a97}, {0xd1, 0x6, 0x2, 0x7, 0x5a, 0x9}, {0x8, 0x7f, 0x7fffffff, 0x7f, 0x2, 0x8}, {0x7ff, 0x1, 0x3, 0x2, 0x9, 0x400}, {0x6, 0x1ff, 0x0, 0x9, 0x7, 0x4}, {0x4, 0x6, 0xfe, 0x100, 0xc6}, {0x3, 0xfffffffd, 0xd, 0x6, 0xfffffffe, 0x1000}, {0x7, 0x2, 0x1, 0xd, 0xfffffffe, 0x3}, {0xfffffff9, 0x80000001, 0xe, 0x2, 0x200, 0x7}, {0x3, 0x0, 0xa820, 0x787e, 0x2, 0x2}, {0x8, 0x4, 0x5ae, 0x2, 0x8}, {0x5, 0x52, 0x8, 0x5, 0x10, 0x9}, {0x1, 0x7, 0x3, 0x280, 0x800, 0x6}, {0x10, 0x801, 0x0, 0x2, 0x3, 0x7}, {0xad, 0x8, 0x4, 0x5, 0x0, 0xfff}, {0x6, 0x4, 0x7fff, 0x64397228, 0xff, 0x7fffffff}, {0x8, 0x85e6, 0x3, 0x0, 0x5, 0xc}, {0x9, 0x78e3, 0x5, 0xbc27, 0x7, 0x9}, {0x6, 0x7, 0x2, 0xdb60, 0x3}, {0x80000001, 0x0, 0x3, 0x1, 0x81, 0xba}, {0x10001, 0xfff, 0x7, 0x0, 0x9, 0xc29}, {0x100, 0x2, 0x9, 0x7, 0x84e1, 0x3ff}, {0xdc, 0x8, 0xe, 0x7, 0x9}, {0x7, 0x5, 0x1, 0x80, 0x6, 0xff}, {0xd5e, 0x5, 0x0, 0x100, 0x0, 0x10}, {0x200, 0x2, 0x8000, 0x0, 0x6b, 0x4}, {0x0, 0x0, 0x9, 0x8, 0x100, 0x1000}, {0x4, 0x3ff, 0x0, 0x90000, 0x7, 0x7}, {0x6, 0x9, 0x1, 0x1ff, 0x4, 0x1}, {0x4, 0xd38f, 0x6, 0x4, 0x170ddbc4, 0xe38}, {0x14a, 0x7, 0x0, 0x10001, 0x1, 0x2}, {0x9, 0x6, 0x1, 0x400, 0xffffffff, 0xfffffffc}, {0x80000001, 0x80006, 0x3909, 0xffffffff, 0x1705, 0x7}, {0x3, 0x3b10fe2d, 0x6, 0x5, 0x3, 0xffff7fff}, {0x9430, 0xb, 0x6, 0x2, 0x9, 0x5}, {0xa, 0xb1fb, 0x6, 0x6, 0xc5, 0x9}, {0x2a455dad, 0x5, 0x29, 0xfffffff9, 0x800, 0x7fff}, {0x3, 0x3, 0xee, 0x9, 0x6, 0x8}, {0x7, 0x3, 0x0, 0xb, 0x8, 0x99}, {0x2, 0x9, 0xf623, 0x7, 0xff, 0x8}, {0x101, 0x6, 0x80000000, 0x9, 0xfffff697, 0x8}, {0x9, 0x8, 0x7, 0x2, 0xa226, 0x9}, {0x8, 0x8, 0x3, 0xfffff246, 0xf, 0x2}, {0x3, 0xaf, 0x7ff, 0xe0, 0x0, 0x7cf}, {0x8, 0x7, 0x29af2cf0, 0x1, 0x7, 0x80000000}, {0x7fff, 0x9, 0x4b, 0xa4e}, {0xffffffff, 0x7, 0x6, 0x80000000, 0x2, 0x69}, {0x4, 0x9, 0x9, 0x4, 0x100, 0x5}, {0x6, 0x6, 0x2, 0x3ff, 0x6, 0x9}, {0x6, 0x401, 0x2, 0x2, 0x3, 0xb}, {0xd, 0x40, 0x3, 0xa, 0xffffffff, 0x1d1a}, {0xc0, 0x81, 0xc, 0x3, 0xea, 0x3}, {0xc, 0x2, 0x1, 0xa, 0x1, 0x2f4}, {0xf, 0x6, 0x9, 0x73e7, 0x1000, 0x4}, {0x6, 0x8000, 0x3ff, 0x8dcc, 0x4, 0x7ff}, {0x7, 0xe, 0x8, 0x8, 0x69, 0x9}, {0x7f, 0x10001, 0x4, 0x0, 0x3, 0x2}, {0x6, 0x0, 0x7a, 0x5, 0x4, 0x1000}, {0xb06, 0x7, 0x7ff, 0x9, 0x0, 0x7bffffff}, {0x80000000, 0x7b, 0x3, 0x4, 0x0, 0xa7}, {0x81, 0x56c3, 0x1, 0xdda, 0x6, 0xb27d}, {0x4, 0x3, 0x401, 0xad, 0xcf5, 0xf8c}, {0x8, 0x1, 0x3, 0x40, 0x1, 0x4907}, {0x6, 0x4, 0x38, 0x4, 0x5, 0x6}, {0x7, 0x2, 0xf, 0x64, 0x1, 0x7}, {0x1, 0x2, 0x4010, 0xffffffad, 0x0, 0x751e}, {0xfff0, 0x2, 0x4, 0x8, 0x3, 0x5}, {0x5, 0x7, 0x8, 0x1, 0x5, 0xfff}, {0x4fb, 0x0, 0x0, 0x7ff, 0x4, 0x5}, {0xf455, 0x3, 0x7fff, 0x59ed, 0xb4e9, 0xe4}, {0x7, 0x2, 0xe, 0x0, 0x3da78e9c, 0x8000}, {0x2, 0x0, 0x400, 0x765, 0x4, 0x7}, {0x5, 0x7, 0x5, 0x8, 0x8, 0x7}, {0x10, 0x3, 0x9, 0x5, 0x8, 0x2}, {0x6a, 0x200, 0x81, 0xffffffff, 0x4, 0x200}, {0x3, 0x7, 0x3, 0x4a, 0x6, 0x1}, {0x0, 0x3, 0x7, 0x616, 0x5, 0x4}, {0x6, 0xb25b, 0x3, 0x0, 0x6, 0xb}], [{0x4, 0x1}, {0x5}, {}, {}, {0x3, 0x1}, {}, {0x0, 0x1}, {0x5, 0x1}, {0x6}, {0x0, 0x1}, {0x2}, {0x4}, {0x5}, {0x4, 0x1}, {0x1, 0x1}, {0x1}, {0x1}, {0x2}, {0x4}, {0x1, 0x1}, {}, {0x5}, {0x5, 0x1}, {0x5}, {0x2, 0x1}, {0x0, 0x1}, {}, {0x5}, {0x4}, {0x3, 0x1}, {}, {0x4, 0x1}, {0x4}, {}, {0x5}, {0x5, 0x1}, {0x0, 0x1}, {0x0, 0x1}, {0x5, 0x1}, {0x4, 0x1}, {}, {0x3, 0x1}, {0x1, 0x1}, {0x1}, {}, {0x5}, {0x3}, {0xd}, {0x0, 0x338f50ad6d91f11}, {0x1, 0x1}, {0x5, 0x1}, {0x0, 0x1}, {0x4}, {}, {0x4}, {0x3}, {0x1, 0x1}, {0x4}, {0x5}, {0x4, 0x1}, {0x5, 0x1}, {}, {0x1}, {0x3, 0x1}, {0x0, 0x1}, {0x1}, {}, {0x5, 0x1}, {0x4}, {0x4, 0x1}, {0x2, 0x1}, {0x1, 0x1}, {0x2, 0x1}, {0x3}, {0x1, 0x1}, {0x3, 0x1}, {0x1, 0x1}, {0x3, 0x1}, {0x0, 0x1}, {0x1, 0x1}, {0x4}, {0x5}, {0x4}, {0x3}, {}, {0x5, 0x1}, {0x2, 0x1}, {}, {0x1, 0x1}, {0x3}, {0x3, 0x1}, {0x5, 0x1}, {0x2, 0x1}, {0x5, 0x1}, {0x1, 0x1}, {0x6, 0x1}, {0x5}, {0x3}, {0x1, 0x1}, {0x1, 0x1}, {}, {0x3, 0x1}, {0x0, 0x1}, {0x4, 0x1}, {0x3, 0x1}, {0x5, 0x1}, {0x3}, {0x3}, {0x3}, {0x4}, {0x5, 0x1}, {0x3}, {0x0, 0x1}, {0x2, 0x1}, {0x3}, {0x5}, {0x5, 0x1}, {0x2, 0x1}, {0x3}, {0x3, 0x1}, {0x4}, {0x4}, {0x5}, {0x5, 0x1}, {0x2, 0x1}, {0x2, 0x1}, {0x1, 0x1}, {0x4}]}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}]}]}}]}, 0xe8c}}, 0x0) setsockopt$sock_attach_bpf(r10, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r10, &(0x7f00000000c0)={&(0x7f0000000500)=@xdp={0x2c, 0x0, r8, 0xc}, 0x80, &(0x7f00000006c0)=[{&(0x7f0000000180)="27030200590214000600002fb96dbcf706e10500000086ddffff1144ee163cd4b8bf", 0x22}, {&(0x7f0000000c00)="4307ed2e", 0x4}], 0x2}, 0x4) r14 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r14, 0x8933, &(0x7f00000000c0)={'syz_tun\x00', 0x0}) socket$kcm(0x29, 0x2, 0x0) (async) r16 = socket$kcm(0x29, 0x2, 0x0) sendmsg$kcm(r16, &(0x7f0000003a40)={0x0, 0x0, &(0x7f0000000400)=[{&(0x7f00000037c0)="076202b7638f7fa945cb5040bd7ed1b26cc7d1cc5706348844adc0701a6b5bd1ff9314c7fab62305def66fb91ffa3b691e2c332a7c91ba4097195ca8c5a4655c7caea9a3608b0bb7bf404dfde35ae6e1e9df09693f070e7d57240c3732f85d0aef41ba1cd541b2b5f1c79a2b33c00b22be5b6d02f48e2353b638f898df96b82284e6db8ba4e5385767c8438a91", 0x8d}, {&(0x7f0000003880)="d133a5d5dbcd508f56df405868fa91023aada294c873f35176bdc0b0bb9926f01df553133962f915481c6703e93af3c1579c96dc818995ed09bd966b9417014aa0cd904cf5d51d89be32a7397c910053e6c765ec7216259d10a844b7425282d96b32bb586925fde6e4b45589dd55c8f3f36656be88e229eabede812ed0c551c55c46be396d7e21497e3cdf77e60a371d99c53d79f8243d1cddbdd9962c5ade6375fc29209b793ef32c22e5c6ac8ff9b5579d1c54b48d96e2e153a87d99f0f98d2dfb02aed2221c0e9bde427351237c858d47818fa90bcbc49fe48a1d070fc856419f", 0xe2}, {&(0x7f00000003c0)="bb2c2760b4ed8b083f1a33ea9d3b1ca47ad5a547cb5044f76b5a1820d0cbc78d32f73a61d65a", 0x26}, {&(0x7f0000003980)="ade98ddfce0a7ed39da457ba1ec6bf2d3d8d8e9d9b7372a2f838c92c201918221170f63fef020dc6f74f15e54851f0eb0857a3138928a232eef7d9b5c4be2f0d38ddbd72ac28b8e748f9a28a5470209858899a1bf1ab6a91714f858b827f28501d8b12729e5423a4a8770cd209c9e71a9178", 0x72}], 0x4, &(0x7f0000003a00)}, 0x5) sendmsg$nl_route(r14, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="4400000010000104000002000000000000000000", @ANYRES32=0x0, @ANYBLOB="0380000000000000140012800b0001006970766c616e00000200028008000500", @ANYRES32=r15, @ANYBLOB='\b\x00\n\x00', @ANYRES32=r15], 0x44}, 0x1, 0x0, 0x0, 0x20004885}, 0x4054) (async) sendmsg$nl_route(r14, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="4400000010000104000002000000000000000000", @ANYRES32=0x0, @ANYBLOB="0380000000000000140012800b0001006970766c616e00000200028008000500", @ANYRES32=r15, @ANYBLOB='\b\x00\n\x00', @ANYRES32=r15], 0x44}, 0x1, 0x0, 0x0, 0x20004885}, 0x4054) socket$nl_sock_diag(0x10, 0x3, 0x4) 1.131898973s ago: executing program 4 (id=7053): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x6, 0xc, &(0x7f0000000100)=ANY=[@ANYBLOB="18020000feffefff0000000003000000850000004100000018010000696c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f805ffffb702000008000006b703000003000000850000001700000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x0, 0x2100, 0x0, &(0x7f0000000100), 0x0, 0x1008, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0x4002}) writev(r1, &(0x7f0000000180)=[{&(0x7f00000000c0)="0bc3ff", 0x3}, {&(0x7f0000000040)='\x00\x00\x00\x00\x00', 0x5}, {&(0x7f0000000240)="6200bd750a5c", 0x6}], 0x3) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x6, 0x4, &(0x7f0000000100)=@framed={{0x18, 0x2, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0xfffffffe}, [@call={0x85, 0x0, 0x0, 0x6d}]}, &(0x7f00000001c0)='GPL\x00', 0x2, 0x0, 0x0, 0x40f00, 0x21, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) r2 = socket$nl_sock_diag(0x10, 0x3, 0x4) setsockopt$sock_int(r2, 0x1, 0x3c, &(0x7f0000000000)=0x4a, 0x4) 993.216404ms ago: executing program 0 (id=7054): r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="180000000200000000"], &(0x7f0000000040)='syzkaller\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000840)={r0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x7, 0x54, &(0x7f00000005c0)="f189e2cb77dbcc", &(0x7f00000007c0)="a16df52369c20b709852e85a9260c28a3e1c3241b0420185201fef937cda13abd95775cfb2060ea2504951ecff2552916d4702457b50783932c3d98b97d7321c7022018ed4c76c692f0b00c1b02ce137005a62e9", 0x2, 0x0, 0x5}, 0x50) 937.098315ms ago: executing program 4 (id=7055): unshare(0x2c020400) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000980)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x7}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x8004}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x58, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x30, 0x4, 0x0, 0x1, [{0x2c, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x14}, @NFTA_BITWISE_OP={0x8, 0x6, 0x1, 0x0, 0x5}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0xcc}}, 0x0) r1 = socket$kcm(0x10, 0x3, 0x4) sendmsg$kcm(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000440)="9f000000120081ae08060cdc030ec0007f03e3f70000000000e2ffca1b1f0000000004c00e72f750375ed08a56331dbf9ed7811e381ad6e747033a0093b837dc6cc01e32efaec8c7a6ec08123d00020008000140010000009bbc7a46e3988285dcdf12f21308f868fece01955fed0009d78f0a947ee2b49e33538afa8af92347514f0b56a20ff27fff55e461247604821d35c86ee54bbab3eaf8956e2ca426", 0x9f}], 0x1}, 0x0) 888.345549ms ago: executing program 2 (id=7056): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)=@newlink={0x28, 0x10, 0x801, 0xfffffffd, 0x8000000, {0x0, 0x0, 0x0, 0x0, 0x0, 0x20421}, [@IFLA_GROUP={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x4040000}, 0x8024) r1 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r1, 0x29, 0x2e, &(0x7f0000000080)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x4e20, 0xfffffffe, @empty, 0x8}}}, 0x108) sendmsg$IPVS_CMD_SET_DEST(r1, 0x0, 0x44000) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x54, 0x10, 0x1, 0x0, 0x0, {0x6, 0x0, 0x8100, 0x0, {0xc3}, {}, {0xe, 0xd}}, [@TCA_RATE={0x6}, @TCA_STAB={0x28, 0x8, 0x0, 0x1, [{{0x1c, 0x11, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}}, {0x8, 0x1b, [0x0, 0x0]}}]}]}, 0x54}}, 0x18) 870.569917ms ago: executing program 0 (id=7057): r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, 0x0, 0x101) syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/ipc\x00') unshare(0x6a040000) r1 = socket(0x8, 0x3, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$packet(0x11, 0x3, 0x300) ioctl$SIOCGSTAMPNS(r3, 0x8907, 0x0) recvmmsg(r3, &(0x7f00000021c0)=[{{0x0, 0x0, 0x0}, 0x9}], 0x1, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX_802154(r2, 0x8933, &(0x7f0000000180)={'wpan0\x00'}) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r2, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000}, 0x40000) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000001000), 0xffffffffffffffff) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$IMGETCOUNT(r1, 0x61d8, 0x0) 820.578161ms ago: executing program 4 (id=7058): r0 = socket$kcm(0x11, 0xa, 0x300) ioctl$SIOCSIFHWADDR(r0, 0x8b04, &(0x7f0000000040)={'wlan1\x00', @random="c3000e000300"}) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) r3 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000600), 0xffffffffffffffff) sendmsg$WG_CMD_SET_DEVICE(0xffffffffffffffff, &(0x7f0000001000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000640)=ANY=[@ANYBLOB="d4000000", @ANYRES16=r3, @ANYBLOB="0100000000000000000001000000ac000880a8000080800009801c00008006000100020000000e000200ac1414aa05000300020000001c0000800600010002000000080002007f00000105000300030000001c0000800600010002000000080002000a010102050003000300000028000080060001000a00000014000200fc010000000000000000000000000000050003000300000024000100000000000000000000000000000000000000000000000000000000000000000014000200776731"], 0xd4}, 0x1, 0x0, 0x0, 0x4084}, 0x20008040) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) socket$unix(0x1, 0x1, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000540)=ANY=[@ANYBLOB="fc0000001900010029bd7000fbdbdf25ac1e0101000000000000000000000000ffffffff00000000000000000000000000000000000000000200000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000001000080000000000000000000000000000000000000000000000000000000000200000000000000fdffffffefffffff00000000000000001000000000000000050000000000000000000000002000000000000000000000000000000000000001000202000000004400050000000000000000000000ffff0a010100000004d63c"], 0xfc}, 0x1, 0x0, 0x0, 0x20000004}, 0x0) r5 = socket$kcm(0xf, 0x3, 0x2) sendmsg$inet(r5, &(0x7f00000000c0)={0x0, 0xfe, &(0x7f0000000000)=[{&(0x7f0000000040)="0207000902000000e4a17c45c8d260c9", 0x10}], 0x1}, 0x0) socket$kcm(0xa, 0x2, 0x88) getsockname$packet(r2, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r6, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000) sendmsg$nl_route(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="20070000e9ffffffffbc7000fcdbdf2512200101", @ANYRES32=r6, @ANYBLOB="08000200ac1414aa"], 0x20}}, 0x40000c0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=@newlink={0x3c, 0x10, 0x503, 0x70bd29, 0x700, {0x0, 0x0, 0x0, 0x0, 0x0, 0x1006}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @vcan={{0x9}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x440b0) 726.319711ms ago: executing program 3 (id=7059): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000000000071120b000700000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8}, 0x94) 616.017016ms ago: executing program 3 (id=7060): r0 = socket(0x2, 0x80805, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r1, 0x0, 0x482, &(0x7f0000000040)={0x84, @dev={0xac, 0x14, 0x14, 0x2d}, 0x4e20, 0x3, 'wrr\x00', 0x1, 0x2, 0x6e}, 0x2c) socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$IP_VS_SO_SET_ADDDEST(r0, 0x0, 0x487, &(0x7f0000000000)={{0x84, @private=0xa010101, 0x4e21, 0x3, 'lc\x00', 0x2c, 0x8, 0x73}, {@loopback, 0x4e23, 0x2, 0xcd, 0x12d5f, 0x3}}, 0x44) r2 = socket$inet_smc(0x2b, 0x1, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCGIFADDR(r0, 0x8915, &(0x7f00000000c0)={'ip6tnl0\x00'}) sendmsg$nl_route(r3, &(0x7f0000000c80)={0x0, 0x0, &(0x7f0000000c40)={&(0x7f0000000000)=@setlink={0x44, 0x13, 0x5, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x70428, 0x1810}, [@IFLA_IFNAME={0x14, 0x3, 'bridge_slave_1\x00'}, @IFLA_MASTER={0x8}, @IFLA_CARRIER={0x5, 0x21, 0x81}]}, 0x44}}, 0x4040) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)=@newlink={0x48, 0x10, 0x421, 0x0, 0x25dfdbfd, {}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @geneve={{0xb}, {0x18, 0x2, 0x0, 0x1, [@IFLA_GENEVE_COLLECT_METADATA={0x4}, @IFLA_GENEVE_PORT={0x6, 0x5, 0x4e24}, @IFLA_GENEVE_UDP_CSUM={0x5, 0x8, 0x1}]}}}]}, 0x48}}, 0x0) unshare(0x60600) r5 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000100), 0x40002, 0x0) ioctl$RFKILL_IOCTL_NOINPUT(r5, 0x5202) setsockopt$IP_VS_SO_SET_ADDDEST(r2, 0x0, 0x487, &(0x7f0000000580)={{0x84, @broadcast, 0x4e23, 0x3, 'lc\x00', 0x2, 0x4, 0x7b}, {@private=0xa010102, 0x4e22, 0x2, 0xc8, 0x80012d58, 0x12d5c}}, 0x44) setsockopt$IP_VS_SO_SET_FLUSH(r1, 0x0, 0x485, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000400)=@gettclass={0x24, 0x2a, 0x1, 0x70bd27, 0x7, {0x0, 0x0, 0x0, 0x0, {0x6}, {}, {0x6, 0x10}}}, 0x24}, 0x1, 0x0, 0x0, 0x20000010}, 0x20000080) r6 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000080)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route(r6, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=ANY=[@ANYBLOB="440000001000010027bd7004fbdbdf2500000000", @ANYRES32=r8, @ANYBLOB="202a06006b80010024001280110001006272696467655f736c617665000000000c000580050028"], 0x44}, 0x1, 0x0, 0x0, 0x400c080}, 0x8000) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x3, &(0x7f0000000100)=@framed={{0x15, 0xa, 0x0, 0x0, 0x7, 0x61, 0x11, 0xbc}}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x10}, 0x94) 270.973341ms ago: executing program 2 (id=7061): unshare(0x2020600) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000900)={&(0x7f0000000040)=ANY=[@ANYBLOB="3800000040000701feffffff00000000017c0000040042801c0001800600060088a80000100004002524298d275c232f262d2b00040002"], 0x38}, 0x1, 0x0, 0x0, 0x48815}, 0xc000) r2 = openat$cgroup_int(r0, &(0x7f0000000080)='hugetlb.2MB.rsvd.max_usage_in_bytes\x00', 0x2, 0x0) pread64(r2, &(0x7f00000000c0)=""/244, 0xf4, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'sit0\x00', 0x0}) ioctl$sock_inet6_SIOCSIFDSTADDR(r3, 0x8918, &(0x7f0000000080)={@mcast2, 0x0, r4}) setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000480)={@in={{0x2, 0x4e24, @multicast2}}, 0x0, 0x0, 0x34, 0x0, "bb02a3c364ca41d6357e544508474004000b42a201ecffffffffffffff8a0e2f964e0000c534a632ab6193fcf19b2df3ee0500faa4ff1f56c54dc46d8b6d2ccd00a0cf0a007bbe00"}, 0xd8) r5 = socket$kcm(0x23, 0x5, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) socket(0x10, 0x803, 0x0) socket$unix(0x1, 0x1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000680)) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0xfffffffffffffffd, 0x9323, 0xfffffffffffffffe, 0x0, 0x2}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x9, 0x0, 0x0, 0x7fffffff, 0x2}, 0x0, 0x0) setsockopt$sock_int(r5, 0x1, 0x6, &(0x7f0000000240)=0x6, 0x4) bind(r5, &(0x7f0000000400)=@phonet={0x23, 0xe, 0x10, 0x2}, 0x80) write$tun(r6, &(0x7f0000000380)=ANY=[@ANYBLOB="1c0000f500000000000000862dfdff000000"], 0x78) 0s ago: executing program 3 (id=7062): sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000580)="d8000000180081054e81f783db4cb9040a1d080006007c03e8fc55a10a0015000600142603600e120800060000000401a8000800a40000000100000003157a452a25ac81d8ed595c0461c1d67f6f94007134cf6efb8000a007a290457f010400000700000000ceac3c2fb14c2ee5a7cef4090000001fb71b14d6d930dfe1d9d322fe7c9f8775820d16a4683f5aeb4edbb57a5025cccade003c0db798262f3d40fad9", 0xa2}], 0x1}, 0x0) r0 = socket$phonet(0x23, 0x2, 0x1) ioctl$VFAT_IOCTL_READDIR_BOTH(r0, 0x82307201, &(0x7f0000000240)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) socket$kcm(0x29, 0x5, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$unix(r1, 0x0, 0x0) r3 = socket$inet6(0xa, 0x2, 0x3a) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000080)='ip6gretap0\x00', 0x10) r4 = socket$inet6(0xa, 0x3, 0x88) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000100)={{{@in=@broadcast, @in=@remote, 0x0, 0x0, 0x4e21, 0x9, 0x2}, {0xfffffffffffffffe, 0x200000000, 0x40000000007, 0x20000a0de, 0x40000000000001, 0x4, 0x200000003, 0x9}, {0xa5f}, 0x4, 0x0, 0x1, 0x0, 0x3, 0x3}, {{@in=@loopback, 0x4d3, 0x33}, 0x2, @in6=@empty, 0x3502, 0x1, 0x8, 0x0, 0x9075}}, 0xe8) connect$inet6(r4, &(0x7f0000000000)={0xa, 0x0, 0xfffffffe, @ipv4={'\x00', '\xff\xff', @empty}}, 0x1c) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, 0x0, 0xc000) sendmmsg$inet6(r3, &(0x7f0000000340)=[{{&(0x7f0000000380)={0xa, 0x0, 0x0, @remote, 0xa0}, 0x1c, &(0x7f0000000000)=[{&(0x7f0000000100)="a0002883781ecc0e", 0x8}], 0x10000000000000e7}}], 0x1, 0x40) getsockopt$sock_timeval(r2, 0x1, 0x42, &(0x7f00000004c0), &(0x7f0000000500)=0x10) r6 = socket(0x10, 0x803, 0x0) write(r6, &(0x7f0000000040)="2600000022004701050007108980e8ff06006d20002b1ffec0e90101c7bb0000b00000000000", 0x26) setsockopt$sock_int(r6, 0x1, 0x8, &(0x7f0000d9bffc), 0x4) setsockopt$RDS_RECVERR(r6, 0x114, 0x3f, &(0x7f0000000000)=0x3, 0x4) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="5c0300002e0009002fbd70000000000004000000480311802e798490d83a929143ec1917b934e6ecc0b1e3368dbd0c042327d28693bec3e401a736abb8"], 0x35c}, 0x1, 0x0, 0x0, 0x42804}, 0x4000010) kernel console output (not intermixed with test programs): omm: syz.4.6028 Not tainted syzkaller #0 PREEMPT(full) [ 894.247837][T27511] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/27/2026 [ 894.247850][T27511] Call Trace: [ 894.247858][T27511] [ 894.247866][T27511] dump_stack_lvl+0xe8/0x150 [ 894.247899][T27511] should_fail_ex+0x412/0x560 [ 894.247929][T27511] _copy_from_user+0x2d/0xb0 [ 894.247956][T27511] __sys_bpf+0x229/0x950 [ 894.247997][T27511] ? __pfx___sys_bpf+0x10/0x10 [ 894.248036][T27511] ? ksys_write+0x242/0x270 [ 894.248058][T27511] ? __pfx_ksys_write+0x10/0x10 [ 894.248083][T27511] __x64_sys_bpf+0x7c/0x90 [ 894.248107][T27511] do_syscall_64+0x14d/0xf80 [ 894.248128][T27511] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 894.248147][T27511] ? clear_bhb_loop+0x40/0x90 [ 894.248169][T27511] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 894.248186][T27511] RIP: 0033:0x7effa299c799 [ 894.248203][T27511] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 894.248218][T27511] RSP: 002b:00007effa37bb028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 894.248239][T27511] RAX: ffffffffffffffda RBX: 00007effa2c15fa0 RCX: 00007effa299c799 [ 894.248252][T27511] RDX: 0000000000000050 RSI: 0000200000000340 RDI: 000000000000000a [ 894.248264][T27511] RBP: 00007effa37bb090 R08: 0000000000000000 R09: 0000000000000000 [ 894.248275][T27511] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 894.248286][T27511] R13: 00007effa2c16038 R14: 00007effa2c15fa0 R15: 00007ffd304fc388 [ 894.248314][T27511] [ 894.470889][T27518] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6029'. [ 894.602049][T27503] wg1 speed is unknown, defaulting to 1000 [ 894.646980][T27320] 8021q: adding VLAN 0 to HW filter on device team0 [ 894.672705][T27518] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6029'. [ 894.673926][T27512] wg1 speed is unknown, defaulting to 1000 [ 894.688652][T26372] Bluetooth: hci4: command tx timeout [ 894.698659][ T148] bridge0: port 1(bridge_slave_0) entered blocking state [ 894.706125][ T148] bridge0: port 1(bridge_slave_0) entered forwarding state [ 894.966622][T15213] bridge0: port 2(bridge_slave_1) entered blocking state [ 894.974105][T15213] bridge0: port 2(bridge_slave_1) entered forwarding state [ 895.217200][T27526] batman_adv: batadv0: Adding interface: wlan1 [ 895.223479][T27526] batman_adv: batadv0: The MTU of interface wlan1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 895.251390][T27526] batman_adv: batadv0: Not using interface wlan1 (retrying later): interface not active [ 895.670816][T27320] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 895.773727][T27320] veth0_vlan: entered promiscuous mode [ 895.804673][T27320] veth1_vlan: entered promiscuous mode [ 895.877588][T27320] veth0_macvtap: entered promiscuous mode [ 895.906267][T27320] veth1_macvtap: entered promiscuous mode [ 895.947897][T27320] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 895.995036][T27320] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 896.036468][T19242] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 896.069527][T19242] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 896.092160][T27550] FAULT_INJECTION: forcing a failure. [ 896.092160][T27550] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 896.097152][T19242] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 896.125838][T27550] CPU: 0 UID: 0 PID: 27550 Comm: syz.4.6035 Not tainted syzkaller #0 PREEMPT(full) [ 896.125864][T27550] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/27/2026 [ 896.125875][T27550] Call Trace: [ 896.125883][T27550] [ 896.125891][T27550] dump_stack_lvl+0xe8/0x150 [ 896.125921][T27550] should_fail_ex+0x412/0x560 [ 896.125948][T27550] _copy_to_user+0x31/0xb0 [ 896.125975][T27550] simple_read_from_buffer+0xe1/0x170 [ 896.126002][T27550] proc_fail_nth_read+0x1bb/0x230 [ 896.126028][T27550] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 896.126054][T27550] ? rw_verify_area+0x2a6/0x4d0 [ 896.126073][T27550] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 896.126098][T27550] vfs_read+0x20c/0xa70 [ 896.126116][T27550] ? fdget_pos+0x246/0x320 [ 896.126145][T27550] ? __pfx___mutex_lock+0x10/0x10 [ 896.126163][T27550] ? __pfx_vfs_read+0x10/0x10 [ 896.126182][T27550] ? __fget_files+0x2a/0x420 [ 896.126208][T27550] ? __fget_files+0x3a0/0x420 [ 896.126230][T27550] ? __fget_files+0x2a/0x420 [ 896.126270][T27550] ksys_read+0x150/0x270 [ 896.126293][T27550] ? __pfx_ksys_read+0x10/0x10 [ 896.126322][T27550] do_syscall_64+0x14d/0xf80 [ 896.126338][T27550] ? trace_irq_disable+0x3b/0x150 [ 896.126363][T27550] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 896.126382][T27550] ? clear_bhb_loop+0x40/0x90 [ 896.126405][T27550] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 896.126422][T27550] RIP: 0033:0x7effa295cfce [ 896.126439][T27550] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 896.126453][T27550] RSP: 002b:00007effa37bafe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 896.126472][T27550] RAX: ffffffffffffffda RBX: 00007effa37bb6c0 RCX: 00007effa295cfce [ 896.126484][T27550] RDX: 000000000000000f RSI: 00007effa37bb0a0 RDI: 0000000000000005 [ 896.126494][T27550] RBP: 00007effa37bb090 R08: 0000000000000000 R09: 0000000000000000 [ 896.126503][T27550] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 896.126512][T27550] R13: 00007effa2c16038 R14: 00007effa2c15fa0 R15: 00007ffd304fc388 [ 896.126538][T27550] [ 896.578099][T19242] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 896.687536][T27555] netlink: 'syz.4.6037': attribute type 2 has an invalid length. [ 896.734245][T27555] netlink: 60 bytes leftover after parsing attributes in process `syz.4.6037'. [ 896.745131][T27556] openvswitch: netlink: Duplicate key (type 21). [ 896.752847][T19242] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 896.767837][ T5833] Bluetooth: hci4: command tx timeout [ 896.775593][T19242] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 896.863449][T15213] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 896.890035][T15213] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 897.515809][T27585] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6048'. [ 897.733979][T15830] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 897.752026][T15830] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 897.764039][T15830] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 897.782112][T15830] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 897.791674][T15830] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 897.866749][T27601] ip6t_REJECT: TCP_RESET illegal for non-tcp [ 897.878206][T27592] wg1 speed is unknown, defaulting to 1000 [ 897.934628][T27453] IPVS: starting estimator thread 0... [ 898.051849][T27606] IPVS: using max 31 ests per chain, 74400 per kthread [ 898.124082][T27609] netlink: 16 bytes leftover after parsing attributes in process `syz.2.6055'. [ 898.453025][T27620] wg1 speed is unknown, defaulting to 1000 [ 898.616234][T27592] chnl_net:caif_netlink_parms(): no params data found [ 898.661155][T27623] netlink: 'syz.3.6058': attribute type 1 has an invalid length. [ 898.683512][T27623] netlink: 244 bytes leftover after parsing attributes in process `syz.3.6058'. [ 898.841006][T15830] Bluetooth: hci4: command 0x0405 tx timeout [ 899.173770][T27592] bridge0: port 1(bridge_slave_0) entered blocking state [ 899.181763][T27592] bridge0: port 1(bridge_slave_0) entered disabled state [ 899.189070][T27592] bridge_slave_0: entered allmulticast mode [ 899.229683][T27592] bridge_slave_0: entered promiscuous mode [ 899.271736][T27592] bridge0: port 2(bridge_slave_1) entered blocking state [ 899.282668][T27592] bridge0: port 2(bridge_slave_1) entered disabled state [ 899.299511][T27592] bridge_slave_1: entered allmulticast mode [ 899.306274][T27647] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6065'. [ 899.318032][T27592] bridge_slave_1: entered promiscuous mode [ 899.392336][T27592] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 899.422625][T27592] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 899.515201][T27592] team0: Port device team_slave_0 added [ 899.536873][T27592] team0: Port device team_slave_1 added [ 899.610265][T27660] netlink: 24 bytes leftover after parsing attributes in process `syz.0.6069'. [ 899.628397][T27592] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 899.640155][T27592] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 899.667628][T27660] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6069'. [ 899.676975][T27660] netlink: 20 bytes leftover after parsing attributes in process `syz.0.6069'. [ 899.702080][T27592] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 899.722432][T27592] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 899.735928][T27592] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 899.773643][T27592] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 899.858857][T27673] bridge1: trying to set multicast query interval above maximum, setting to 8640000 (86400000ms) [ 899.877758][T27670] netlink: 24 bytes leftover after parsing attributes in process `syz.4.6071'. [ 899.888874][T27670] netlink: 11 bytes leftover after parsing attributes in process `syz.4.6071'. [ 899.898143][T26372] Bluetooth: hci1: command tx timeout [ 899.950253][T27592] hsr_slave_0: entered promiscuous mode [ 899.957200][T27592] hsr_slave_1: entered promiscuous mode [ 899.964831][T27592] debugfs: 'hsr0' already exists in 'hsr' [ 899.970963][T27592] Cannot create hsr debugfs directory [ 900.127804][T27680] netlink: 24 bytes leftover after parsing attributes in process `syz.2.6075'. [ 900.491873][T27698] netlink: 'syz.4.6081': attribute type 21 has an invalid length. [ 900.500472][T27698] netlink: 132 bytes leftover after parsing attributes in process `syz.4.6081'. [ 900.532505][T27698] netlink: 'syz.4.6081': attribute type 1 has an invalid length. [ 900.608183][T27706] netlink: 'syz.4.6084': attribute type 1 has an invalid length. [ 900.667959][T27709] netlink: 24 bytes leftover after parsing attributes in process `syz.2.6086'. [ 900.692143][T27706] bond1: (slave vxcan3): The slave device specified does not support setting the MAC address [ 900.704948][T27706] bond1: (slave vxcan3): Error -95 calling set_mac_address [ 900.781455][T27714] bond1: (slave bridge1): Enslaving as an active interface with a down link [ 900.808619][T27706] bond1: (slave bridge2): Enslaving as an active interface with a down link [ 900.849697][T27718] x_tables: duplicate underflow at hook 1 [ 900.940447][T27706] macvlan2: entered promiscuous mode [ 900.948791][T27706] macvlan2: entered allmulticast mode [ 900.975091][T27706] bond1: entered promiscuous mode [ 901.003221][T27706] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 901.024162][T27726] netlink: 'syz.3.6089': attribute type 1 has an invalid length. [ 901.082992][T27706] bond1: left promiscuous mode [ 901.191704][T27726] vlan2: entered allmulticast mode [ 901.196961][T27726] veth1_to_bridge: entered allmulticast mode [ 901.226528][T27730] wg1 speed is unknown, defaulting to 1000 [ 901.238582][T27592] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 901.268542][T27592] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 901.289774][T27592] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 901.352064][T27743] ip6t_REJECT: TCP_RESET illegal for non-tcp [ 901.364731][T27592] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 901.379414][T27461] IPVS: starting estimator thread 0... [ 901.446168][T27745] bridge0: port 1(bridge_slave_0) entered disabled state [ 901.456670][T27745] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 901.481173][T27749] IPVS: using max 36 ests per chain, 86400 per kthread [ 901.665874][T27767] FAULT_INJECTION: forcing a failure. [ 901.665874][T27767] name failslab, interval 1, probability 0, space 0, times 0 [ 901.691229][T27767] CPU: 0 UID: 0 PID: 27767 Comm: syz.2.6100 Not tainted syzkaller #0 PREEMPT(full) [ 901.691254][T27767] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/27/2026 [ 901.691265][T27767] Call Trace: [ 901.691272][T27767] [ 901.691281][T27767] dump_stack_lvl+0xe8/0x150 [ 901.691309][T27767] should_fail_ex+0x412/0x560 [ 901.691335][T27767] should_failslab+0xa8/0x100 [ 901.691360][T27767] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 901.691382][T27767] ? __alloc_skb+0x1d0/0x7d0 [ 901.691407][T27767] ? __local_bh_enable_ip+0xd0/0x130 [ 901.691434][T27767] __alloc_skb+0x1d0/0x7d0 [ 901.691455][T27767] ? netlink_ack_tlv_len+0x6c/0x210 [ 901.691481][T27767] netlink_ack+0x146/0xa50 [ 901.691499][T27767] ? __pfx_genl_rcv_msg+0x10/0x10 [ 901.691519][T27767] ? __lock_acquire+0x6b5/0x2cf0 [ 901.691552][T27767] netlink_rcv_skb+0x2b6/0x4b0 [ 901.691575][T27767] ? __pfx_genl_rcv_msg+0x10/0x10 [ 901.691594][T27767] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 901.691632][T27767] ? down_read+0x272/0x2e0 [ 901.691651][T27767] ? genl_rcv+0xd/0x40 [ 901.691670][T27767] genl_rcv+0x28/0x40 [ 901.691685][T27767] netlink_unicast+0x80f/0x9b0 [ 901.691714][T27767] ? __pfx_netlink_unicast+0x10/0x10 [ 901.691735][T27767] ? netlink_sendmsg+0x650/0xb40 [ 901.691755][T27767] ? skb_put+0x11b/0x210 [ 901.691782][T27767] netlink_sendmsg+0x813/0xb40 [ 901.691814][T27767] ? __pfx_netlink_sendmsg+0x10/0x10 [ 901.691840][T27767] ? aa_sock_msg_perm+0xf1/0x1b0 [ 901.691864][T27767] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 901.691884][T27767] ? __pfx_netlink_sendmsg+0x10/0x10 [ 901.691908][T27767] __sys_sendto+0x672/0x710 [ 901.691946][T27767] ? __pfx___sys_sendto+0x10/0x10 [ 901.691967][T27767] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 901.691997][T27767] ? __fget_files+0x3a0/0x420 [ 901.692032][T27767] ? ksys_write+0x242/0x270 [ 901.692053][T27767] ? __pfx_ksys_write+0x10/0x10 [ 901.692076][T27767] __x64_sys_sendto+0xde/0x100 [ 901.692104][T27767] do_syscall_64+0x14d/0xf80 [ 901.692118][T27767] ? trace_irq_disable+0x3b/0x150 [ 901.692141][T27767] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 901.692157][T27767] ? clear_bhb_loop+0x40/0x90 [ 901.692178][T27767] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 901.692195][T27767] RIP: 0033:0x7f959155cfce [ 901.692213][T27767] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 901.692228][T27767] RSP: 002b:00007f9592506e88 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 901.692247][T27767] RAX: ffffffffffffffda RBX: 00007f95925086c0 RCX: 00007f959155cfce [ 901.692263][T27767] RDX: 0000000000000024 RSI: 00007f9592507000 RDI: 0000000000000004 [ 901.692274][T27767] RBP: 0000000000000000 R08: 00007f9592506f04 R09: 000000000000000c [ 901.692284][T27767] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 [ 901.692294][T27767] R13: 00007f9592506f58 R14: 00007f9592507000 R15: 0000000000000000 [ 901.692319][T27767] [ 902.042587][T26372] Bluetooth: hci1: command tx timeout [ 902.174235][T27592] 8021q: adding VLAN 0 to HW filter on device bond0 [ 902.233742][T27592] 8021q: adding VLAN 0 to HW filter on device team0 [ 902.292646][T19241] bridge0: port 1(bridge_slave_0) entered blocking state [ 902.300027][T19241] bridge0: port 1(bridge_slave_0) entered forwarding state [ 902.313508][T19241] bridge0: port 2(bridge_slave_1) entered blocking state [ 902.321250][T19241] bridge0: port 2(bridge_slave_1) entered forwarding state [ 902.432483][T27788] syzkaller0: entered promiscuous mode [ 902.438331][T27788] syzkaller0: entered allmulticast mode [ 902.699403][T27809] FAULT_INJECTION: forcing a failure. [ 902.699403][T27809] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 902.735057][T27809] CPU: 0 UID: 0 PID: 27809 Comm: syz.2.6111 Not tainted syzkaller #0 PREEMPT(full) [ 902.735082][T27809] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/27/2026 [ 902.735093][T27809] Call Trace: [ 902.735101][T27809] [ 902.735110][T27809] dump_stack_lvl+0xe8/0x150 [ 902.735138][T27809] should_fail_ex+0x412/0x560 [ 902.735164][T27809] _copy_from_user+0x2d/0xb0 [ 902.735189][T27809] kstrtouint_from_user+0xd6/0x180 [ 902.735213][T27809] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 902.735250][T27809] proc_fail_nth_write+0x8e/0x210 [ 902.735274][T27809] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 902.735301][T27809] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 902.735325][T27809] vfs_write+0x29a/0xb90 [ 902.735348][T27809] ? __pfx_vfs_write+0x10/0x10 [ 902.735367][T27809] ? __fget_files+0x2a/0x420 [ 902.735393][T27809] ? __fget_files+0x3a0/0x420 [ 902.735415][T27809] ? __fget_files+0x2a/0x420 [ 902.735455][T27809] ksys_write+0x150/0x270 [ 902.735475][T27809] ? __pfx_ksys_write+0x10/0x10 [ 902.735504][T27809] do_syscall_64+0x14d/0xf80 [ 902.735521][T27809] ? trace_irq_disable+0x3b/0x150 [ 902.735544][T27809] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 902.735561][T27809] ? clear_bhb_loop+0x40/0x90 [ 902.735584][T27809] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 902.735600][T27809] RIP: 0033:0x7f959155cfce [ 902.735617][T27809] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 902.735633][T27809] RSP: 002b:00007f9592507fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 902.735652][T27809] RAX: ffffffffffffffda RBX: 00007f95925086c0 RCX: 00007f959155cfce [ 902.735663][T27809] RDX: 0000000000000001 RSI: 00007f95925080a0 RDI: 0000000000000003 [ 902.735673][T27809] RBP: 00007f9592508090 R08: 0000000000000000 R09: 0000000000000000 [ 902.735684][T27809] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 902.735695][T27809] R13: 00007f9591816038 R14: 00007f9591815fa0 R15: 00007ffdf2417408 [ 902.735724][T27809] [ 902.837598][T27592] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 902.996205][T27814] rdma_rxe: rxe_newlink: failed to add bond_slave_0 [ 903.055391][T27592] veth0_vlan: entered promiscuous mode [ 903.069610][T27592] veth1_vlan: entered promiscuous mode [ 903.237340][T27592] veth0_macvtap: entered promiscuous mode [ 903.253615][T27592] veth1_macvtap: entered promiscuous mode [ 903.299655][T27592] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 903.342213][T27592] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 903.378770][T15213] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 903.425933][T15213] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 903.435985][T15213] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 903.463593][T15213] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 903.634023][ T148] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 903.660987][ T148] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 903.699240][T19242] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 903.710846][T19242] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 903.863103][T27862] __nla_validate_parse: 13 callbacks suppressed [ 903.863123][T27862] netlink: 14 bytes leftover after parsing attributes in process `syz.3.6123'. [ 903.937289][T27862] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 903.957791][T27862] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 903.961574][T27868] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6128'. [ 903.981058][T27869] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6126'. [ 903.985896][T27862] bond0 (unregistering): Released all slaves [ 904.005816][T27864] ip6gretap1: entered allmulticast mode [ 904.121735][T26372] Bluetooth: hci1: command tx timeout [ 904.417847][T27887] netlink: 212368 bytes leftover after parsing attributes in process `syz.1.6134'. [ 904.525513][T27889] netdevsim netdevsim0: Direct firmware load for & failed with error -2 [ 904.540397][T27889] netdevsim netdevsim0: Falling back to sysfs fallback for: & [ 904.678057][T27897] syzkaller0: entered promiscuous mode [ 904.691520][T27897] syzkaller0: entered allmulticast mode [ 904.762347][T27908] Cannot find add_set index 0 as target [ 904.767485][T27899] syzkaller0: entered promiscuous mode [ 904.774594][T27899] syzkaller0: entered allmulticast mode [ 905.101588][T27915] netlink: 56 bytes leftover after parsing attributes in process `syz.2.6143'. [ 906.207610][T26372] Bluetooth: hci1: command tx timeout [ 907.804969][T27921] 8021q: adding VLAN 0 to HW filter on device team0 [ 907.835122][T27921] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 907.895598][T27931] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6148'. [ 907.935763][T27931] macvtap0: entered allmulticast mode [ 908.124331][T27946] netlink: 36 bytes leftover after parsing attributes in process `syz.4.6152'. [ 909.053740][T27980] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 909.108079][T27980] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 909.157062][T27980] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 909.192267][T27980] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 909.393479][T27996] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6167'. [ 909.403522][T27996] netlink: 20 bytes leftover after parsing attributes in process `syz.4.6167'. [ 909.589008][T28013] netlink: 14 bytes leftover after parsing attributes in process `syz.2.6172'. [ 909.697195][T28018] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6171'. [ 909.728918][T28018] team0: Port device team_slave_0 removed [ 909.776401][T28028] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6176'. [ 909.847320][T28030] netlink: 199836 bytes leftover after parsing attributes in process `syz.2.6177'. [ 909.870048][T28030] ksmbd: Unknown IPC event: 1, ignore. [ 910.107674][T28044] bridge0: entered promiscuous mode [ 910.114268][T28044] bridge0: port 3(macvlan2) entered blocking state [ 910.122193][T28044] bridge0: port 3(macvlan2) entered disabled state [ 910.129249][T28044] macvlan2: entered allmulticast mode [ 910.138574][T28044] bridge0: entered allmulticast mode [ 910.146262][T28044] macvlan2: left allmulticast mode [ 910.152388][T28044] bridge0: left allmulticast mode [ 910.160811][T28044] bridge0: left promiscuous mode [ 910.324097][T28051] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6182'. [ 910.603887][T28060] netlink: 'syz.0.6185': attribute type 3 has an invalid length. [ 910.612367][T28060] netlink: 666 bytes leftover after parsing attributes in process `syz.0.6185'. [ 910.743045][T28066] ip6t_REJECT: TCP_RESET illegal for non-tcp [ 910.787842][T28068] lo speed is unknown, defaulting to 1000 [ 910.794504][T28068] lo speed is unknown, defaulting to 1000 [ 910.807161][T28068] lo speed is unknown, defaulting to 1000 [ 910.834067][T28071] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6190'. [ 910.836520][T28068] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98 [ 910.883372][T28068] lo speed is unknown, defaulting to 1000 [ 910.892276][T28068] lo speed is unknown, defaulting to 1000 [ 910.905007][T28068] lo speed is unknown, defaulting to 1000 [ 910.935416][T28068] lo speed is unknown, defaulting to 1000 [ 910.945318][T28068] lo speed is unknown, defaulting to 1000 [ 910.956036][T28068] lo speed is unknown, defaulting to 1000 [ 910.964277][T28074] netlink: 24 bytes leftover after parsing attributes in process `syz.2.6191'. [ 910.975189][T28068] lo speed is unknown, defaulting to 1000 [ 910.984376][T28068] lo speed is unknown, defaulting to 1000 [ 910.993003][T28068] lo speed is unknown, defaulting to 1000 [ 911.043534][T28076] xt_recent: hitcount (4194304) is larger than allowed maximum (65535) [ 911.106909][T28079] wg1 speed is unknown, defaulting to 1000 [ 911.127434][T28079] lo speed is unknown, defaulting to 1000 [ 911.133024][T28081] FAULT_INJECTION: forcing a failure. [ 911.133024][T28081] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 911.148427][T28081] CPU: 1 UID: 0 PID: 28081 Comm: syz.2.6194 Not tainted syzkaller #0 PREEMPT(full) [ 911.148450][T28081] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/27/2026 [ 911.148460][T28081] Call Trace: [ 911.148468][T28081] [ 911.148476][T28081] dump_stack_lvl+0xe8/0x150 [ 911.148503][T28081] should_fail_ex+0x412/0x560 [ 911.148531][T28081] _copy_to_user+0x31/0xb0 [ 911.148578][T28081] simple_read_from_buffer+0xe1/0x170 [ 911.148606][T28081] proc_fail_nth_read+0x1bb/0x230 [ 911.148636][T28081] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 911.148661][T28081] ? rw_verify_area+0x2a6/0x4d0 [ 911.148677][T28081] ? __fget_files+0x2a/0x420 [ 911.148699][T28081] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 911.148721][T28081] vfs_read+0x20c/0xa70 [ 911.148737][T28081] ? fdget_pos+0x246/0x320 [ 911.148763][T28081] ? __pfx___mutex_lock+0x10/0x10 [ 911.148781][T28081] ? __pfx_vfs_read+0x10/0x10 [ 911.148798][T28081] ? __fget_files+0x2a/0x420 [ 911.148823][T28081] ? __fget_files+0x3a0/0x420 [ 911.148843][T28081] ? __fget_files+0x2a/0x420 [ 911.148872][T28081] ksys_read+0x150/0x270 [ 911.148892][T28081] ? __pfx_ksys_read+0x10/0x10 [ 911.148921][T28081] do_syscall_64+0x14d/0xf80 [ 911.148937][T28081] ? trace_irq_disable+0x3b/0x150 [ 911.148960][T28081] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 911.148979][T28081] ? clear_bhb_loop+0x40/0x90 [ 911.149001][T28081] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 911.149018][T28081] RIP: 0033:0x7f959155cfce [ 911.149036][T28081] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 911.149051][T28081] RSP: 002b:00007f9592507fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 911.149069][T28081] RAX: ffffffffffffffda RBX: 00007f95925086c0 RCX: 00007f959155cfce [ 911.149079][T28081] RDX: 000000000000000f RSI: 00007f95925080a0 RDI: 0000000000000006 [ 911.149088][T28081] RBP: 00007f9592508090 R08: 0000000000000000 R09: 0000000000000000 [ 911.149096][T28081] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 911.149104][T28081] R13: 00007f9591816038 R14: 00007f9591815fa0 R15: 00007ffdf2417408 [ 911.149128][T28081] [ 911.587941][T28091] netlink: 'syz.3.6195': attribute type 1 has an invalid length. [ 911.713076][T28091] bond0: entered promiscuous mode [ 911.718883][T28091] 8021q: adding VLAN 0 to HW filter on device bond0 [ 911.754153][T28101] 8021q: adding VLAN 0 to HW filter on device bond0 [ 911.763157][T28101] bond0: (slave vcan1): The slave device specified does not support setting the MAC address [ 911.774263][T28101] bond0: (slave vcan1): Setting fail_over_mac to active for active-backup mode [ 911.806572][T28101] bond0: (slave vcan1): making interface the new active one [ 911.816381][T28101] vcan1: entered promiscuous mode [ 911.826573][T28101] bond0: (slave vcan1): Enslaving as an active interface with an up link [ 912.298655][T28119] wg1 speed is unknown, defaulting to 1000 [ 912.307703][T28119] lo speed is unknown, defaulting to 1000 [ 913.383718][T28188] netlink: 'syz.1.6216': attribute type 1 has an invalid length. [ 914.428804][T28245] __nla_validate_parse: 4 callbacks suppressed [ 914.428823][T28245] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6231'. [ 914.584925][T28258] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6235'. [ 914.653305][T28260] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6236'. [ 914.773717][T28275] netlink: 'syz.4.6238': attribute type 1 has an invalid length. [ 914.832563][T28275] bond2: entered promiscuous mode [ 914.838148][T28275] 8021q: adding VLAN 0 to HW filter on device bond2 [ 914.923830][T28279] 8021q: adding VLAN 0 to HW filter on device bond2 [ 914.935330][T28279] bond2: (slave vcan1): The slave device specified does not support setting the MAC address [ 914.970965][T28279] bond2: (slave vcan1): Setting fail_over_mac to active for active-backup mode [ 915.022962][T28279] bond2: (slave vcan1): making interface the new active one [ 915.046840][T28279] vcan1: entered promiscuous mode [ 915.065013][T28279] bond2: (slave vcan1): Enslaving as an active interface with an up link [ 915.150987][T28301] netlink: 'syz.0.6245': attribute type 1 has an invalid length. [ 915.503024][T28322] FAULT_INJECTION: forcing a failure. [ 915.503024][T28322] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 915.524356][T28322] CPU: 1 UID: 0 PID: 28322 Comm: syz.0.6248 Not tainted syzkaller #0 PREEMPT(full) [ 915.524381][T28322] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/27/2026 [ 915.524391][T28322] Call Trace: [ 915.524398][T28322] [ 915.524404][T28322] dump_stack_lvl+0xe8/0x150 [ 915.524435][T28322] should_fail_ex+0x412/0x560 [ 915.524459][T28322] _copy_from_user+0x2d/0xb0 [ 915.524487][T28322] ___sys_sendmsg+0x1c6/0x360 [ 915.524509][T28322] ? __pfx____sys_sendmsg+0x10/0x10 [ 915.524555][T28322] ? __fget_files+0x2a/0x420 [ 915.524576][T28322] ? __fget_files+0x3a0/0x420 [ 915.524610][T28322] __x64_sys_sendmsg+0x1bd/0x2a0 [ 915.524629][T28322] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 915.524653][T28322] ? __pfx_ksys_write+0x10/0x10 [ 915.524680][T28322] do_syscall_64+0x14d/0xf80 [ 915.524696][T28322] ? trace_irq_disable+0x3b/0x150 [ 915.524720][T28322] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 915.524737][T28322] ? clear_bhb_loop+0x40/0x90 [ 915.524766][T28322] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 915.524781][T28322] RIP: 0033:0x7fe20d19c799 [ 915.524799][T28322] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 915.524814][T28322] RSP: 002b:00007fe20b3d5028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 915.524833][T28322] RAX: ffffffffffffffda RBX: 00007fe20d416090 RCX: 00007fe20d19c799 [ 915.524846][T28322] RDX: 0000000030006041 RSI: 0000200000000000 RDI: 0000000000000005 [ 915.524858][T28322] RBP: 00007fe20b3d5090 R08: 0000000000000000 R09: 0000000000000000 [ 915.524869][T28322] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 915.524880][T28322] R13: 00007fe20d416128 R14: 00007fe20d416090 R15: 00007ffd9bdb85e8 [ 915.524907][T28322] [ 915.559883][T28321] wg1 speed is unknown, defaulting to 1000 [ 915.812830][T28322] wg1 speed is unknown, defaulting to 1000 [ 915.818991][T28321] lo speed is unknown, defaulting to 1000 [ 915.827920][T28322] lo speed is unknown, defaulting to 1000 [ 916.148499][T28336] wg1 speed is unknown, defaulting to 1000 [ 916.193064][T28336] lo speed is unknown, defaulting to 1000 [ 916.345300][T28341] syzkaller0: entered promiscuous mode [ 916.351723][T28341] syzkaller0: entered allmulticast mode [ 916.654888][T28349] netlink: 48 bytes leftover after parsing attributes in process `syz.0.6256'. [ 919.541537][T28399] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6266'. [ 919.591544][T28407] netlink: 56 bytes leftover after parsing attributes in process `syz.3.6267'. [ 919.609471][T28409] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6266'. [ 919.643699][T28407] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6267'. [ 919.657168][T28407] netlink: 'syz.3.6267': attribute type 1 has an invalid length. [ 919.666771][T28407] netlink: 36 bytes leftover after parsing attributes in process `syz.3.6267'. [ 919.686509][T28412] IPVS: set_ctl: invalid protocol: 46 127.0.0.1:20001 [ 919.723601][T28409] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 919.818684][T28409] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 919.849337][T28418] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6269'. [ 919.953663][T28423] nbd: couldn't find device at index 0 [ 920.019279][T28417] netlink: 'syz.3.6271': attribute type 3 has an invalid length. [ 920.035585][T28399] wg1 speed is unknown, defaulting to 1000 [ 920.050753][T28416] netlink: 120 bytes leftover after parsing attributes in process `syz.3.6271'. [ 920.106137][T28399] lo speed is unknown, defaulting to 1000 [ 920.690896][T28443] netlink: 'syz.0.6277': attribute type 1 has an invalid length. [ 920.808441][T28449] 8021q: adding VLAN 0 to HW filter on device bond3 [ 920.828292][T28449] bond2: (slave bond3): making interface the new active one [ 920.851584][T28449] bond2: (slave bond3): Enslaving as an active interface with an up link [ 920.876410][T28449] netlink: 28 bytes leftover after parsing attributes in process `syz.0.6277'. [ 920.927183][T28443] bond2: (slave gretap1): Enslaving as a backup interface with an up link [ 920.949395][T28454] vlan2: entered promiscuous mode [ 920.955848][T28454] bond2: entered promiscuous mode [ 920.961078][T28454] bond3: entered promiscuous mode [ 920.968722][T28454] bond2: (slave vlan2): Opening slave failed [ 920.985935][T28444] wg1 speed is unknown, defaulting to 1000 [ 920.987895][T28449] 8021q: adding VLAN 0 to HW filter on device bond2 [ 921.015386][T28444] lo speed is unknown, defaulting to 1000 [ 921.220368][T28473] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6281'. [ 921.224389][T28472] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6282'. [ 921.629780][T15830] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 921.643583][T15830] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 921.653567][T15830] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 921.663183][T15830] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 921.672680][T15830] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 921.765286][T28480] syzkaller1: entered promiscuous mode [ 921.780085][T28480] syzkaller1: entered allmulticast mode [ 922.013561][T28496] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 922.013673][T28483] wg1 speed is unknown, defaulting to 1000 [ 922.037123][T28496] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 922.049675][T28496] bond0 (unregistering): Released all slaves [ 922.100931][T28483] lo speed is unknown, defaulting to 1000 [ 922.482543][T28498] netdevsim netdevsim3: loading /lib/firmware/. failed with error -22 [ 922.506792][T28498] netdevsim netdevsim3: Direct firmware load for . failed with error -22 [ 922.517991][T28515] netlink: 'syz.1.6292': attribute type 13 has an invalid length. [ 922.537508][T28498] netdevsim netdevsim3: Falling back to sysfs fallback for: . [ 922.689508][T28520] wg1 speed is unknown, defaulting to 1000 [ 922.736674][T28520] lo speed is unknown, defaulting to 1000 [ 922.744296][T28483] chnl_net:caif_netlink_parms(): no params data found [ 923.088783][T19240] bridge_slave_1: left allmulticast mode [ 923.095475][T19240] bridge_slave_1: left promiscuous mode [ 923.114064][T19240] bridge0: port 2(bridge_slave_1) entered disabled state [ 923.128780][T19240] bridge_slave_0: left allmulticast mode [ 923.143886][T19240] bridge_slave_0: left promiscuous mode [ 923.151097][T19240] bridge0: port 1(bridge_slave_0) entered disabled state [ 923.334547][T28556] netlink: 'syz.0.6300': attribute type 4 has an invalid length. [ 923.399518][T28558] netlink: 'syz.0.6300': attribute type 4 has an invalid length. [ 923.453946][T28559] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 923.513996][T19240] bond1 (unregistering): (slave bridge2): Releasing active interface [ 923.526787][T19240] bond1 (unregistering): (slave bridge2): the permanent HWaddr of slave - 7e:2a:ea:61:56:0b - is still in use by bond - set the HWaddr of slave to a different address to avoid conflicts [ 923.593462][T19240] bond1 (unregistering): (slave bridge3): Releasing active interface [ 923.720778][T15830] Bluetooth: hci5: command tx timeout [ 923.894306][T19240] bond1 (unregistering): Released all slaves [ 923.907395][T19240] bond0 (unregistering): Released all slaves [ 923.922779][T19240] bond2 (unregistering): Released all slaves [ 923.936164][T19240] bond3 (unregistering): Released all slaves [ 923.957211][T19240] bond4 (unregistering): Released all slaves [ 923.980724][T19240] bond5 (unregistering): Released all slaves [ 924.009581][T28555] netlink: 'syz.1.6302': attribute type 6 has an invalid length. [ 924.071284][T28483] bridge0: port 1(bridge_slave_0) entered blocking state [ 924.078453][T28483] bridge0: port 1(bridge_slave_0) entered disabled state [ 924.118791][T28483] bridge_slave_0: entered allmulticast mode [ 924.138881][T28483] bridge_slave_0: entered promiscuous mode [ 924.179281][T18688] lo speed is unknown, defaulting to 1000 [ 924.202062][T18688] syz2: Port: 1 Link ACTIVE [ 924.258839][T28483] bridge0: port 2(bridge_slave_1) entered blocking state [ 924.269626][T28483] bridge0: port 2(bridge_slave_1) entered disabled state [ 924.277830][T28483] bridge_slave_1: entered allmulticast mode [ 924.289337][T28483] bridge_slave_1: entered promiscuous mode [ 924.298188][T19240] M: left promiscuous mode [ 924.330758][T28571] dvmrp1: tun_chr_ioctl cmd 2148553947 [ 924.454163][T19240] tipc: Left network mode [ 924.503255][T28483] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 924.560331][T28483] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 924.712266][T28483] team0: Port device team_slave_0 added [ 924.724065][T28483] team0: Port device team_slave_1 added [ 924.754931][T28580] netlink: 'syz.1.6309': attribute type 16 has an invalid length. [ 924.785789][T28582] bridge0: port 1(bridge_slave_0) entered disabled state [ 924.827404][T28580] netlink: 'syz.1.6309': attribute type 17 has an invalid length. [ 924.863592][T28582] bridge0: port 2(bridge_slave_1) entered disabled state [ 924.948996][T28598] Bluetooth: MGMT ver 1.23 [ 925.018265][T28600] __nla_validate_parse: 7 callbacks suppressed [ 925.018283][T28600] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6312'. [ 925.069154][T28597] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6312'. [ 925.157138][T28580] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 925.277462][T28600] workqueue: Failed to create a rescuer kthread for wq "bond3": -EINTR [ 925.278461][T28483] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 925.314831][T28483] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 925.378141][T28483] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 925.501179][T28483] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 925.525735][T28483] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 925.578247][T28483] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 925.593151][T28598] wg1 speed is unknown, defaulting to 1000 [ 925.600647][T28620] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6317'. [ 925.639815][T28598] lo speed is unknown, defaulting to 1000 [ 925.776518][T28483] hsr_slave_0: entered promiscuous mode [ 925.784279][T28483] hsr_slave_1: entered promiscuous mode [ 925.792990][T28483] debugfs: 'hsr0' already exists in 'hsr' [ 925.799125][T28483] Cannot create hsr debugfs directory [ 925.805233][T15830] Bluetooth: hci5: command tx timeout [ 925.847242][T28630] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6320'. [ 925.887649][T28629] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6320'. [ 925.922053][T28636] netlink: 112 bytes leftover after parsing attributes in process `syz.0.6322'. [ 925.966817][T28636] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6322'. [ 926.047265][T28630] team0 (unregistering): Port device team_slave_0 removed [ 926.073200][T28630] team0 (unregistering): Port device team_slave_1 removed [ 926.268553][T19240] hsr_slave_0: left promiscuous mode [ 926.277860][T19240] hsr_slave_1: left promiscuous mode [ 926.290781][T19240] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 926.305958][T19240] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 926.338224][T28661] netlink: 'syz.0.6325': attribute type 1 has an invalid length. [ 926.370736][T28661] netlink: 13 bytes leftover after parsing attributes in process `syz.0.6325'. [ 926.381763][T28665] netlink: 36 bytes leftover after parsing attributes in process `syz.3.6326'. [ 926.411745][T28661] netlink: 'syz.0.6325': attribute type 1 has an invalid length. [ 926.554695][T19240] batadv_slave_1 (unregistering): left allmulticast mode [ 926.606190][T19240] team0 (unregistering): Port device team_slave_1 removed [ 926.626069][T19240] team0 (unregistering): Port device team_slave_0 removed [ 927.259469][T28697] netlink: 'syz.3.6332': attribute type 13 has an invalid length. [ 927.287215][T28697] netlink: 'syz.3.6332': attribute type 17 has an invalid length. [ 927.288086][T28682] wg1 speed is unknown, defaulting to 1000 [ 927.319583][T28699] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6333'. [ 927.882144][T15830] Bluetooth: hci5: command tx timeout [ 928.082140][T28697] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 928.106826][T28699] bridge_slave_1: left allmulticast mode [ 928.113163][T28699] bridge_slave_1: left promiscuous mode [ 928.118998][T28699] bridge0: port 2(bridge_slave_1) entered disabled state [ 928.131695][T28699] bridge_slave_0: left allmulticast mode [ 928.137684][T28699] bridge_slave_0: left promiscuous mode [ 928.143614][T28699] bridge0: port 1(bridge_slave_0) entered disabled state [ 928.193789][T28682] lo speed is unknown, defaulting to 1000 [ 928.235809][T28684] wg1 speed is unknown, defaulting to 1000 [ 928.253260][T28684] lo speed is unknown, defaulting to 1000 [ 928.343114][T19240] IPVS: stop unused estimator thread 0... [ 928.986076][T27463] lo speed is unknown, defaulting to 1000 [ 929.000984][T27463] syz2: Port: 1 Link DOWN [ 929.257654][T28483] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 929.323831][T28483] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 929.365826][T28483] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 929.399280][T28483] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 929.532740][T28740] wg1 speed is unknown, defaulting to 1000 [ 929.557690][T28740] lo speed is unknown, defaulting to 1000 [ 929.997374][T15830] Bluetooth: hci5: command tx timeout [ 930.291838][T28483] 8021q: adding VLAN 0 to HW filter on device bond0 [ 930.567845][T28483] 8021q: adding VLAN 0 to HW filter on device team0 [ 930.614229][ T6862] bridge0: port 1(bridge_slave_0) entered blocking state [ 930.621611][ T6862] bridge0: port 1(bridge_slave_0) entered forwarding state [ 930.670805][ T6862] bridge0: port 2(bridge_slave_1) entered blocking state [ 930.678588][ T6862] bridge0: port 2(bridge_slave_1) entered forwarding state [ 930.966534][T28798] __nla_validate_parse: 8 callbacks suppressed [ 930.966556][T28798] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6352'. [ 931.443879][T28483] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 931.543441][T28820] syzkaller0: entered promiscuous mode [ 931.549161][T28820] syzkaller0: entered allmulticast mode [ 931.646011][ T1297] lec:lec_start_xmit: lec0:No lecd attached [ 931.739879][T28831] wg1 speed is unknown, defaulting to 1000 [ 931.748551][T28483] veth0_vlan: entered promiscuous mode [ 931.778700][T28831] lo speed is unknown, defaulting to 1000 [ 931.787754][T28836] netlink: 4768 bytes leftover after parsing attributes in process `syz.1.6359'. [ 931.806670][T28483] veth1_vlan: entered promiscuous mode [ 931.838109][T28837] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6358'. [ 931.849804][T28838] ipt_ECN: cannot use operation on non-tcp rule [ 931.922584][T28828] netlink: 'syz.0.6357': attribute type 32 has an invalid length. [ 931.940731][T28828] netlink: 20 bytes leftover after parsing attributes in process `syz.0.6357'. [ 931.970275][T28828] bond0: option coupled_control: mode dependency failed, not supported in mode balance-rr(0) [ 932.058498][T28842] batman_adv: batadv0: Adding interface: macsec1 [ 932.065559][T28842] batman_adv: batadv0: The MTU of interface macsec1 is too small (1468) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1568 would solve the problem. [ 932.125187][T28842] batman_adv: batadv0: Interface activated: macsec1 [ 933.006113][T28868] RDS: rds_bind could not find a transport for ::ffff:172.30.1.5, load rds_tcp or rds_rdma? [ 935.213797][T28838] wg1 speed is unknown, defaulting to 1000 [ 935.277219][T28483] veth0_macvtap: entered promiscuous mode [ 935.290479][T28838] lo speed is unknown, defaulting to 1000 [ 935.383526][T28483] veth1_macvtap: entered promiscuous mode [ 935.565047][T28483] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 935.588117][T28483] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 935.599663][T28904] tipc: Failed to remove unknown binding: 66,0,0/0:764224119/764224120 [ 935.613042][T28904] tipc: Failed to remove unknown binding: 66,0,0/0:764224119/764224120 [ 935.708969][T28904] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 935.958826][ T49] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 935.984870][ T49] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 936.014230][ T49] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 936.106989][T28904] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 936.196235][ T148] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 936.214603][T28925] xt_TCPMSS: Only works on TCP SYN packets [ 936.293646][T28904] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 936.385268][T28904] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 936.716116][T19240] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 936.787235][T19240] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 936.828390][T28953] wg1 speed is unknown, defaulting to 1000 [ 936.844844][T19243] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 936.854896][T28953] lo speed is unknown, defaulting to 1000 [ 936.889295][T19243] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 936.917043][T19243] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 936.933226][T19240] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 937.000019][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5350 ms [ 937.008830][ C0] lec:lec_tx_timeout: lec0 [ 937.079252][T19242] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 937.091594][T19242] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 937.475524][T28984] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 937.559379][T28984] bridge0: port 2(bridge_slave_1) entered disabled state [ 937.841557][T28984] bond0: left promiscuous mode [ 937.846502][T28984] vcan1: left promiscuous mode [ 937.911454][T15210] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 937.943218][T15210] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 937.957647][T15210] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 937.973193][T15210] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 938.201011][T28995] netlink: 'syz.3.6382': attribute type 1 has an invalid length. [ 938.213071][T29002] netlink: 'syz.1.6384': attribute type 1 has an invalid length. [ 938.240641][T28995] netlink: 244 bytes leftover after parsing attributes in process `syz.3.6382'. [ 938.310990][T29008] ip6t_REJECT: TCP_RESET illegal for non-tcp [ 938.348553][T28995] bond1 (unregistering): Released all slaves [ 938.502877][T29011] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6387'. [ 938.648516][T29015] wg1 speed is unknown, defaulting to 1000 [ 938.677340][T29015] lo speed is unknown, defaulting to 1000 [ 938.735478][T29019] netlink: 24 bytes leftover after parsing attributes in process `syz.4.6390'. [ 938.772079][T29019] netlink: 24 bytes leftover after parsing attributes in process `syz.4.6390'. [ 938.886392][T29026] netlink: 24 bytes leftover after parsing attributes in process `syz.1.6391'. [ 939.152737][T29036] netlink: 148 bytes leftover after parsing attributes in process `syz.2.6396'. [ 939.315643][T29036] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 939.352204][T29046] netlink: 'syz.1.6397': attribute type 30 has an invalid length. [ 939.496644][T29036] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 939.668381][T29036] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 939.743493][T29054] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6401'. [ 939.785173][T29036] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 939.911269][T29060] wg1 speed is unknown, defaulting to 1000 [ 939.936356][T29060] lo speed is unknown, defaulting to 1000 [ 940.032177][T29071] netlink: 11 bytes leftover after parsing attributes in process `syz.4.6405'. [ 940.061313][T19243] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 940.122901][T19238] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 940.143437][T19238] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 940.160799][T19238] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 940.169521][T29055] mpoa:mpoad_close: (lec0) going down [ 940.457970][T29086] x_tables: duplicate underflow at hook 3 [ 940.476756][T29086] netlink: 112 bytes leftover after parsing attributes in process `syz.4.6409'. [ 940.491618][T29086] netlink: 56 bytes leftover after parsing attributes in process `syz.4.6409'. [ 940.689438][T29090] bond1: (slave veth3): Enslaving as an active interface with a down link [ 940.726676][T29093] bond1: (slave veth5): Enslaving as an active interface with a down link [ 941.124101][T29107] wg1 speed is unknown, defaulting to 1000 [ 941.131820][T29107] lo speed is unknown, defaulting to 1000 [ 941.134656][T29103] syzkaller1: entered promiscuous mode [ 941.159633][T29103] syzkaller1: entered allmulticast mode [ 941.445911][T29117] netlink: 'syz.1.6417': attribute type 1 has an invalid length. [ 941.471130][T29121] netlink: 'syz.4.6416': attribute type 9 has an invalid length. [ 941.701570][T29129] ip6erspan0: entered allmulticast mode [ 942.028138][T29149] bond2: option lacp_rate: invalid value (128) [ 942.061651][T29149] bond2 (unregistering): Released all slaves [ 942.395460][T29162] sctp: [Deprecated]: syz.4.6431 (pid 29162) Use of struct sctp_assoc_value in delayed_ack socket option. [ 942.395460][T29162] Use struct sctp_sack_info instead [ 942.838700][T29190] syzkaller0: entered promiscuous mode [ 942.848218][T29190] syzkaller0: entered allmulticast mode [ 943.453726][T29221] wg1 speed is unknown, defaulting to 1000 [ 943.483169][T29221] lo speed is unknown, defaulting to 1000 [ 943.529079][T29217] __nla_validate_parse: 12 callbacks suppressed [ 943.529100][T29217] netlink: 228 bytes leftover after parsing attributes in process `syz.0.6448'. [ 943.565779][T29228] tipc: Started in network mode [ 943.571554][T29228] tipc: Node identity ff020000000000000000000000000001, cluster identity 4711 [ 943.581085][T29228] tipc: Enabling of bearer rejected, failed to enable media [ 943.967097][T29250] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6459'. [ 944.113396][T29252] wg1 speed is unknown, defaulting to 1000 [ 944.169703][T29252] lo speed is unknown, defaulting to 1000 [ 944.294845][T29263] netlink: 20 bytes leftover after parsing attributes in process `syz.1.6465'. [ 944.356012][T29272] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6468'. [ 944.376468][T29263] nbd: socks must be embedded in a SOCK_ITEM attr [ 944.385510][T29270] netlink: 20 bytes leftover after parsing attributes in process `syz.1.6465'. [ 944.395388][T29270] nbd: nbd64 already in use [ 944.405869][T28978] block nbd64: NBD_DISCONNECT [ 944.458418][T29274] netlink: 24 bytes leftover after parsing attributes in process `syz.0.6467'. [ 944.491828][T29273] netlink: 28 bytes leftover after parsing attributes in process `syz.4.6468'. [ 944.827175][T28978] udevd[28978]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 945.127746][T29315] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6481'. [ 945.143854][T29315] netlink: 'syz.3.6481': attribute type 1 has an invalid length. [ 945.153347][T29320] netlink: 36 bytes leftover after parsing attributes in process `syz.4.6480'. [ 945.224453][T29322] bond1: (slave geneve2): making interface the new active one [ 945.233783][T29322] bond1: (slave geneve2): Enslaving as an active interface with an up link [ 945.251789][ T49] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 20000 - 0 [ 945.294292][ T49] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 20000 - 0 [ 945.303283][T29322] netlink: 28 bytes leftover after parsing attributes in process `syz.3.6481'. [ 945.355328][T29322] 8021q: adding VLAN 0 to HW filter on device bond1 [ 945.363745][ T49] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 20000 - 0 [ 945.373463][ T49] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 20000 - 0 [ 945.426019][ T49] netdevsim netdevsim1 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 945.450874][ T49] netdevsim netdevsim1 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 945.478899][ T49] netdevsim netdevsim1 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 945.516718][ T49] netdevsim netdevsim1 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 945.916424][T29371] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 945.947869][T29373] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 946.129307][T29385] gre1: entered allmulticast mode [ 946.378289][T29393] team0 (unregistering): Port device team_slave_0 removed [ 946.399722][T29393] team0 (unregistering): Port device team_slave_1 removed [ 946.482420][T29399] wg1 speed is unknown, defaulting to 1000 [ 946.548868][T29399] lo speed is unknown, defaulting to 1000 [ 946.852977][T29428] dvmrp1: entered allmulticast mode [ 946.895237][T29433] dvmrp1: left allmulticast mode [ 947.133426][T29448] vlan2: entered promiscuous mode [ 947.138616][T29448] bridge0: entered promiscuous mode [ 947.226110][T29457] netlink: 'syz.4.6523': attribute type 1 has an invalid length. [ 947.254855][T29457] netlink: 'syz.4.6523': attribute type 3 has an invalid length. [ 947.282165][T29457] netlink: 'syz.4.6523': attribute type 1 has an invalid length. [ 947.768081][T29484] Bluetooth: MGMT ver 1.23 [ 947.861045][T29477] wg1 speed is unknown, defaulting to 1000 [ 947.900841][T29477] lo speed is unknown, defaulting to 1000 [ 948.223310][T29498] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 948.245615][T29498] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 948.257784][T29498] bond0 (unregistering): Released all slaves [ 948.972822][T29549] __nla_validate_parse: 12 callbacks suppressed [ 948.972844][T29549] netlink: 44 bytes leftover after parsing attributes in process `syz.2.6543'. [ 948.991894][T29549] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6543'. [ 949.683015][T29578] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6550'. [ 949.766632][T29588] netlink: 'syz.1.6554': attribute type 4 has an invalid length. [ 949.789358][T29578] 8021q: adding VLAN 0 to HW filter on device bond3 [ 949.799448][T29588] netlink: 'syz.1.6554': attribute type 4 has an invalid length. [ 949.856030][T29578] netlink: 'syz.4.6550': attribute type 15 has an invalid length. [ 949.989524][T29593] bond3: option ad_select: unable to set because the bond device is up [ 950.031831][T29600] sctp: [Deprecated]: syz.0.6556 (pid 29600) Use of struct sctp_assoc_value in delayed_ack socket option. [ 950.031831][T29600] Use struct sctp_sack_info instead [ 950.099299][T29602] syz.1.6557: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 950.154406][T29602] CPU: 0 UID: 0 PID: 29602 Comm: syz.1.6557 Not tainted syzkaller #0 PREEMPT(full) [ 950.154435][T29602] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/27/2026 [ 950.154448][T29602] Call Trace: [ 950.154457][T29602] [ 950.154466][T29602] dump_stack_lvl+0xe8/0x150 [ 950.154501][T29602] warn_alloc+0x249/0x340 [ 950.154527][T29602] ? stack_trace_save+0xa9/0x100 [ 950.154551][T29602] ? __pfx_warn_alloc+0x10/0x10 [ 950.154581][T29602] ? kasan_save_track+0x4f/0x80 [ 950.154601][T29602] ? kasan_save_track+0x3e/0x80 [ 950.154619][T29602] ? __kasan_kmalloc+0x93/0xb0 [ 950.154640][T29602] ? __kmalloc_cache_noprof+0x31c/0x660 [ 950.154662][T29602] ? xskq_create+0x56/0x170 [ 950.154806][T29602] ? xsk_setsockopt+0x54c/0x990 [ 950.154831][T29602] ? do_sock_setsockopt+0x17c/0x1b0 [ 950.154860][T29602] ? __x64_sys_setsockopt+0x13d/0x1b0 [ 950.154888][T29602] ? do_syscall_64+0x14d/0xf80 [ 950.154911][T29602] __vmalloc_node_range_noprof+0x132/0x1730 [ 950.154982][T29602] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 950.155011][T29602] ? __kasan_kmalloc+0x93/0xb0 [ 950.155039][T29602] vmalloc_user_noprof+0xad/0xe0 [ 950.155061][T29602] ? xskq_create+0xbf/0x170 [ 950.155090][T29602] xskq_create+0xbf/0x170 [ 950.155120][T29602] xsk_init_queue+0x8a/0xe0 [ 950.155149][T29602] xsk_setsockopt+0x54c/0x990 [ 950.155178][T29602] ? __pfx_xsk_setsockopt+0x10/0x10 [ 950.155203][T29602] ? __pfx_aa_sk_perm+0x10/0x10 [ 950.155230][T29602] ? aa_sock_opt_perm+0xff/0x1a0 [ 950.155259][T29602] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 950.155290][T29602] ? __pfx_xsk_setsockopt+0x10/0x10 [ 950.155317][T29602] do_sock_setsockopt+0x17c/0x1b0 [ 950.155352][T29602] __x64_sys_setsockopt+0x13d/0x1b0 [ 950.155387][T29602] do_syscall_64+0x14d/0xf80 [ 950.155405][T29602] ? trace_irq_disable+0x3b/0x150 [ 950.155434][T29602] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 950.155455][T29602] ? clear_bhb_loop+0x40/0x90 [ 950.155479][T29602] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 950.155499][T29602] RIP: 0033:0x7fdf51b9c799 [ 950.155519][T29602] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 950.155536][T29602] RSP: 002b:00007fdf52a95028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 950.155556][T29602] RAX: ffffffffffffffda RBX: 00007fdf51e15fa0 RCX: 00007fdf51b9c799 [ 950.155569][T29602] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000003 [ 950.155581][T29602] RBP: 00007fdf51c32c99 R08: 0000000000000004 R09: 0000000000000000 [ 950.155592][T29602] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 950.155602][T29602] R13: 00007fdf51e16038 R14: 00007fdf51e15fa0 R15: 00007ffd86567e58 [ 950.155628][T29602] [ 950.155640][T29602] Mem-Info: [ 950.311184][T29616] netlink: 56 bytes leftover after parsing attributes in process `syz.1.6557'. [ 950.350058][T29602] active_anon:5809 inactive_anon:0 isolated_anon:0 [ 950.350058][T29602] active_file:3453 inactive_file:40389 isolated_file:0 [ 950.350058][T29602] unevictable:768 dirty:301 writeback:0 [ 950.350058][T29602] slab_reclaimable:13507 slab_unreclaimable:181843 [ 950.350058][T29602] mapped:29731 shmem:1370 pagetables:1638 [ 950.350058][T29602] sec_pagetables:0 bounce:0 [ 950.350058][T29602] kernel_misc_reclaimable:0 [ 950.350058][T29602] free:1204902 free_pcp:41371 free_cma:0 [ 950.450889][T29607] xt_bpf: check failed: parse error [ 950.456303][T29602] Node 0 active_anon:23336kB inactive_anon:0kB active_file:13812kB inactive_file:161348kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:77964kB dirty:1204kB writeback:0kB shmem:3944kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:15332kB pagetables:6372kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 950.561763][T29602] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:208kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:44960kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:32kB pagetables:180kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 950.629264][T29602] Node 0 DMA free:11244kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:20kB local_pcp:12kB free_cma:0kB [ 950.687111][T29602] lowmem_reserve[]: 0 2492 2493 2493 2493 [ 950.740302][T29602] Node 0 DMA32 free:1049516kB boost:0kB min:34200kB low:42748kB high:51296kB reserved_highatomic:0KB free_highatomic:0KB active_anon:23436kB inactive_anon:0kB active_file:13812kB inactive_file:161348kB unevictable:1536kB writepending:1204kB zspages:0kB present:3129332kB managed:2552728kB mlocked:0kB bounce:0kB free_pcp:111584kB local_pcp:32924kB free_cma:0kB [ 950.780641][T29602] lowmem_reserve[]: 0 0 0 0 0 [ 950.782921][T29632] wg1 speed is unknown, defaulting to 1000 [ 950.791011][T29602] Node 0 Normal free:0kB boost:0kB min:8kB low:8kB high:8kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:884kB mlocked:0kB bounce:0kB free_pcp:4kB local_pcp:0kB free_cma:0kB [ 950.805118][T29632] lo speed is unknown, defaulting to 1000 [ 950.858419][T29602] lowmem_reserve[]: 0 0 0 0 0 [ 950.864138][T29602] Node 1 Normal free:3758560kB boost:0kB min:55688kB low:69608kB high:83528kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:208kB unevictable:1536kB writepending:0kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:52680kB local_pcp:25160kB free_cma:0kB [ 950.959380][T29602] lowmem_reserve[]: 0 0 0 0 0 [ 950.970592][T29602] Node 0 DMA: 1*4kB (U) 1*8kB (U) 2*16kB (U) 2*32kB (U) 2*64kB (U) 2*128kB (U) 2*256kB (U) 2*512kB (U) 3*1024kB (U) 3*2048kB (UM) 0*4096kB = 11244kB [ 951.016648][T29602] Node 0 DMA32: 6999*4kB (UME) 5688*8kB (UME) 4146*16kB (UME) 1155*32kB (UME) 232*64kB (UME) 916*128kB (UM) 347*256kB (UME) 505*512kB (UM) 247*1024kB (UME) 72*2048kB (UM) 0*4096kB = 1056668kB [ 951.038346][T29640] FAULT_INJECTION: forcing a failure. [ 951.038346][T29640] name failslab, interval 1, probability 0, space 0, times 0 [ 951.043413][T29646] wg1 speed is unknown, defaulting to 1000 [ 951.054022][T29640] CPU: 1 UID: 0 PID: 29640 Comm: syz.3.6566 Not tainted syzkaller #0 PREEMPT(full) [ 951.054045][T29640] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/27/2026 [ 951.054056][T29640] Call Trace: [ 951.054064][T29640] [ 951.054071][T29640] dump_stack_lvl+0xe8/0x150 [ 951.054102][T29640] should_fail_ex+0x412/0x560 [ 951.054129][T29640] should_failslab+0xa8/0x100 [ 951.054153][T29640] __kmalloc_noprof+0xe8/0x760 [ 951.054172][T29640] ? tomoyo_encode+0x28b/0x550 [ 951.054201][T29640] tomoyo_encode+0x28b/0x550 [ 951.054229][T29640] tomoyo_realpath_from_path+0x58d/0x5d0 [ 951.054261][T29640] ? tomoyo_path_number_perm+0x219/0x630 [ 951.054281][T29640] tomoyo_path_number_perm+0x246/0x630 [ 951.054303][T29640] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 951.054325][T29640] ? __lock_acquire+0x6b5/0x2cf0 [ 951.054356][T29640] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 951.054393][T29640] ? __fget_files+0x2a/0x420 [ 951.054428][T29640] ? __fget_files+0x2a/0x420 [ 951.054450][T29640] ? __fget_files+0x3a0/0x420 [ 951.054473][T29640] ? __fget_files+0x2a/0x420 [ 951.054499][T29640] security_file_ioctl+0xc3/0x2a0 [ 951.054521][T29640] __se_sys_ioctl+0x47/0x170 [ 951.054543][T29640] do_syscall_64+0x14d/0xf80 [ 951.054558][T29640] ? trace_irq_disable+0x3b/0x150 [ 951.054582][T29640] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 951.054600][T29640] ? clear_bhb_loop+0x40/0x90 [ 951.054621][T29640] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 951.054638][T29640] RIP: 0033:0x7f2ab299c799 [ 951.054656][T29640] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 951.054672][T29640] RSP: 002b:00007f2ab38c4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 951.054691][T29640] RAX: ffffffffffffffda RBX: 00007f2ab2c15fa0 RCX: 00007f2ab299c799 [ 951.054704][T29640] RDX: 0000000000000000 RSI: 00000000400461f1 RDI: 0000000000000004 [ 951.054716][T29640] RBP: 00007f2ab38c4090 R08: 0000000000000000 R09: 0000000000000000 [ 951.054727][T29640] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 951.054737][T29640] R13: 00007f2ab2c16038 R14: 00007f2ab2c15fa0 R15: 00007ffe24034e28 [ 951.054764][T29640] [ 951.054796][T29640] ERROR: Out of memory at tomoyo_realpath_from_path. [ 951.093772][T29646] lo speed is unknown, defaulting to 1000 [ 951.110762][T29602] Node 0 [ 951.220560][T29640] atm:do_vcc_ioctl: ATM_SETSC is obsolete; used by syz.3.6566:29640 [ 951.295949][T29602] Normal: [ 951.378945][T29651] wg1 speed is unknown, defaulting to 1000 [ 951.421558][T29652] wg1 speed is unknown, defaulting to 1000 [ 951.428815][T29652] lo speed is unknown, defaulting to 1000 [ 951.435602][T29602] 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 951.448149][T29602] Node 1 Normal: 9*4kB (UM) 10*8kB (UM) 22*16kB (UME) 10*32kB (UME) 18*64kB (UME) 7*128kB (UME) 11*256kB (UME) 8*512kB (UME) 11*1024kB (UM) 7*2048kB (UE) 909*4096kB (UM) = 3758612kB [ 951.496514][T29602] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 951.507258][T29651] lo speed is unknown, defaulting to 1000 [ 951.520738][T29602] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 951.550610][T29602] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 951.570532][T29602] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 951.590579][T29602] 46285 total pagecache pages [ 951.595578][T29602] 1 pages in swap cache [ 951.620629][T29602] Free swap = 124992kB [ 951.624835][T29602] Total swap = 124996kB [ 951.629349][T29602] 2097051 pages RAM [ 951.660259][T29602] 0 pages HighMem/MovableOnly [ 951.665020][T29602] 427033 pages reserved [ 951.669195][T29602] 0 pages cma reserved [ 952.241155][T29664] bridge0: port 2(bridge_slave_1) entered disabled state [ 952.248733][T29664] bridge0: port 1(bridge_slave_0) entered disabled state [ 952.377879][T29664] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 952.410000][T29664] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 952.631063][T29664] vlan2: left promiscuous mode [ 952.647357][T29664] bridge0: left promiscuous mode [ 952.729582][T19240] netdevsim netdevsim2 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 952.767872][T19240] netdevsim netdevsim2 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 952.822658][T19240] netdevsim netdevsim2 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 952.848521][T19240] netdevsim netdevsim2 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 952.884539][T29684] netlink: 24 bytes leftover after parsing attributes in process `syz.3.6576'. [ 953.233845][T29688] wg1 speed is unknown, defaulting to 1000 [ 953.245085][T29688] lo speed is unknown, defaulting to 1000 [ 953.253939][T29695] wg1 speed is unknown, defaulting to 1000 [ 953.296380][T29695] lo speed is unknown, defaulting to 1000 [ 953.697191][T29717] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6585'. [ 953.770267][ C1] vcan0: j1939_tp_rxtimer: 0xffff888029721400: rx timeout, send abort [ 953.813701][T29722] netlink: 'syz.3.6587': attribute type 1 has an invalid length. [ 954.016070][T29725] netlink: 24 bytes leftover after parsing attributes in process `syz.2.6588'. [ 954.074615][T29727] pimreg: tun_chr_ioctl cmd 1074025677 [ 954.094697][T29727] pimreg: linktype set to 780 [ 954.101201][T29729] pimreg: tun_chr_ioctl cmd 37916 [ 954.144475][T29731] netlink: 24 bytes leftover after parsing attributes in process `syz.1.6590'. [ 954.270728][ C1] vcan0: j1939_tp_rxtimer: 0xffff888029721000: rx timeout, send abort [ 954.279007][ C1] vcan0: j1939_tp_rxtimer: 0xffff888029721400: abort rx timeout. Force session deactivation [ 954.360799][T29747] netlink: 'syz.2.6593': attribute type 1 has an invalid length. [ 954.443599][T29747] bond0: entered promiscuous mode [ 954.451111][T29747] 8021q: adding VLAN 0 to HW filter on device bond0 [ 954.464766][T29746] wg1 speed is unknown, defaulting to 1000 [ 954.472297][T29746] lo speed is unknown, defaulting to 1000 [ 954.590748][T29751] 8021q: adding VLAN 0 to HW filter on device bond0 [ 954.634483][T29751] bond0: (slave vcan1): The slave device specified does not support setting the MAC address [ 954.689820][T29751] bond0: (slave vcan1): Setting fail_over_mac to active for active-backup mode [ 954.748734][T29751] bond0: (slave vcan1): making interface the new active one [ 954.775273][T29751] vcan1: entered promiscuous mode [ 954.778999][ C1] vcan0: j1939_tp_rxtimer: 0xffff888029721000: abort rx timeout. Force session deactivation [ 954.796406][T29751] bond0: (slave vcan1): Enslaving as an active interface with an up link [ 954.961145][T29779] netlink: 24 bytes leftover after parsing attributes in process `syz.0.6601'. [ 955.018234][T29781] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6600'. [ 955.044086][T29779] FAULT_INJECTION: forcing a failure. [ 955.044086][T29779] name failslab, interval 1, probability 0, space 0, times 0 [ 955.082986][T29781] netlink: 24 bytes leftover after parsing attributes in process `syz.1.6600'. [ 955.093538][T29779] CPU: 1 UID: 0 PID: 29779 Comm: syz.0.6601 Not tainted syzkaller #0 PREEMPT(full) [ 955.093562][T29779] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/27/2026 [ 955.093574][T29779] Call Trace: [ 955.093582][T29779] [ 955.093589][T29779] dump_stack_lvl+0xe8/0x150 [ 955.093622][T29779] should_fail_ex+0x412/0x560 [ 955.093650][T29779] should_failslab+0xa8/0x100 [ 955.093675][T29779] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 955.093696][T29779] ? __alloc_skb+0x1d0/0x7d0 [ 955.093719][T29779] ? __local_bh_enable_ip+0xd0/0x130 [ 955.093747][T29779] __alloc_skb+0x1d0/0x7d0 [ 955.093775][T29779] rtmsg_ifa+0xf8/0x1f0 [ 955.093919][T29779] __inet_del_ifa+0x289/0xfe0 [ 955.093953][T29779] inet_rtm_deladdr+0x68d/0x790 [ 955.093998][T29779] ? __pfx_inet_rtm_deladdr+0x10/0x10 [ 955.094036][T29779] ? __pfx_inet_rtm_deladdr+0x10/0x10 [ 955.094066][T29779] rtnetlink_rcv_msg+0x7d5/0xbe0 [ 955.094100][T29779] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 955.094127][T29779] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 955.094158][T29779] ? __lock_acquire+0x6b5/0x2cf0 [ 955.094195][T29779] netlink_rcv_skb+0x232/0x4b0 [ 955.094217][T29779] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 955.094244][T29779] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 955.094274][T29779] ? netlink_deliver_tap+0x2e/0x1b0 [ 955.094307][T29779] netlink_unicast+0x80f/0x9b0 [ 955.094343][T29779] ? __pfx_netlink_unicast+0x10/0x10 [ 955.094364][T29779] ? netlink_sendmsg+0x650/0xb40 [ 955.094386][T29779] ? skb_put+0x11b/0x210 [ 955.094414][T29779] netlink_sendmsg+0x813/0xb40 [ 955.094445][T29779] ? __pfx_netlink_sendmsg+0x10/0x10 [ 955.094471][T29779] ? aa_sock_msg_perm+0xf1/0x1b0 [ 955.094496][T29779] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 955.094521][T29779] ____sys_sendmsg+0x972/0x9f0 [ 955.094546][T29779] ? __pfx_____sys_sendmsg+0x10/0x10 [ 955.094567][T29779] ? import_iovec+0x73/0xa0 [ 955.094610][T29779] ___sys_sendmsg+0x2a5/0x360 [ 955.094635][T29779] ? __pfx____sys_sendmsg+0x10/0x10 [ 955.094682][T29779] ? __fget_files+0x2a/0x420 [ 955.094706][T29779] ? __fget_files+0x3a0/0x420 [ 955.094740][T29779] __x64_sys_sendmsg+0x1bd/0x2a0 [ 955.094760][T29779] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 955.094788][T29779] ? __pfx_ksys_write+0x10/0x10 [ 955.094818][T29779] do_syscall_64+0x14d/0xf80 [ 955.094837][T29779] ? trace_irq_disable+0x3b/0x150 [ 955.094861][T29779] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 955.094881][T29779] ? clear_bhb_loop+0x40/0x90 [ 955.094904][T29779] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 955.094922][T29779] RIP: 0033:0x7fe20d19c799 [ 955.094939][T29779] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 955.094955][T29779] RSP: 002b:00007fe20b3f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 955.094975][T29779] RAX: ffffffffffffffda RBX: 00007fe20d415fa0 RCX: 00007fe20d19c799 [ 955.094989][T29779] RDX: 0000000000000000 RSI: 0000200000000100 RDI: 0000000000000004 [ 955.095000][T29779] RBP: 00007fe20b3f6090 R08: 0000000000000000 R09: 0000000000000000 [ 955.095013][T29779] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 955.095024][T29779] R13: 00007fe20d416038 R14: 00007fe20d415fa0 R15: 00007ffd9bdb85e8 [ 955.095060][T29779] [ 955.598246][T29790] syzkaller0: entered promiscuous mode [ 955.622533][T29790] syzkaller0: entered allmulticast mode [ 955.795679][T29802] tipc: Started in network mode [ 955.812397][T29802] tipc: Node identity 1e12fa6c834, cluster identity 4711 [ 955.831011][T29802] tipc: Enabled bearer , priority 0 [ 955.907249][T29806] wg1 speed is unknown, defaulting to 1000 [ 955.915576][T29806] lo speed is unknown, defaulting to 1000 [ 955.950792][T29802] tipc: Disabling bearer [ 956.010916][T29819] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6610'. [ 956.044227][T29819] netlink: 'syz.4.6610': attribute type 5 has an invalid length. [ 956.053888][T29819] netlink: 20 bytes leftover after parsing attributes in process `syz.4.6610'. [ 956.088090][T29819] geneve2: entered promiscuous mode [ 956.094320][T29819] geneve2: entered allmulticast mode [ 956.103962][T29816] netlink: 14 bytes leftover after parsing attributes in process `syz.1.6609'. [ 956.128936][T19242] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 256 - 0 [ 956.133869][T29824] netlink: 'syz.3.6611': attribute type 13 has an invalid length. [ 956.148233][T19242] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 256 - 0 [ 956.166295][T29824] netlink: 'syz.3.6611': attribute type 17 has an invalid length. [ 956.253644][T29816] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 956.267922][T29816] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 956.297058][T29833] netlink: 24 bytes leftover after parsing attributes in process `syz.4.6613'. [ 956.308815][T29816] bond0 (unregistering): Released all slaves [ 956.344460][T19242] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 256 - 0 [ 956.354320][T19242] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 256 - 0 [ 956.398977][T29824] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 956.446344][T19242] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 20000 - 0 [ 956.457540][T19242] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 20000 - 0 [ 956.477634][T19242] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 20000 - 0 [ 956.501767][T19242] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 20000 - 0 [ 956.549031][T29828] wg1 speed is unknown, defaulting to 1000 [ 956.597422][T29839] x_tables: ip6_tables: sctp match: only valid for protocol 132 [ 956.606368][T29828] lo speed is unknown, defaulting to 1000 [ 956.666390][T29841] netlink: 'syz.4.6614': attribute type 1 has an invalid length. [ 956.744537][T29841] bond4: entered promiscuous mode [ 956.751338][T29841] 8021q: adding VLAN 0 to HW filter on device bond4 [ 956.814973][T29849] netlink: 28 bytes leftover after parsing attributes in process `syz.3.6616'. [ 956.872284][T29847] 8021q: adding VLAN 0 to HW filter on device bond4 [ 956.879746][T29847] bond4: (slave vcan2): The slave device specified does not support setting the MAC address [ 956.920597][T29847] bond4: (slave vcan2): Setting fail_over_mac to active for active-backup mode [ 956.978783][T29847] bond4: (slave vcan2): making interface the new active one [ 957.004484][T29861] openvswitch: netlink: Invalid VLAN frame [ 957.016514][T29847] vcan2: entered promiscuous mode [ 957.051661][T29847] bond4: (slave vcan2): Enslaving as an active interface with an up link [ 957.121324][T15830] block nbd1: Receive control failed (result -32) [ 957.385345][T29872] wg1 speed is unknown, defaulting to 1000 [ 957.449337][T29883] wg1 speed is unknown, defaulting to 1000 [ 957.476497][T29872] lo speed is unknown, defaulting to 1000 [ 957.634251][T29883] lo speed is unknown, defaulting to 1000 [ 957.845235][T29905] netlink: 'syz.4.6630': attribute type 10 has an invalid length. [ 957.872232][T29905] team0: Port device netdevsim0 added [ 957.888285][T29907] netlink: 'syz.4.6630': attribute type 10 has an invalid length. [ 957.926588][T29910] netlink: 'syz.0.6631': attribute type 1 has an invalid length. [ 957.999012][T29910] bond0: entered promiscuous mode [ 958.005770][T29910] bond0: entered allmulticast mode [ 958.012597][T29910] 8021q: adding VLAN 0 to HW filter on device bond0 [ 958.078423][T29914] macvlan2: entered promiscuous mode [ 958.084680][T29914] macvlan2: entered allmulticast mode [ 958.094616][T29914] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 958.501576][T29935] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 958.550985][T29935] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 958.646850][T29940] wg1 speed is unknown, defaulting to 1000 [ 958.665808][T29940] lo speed is unknown, defaulting to 1000 [ 958.666915][T29942] wg1 speed is unknown, defaulting to 1000 [ 958.721898][T29946] wg1 speed is unknown, defaulting to 1000 [ 958.721903][T29942] lo speed is unknown, defaulting to 1000 [ 958.774065][T29946] lo speed is unknown, defaulting to 1000 [ 958.966843][T29928] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 958.975222][T29928] Bluetooth: hci4: Error when powering off device on rfkill (-4) [ 959.059769][T29928] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 959.084001][T29928] Bluetooth: hci1: Error when powering off device on rfkill (-4) [ 959.298812][T29928] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 959.334770][T29928] Bluetooth: hci5: Error when powering off device on rfkill (-4) [ 959.518070][T29981] netlink: 36 bytes leftover after parsing attributes in process `syz.1.6649'. [ 959.794055][T29998] netdevsim netdevsim4 netdevsim0: entered promiscuous mode [ 959.840371][T29998] netdevsim netdevsim4 netdevsim0: entered allmulticast mode [ 960.011080][T30004] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6651'. [ 960.111499][T30007] netdevsim netdevsim1 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 960.160960][T30007] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 960.253589][T30017] netlink: 28 bytes leftover after parsing attributes in process `syz.4.6656'. [ 960.306890][T30007] netdevsim netdevsim1 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 960.347585][T30007] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 960.475134][T30013] wg1 speed is unknown, defaulting to 1000 [ 960.488821][T30024] netlink: 'syz.4.6659': attribute type 2 has an invalid length. [ 960.508687][T30013] lo speed is unknown, defaulting to 1000 [ 960.516680][T29993] wg1 speed is unknown, defaulting to 1000 [ 960.530664][T30024] !9: entered promiscuous mode [ 960.547373][T30028] netlink: 'syz.4.6659': attribute type 2 has an invalid length. [ 960.568608][T29993] lo speed is unknown, defaulting to 1000 [ 960.581114][T30007] netdevsim netdevsim1 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 960.610923][T30007] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 960.650830][T30028] !9: left promiscuous mode [ 960.827993][T30033] syzkaller0: entered promiscuous mode [ 960.842749][T30033] syzkaller0: entered allmulticast mode [ 960.863824][T30007] netdevsim netdevsim1 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 960.876771][T30007] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 961.147175][T30054] netlink: 36 bytes leftover after parsing attributes in process `syz.4.6663'. [ 964.226225][T15210] netdevsim netdevsim1 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 964.235430][T15210] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 964.312221][T15210] netdevsim netdevsim1 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 964.342412][T15210] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 964.387566][T19240] netdevsim netdevsim1 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 964.396132][T19240] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 964.406874][T30094] netlink: 24 bytes leftover after parsing attributes in process `syz.0.6671'. [ 964.481207][T19238] netdevsim netdevsim1 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 964.489512][T19238] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 964.619207][T30098] sock: sock_set_timeout: `syz.0.6672' (pid 30098) tries to set negative timeout [ 964.652764][T30102] dvmrp0: entered allmulticast mode [ 964.661071][T30098] syzkaller0: entered promiscuous mode [ 964.667018][T30098] syzkaller0: entered allmulticast mode [ 964.814169][T30110] netlink: 192 bytes leftover after parsing attributes in process `syz.1.6675'. [ 965.097177][T30117] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6677'. [ 965.123048][T30117] netlink: 'syz.0.6677': attribute type 26 has an invalid length. [ 965.156625][T30117] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6677'. [ 965.212934][T30123] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6678'. [ 965.216578][T30124] veth1_to_hsr: entered promiscuous mode [ 965.227828][T30124] veth1_to_hsr: entered allmulticast mode [ 965.384896][T30128] netlink: 'syz.0.6680': attribute type 1 has an invalid length. [ 965.647665][T30139] netdevsim netdevsim1 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 965.670240][T30139] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 965.729448][T30143] syzkaller0: entered promiscuous mode [ 965.756244][T30143] syzkaller0: entered allmulticast mode [ 965.778404][T30139] netdevsim netdevsim1 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 965.814438][T30139] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 965.938143][T30148] wg1 speed is unknown, defaulting to 1000 [ 965.959462][T30139] netdevsim netdevsim1 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 965.979654][T30139] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 965.996882][T30148] lo speed is unknown, defaulting to 1000 [ 966.072161][T30139] netdevsim netdevsim1 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 966.082345][T30139] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 966.198185][T30170] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6691'. [ 966.206718][T30168] wg1 speed is unknown, defaulting to 1000 [ 966.249625][T30168] lo speed is unknown, defaulting to 1000 [ 966.287738][T30171] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6690'. [ 966.407522][T30187] openvswitch: netlink: Missing key (keys=40, expected=2000) [ 966.414466][T30189] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6693'. [ 966.426453][T30189] netlink: 580 bytes leftover after parsing attributes in process `syz.0.6693'. [ 966.614227][T30200] netlink: 'syz.4.6697': attribute type 11 has an invalid length. [ 966.729569][T30212] netlink: 52 bytes leftover after parsing attributes in process `syz.4.6701'. [ 966.747897][T30212] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6701'. [ 966.759120][T30212] openvswitch: netlink: ufid size 20 bytes exceeds the range (1, 16) [ 966.914356][T30207] wg1 speed is unknown, defaulting to 1000 [ 966.923260][T30207] lo speed is unknown, defaulting to 1000 [ 967.014810][T30216] wg1 speed is unknown, defaulting to 1000 [ 967.067589][T30216] lo speed is unknown, defaulting to 1000 [ 967.081737][T30228] netlink: 'syz.2.6703': attribute type 13 has an invalid length. [ 967.573543][T30237] : renamed from team_slave_1 [ 967.744922][T30247] IPVS: set_ctl: invalid protocol: 0 10.65.1.0:20001 [ 967.781290][T30243] wg1 speed is unknown, defaulting to 1000 [ 967.847528][T30243] lo speed is unknown, defaulting to 1000 [ 968.234950][T30273] netlink: 'syz.4.6718': attribute type 21 has an invalid length. [ 968.254367][T30273] netlink: 'syz.4.6718': attribute type 1 has an invalid length. [ 968.286584][T19240] netdevsim netdevsim1 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 968.296347][T19240] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 968.338698][T19240] netdevsim netdevsim1 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 968.347767][T19240] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 968.351756][T30274] xt_CT: No such helper "netbios-ns" [ 968.428182][T30273] syzkaller0: entered promiscuous mode [ 968.436207][T30273] syzkaller0: entered allmulticast mode [ 968.473768][T30273] tipc: Started in network mode [ 968.483095][T30273] tipc: Node identity 2ea525375adf, cluster identity 4711 [ 968.501108][T30273] tipc: Enabled bearer , priority 0 [ 968.523616][T30271] tipc: Resetting bearer [ 968.562410][T30271] tipc: Disabling bearer [ 968.575911][ T6862] netdevsim netdevsim1 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 968.589846][ T6862] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 968.684301][T30288] wg1 speed is unknown, defaulting to 1000 [ 968.703241][ T49] netdevsim netdevsim1 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 968.722488][ T49] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 968.776108][T30288] lo speed is unknown, defaulting to 1000 [ 968.799648][T30283] wg1 speed is unknown, defaulting to 1000 [ 968.838382][T30283] lo speed is unknown, defaulting to 1000 [ 969.149302][T30305] wg1 speed is unknown, defaulting to 1000 [ 969.298186][T30305] lo speed is unknown, defaulting to 1000 [ 969.825538][T30336] __nla_validate_parse: 72 callbacks suppressed [ 969.825557][T30336] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6737'. [ 969.850734][T30336] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6737'. [ 969.888631][T30336] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6737'. [ 969.935041][T30336] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6737'. [ 969.947467][T30336] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6737'. [ 970.041101][T30336] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6737'. [ 970.057973][T30336] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6737'. [ 970.114813][T30336] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6737'. [ 970.124846][T30336] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6737'. [ 970.194871][T30336] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6737'. [ 970.248302][T30356] netlink: 'syz.4.6744': attribute type 14 has an invalid length. [ 970.321467][T30368] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 970.349313][T30377] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 970.358384][T30377] IPv6: NLM_F_CREATE should be set when creating new route [ 970.365975][T30377] IPv6: NLM_F_CREATE should be set when creating new route [ 970.491150][T30371] rdma_rxe: rxe_newlink: failed to add bond0 [ 970.795143][T30397] wg1 speed is unknown, defaulting to 1000 [ 970.838206][T30397] lo speed is unknown, defaulting to 1000 [ 971.003461][T30417] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable [ 971.016817][T30412] netlink: 'syz.0.6763': attribute type 4 has an invalid length. [ 971.377330][T30417] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 971.471569][T30421] wg1 speed is unknown, defaulting to 1000 [ 971.479480][T30421] lo speed is unknown, defaulting to 1000 [ 971.678400][T30431] netlink: 'syz.0.6768': attribute type 4 has an invalid length. [ 971.706957][T30432] netlink: 'syz.0.6768': attribute type 4 has an invalid length. [ 971.762717][ T7689] lo speed is unknown, defaulting to 1000 [ 971.768880][ T7689] syz2: Port: 1 Link ACTIVE [ 971.816869][ T7689] lo speed is unknown, defaulting to 1000 [ 971.830334][ T7689] syz2: Port: 1 Link DOWN [ 972.124880][T30452] netlink: 'syz.2.6774': attribute type 13 has an invalid length. [ 972.153464][T30452] netlink: 'syz.2.6774': attribute type 17 has an invalid length. [ 972.286312][T30452] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 972.343425][T30462] wg1 speed is unknown, defaulting to 1000 [ 972.352746][T30462] lo speed is unknown, defaulting to 1000 [ 972.435757][T30465] syzkaller0: entered promiscuous mode [ 972.441407][T30465] syzkaller0: entered allmulticast mode [ 972.509337][T27444] IPVS: starting estimator thread 0... [ 972.629305][T30471] IPVS: using max 32 ests per chain, 76800 per kthread [ 975.080534][T30480] netlink: 'syz.3.6782': attribute type 1 has an invalid length. [ 975.090518][T30480] netlink: 'syz.3.6782': attribute type 2 has an invalid length. [ 975.098271][T30480] netlink: 'syz.3.6782': attribute type 3 has an invalid length. [ 975.406125][T30499] __nla_validate_parse: 65 callbacks suppressed [ 975.406146][T30499] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6786'. [ 975.442206][T30499] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6786'. [ 975.462864][T30499] nbd: socks must be embedded in a SOCK_ITEM attr [ 975.616931][T30502] delete_channel: no stack [ 975.763027][T30525] netlink: 48 bytes leftover after parsing attributes in process `syz.3.6796'. [ 975.803989][T30518] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 975.849143][T30534] netlink: 'syz.3.6796': attribute type 2 has an invalid length. [ 975.859348][T30534] netlink: 36 bytes leftover after parsing attributes in process `syz.3.6796'. [ 975.902630][T30529] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6791'. [ 976.017589][T30533] wg1 speed is unknown, defaulting to 1000 [ 976.037117][T30533] lo speed is unknown, defaulting to 1000 [ 976.052174][T30542] syz.2.6799: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 976.080914][T30542] CPU: 0 UID: 0 PID: 30542 Comm: syz.2.6799 Not tainted syzkaller #0 PREEMPT(full) [ 976.080942][T30542] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/27/2026 [ 976.080954][T30542] Call Trace: [ 976.080962][T30542] [ 976.080972][T30542] dump_stack_lvl+0xe8/0x150 [ 976.081003][T30542] warn_alloc+0x249/0x340 [ 976.081027][T30542] ? stack_trace_save+0xa9/0x100 [ 976.081051][T30542] ? __pfx_warn_alloc+0x10/0x10 [ 976.081082][T30542] ? kasan_save_track+0x4f/0x80 [ 976.081104][T30542] ? kasan_save_track+0x3e/0x80 [ 976.081123][T30542] ? __kasan_kmalloc+0x93/0xb0 [ 976.081141][T30542] ? __kmalloc_cache_noprof+0x31c/0x660 [ 976.081157][T30542] ? xskq_create+0x56/0x170 [ 976.081184][T30542] ? xsk_setsockopt+0x54c/0x990 [ 976.081204][T30542] ? do_sock_setsockopt+0x17c/0x1b0 [ 976.081232][T30542] ? __x64_sys_setsockopt+0x13d/0x1b0 [ 976.081260][T30542] ? do_syscall_64+0x14d/0xf80 [ 976.081282][T30542] __vmalloc_node_range_noprof+0x132/0x1730 [ 976.081335][T30542] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 976.081364][T30542] ? __kasan_kmalloc+0x93/0xb0 [ 976.081393][T30542] vmalloc_user_noprof+0xad/0xe0 [ 976.081414][T30542] ? xskq_create+0xbf/0x170 [ 976.081462][T30542] xskq_create+0xbf/0x170 [ 976.081492][T30542] xsk_init_queue+0x8a/0xe0 [ 976.081521][T30542] xsk_setsockopt+0x54c/0x990 [ 976.081551][T30542] ? __pfx_xsk_setsockopt+0x10/0x10 [ 976.081579][T30542] ? __pfx_aa_sk_perm+0x10/0x10 [ 976.081608][T30542] ? aa_sock_opt_perm+0xff/0x1a0 [ 976.081637][T30542] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 976.081659][T30542] ? __pfx_xsk_setsockopt+0x10/0x10 [ 976.081687][T30542] do_sock_setsockopt+0x17c/0x1b0 [ 976.081720][T30542] __x64_sys_setsockopt+0x13d/0x1b0 [ 976.081750][T30542] do_syscall_64+0x14d/0xf80 [ 976.081767][T30542] ? trace_irq_disable+0x3b/0x150 [ 976.081791][T30542] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 976.081809][T30542] ? clear_bhb_loop+0x40/0x90 [ 976.081833][T30542] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 976.081854][T30542] RIP: 0033:0x7fb142d9c799 [ 976.081874][T30542] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 976.081893][T30542] RSP: 002b:00007fb140ff6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 976.081915][T30542] RAX: ffffffffffffffda RBX: 00007fb143015fa0 RCX: 00007fb142d9c799 [ 976.081929][T30542] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000003 [ 976.081943][T30542] RBP: 00007fb142e32c99 R08: 0000000000000004 R09: 0000000000000000 [ 976.081956][T30542] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 976.081969][T30542] R13: 00007fb143016038 R14: 00007fb143015fa0 R15: 00007ffe3064a1d8 [ 976.082002][T30542] [ 976.082010][T30542] Mem-Info: [ 976.505274][T30551] wg1 speed is unknown, defaulting to 1000 [ 976.515722][T30542] active_anon:5766 inactive_anon:0 isolated_anon:0 [ 976.515722][T30542] active_file:3453 inactive_file:40399 isolated_file:0 [ 976.515722][T30542] unevictable:768 dirty:138 writeback:0 [ 976.515722][T30542] slab_reclaimable:13637 slab_unreclaimable:195751 [ 976.515722][T30542] mapped:30633 shmem:1420 pagetables:1622 [ 976.515722][T30542] sec_pagetables:0 bounce:0 [ 976.515722][T30542] kernel_misc_reclaimable:0 [ 976.515722][T30542] free:1208841 free_pcp:22265 free_cma:0 [ 976.552383][T30551] lo speed is unknown, defaulting to 1000 [ 976.568624][T30542] Node 0 active_anon:22864kB inactive_anon:0kB active_file:13812kB inactive_file:161388kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:77572kB dirty:548kB writeback:0kB shmem:4144kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:15448kB pagetables:6308kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 976.604520][T30542] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:208kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:44960kB dirty:4kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:32kB pagetables:180kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 976.667792][T30542] Node 0 DMA free:11244kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:20kB local_pcp:12kB free_cma:0kB [ 976.702196][T30542] lowmem_reserve[]: 0 2492 2493 2493 2493 [ 976.708276][T30542] Node 0 DMA32 free:1112672kB boost:0kB min:34200kB low:42748kB high:51296kB reserved_highatomic:0KB free_highatomic:0KB active_anon:22464kB inactive_anon:0kB active_file:13812kB inactive_file:161388kB unevictable:1536kB writepending:548kB zspages:0kB present:3129332kB managed:2552728kB mlocked:0kB bounce:0kB free_pcp:31700kB local_pcp:12984kB free_cma:0kB [ 976.795342][T30564] ipt_ECN: cannot use operation on non-tcp rule [ 976.806182][T30542] lowmem_reserve[]: 0 0 0 0 0 [ 976.878330][T30542] Node 0 Normal free:0kB boost:0kB min:8kB low:8kB high:8kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:884kB mlocked:0kB bounce:0kB free_pcp:4kB local_pcp:0kB free_cma:0kB [ 976.990905][T30566] netlink: 56 bytes leftover after parsing attributes in process `syz.2.6799'. [ 977.060668][T30542] lowmem_reserve[]: 0 0 0 0 0 [ 977.095901][T30542] Node 1 Normal free:3711848kB boost:0kB min:55688kB low:69608kB high:83528kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:208kB unevictable:1536kB writepending:4kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:58380kB local_pcp:27920kB free_cma:0kB [ 977.152857][T30542] lowmem_reserve[]: 0 0 0 0 0 [ 977.166500][T30542] Node 0 DMA: 1*4kB (U) 1*8kB (U) 2*16kB (U) 2*32kB (U) 2*64kB (U) 2*128kB (U) 2*256kB (U) 2*512kB (U) 3*1024kB (U) 3*2048kB (UM) 0*4096kB = 11244kB [ 977.183373][T30542] Node 0 DMA32: 5776*4kB (UME) 6388*8kB (UME) 4179*16kB (UM) 1383*32kB (UME) 1052*64kB (UME) 920*128kB (UM) 347*256kB (UME) 501*512kB (UM) 246*1024kB (UME) 70*2048kB (UM) 0*4096kB = 1111024kB [ 977.207141][T30542] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 977.227773][T30542] Node 1 Normal: 6*4kB (UM) 9*8kB (UM) 21*16kB (UME) 11*32kB (UME) 17*64kB (UME) 9*128kB (UME) 12*256kB (UME) 10*512kB (UME) 8*1024kB (UM) 9*2048kB (UE) 897*4096kB (UM) = 3711952kB [ 977.247791][T30542] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 977.282677][T30542] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 977.340825][T30542] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 977.362148][T30542] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 977.388436][T30542] 45219 total pagecache pages [ 977.401009][T30542] 1 pages in swap cache [ 977.417449][T30542] Free swap = 124992kB [ 977.427418][T30542] Total swap = 124996kB [ 977.451824][T30542] 2097051 pages RAM [ 977.456102][T30542] 0 pages HighMem/MovableOnly [ 977.462106][T30542] 427033 pages reserved [ 977.466840][T30542] 0 pages cma reserved [ 977.789567][T30601] netlink: 'syz.0.6811': attribute type 13 has an invalid length. [ 977.798010][T30601] netlink: 'syz.0.6811': attribute type 17 has an invalid length. [ 977.917853][T30601] 8021q: adding VLAN 0 to HW filter on device team0 [ 977.947907][T30601] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 977.983078][T27454] lo speed is unknown, defaulting to 1000 [ 977.989928][T27454] syz2: Port: 1 Link ACTIVE [ 978.062994][T30603] wg1 speed is unknown, defaulting to 1000 [ 978.094558][T30603] lo speed is unknown, defaulting to 1000 [ 978.486425][T30630] netlink: 64 bytes leftover after parsing attributes in process `syz.2.6819'. [ 978.518169][T30632] x_tables: ip6_tables: mh match: only valid for protocol 135 [ 978.601065][T30630] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6819'. [ 978.677229][T30642] netlink: 'syz.3.6821': attribute type 1 has an invalid length. [ 978.813458][T30642] 8021q: adding VLAN 0 to HW filter on device bond2 [ 978.954846][T30663] netlink: 'syz.2.6824': attribute type 13 has an invalid length. [ 978.969574][T30663] netlink: 'syz.2.6824': attribute type 17 has an invalid length. [ 979.066113][T30647] bond2: (slave dummy0): making interface the new active one [ 979.076056][T30647] bond2: (slave dummy0): Enslaving as an active interface with an up link [ 979.142824][T30663] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 979.224813][T30672] wg1 speed is unknown, defaulting to 1000 [ 979.262188][T30672] lo speed is unknown, defaulting to 1000 [ 979.263192][T30674] syzkaller1: entered promiscuous mode [ 979.274515][T30674] syzkaller1: entered allmulticast mode [ 979.650984][T30708] netlink: 'syz.1.6836': attribute type 10 has an invalid length. [ 979.659033][T30708] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 979.699004][T30712] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6839'. [ 979.788272][T30719] netlink: 140 bytes leftover after parsing attributes in process `syz.3.6841'. [ 979.805285][T30714] bond4 (unregistering): Released all slaves [ 979.902227][T30712] bond4: entered promiscuous mode [ 979.917646][T30712] 8021q: adding VLAN 0 to HW filter on device bond4 [ 979.953940][T30704] wg1 speed is unknown, defaulting to 1000 [ 979.986764][T30704] lo speed is unknown, defaulting to 1000 [ 980.040596][T30731] FAULT_INJECTION: forcing a failure. [ 980.040596][T30731] name failslab, interval 1, probability 0, space 0, times 0 [ 980.081057][T30731] CPU: 0 UID: 0 PID: 30731 Comm: syz.0.6844 Not tainted syzkaller #0 PREEMPT(full) [ 980.081083][T30731] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/27/2026 [ 980.081094][T30731] Call Trace: [ 980.081102][T30731] [ 980.081110][T30731] dump_stack_lvl+0xe8/0x150 [ 980.081153][T30731] should_fail_ex+0x412/0x560 [ 980.081185][T30731] should_failslab+0xa8/0x100 [ 980.081208][T30731] ? skb_clone+0x212/0x3a0 [ 980.081227][T30731] kmem_cache_alloc_noprof+0x87/0x650 [ 980.081245][T30731] ? __netlink_lookup+0xc6/0x8b0 [ 980.081277][T30731] skb_clone+0x212/0x3a0 [ 980.081298][T30731] __netlink_deliver_tap+0x404/0x850 [ 980.081331][T30731] ? netlink_deliver_tap+0x2e/0x1b0 [ 980.081366][T30731] netlink_deliver_tap+0x19c/0x1b0 [ 980.081391][T30731] netlink_unicast+0x7e3/0x9b0 [ 980.081420][T30731] ? __pfx_netlink_unicast+0x10/0x10 [ 980.081443][T30731] ? netlink_sendmsg+0x650/0xb40 [ 980.081464][T30731] ? skb_put+0x11b/0x210 [ 980.081487][T30731] netlink_sendmsg+0x813/0xb40 [ 980.081516][T30731] ? __pfx_netlink_sendmsg+0x10/0x10 [ 980.081542][T30731] ? aa_sock_msg_perm+0xf1/0x1b0 [ 980.081567][T30731] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 980.081592][T30731] ____sys_sendmsg+0x972/0x9f0 [ 980.081617][T30731] ? __pfx_____sys_sendmsg+0x10/0x10 [ 980.081643][T30731] ? import_iovec+0x73/0xa0 [ 980.081673][T30731] ___sys_sendmsg+0x2a5/0x360 [ 980.081696][T30731] ? __pfx____sys_sendmsg+0x10/0x10 [ 980.081747][T30731] ? __fget_files+0x2a/0x420 [ 980.081771][T30731] ? __fget_files+0x3a0/0x420 [ 980.081805][T30731] __x64_sys_sendmsg+0x1bd/0x2a0 [ 980.081825][T30731] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 980.081852][T30731] ? __pfx_ksys_write+0x10/0x10 [ 980.081881][T30731] do_syscall_64+0x14d/0xf80 [ 980.081896][T30731] ? trace_irq_disable+0x3b/0x150 [ 980.081918][T30731] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 980.081935][T30731] ? clear_bhb_loop+0x40/0x90 [ 980.081955][T30731] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 980.081972][T30731] RIP: 0033:0x7fe20d19c799 [ 980.081990][T30731] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 980.082004][T30731] RSP: 002b:00007fe20b3f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 980.082023][T30731] RAX: ffffffffffffffda RBX: 00007fe20d415fa0 RCX: 00007fe20d19c799 [ 980.082034][T30731] RDX: 0000000000000000 RSI: 00002000000002c0 RDI: 0000000000000005 [ 980.082045][T30731] RBP: 00007fe20b3f6090 R08: 0000000000000000 R09: 0000000000000000 [ 980.082055][T30731] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 980.082065][T30731] R13: 00007fe20d416038 R14: 00007fe20d415fa0 R15: 00007ffd9bdb85e8 [ 980.082091][T30731] [ 980.848734][T30763] bond0: (slave veth0_to_hsr): Device is not bonding slave [ 980.858006][T30763] bond0: option active_slave: invalid value (veth0_to_hsr) [ 981.014587][T30776] __nla_validate_parse: 1 callbacks suppressed [ 981.014608][T30776] netlink: 36 bytes leftover after parsing attributes in process `syz.2.6859'. [ 981.224391][T30785] FAULT_INJECTION: forcing a failure. [ 981.224391][T30785] name failslab, interval 1, probability 0, space 0, times 0 [ 981.241371][T30785] CPU: 0 UID: 0 PID: 30785 Comm: syz.2.6861 Not tainted syzkaller #0 PREEMPT(full) [ 981.241398][T30785] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/27/2026 [ 981.241410][T30785] Call Trace: [ 981.241418][T30785] [ 981.241426][T30785] dump_stack_lvl+0xe8/0x150 [ 981.241457][T30785] should_fail_ex+0x412/0x560 [ 981.241484][T30785] should_failslab+0xa8/0x100 [ 981.241506][T30785] ? skb_clone+0x212/0x3a0 [ 981.241525][T30785] kmem_cache_alloc_noprof+0x87/0x650 [ 981.241543][T30785] ? apparmor_capable+0x126/0x170 [ 981.241574][T30785] skb_clone+0x212/0x3a0 [ 981.241590][T30785] ? nfnetlink_rcv+0x4b0/0x27b0 [ 981.241615][T30785] nfnetlink_rcv+0x4e2/0x27b0 [ 981.241646][T30785] ? lockdep_hardirqs_on+0x7a/0x110 [ 981.241672][T30785] ? __dev_queue_xmit+0x28d/0x38d0 [ 981.241688][T30785] ? __local_bh_enable_ip+0xd0/0x130 [ 981.241712][T30785] ? __dev_queue_xmit+0x1f56/0x38d0 [ 981.241745][T30785] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 981.241769][T30785] ? __dev_queue_xmit+0x28d/0x38d0 [ 981.241795][T30785] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 981.241831][T30785] ? ref_tracker_free+0x693/0x840 [ 981.241852][T30785] ? __copy_skb_header+0xa3/0x4a0 [ 981.241871][T30785] ? __pfx_ref_tracker_free+0x10/0x10 [ 981.241907][T30785] ? skb_clone+0x246/0x3a0 [ 981.241928][T30785] ? __netlink_deliver_tap+0x807/0x850 [ 981.241952][T30785] ? netlink_deliver_tap+0x2e/0x1b0 [ 981.241991][T30785] netlink_unicast+0x80f/0x9b0 [ 981.242017][T30785] ? __pfx_netlink_unicast+0x10/0x10 [ 981.242039][T30785] ? netlink_sendmsg+0x650/0xb40 [ 981.242059][T30785] ? skb_put+0x11b/0x210 [ 981.242085][T30785] netlink_sendmsg+0x813/0xb40 [ 981.242114][T30785] ? __pfx_netlink_sendmsg+0x10/0x10 [ 981.242140][T30785] ? aa_sock_msg_perm+0xf1/0x1b0 [ 981.242164][T30785] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 981.242195][T30785] ____sys_sendmsg+0x972/0x9f0 [ 981.242221][T30785] ? __pfx_____sys_sendmsg+0x10/0x10 [ 981.242246][T30785] ? import_iovec+0x73/0xa0 [ 981.242276][T30785] ___sys_sendmsg+0x2a5/0x360 [ 981.242300][T30785] ? __pfx____sys_sendmsg+0x10/0x10 [ 981.242350][T30785] ? __fget_files+0x2a/0x420 [ 981.242373][T30785] ? __fget_files+0x3a0/0x420 [ 981.242407][T30785] __x64_sys_sendmsg+0x1bd/0x2a0 [ 981.242427][T30785] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 981.242454][T30785] ? __pfx_ksys_write+0x10/0x10 [ 981.242485][T30785] do_syscall_64+0x14d/0xf80 [ 981.242501][T30785] ? trace_irq_disable+0x3b/0x150 [ 981.242525][T30785] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 981.242543][T30785] ? clear_bhb_loop+0x40/0x90 [ 981.242565][T30785] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 981.242583][T30785] RIP: 0033:0x7fb142d9c799 [ 981.242601][T30785] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 981.242616][T30785] RSP: 002b:00007fb140ff6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 981.242636][T30785] RAX: ffffffffffffffda RBX: 00007fb143015fa0 RCX: 00007fb142d9c799 [ 981.242649][T30785] RDX: 0000000000000000 RSI: 00002000000002c0 RDI: 0000000000000005 [ 981.242661][T30785] RBP: 00007fb140ff6090 R08: 0000000000000000 R09: 0000000000000000 [ 981.242672][T30785] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 981.242681][T30785] R13: 00007fb143016038 R14: 00007fb143015fa0 R15: 00007ffe3064a1d8 [ 981.242710][T30785] [ 982.022813][T30807] netlink: 16150 bytes leftover after parsing attributes in process `syz.2.6867'. [ 982.032322][T30795] wg1 speed is unknown, defaulting to 1000 [ 982.118296][T30795] lo speed is unknown, defaulting to 1000 [ 982.171628][T30804] netlink: 'syz.2.6867': attribute type 1 has an invalid length. [ 982.184418][T30804] netlink: 228 bytes leftover after parsing attributes in process `syz.2.6867'. [ 982.208260][T30814] wg1 speed is unknown, defaulting to 1000 [ 982.222622][T30814] lo speed is unknown, defaulting to 1000 [ 982.435619][T30826] netlink: 28 bytes leftover after parsing attributes in process `syz.3.6872'. [ 982.490286][T30826] netlink: 28 bytes leftover after parsing attributes in process `syz.3.6872'. [ 982.583300][T30823] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 982.747943][T30820] wg1 speed is unknown, defaulting to 1000 [ 982.823021][T30841] netlink: 24 bytes leftover after parsing attributes in process `syz.3.6876'. [ 982.874611][T30842] netlink: 120 bytes leftover after parsing attributes in process `syz.3.6876'. [ 982.890308][T30842] openvswitch: netlink: Flow key attr not present in new flow. [ 982.950312][T30820] lo speed is unknown, defaulting to 1000 [ 983.556410][T30883] netlink: 'syz.3.6887': attribute type 1 has an invalid length. [ 983.583042][T30879] netlink: 36 bytes leftover after parsing attributes in process `syz.1.6889'. [ 983.667890][T30883] bond3: entered promiscuous mode [ 983.674204][T30883] 8021q: adding VLAN 0 to HW filter on device bond3 [ 984.057736][T30911] macsec1: entered allmulticast mode [ 984.076494][T30911] veth1: entered allmulticast mode [ 984.086564][T30920] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6896'. [ 984.101680][T30911] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6894'. [ 984.124082][T30920] hsr_slave_1 (unregistering): left promiscuous mode [ 984.781748][T30954] wg1 speed is unknown, defaulting to 1000 [ 984.789311][T30954] lo speed is unknown, defaulting to 1000 [ 984.867902][T30965] netlink: 'syz.1.6911': attribute type 3 has an invalid length. [ 984.884969][T30965] netlink: 'syz.1.6911': attribute type 3 has an invalid length. [ 984.908212][T30958] wg1 speed is unknown, defaulting to 1000 [ 984.977204][T30958] lo speed is unknown, defaulting to 1000 [ 984.985271][T30978] netlink: 'syz.0.6913': attribute type 1 has an invalid length. [ 985.271779][T30978] bond5: entered promiscuous mode [ 985.305494][T30978] 8021q: adding VLAN 0 to HW filter on device bond5 [ 985.553138][T30983] 8021q: adding VLAN 0 to HW filter on device bond5 [ 985.571028][T30983] bond5: (slave vcan1): The slave device specified does not support setting the MAC address [ 985.590499][T30983] bond5: (slave vcan1): Setting fail_over_mac to active for active-backup mode [ 985.614048][T30983] bond5: (slave vcan1): making interface the new active one [ 985.621627][T30983] vcan1: entered promiscuous mode [ 985.628542][T30983] bond5: (slave vcan1): Enslaving as an active interface with an up link [ 986.086818][T31031] netlink: 'syz.0.6923': attribute type 13 has an invalid length. [ 986.095311][T31031] netlink: 'syz.0.6923': attribute type 17 has an invalid length. [ 986.137157][T31005] wg1 speed is unknown, defaulting to 1000 [ 986.267675][T31031] 8021q: adding VLAN 0 to HW filter on device team0 [ 986.282112][T31031] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 986.308937][T31030] team_slave_1: Caught tx_queue_len zero misconfig [ 986.321018][T31005] lo speed is unknown, defaulting to 1000 [ 986.327211][ T7689] lo speed is unknown, defaulting to 1000 [ 986.369615][T18689] lo speed is unknown, defaulting to 1000 [ 986.469350][T31036] xt_ecn: cannot match TCP bits for non-tcp packets [ 986.512619][T31038] __nla_validate_parse: 1 callbacks suppressed [ 986.512643][T31038] netlink: 212348 bytes leftover after parsing attributes in process `syz.1.6926'. [ 986.547185][T31038] netlink: ct family unspecified [ 986.701187][T31044] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6928'. [ 986.734876][T31047] "syz.1.6929" (31047) uses obsolete ecb(arc4) skcipher [ 986.837821][T31053] netlink: 36 bytes leftover after parsing attributes in process `syz.4.6930'. [ 986.934028][T31059] netlink: 'syz.2.6931': attribute type 1 has an invalid length. [ 987.015307][T31059] bond2: entered promiscuous mode [ 987.023124][T31059] 8021q: adding VLAN 0 to HW filter on device bond2 [ 987.080985][T31065] 8021q: adding VLAN 0 to HW filter on device bond2 [ 987.088400][T31065] bond2: (slave vcan2): The slave device specified does not support setting the MAC address [ 987.112739][T31065] bond2: (slave vcan2): Setting fail_over_mac to active for active-backup mode [ 987.129305][T31065] bond2: (slave vcan2): making interface the new active one [ 987.138256][T31065] vcan2: entered promiscuous mode [ 987.147514][T31065] bond2: (slave vcan2): Enslaving as an active interface with an up link [ 987.218473][T31075] netlink: 'syz.4.6935': attribute type 13 has an invalid length. [ 987.264844][T31075] netlink: 'syz.4.6935': attribute type 17 has an invalid length. [ 987.313126][T31071] batman_adv: batadv0: Interface deactivated: macsec1 [ 987.349691][T31082] netlink: 32 bytes leftover after parsing attributes in process `syz.0.6937'. [ 987.443631][T31075] 8021q: adding VLAN 0 to HW filter on device team0 [ 987.457899][T31075] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 987.488895][ T49] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 256 - 0 [ 987.513450][T31077] netlink: 'syz.3.6936': attribute type 4 has an invalid length. [ 987.555313][ T49] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 256 - 0 [ 987.635101][ T49] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 256 - 0 [ 987.659190][ T49] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 256 - 0 [ 987.726097][T31093] 8021q: adding VLAN 0 to HW filter on device bond4 [ 987.887748][T31106] bond4: (slave veth9): Enslaving as an active interface with a down link [ 987.935171][T31116] netlink: 40 bytes leftover after parsing attributes in process `syz.2.6943'. [ 987.958927][T31116] netlink: 40 bytes leftover after parsing attributes in process `syz.2.6943'. [ 987.994736][T31093] bond4: (slave veth11): Enslaving as an active interface with a down link [ 988.124188][T31126] wg1 speed is unknown, defaulting to 1000 [ 988.162913][T31126] lo speed is unknown, defaulting to 1000 [ 988.443690][T31150] netlink: 20 bytes leftover after parsing attributes in process `syz.4.6952'. [ 988.465297][T31150] bond5: (slave bridge3): making interface the new active one [ 988.483802][T31150] bond5: (slave bridge3): Enslaving as an active interface with an up link [ 988.530931][T31153] 8021q: adding VLAN 0 to HW filter on device bond3 [ 988.558430][T31160] bond3: (slave dummy0): making interface the new active one [ 988.567620][T31160] bond3: (slave dummy0): Enslaving as an active interface with an up link [ 988.677903][T31152] bond6: entered promiscuous mode [ 988.684268][T31152] 8021q: adding VLAN 0 to HW filter on device bond6 [ 988.711367][T31170] 8021q: adding VLAN 0 to HW filter on device bond6 [ 988.718873][T31170] bond6: (slave vcan2): The slave device specified does not support setting the MAC address [ 988.769916][T31170] bond6: (slave vcan2): Setting fail_over_mac to active for active-backup mode [ 988.862747][T31170] bond6: (slave vcan2): making interface the new active one [ 988.894047][T31170] vcan2: entered promiscuous mode [ 988.909501][T31170] bond6: (slave vcan2): Enslaving as an active interface with an up link [ 988.968861][T31187] : renamed from bond_slave_0 [ 989.142165][T31173] wg1 speed is unknown, defaulting to 1000 [ 989.166398][T31173] lo speed is unknown, defaulting to 1000 [ 989.367457][T31208] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6965'. [ 989.403886][T31208] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6965'. [ 989.442497][T31212] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6964'. [ 989.514126][T31219] validate_nla: 7 callbacks suppressed [ 989.514146][T31219] netlink: 'syz.0.6967': attribute type 13 has an invalid length. [ 989.540960][T31219] netlink: 'syz.0.6967': attribute type 17 has an invalid length. [ 989.652100][T31208] bond4: option xmit_hash_policy: invalid value (10) [ 989.660776][T31208] bond4 (unregistering): Released all slaves [ 989.743137][T31219] 8021q: adding VLAN 0 to HW filter on device team0 [ 989.774218][T31219] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 989.842461][T18686] lo speed is unknown, defaulting to 1000 [ 989.855044][ T7689] lo speed is unknown, defaulting to 1000 [ 990.529255][T31251] wg1 speed is unknown, defaulting to 1000 [ 990.537533][T31251] lo speed is unknown, defaulting to 1000 [ 990.578404][T31264] netlink: 'syz.1.6977': attribute type 1 has an invalid length. [ 990.704603][T31264] bond2: entered promiscuous mode [ 990.711462][T31264] 8021q: adding VLAN 0 to HW filter on device bond2 [ 990.735277][T31267] 8021q: adding VLAN 0 to HW filter on device bond2 [ 990.743984][T31267] bond2: (slave vcan1): The slave device specified does not support setting the MAC address [ 990.754806][T31267] bond2: (slave vcan1): Setting fail_over_mac to active for active-backup mode [ 990.769061][T31267] bond2: (slave vcan1): making interface the new active one [ 990.777058][T31267] vcan1: entered promiscuous mode [ 990.784917][T31267] bond2: (slave vcan1): Enslaving as an active interface with an up link [ 991.610767][T31307] wg1 speed is unknown, defaulting to 1000 [ 991.625371][T31307] lo speed is unknown, defaulting to 1000 [ 991.987946][T31343] openvswitch: netlink: Flow key attribute not present in set flow. [ 992.380040][T31363] __nla_validate_parse: 3 callbacks suppressed [ 992.380117][T31363] netlink: 116 bytes leftover after parsing attributes in process `syz.2.6998'. [ 992.428772][T31368] xt_TPROXY: Can be used only with -p tcp or -p udp [ 992.502020][T31374] netlink: 'syz.3.7000': attribute type 1 has an invalid length. [ 992.551561][T31374] bond5: entered promiscuous mode [ 992.558197][T31374] 8021q: adding VLAN 0 to HW filter on device bond5 [ 992.607895][T31374] 8021q: adding VLAN 0 to HW filter on device bond5 [ 992.650679][T31374] bond5: (slave vcan3): The slave device specified does not support setting the MAC address [ 992.698306][T31374] bond5: (slave vcan3): Setting fail_over_mac to active for active-backup mode [ 992.756170][T31374] bond5: (slave vcan3): making interface the new active one [ 992.807318][T31374] vcan3: entered promiscuous mode [ 992.853001][T31374] bond5: (slave vcan3): Enslaving as an active interface with an up link [ 992.933873][T31399] wg1 speed is unknown, defaulting to 1000 [ 992.977831][T31399] lo speed is unknown, defaulting to 1000 [ 993.087012][ T1297] lec:lec_start_xmit: lec0:No lecd attached [ 993.556997][T31426] syzkaller1: entered promiscuous mode [ 993.564150][T31426] syzkaller1: entered allmulticast mode [ 993.586510][T31417] syzkaller0: entered promiscuous mode [ 993.592544][T31417] syzkaller0: entered allmulticast mode [ 993.632814][T31426] netlink: 12 bytes leftover after parsing attributes in process `syz.2.7009'. [ 993.972551][T31465] netlink: 36 bytes leftover after parsing attributes in process `syz.2.7019'. [ 994.103238][T31474] netlink: 'syz.3.7021': attribute type 1 has an invalid length. [ 994.176672][T31474] bond6: entered promiscuous mode [ 994.208892][T31474] 8021q: adding VLAN 0 to HW filter on device bond6 [ 994.369573][T31478] 8021q: adding VLAN 0 to HW filter on device bond6 [ 994.413257][T31478] bond6: (slave vcan4): The slave device specified does not support setting the MAC address [ 994.437187][T31478] bond6: (slave vcan4): Setting fail_over_mac to active for active-backup mode [ 994.483789][T31478] bond6: (slave vcan4): making interface the new active one [ 994.504456][T31478] vcan4: entered promiscuous mode [ 994.513931][T31478] bond6: (slave vcan4): Enslaving as an active interface with an up link [ 994.601114][T31480] wg1 speed is unknown, defaulting to 1000 [ 994.629750][T31480] lo speed is unknown, defaulting to 1000 [ 994.994099][T31472] mpoa:mpoad_close: (lec0) going down [ 995.001901][T31513] netlink: 'syz.4.7027': attribute type 1 has an invalid length. [ 995.154834][T31513] 8021q: adding VLAN 0 to HW filter on device bond6 [ 995.168408][T31520] netlink: 24 bytes leftover after parsing attributes in process `syz.3.7028'. [ 995.262968][T31523] openvswitch: netlink: Invalid VLAN frame [ 995.298716][T31517] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 995.312763][T31517] bond6: (slave batadv1): making interface the new active one [ 995.333173][T31517] bond6: (slave batadv1): Enslaving as an active interface with an up link [ 995.711295][T31539] netlink: 24 bytes leftover after parsing attributes in process `syz.0.7035'. [ 995.919424][T31545] wg1 speed is unknown, defaulting to 1000 [ 995.921842][T31549] netlink: 'syz.2.7038': attribute type 1 has an invalid length. [ 995.984347][T31545] lo speed is unknown, defaulting to 1000 [ 996.125186][T31549] bond4: entered promiscuous mode [ 996.164147][T31549] 8021q: adding VLAN 0 to HW filter on device bond4 [ 996.237917][T31558] 8021q: adding VLAN 0 to HW filter on device bond4 [ 996.256237][T31558] bond4: (slave vcan3): The slave device specified does not support setting the MAC address [ 996.289545][T31558] bond4: (slave vcan3): Setting fail_over_mac to active for active-backup mode [ 996.312130][T31558] bond4: (slave vcan3): making interface the new active one [ 996.337593][T31558] vcan3: entered promiscuous mode [ 996.358428][T31558] bond4: (slave vcan3): Enslaving as an active interface with an up link [ 996.474614][ T8165] lo speed is unknown, defaulting to 1000 [ 996.482575][ T8165] syz2: Port: 1 Link DOWN [ 996.760324][T31586] openvswitch: netlink: Invalid VLAN frame [ 996.993837][T31604] netlink: 211856 bytes leftover after parsing attributes in process `syz.3.7050'. [ 997.258251][T31614] syzkaller0: entered promiscuous mode [ 997.265400][T31614] syzkaller0: entered allmulticast mode [ 997.330760][T31614] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7052'. [ 997.344056][T31619] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7052'. [ 997.773955][T31632] netlink: 'syz.2.7056': attribute type 13 has an invalid length. [ 997.823515][T31632] netlink: 'syz.2.7056': attribute type 17 has an invalid length. [ 997.934185][T31629] veth1: left allmulticast mode [ 998.005212][T31643] netlink: 'syz.4.7058': attribute type 1 has an invalid length. [ 998.100299][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 998.108341][ C0] lec:lec_tx_timeout: lec0 [ 998.208630][T31632] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 998.261763][T31643] bond7: entered promiscuous mode [ 998.267374][T31643] 8021q: adding VLAN 0 to HW filter on device bond7 [ 998.323681][T31646] 8021q: adding VLAN 0 to HW filter on device bond7 [ 998.336055][T31646] bond7: (slave vcan3): The slave device specified does not support setting the MAC address [ 998.374423][T31646] bond7: (slave vcan3): Setting fail_over_mac to active for active-backup mode [ 998.389100][T31646] bond7: (slave vcan3): making interface the new active one [ 998.396911][T31646] vcan3: entered promiscuous mode [ 998.403964][T31646] bond7: (slave vcan3): Enslaving as an active interface with an up link [ 998.413324][T31651] bridge_slave_1: left allmulticast mode [ 998.418996][T31651] bridge_slave_1: left promiscuous mode [ 998.425564][T31651] bridge0: port 2(bridge_slave_1) entered disabled state [ 998.442852][T31651] A link change request failed with some changes committed already. Interface bridge_slave_1 may have been left with an inconsistent configuration, please check. [ 998.442903][T31660] openvswitch: netlink: Invalid VLAN frame [ 998.483751][T31634] wg1 speed is unknown, defaulting to 1000 [ 998.506001][T31634] lo speed is unknown, defaulting to 1000 [ 998.608557][T31630] ------------[ cut here ]------------ [ 998.615008][T31630] refcount_t: decrement hit 0; leaking memory. [ 998.622144][T31630] WARNING: lib/refcount.c:31 at refcount_warn_saturate+0x70/0x110, CPU#1: syz.0.7057/31630 [ 998.633396][T31630] Modules linked in: [ 998.638026][T31630] CPU: 1 UID: 0 PID: 31630 Comm: syz.0.7057 Not tainted syzkaller #0 PREEMPT(full) [ 998.649022][T31630] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/27/2026 [ 998.660477][T31630] RIP: 0010:refcount_warn_saturate+0x70/0x110 [ 998.666620][T31630] Code: c6 00 28 f0 8e e8 10 13 17 fd 83 fb 01 7e 22 83 fb 02 74 39 83 fb 03 74 47 83 fb 04 75 68 e8 77 0d 17 fd 48 8d 3d 30 70 6d 0b <67> 48 0f b9 3a eb 66 85 db 74 3e 83 fb 01 75 4c e8 5b 0d 17 fd 48 [ 998.687470][T31630] RSP: 0018:ffffc9000cbdfb08 EFLAGS: 00010293 [ 998.694700][T31630] RAX: ffffffff84ae8bf9 RBX: 0000000000000004 RCX: ffff88804b5e9e80 [ 998.703916][T31630] RDX: 0000000000000000 RSI: ffffffff8ef02800 RDI: ffffffff901bfc30 [ 998.713246][T31630] RBP: ffffc9000cbdfc60 R08: ffff88804b5e9e80 R09: 0000000000000005 [ 998.722386][T31630] R10: 0000000000000004 R11: 0000000000000000 R12: f8f8f8f8f8f8f8f8 [ 998.731466][T31630] R13: dffffc0000000000 R14: ffff888034116668 R15: 0000000000000001 [ 998.739465][T31630] FS: 00005555772e8500(0000) GS:ffff888125565000(0000) knlGS:0000000000000000 [ 998.749721][T31630] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 998.757436][T31630] CR2: 000000110c3d7900 CR3: 0000000083d7e000 CR4: 00000000003526f0 [ 998.766974][T31630] Call Trace: [ 998.771376][T31630] [ 998.774328][T31630] ref_tracker_free+0x6fc/0x840 [ 998.779361][T31630] ? __pfx_ref_tracker_free+0x10/0x10 [ 998.785815][T31630] ? __pfx_locks_remove_file+0x10/0x10 [ 998.792488][T31630] ? ima_file_free+0x170/0x4e0 [ 998.797369][T31630] ? do_raw_spin_lock+0x12b/0x2f0 [ 998.803676][T31630] ? lock_acquire+0xf0/0x2e0 [ 998.808399][T31630] ? vcc_release+0x54/0x580 [ 998.813830][T31630] mpoad_close+0x1fc/0x3e0 [ 998.818469][T31630] ? __pfx_mpoad_close+0x10/0x10 [ 998.824071][T31630] vcc_release+0x10f/0x580 [ 998.828700][T31630] sock_close+0xc3/0x240 [ 998.833532][T31630] ? __pfx_sock_close+0x10/0x10 [ 998.838516][T31630] __fput+0x44f/0xa70 [ 998.843711][T31630] task_work_run+0x1d9/0x270 [ 998.848412][T31630] ? __pfx_task_work_run+0x10/0x10 [ 998.854538][T31630] exit_to_user_mode_loop+0xed/0x480 [ 998.859889][T31630] ? rcu_is_watching+0x15/0xb0 [ 998.865489][T31630] do_syscall_64+0x32d/0xf80 [ 998.870782][T31630] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 998.876971][T31630] ? clear_bhb_loop+0x40/0x90 [ 998.882941][T31630] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 998.889075][T31630] RIP: 0033:0x7fe20d19c799 [ 998.894568][T31630] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 998.915940][T31630] RSP: 002b:00007ffd9bdb8748 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 998.925571][T31630] RAX: 0000000000000000 RBX: 00007fe20d417da0 RCX: 00007fe20d19c799 [ 998.934938][T31630] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 998.944102][T31630] RBP: 00007fe20d417da0 R08: 0000000000000006 R09: 0000000000000000 [ 998.953287][T31630] R10: 00007fe20d417cb0 R11: 0000000000000246 R12: 00000000000f3cad [ 998.962468][T31630] R13: 00007fe20d41627c R14: 00000000000f3ac2 R15: 00007ffd9bdb8850 [ 998.971655][T31630] [ 998.974987][T31630] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 998.982283][T31630] CPU: 1 UID: 0 PID: 31630 Comm: syz.0.7057 Not tainted syzkaller #0 PREEMPT(full) [ 998.991809][T31630] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/27/2026 [ 999.001882][T31630] Call Trace: [ 999.005269][T31630] [ 999.008223][T31630] vpanic+0x56c/0xa60 [ 999.012414][T31630] ? __pfx__printk+0x10/0x10 [ 999.017031][T31630] ? __pfx_vpanic+0x10/0x10 [ 999.021651][T31630] ? is_bpf_text_address+0x292/0x2b0 [ 999.027132][T31630] ? is_bpf_text_address+0x26/0x2b0 [ 999.032398][T31630] panic+0xc5/0xd0 [ 999.036339][T31630] ? __pfx_panic+0x10/0x10 [ 999.041052][T31630] __warn+0x315/0x4f0 [ 999.045060][T31630] ? refcount_warn_saturate+0x70/0x110 [ 999.050550][T31630] ? refcount_warn_saturate+0x70/0x110 [ 999.056129][T31630] __report_bug+0x29a/0x540 [ 999.060848][T31630] ? is_bpf_text_address+0x26/0x2b0 [ 999.066082][T31630] ? refcount_warn_saturate+0x70/0x110 [ 999.071743][T31630] ? __pfx___report_bug+0x10/0x10 [ 999.076805][T31630] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 999.083076][T31630] ? arch_stack_walk+0xfb/0x150 [ 999.088228][T31630] report_bug_entry+0x19a/0x290 [ 999.093090][T31630] ? refcount_warn_saturate+0x70/0x110 [ 999.098638][T31630] ? refcount_warn_saturate+0x75/0x110 [ 999.104123][T31630] handle_bug+0xce/0x200 [ 999.108366][T31630] exc_invalid_op+0x1a/0x50 [ 999.113034][T31630] asm_exc_invalid_op+0x1a/0x20 [ 999.117879][T31630] RIP: 0010:refcount_warn_saturate+0x70/0x110 [ 999.124204][T31630] Code: c6 00 28 f0 8e e8 10 13 17 fd 83 fb 01 7e 22 83 fb 02 74 39 83 fb 03 74 47 83 fb 04 75 68 e8 77 0d 17 fd 48 8d 3d 30 70 6d 0b <67> 48 0f b9 3a eb 66 85 db 74 3e 83 fb 01 75 4c e8 5b 0d 17 fd 48 [ 999.144095][T31630] RSP: 0018:ffffc9000cbdfb08 EFLAGS: 00010293 [ 999.150349][T31630] RAX: ffffffff84ae8bf9 RBX: 0000000000000004 RCX: ffff88804b5e9e80 [ 999.158846][T31630] RDX: 0000000000000000 RSI: ffffffff8ef02800 RDI: ffffffff901bfc30 [ 999.166856][T31630] RBP: ffffc9000cbdfc60 R08: ffff88804b5e9e80 R09: 0000000000000005 [ 999.175027][T31630] R10: 0000000000000004 R11: 0000000000000000 R12: f8f8f8f8f8f8f8f8 [ 999.183064][T31630] R13: dffffc0000000000 R14: ffff888034116668 R15: 0000000000000001 [ 999.191229][T31630] ? refcount_warn_saturate+0x69/0x110 [ 999.196972][T31630] ? refcount_warn_saturate+0x69/0x110 [ 999.202437][T31630] ref_tracker_free+0x6fc/0x840 [ 999.207464][T31630] ? __pfx_ref_tracker_free+0x10/0x10 [ 999.212829][T31630] ? __pfx_locks_remove_file+0x10/0x10 [ 999.218280][T31630] ? ima_file_free+0x170/0x4e0 [ 999.223055][T31630] ? do_raw_spin_lock+0x12b/0x2f0 [ 999.228078][T31630] ? lock_acquire+0xf0/0x2e0 [ 999.233027][T31630] ? vcc_release+0x54/0x580 [ 999.237544][T31630] mpoad_close+0x1fc/0x3e0 [ 999.242133][T31630] ? __pfx_mpoad_close+0x10/0x10 [ 999.247330][T31630] vcc_release+0x10f/0x580 [ 999.251755][T31630] sock_close+0xc3/0x240 [ 999.255995][T31630] ? __pfx_sock_close+0x10/0x10 [ 999.260842][T31630] __fput+0x44f/0xa70 [ 999.264829][T31630] task_work_run+0x1d9/0x270 [ 999.269410][T31630] ? __pfx_task_work_run+0x10/0x10 [ 999.274520][T31630] exit_to_user_mode_loop+0xed/0x480 [ 999.280147][T31630] ? rcu_is_watching+0x15/0xb0 [ 999.284934][T31630] do_syscall_64+0x32d/0xf80 [ 999.289628][T31630] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 999.295949][T31630] ? clear_bhb_loop+0x40/0x90 [ 999.300622][T31630] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 999.306611][T31630] RIP: 0033:0x7fe20d19c799 [ 999.311020][T31630] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 999.330840][T31630] RSP: 002b:00007ffd9bdb8748 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 999.339944][T31630] RAX: 0000000000000000 RBX: 00007fe20d417da0 RCX: 00007fe20d19c799 [ 999.348265][T31630] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 999.356413][T31630] RBP: 00007fe20d417da0 R08: 0000000000000006 R09: 0000000000000000 [ 999.364556][T31630] R10: 00007fe20d417cb0 R11: 0000000000000246 R12: 00000000000f3cad [ 999.373216][T31630] R13: 00007fe20d41627c R14: 00000000000f3ac2 R15: 00007ffd9bdb8850 [ 999.381459][T31630] [ 999.384869][T31630] Kernel Offset: disabled [ 999.389278][T31630] Rebooting in 86400 seconds..