last executing test programs: 11.296880311s ago: executing program 2 (id=3183): r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000080)={0x84, @rand_addr=0x64010100, 0x4e21, 0x3, 'wrr\x00', 0x1, 0xa8a, 0x30}, 0x2c) setsockopt$IP_VS_SO_SET_ADDDEST(r0, 0x0, 0x487, &(0x7f0000000000)={{0x84, @rand_addr=0x64010100, 0x4e24, 0x3, 'lc\x00', 0x8, 0x323b, 0x55}, {@remote, 0x4e24, 0x10000, 0x0, 0x12d5c, 0x12d4c}}, 0x44) 11.118946304s ago: executing program 2 (id=3185): openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) (async) socket$nl_netfilter(0x10, 0x3, 0xc) (async) openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) (async) r0 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0xc, 0x8, &(0x7f0000000d80)=ANY=[@ANYBLOB="18f7ff000000001665ef187f03a23a0018020100", @ANYRES32=r0, @ANYBLOB="0000000000000000b703000000000000850000000d000000b70000000000000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback=0x1b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000003c0)={r1, 0x3e8, 0xe, 0x0, &(0x7f0000000000)="c1df07000000d30a298ee68888a8", 0x0, 0x3ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x50) 10.817083164s ago: executing program 2 (id=3187): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) r1 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000001080)=0x4) setsockopt$inet_sctp6_SCTP_MAX_BURST(r0, 0x84, 0x14, &(0x7f0000000080)=@assoc_value={r2}, 0x8) getsockopt$inet_sctp_SCTP_DELAYED_SACK(0xffffffffffffffff, 0x84, 0x10, &(0x7f0000000040)=@assoc_value={r2, 0x400}, &(0x7f00000000c0)=0x8) (async) getsockopt$inet_sctp_SCTP_DELAYED_SACK(0xffffffffffffffff, 0x84, 0x10, &(0x7f0000000040)=@assoc_value={r2, 0x400}, &(0x7f00000000c0)=0x8) socket$netlink(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) (async) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r4, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) ioctl$BTRFS_IOC_DEV_REPLACE(r3, 0xca289435, &(0x7f0000000b40)={0x1, 0x7fe9, @status={[0x10, 0xbe8, 0x8, 0x8, 0x3, 0x6]}, [0x2, 0x80000001, 0x1, 0x882a, 0x1, 0xffff, 0x5, 0x8000, 0x200, 0x10001, 0x5, 0xc, 0x5f, 0x1d9bf578, 0x40df, 0x8, 0x0, 0xff, 0x1, 0x7ff, 0xffffffffffffffff, 0x9, 0x8000, 0x3, 0xf4, 0x0, 0xb8, 0xfff, 0x2, 0xffffffffffffffff, 0x7fffffffffffffff, 0x0, 0x8, 0x4, 0x3, 0x1, 0x5, 0x9, 0x4, 0x7, 0x9, 0x0, 0x5, 0x6, 0x6, 0x0, 0x800, 0x101, 0x8, 0x291, 0x9, 0x3, 0x8, 0xcab7, 0xa0, 0xd0f, 0x8, 0x5, 0x9, 0x9, 0x101, 0x5, 0x4, 0x9]}) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r5, @ANYBLOB="01000000020000001c0012000c000100626f6e64000000000c0002000800010005"], 0x3c}}, 0x0) (async) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r5, @ANYBLOB="01000000020000001c0012000c000100626f6e64000000000c0002000800010005"], 0x3c}}, 0x0) 10.3963484s ago: executing program 2 (id=3190): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="0e00000004000000040000000200000000000000", @ANYRES32, @ANYBLOB="000000000000c0000000000000b1aa89ca63234f7cd50dac445cd63b02b53ade1b0fbd249c233742ddd7be7073f5ef4e659a6bc672b32224944e768f2af92d520bcae7312acb320b5b6c962c6fcf82a1a3cdda65776d310677e0caa5b15726e70630ad", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000580)={'syztnl1\x00', &(0x7f0000000500)={'syztnl0\x00', 0x0, 0x29, 0xa, 0x3, 0x1, 0x2, @empty, @empty, 0x0, 0x1, 0x10001, 0xfffffff9}}) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x6, 0xd, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000000000000003716b81dbac4cf410000000e00000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bca2000000000000a6020000f8ffffffb703000008000000b70400000100000085000000330000009500000000000000"], &(0x7f00000004c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r1, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000b80)={r2, 0x2000012, 0xfffffffffffffe03, 0x0, &(0x7f0000000280)="63ec33c9e9b98600000000000000", 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xb}, 0x50) r3 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r4) ioctl$IOCTL_GET_NCIDEV_IDX(r3, 0x0, &(0x7f0000000380)=0x0) sendmsg$NFC_CMD_DEV_UP(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000d80)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r5, @ANYBLOB="010426bd7000f8dbdf250200000008000100", @ANYRES32=r6], 0x1c}}, 0x4008054) preadv(r3, &(0x7f00000005c0)=[{0x0, 0xfffffc6e}, {&(0x7f0000000440)=""/39, 0x27}], 0x2, 0x9, 0xbf5) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xd, 0x20000000ec071, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x1400000, 0x0, 0xc3072, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xb, 0xc3072, 0xffffffffffffffff, 0x0) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000feffff10850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r8 = socket$kcm(0x29, 0x2, 0x0) mmap(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x2000009, 0x200000006c832, 0xffffffffffffffff, 0x4000) sendmsg$kcm(r8, &(0x7f0000001b40)={0x0, 0x0, 0x0}, 0x40040) write$cgroup_pressure(r8, &(0x7f0000000140)={'full'}, 0xfffffdef) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r9 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r9, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000440)=[{&(0x7f0000000340)="1400000016001963d25a80648c56915a19aa2bfe", 0x14}, {0x0}], 0x2}, 0x0) socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x16, 0x3, 0x0, &(0x7f0000000040)='GPL\x00'}, 0x94) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000000)={'lo\x00'}) r11 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000004000)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0ff0100000079a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b70000000000000095000000000000005ecefab8f2e85c6c1ca711fcd0cdfa146ec561750379585e5a076d839240d29c034055b67dafe6c8dc3d5d0f65acc0d06d1a1434e4d5b3185fec0e07004e60c08dc8b8dbf11e6e94d75938321a3aa502cd2424a66e6d2ef831ab7ea0c34f17e3946ef3bb622e03b538dfd8e012e79578e51bc53099e90f4580d760551b5b341a29f31e3106d1ddd6152f7cbdb9cd38bdb2209c67deca8eeb9c15ab0300817ac61e4dd11183a13477bf7e860e3670ef0e789f65f1328d6704902cbe7bc04b82d2789cb132b8667c2147661df28d9961b63e1a9cf6c2a660a1fe3c184b751c51160fb20b1c690220b87b20581e7be6ba0dc001c4110555850915148ba532e6ea09c346dfebd38608b3280080005d9a9500000000000000334d83239dd27080851dcac3c12233f9a1fb9c2aec61ce63a38d2fd50117b89a9ab359b4eea0c6e95767d42b4e54861d0227dbfd2e6d7f715a7f3deadd713089856f756436303767d2e24f29e5dad9796edb697a8ad004eea0182babd18cac1bd4f4390af9a9ceafd0002cab154ad029a1090000002780870014751c3c975d5aec84222fd3a0ec4be3e563112f0b39501aafe234870072858dc06e7c337642d3e5a815232f5e16c1b30c3a6a71bc85018e5ff22dc518afc9ffc2cc788bee1b47683db01a2f9398685211dfbbae3e2ed0a50e7313bff5d4c391ddece00fc772dd6b4d4de2a41990f05ca3bdfc92c88c5b8dcd36e7487afa407e2edfae4f390a8337841cef386e22cc22ee17476d738952229682e24b92533ac2a9f5a699593f084419cae0b4532bcc97d3ae526aca54183fb01c73f979ca9857399537f5831808b0dc2a2d0e0000000000000578673f8b6e74ce23877a6b24db0e067345560942fa629fbef2461c96a0c93d47018c12e7ba8188a22e8b15c3e233db00002e30d46a9d24d37cef099ece729aa218f9f44a3210223fdae7ed04935c3c90d3add8eebc8619d73415cda2130f5011e4845535a8b90dfae158b94f50adab188dd8e12baf5cc9398fff00404d5d99f82e20ee6a8c88e18c2977aab37d9ac4cfc1c7b400000000000007ff57c39495c826b956ba859ac8e3c177b91bd7d5e41ff868f7ca1664fe2f3ced846891180604b6dd2499d16d7d9158ffffffff00000000ef069dc42749a89f854797f29d0000002d8c38a967c1bbe09315c29877a308bcc87dc3addb08141bdee5d27874b2f663ddeef0005b4896c7aabf4df517d90bdc01e73835d50200a90800c66ee2b1ad76dff9f9003f07000099d4894ee7f8249dc1e3428d2129369ee1b85af6eb2eea0d0df414b315f651c8412392191fa83ee830548f11e1036a8debd64cbe359454a3f2239cfe35f81b7a490f167e6d5c1109000000000000000042b8ff8c21ad702ccacad5b39eef213d1ca296d2a27798c8ce2a305c0c7d35cf4b22549a4bd92052188bd1f285f653b621491dc6aaee0200e2ff08644fb94c06006eff1be2f633c1d987595ec3db58a7bb3042ec3f771f7a1338a5c3dd35e926049fe86e09c58e273cd905deb28c13c1ed1c0d9cae846bcbfa8cce7b893e578af7dc7d5e87d44ff828de453f34c2b18660b080efc707e676e1fb4d5825c0ca177a4c7fbb4eda0545c00f576b2b5cc7f819abd0f885cc4806f40300966fcf1e54f5a2d38708294cd6f496e547f7ad33850d9feccd0111a2e3700845dee734fe7da3770845cf442d488afd80e17000000000000000000000000000000000000000000000000000005202000000dc1c56d59f35d367632952a93466ae595c6a8cda690d192a070886df42b27098773b45198b4a34ac977ebd4450e121d01342703f5bf030e935878a12489c80aa4252d4ea6b8f6216ff202b5b5a182cb5e838b307632d03a7ca6f6d0339f9953c3093c3690d10ecb65dc5b47481edbf1f000000000000004d16d29c28eb5167e9936ed327fb237a56224e49d9ea955a5f0dec1b3ccd35364600000000000000000000000000000000000000000000000000000000000026ded4dd6fe1518cc7802043ecfe69f743f1213bf8179ecd9e5a225d67521dc728eac7d80a5656ac2cbde21d3ebfbf69ff861f4394836ddf128d6d19079e64336e7c676505c78ad67548f4b192be1827fcd95cf107753cb0a6a979d3db08407081c6281e2d8429a8639034a75f4c7df3ea8fc2018d07af14915f29b719f54926fc32468f65bd06b4092140faed0c329be610c3082d43e121861b5cc03f1a1561f0589e0d12969bc982ff5d8e9b986c0c6c747d9a1cc500bb892c3a16ff10feea20bdac0000000000000000ca06f256c8028e0f9b4c8787361f3289f86ae826c69fa35ba5cbc3f2db1516ffc5c6e3fa618b24a6ce16d6c7010bb37b61fa0a2d8974e69115d33394e86e4b838297ba20f96936b7e4746e92dea6c5d1d33d84d96b50fb000000ae07c65b71088dd7d5d1e1bab9000000000000000000000000b5ace293bec833c13e3229432ad71d646218b5229dd88137fc7c59aa242af3bb4efb82055a3b61227ad40f52c9f2500579aca11033bb9cc16bd83a00840e31d828ec78e116ae46c4897e2795b6ff92e9a1e24b0b855c02f2b7add58ffb25f339297729a7a51810134d3dfbf71f6516737be55c06d9cdcfb1e2bb10b50000eb4acff90756dba1ecf9f58afd3c19b5c4558ba9af6b7333c894a1fb29ade9ad75c9c022e8d03fe28bc358684492aa771dbfe80745fe89ad349ffaad76ff9dd643796caffdf67af5dd476c37e7e9a84e2e5da2696e285a59b53f2fb0e16d8262c080c159ce1d9bc7ef3e3f40c14089c82759106f422582b42e3e8484ea5a6ad9aa520000afe0e0caea1ad4cb23f3c2b8a0f455ba69ea284c268d54b43158a8b1d128d02af263b3dc1cab794c9ac57a2a7332f4d8764c302ccd5aac114482b619fc575aa0dd2777e881e29a854380e2f1e49db5a1517ec40bb3fa44f9959bad67ccaba76408da357f9e93ce055019c9f1534c8bd48bbd61627a2e0a74b5e6aefb7eee403502734137ff47257f164391c672b6079e65d7295eed164ca63e4ea26dce0fb3ce0f6591d80dfb8f386bb74b5589829b6b0679b5d6fccbecfae5553d9950d48c774eaa35b24fce69a20d8bc410d9f48bf7eac90529cd6af061c9e53addddc620ce73c5d177e3d097159f2768636fc10276c6a0adc57483b3f7083f66b87ef296ee85e9bb70a3009a5d30f479e293a3302e11350ea857b37e76ca2f50378e4092ce2c574ad278b9b7b717c571afb2077b019fd9d89efd59b41f051ec5a8ff87ecc8df917a1e386d849fcd10e2f9ca52e02339c2f4666b0c545e25f1cd62421c28d25994be0cff7271a0dee38d7ac4ac736b090e1d29f981fd9086e4000000000000646174b55d251f7f8ca5ccc22a5efb33b237eff5597a3c3a5f3a9bb54abb40e54593e1a7ce4cfa17b3c3fe91c06363496341eae20dcc59b6179b32ddddef5c34000096a54c0c571a91878f61f74912e2299e5501d4d6943bfd74c856511726f0ac8f7d17f1c6b4451c1bcdc6b6e1700e4cd87709d97afc5423c96fa981873d4369b04bbf1fb9f68f17991540868e408201ad1a74179e489aa61f021a437a3fa935588be2068f7ff9b253106326fde795e530b93626cc68e06e602198724249b4445eef08401cd1a3e266db41474e69902e4d8f5da4e94cc36794258fd4032de7ab36bc24c5efd5c8495c1ccd580033c55725f2d60354f8ad5914a0155eaa743350ddb388f486b6de0549ef3b1b3c3b7d4d3a830ff39885776119408029be3788dd8422b1ab7b4c9d5b7d8682fd759c713108e1bdfc64b9121bbf07099def5c0ce3c861ae4b5cad8bba5a0b6059b9ef90c2f96a59320309e25df89484522bb1d6eaa92164f9e4042cb689a45a898354c17b08705205a9189772bcbcb6414e44b33a2470d3bc16f761c33f565b9da5e7991ad8482579cc1b16c1fcec815a5482ae8b1779c5e339971a6ec1217bcfd1ef24284de8a0a9f068f297037d6478c2434a9a18dcc6c7c791e444a79d7ce37f9cf2826b47ad8ca6a2fa254aa02cd098026798a6d336348af0fc11fa2809a5ebbe17ca4d0f889d518f64ee50f562b5fdb1f76d4a7fe14701f8ed0c6a55d66a6efea3e449e6b478abc5b196dd5308cb20c4e2a0bd702651bb39f10523102dcd8ece692159028f314e0d6bfa400475c6699fdc40efe0948e3cef7419a7f113134e5ee20fd87c4521ccfbd32d6f147f743d30866bdd86ca8bf0c7bcc475f4ed53517aaa51f1c151d859a7f0b53abd332c84bdad313e82ac3777a6f7f649ff8a25f6dfe09cb29213896b49a825257bf143e9fa3bbd47009e66fe5705b3ef2b40a182e408c680727d64e00e1ce508f8fd64ac6c84ccc28fc333067de63b9bb5daaa12ce60ee3779ded79651be69d2a413cd948a873dd7ad7017b150828cf100d3df8537f22aff58343c9ee966fceb594bbe10b911427f76a25a219be2f85287b7f83d323a30991067ad1369792166062085ff20c5fb9f6e4f78dd09c7d2d6ca3c8a5d0d26ccbe576f44a1bc94194817"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r11, 0x18000000000002a0, 0xe80, 0x6000, &(0x7f0000000640)="b9ff03076844268cb89e14f088a847e088641100050000210283ac141440e0", 0x0, 0x11, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000}, 0x48) r12 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r12, &(0x7f0000000100)={0xa, 0x4e24, 0x0, @empty, 0xffff8b92}, 0x1c) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000180)={r7, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f0000000340)='./cgroup/cgroup.procs\x00', &(0x7f00000008c0)=[0x45c, 0x9], 0x0, 0x0, 0x2, 0x1}}, 0x40) 7.174383566s ago: executing program 2 (id=3199): socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r3, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r3, 0x0, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32, @ANYBLOB="01000000000000001c0012000c000100626f"], 0x3c}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010001fff0000", @ANYRES64=r0, @ANYBLOB="0000000000000000140012800900010076657468000000000400028008000a00", @ANYRES32], 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x1, 0x8, &(0x7f0000002fc0)=ANY=[@ANYBLOB="7a0af8ff75257078bfa100000000000007010000f8ffffffb702000005000000bf130000000000008500000006000000b700000000000000950000ff00000000b2595285faa6ead0169191d54f8196217fc560e2fc91f6da4dad4fdc2eb1b5986fc4a3f611a7c8edd3aa5d6ee7ab10b1a297cf52866651ddd73f30f2382f6cda4bfdd45be583823c0f09621f3c1c65ee19ee875daf45006a4c4ea5e15b2f9618d547244a22000000000000db453620ce72d75946c2b638d91dbef661962239c77edf2d34b12cd48a1b20fb7dd8432619f2c50d77bc0ea9b0af58e6fff4942eb613eff289026d5045ef76d7d864409eb2dc9518a09f4886afc26abba34635d0e8b598a51bc742135a6e1d33fe226c944bc76be40d435aa8b5208ff0df2db761014b1b999a12df6bee431a668135b8214afa5827b56a8074bf1e6cf5d84b35a3a3a4c66824fe12dbe20fcf50a194185b9e2d8b815fedb0d982936156be3cdda66fb977aef7c9cb92428ef25d9bf665bd60024c09e9eed544126fabe4cb8d826e1ec03cc492f5cad6227c94fea467aea7fa8b58abc37056433edf43fba5566a3e022034ac81fd48f9b7314ffa730017fbd37fdb23bc26992529402a520ef67e246415a6a8ca9d4aa797a95ca3314ded0d8a24abd57e042888a9141ab4e6c6b939aaefc248791464970c43120211b9bc82a85cd2fc18f535c7986c2d52ba62f74f00000000008000000000000000000000000040000000000000"], &(0x7f0000000100)='GPL\x00'}, 0x48) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x32, &(0x7f0000002900)=r4, 0x4) bind$netlink(0xffffffffffffffff, &(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = socket(0x10, 0x803, 0x4) sendmsg$IPVS_CMD_SET_INFO(r6, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r6, &(0x7f00000001c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[], 0x4c}, 0x1, 0x0, 0x0, 0x9c51ab03a598108c}, 0x40000) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000900)={'bridge0\x00', @remote}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r7, 0x89a1, &(0x7f0000000900)={'bridge0\x00', @broadcast}) 6.683930968s ago: executing program 2 (id=3202): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000040), r0) sendmsg$NLBL_UNLABEL_C_STATICREMOVE(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x38, r1, 0x1, 0x0, 0x0, {}, [@NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @private}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @dev}, @NLBL_UNLABEL_A_IFACE={0x14}]}, 0x38}}, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000200)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x7}, 0x50) r2 = bpf$PROG_LOAD(0x5, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_COALESCE_SET(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYBLOB="d35b88ae578581049f29ca2230b8ad54d50b9d1f", @ANYRES16, @ANYBLOB="010000000000000000001400000008000200fc00000018000180140002006e657464657673696d300000000000000800050000fcffff08000900fc000000080011000700000008000e00800000000800", @ANYRESHEX=r2], 0x5c}, 0x1, 0x0, 0x0, 0x800}, 0x801) socket$nl_generic(0x10, 0x3, 0x10) 5.506453464s ago: executing program 3 (id=3209): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000180)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) listen(r0, 0x5) accept(r0, &(0x7f0000000240)=@ax25={{0x3, @null}, [@netrom, @default, @default, @null, @rose, @null, @null, @netrom]}, &(0x7f00000002c0)=0x80) socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r2, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r1, 0x84, 0x71, &(0x7f0000000080)={r3, 0x81}, &(0x7f00000000c0)=0x8) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000a80)=ANY=[@ANYBLOB="1200000029000000080000000200000000000000", @ANYRES32=0x1, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB], 0x50) sendmsg$inet_sctp(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000140)="e5fac1051b89dd10f39b6a0dd30eb890272ff724d4d9118b022ee7f9ba2179fdc89facd45fae87616243f1f4c264455ed5990347b994c641775a5647ea1b0815de308deb8c", 0x45}], 0x1, 0x0, 0x0, 0x4855}, 0x24000052) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{r5, 0xffffffffffffffff}, &(0x7f0000000180), &(0x7f0000000100)=r4}, 0x20) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000300)={r6, &(0x7f0000000340), 0x0}, 0x20) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000140)={'syztnl0\x00', &(0x7f00000000c0)={'ip6_vti0\x00', 0x0, 0x4, 0x81, 0xe4, 0x7fff, 0x0, @dev={0xfe, 0x80, '\x00', 0x12}, @mcast2, 0x20, 0x8000, 0x7, 0x4}}) socket$inet_udp(0x2, 0x2, 0x0) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000003bc0)=[{{&(0x7f0000000040)={0x2, 0x4e22, @private=0xa010102}, 0x10, &(0x7f0000000840)=[{&(0x7f0000000380)="6998ed1579dc11f163c1906cb8c3b26da710a9e829d517070d8cf334e0b4b2d9ca9c89a086a5dfd2b2023a2ecb4348f7d7949ed013f11cfffbf43f88a1b10a99c3d215121ac38deb", 0x48}, {&(0x7f00000004c0)="ed9b4f64d09a4bea83ccbf21def599065502fdf8e55854370fff06bc305f37f908a02768a98102379d20b4f8238eb1c5e637e736d3b131aaec0edbc14fbce9b6d6f0f863dc86ddf8eeef7b36d261f55756f2c070604c13c59264de46a9a90e8f579021e305c1d5c044c0dc97a80e5c333ee0347a3fec255b7c525a6b6a1ef6ddb0e935a35f3105acd7a61b61ccf8001467f242108d5456ca55490aeb9bb4d0d6fd0348affef2b43fb93c8413e2c3c3e3e15858a72218d2dbb76d47489c881c66", 0xc0}, {&(0x7f00000006c0)="60bbc7ab2f7fd7913787edcefca310ac657725cb09dc33b2b2c29929227fc9d495942ce4d4861473a957c8eeb38c3f695ed0b1851bf38b95c42b440b05d411e87e7401027ea36a541b6df5f49bb0b378e077b9a437c2ed19d86cb4a1c6a867bd23158095385e33061a48e815b8d2eec1f7194e4a66b8e96505b04630a7c91d73de4c7b9b2e81bc7d567169b4618d28c476bc237b2246ddd7fdd38b1afe46ef5b472f6aa4d6cd4efc5d48909633ae3071bd83c5a4b8839c", 0xb7}, {&(0x7f0000000780)="1a32f936cbffddfeb0b6d44da7b3357dcb31820a146629810d6af930678868e2a17e19130d780ab1bd5b039e74bb99bc742ba80b18cfd97676207615e04e21b2aceffe9295cd6c9e63b06e2c5e5e517c89fca33503075df94acf12cb554c89833e138974945778ee1db5dc7b80080831e7cdd4a8cf65f4", 0x77}], 0x4}}, {{&(0x7f0000000880)={0x2, 0x4e22, @multicast2}, 0x10, &(0x7f0000001ec0)=[{&(0x7f0000000b00)="492cc4f3b6a6537d63155976301331e80cef17f77f7c457f2e8661537465e68887628d60970521e6f9a8d5a75c1997eeb20a36bf0313d8cd4a2343841536b8cfaeec1b7aa9056400a585b8497a270da21f90ae49444968e4a92aa2fcdc8d9410070dffef05ffb5f26d92700143e7419f84a2b3d5d30a2dbc808a9fd4d5981b3f85fd41d937955a5729df18311d01d28f305aa3e2296902f266820873037743b05f0558e9ab9e5ac9d7f8d40bd47dd956c582ee687cba6442ca0482382dfcd49a4c376536f277f7300ee02edfc6100d58c3bf2dc186cac8", 0xd7}, {&(0x7f0000000c00)="ad8d6aa6668efff6a7b8e7b7198284537b7bb6a5e5cd44e70b25856ca3bc02becbd7f17f63e7a28719b39ed6f65581426934c6d543eaaa25e4323bff42db9acad4d92e91cff9933c6fee89b704334e2b2a71ffd9dd0c53913ec0134ac8ba101b289f7bf1aec3", 0x66}, {&(0x7f0000000c80)="4a32ac6aa1bbfdaf82ee74076955cadfa7106d30a90caa59c931f99b0ea49d33199d60b75ed944da5575bd054db53fd0ec08de6c6994333ad7be67fcc234bd00e7dbed5315d1395c8d95cdb26989ecb62a3e3d46a087d0a835a5fc4e4e2a5fdb5f5f80da6ca6c70f31377934662c824c36c0a871e6e4d63fc3671bad44fb9b4f3c65d902f5d8fdb2b2aaea809a3f05bb", 0x90}, {&(0x7f0000000d40)="ef11620816f9dea40fbd0f970dd574bc4893a2f571c1f3942873f9f8260f404f9aba009d6788f4c156a22848857fe01e2818e8aacae3a6caf5da08189dfa01c088a3457fd4ff023373a79b185142908d7ccbd83dffd7e18c8b19c9a608c53b123b4346d7a0bfc878c8fbc22f0cbfc81b7baf88e5c4f80470dff62449a0545ec56ac929976bdda3c04b50951abe964d64eb94bf66218add62e1a8febc94b395e3e0e5e53a984ebb5c458db042a067f229c4651269db96f15556afcc", 0xbb}, {&(0x7f0000000e00)="fab4bb9e3815bd72c44d9d6156a567602fa33eeb263f19235cb29e6dded9a920a9c864849749c4ebbecb8a3c732b715135759bdf7854d883aba8ba32e6ae7023479296827f78d2884bc529069780def397c71218f17a3a34fbb0334017b37a363e77aeae15ab6974393644877952e1d1ad9b1972b2d4a93b06ce181b2417b101394561f21d6ae3f7e07b6542126d4f9071f8f09784735f9a0f0f8c3667c9d9d80d59fdef3285cb6a7e471b8a0f705eef7c5495bf96c2535764ad450de2cd55922c6cd87d6e53bcb5776757827e3dfd3f2a551aeb0b92cc32b2e6abf6767a4cf9968f3f855e933f501cac5b75e56dab1d6b9a162e110fac98289868991eef03b3b2bae4d5813b095687a0192a355db5afb06556779ce898ace6cbb7f22b364c77cd604d4a9680094b1df8c1430b12f3478060263ec9729e39a8c4193f7b4417792fa1df2f13b22c97eaa76aefefe7964c119aa768bbdc066755fe2fb3f24eaa1c30dd689ae999afdf304afe5e9ff313d9b619e3557625dca1ed6d9c7009c588a27a1f81fd48f1981057b41213b7745316db3c3a3af0cf1d8de26015a447cd6fbd4c600a53a09b6d3d3e1fcc9bce749e4e9455eca0e4a347befea7bb1482367f9f3f160e955dfe4b4818ba506e56684c36b15585c0283937637f6d42609a1c37feffb3f9606bdf92ce65258d470ec8bcdd86125b18c35e6b21dca7c6241bed32e630a6dd5d06b1ce7510f1932ac82aafcccf2d6a6cba45330dc767963d73d6b214741a2e7f0e07c53b6d321c4c0ce9cd9adbb9f50cb0b70be6adfea1bfffa0c6882a60460c7961c05996ee51c9821cac0aa3f406f299ee491dec4157375a6ceb9001cc38df7e794fcbb5f25f865859aedabf6ec88fd902bd0c91cfb8dd374813bda11b9d7b9e3a109b6d77a9109b7b17bd1716fef951217443b912e6f9c228979aa871bfbab2c25769520c66ad2426c106855f79fbcddacf69ee725fe44f48abddc54304024b4e1880f5422f356664082d3a5888c16a073a511630d67585076a867c1247a22b0b3017dee4af54cdeaada9f7f04b7ed4ca7aa2def15cf510e8a1ca3784018d9d8fc8e968f731d6957adcaf3bc566741f5a09332355fe76f71ebddb38a7abd8bf77faaa751fe9157b7015dc6a8f063a12db3a7822182893c659e3632a1b3f539ff00727930974862dabbe3123408e581b25f9e9f2fe876fb985cf5ec487ca872da245d1bd066b8c950f1b9bf55743d4c7162535966ce58abca5d17c3a0cb95f10e34dda055313c3f02a8f931ec85966ed3d74b95f86b72554b3f5475ef74511ac7eb85feb2401d5e05874a8344fda7a97b82aad6782bf59fbcf43f1e4edf962957db900b3edd0ffd8622161f7a9997a2728ef05ed91b239fbee06824cbb55d1b30318910628438de9d81d46c2b64c387249991378f388f7223ca7f90a0143ec194207b9c1ab8d2a69af3636202425e631e54dc691240bb40c15191bc54a5bc4726ba221ee73c455df44556e30be68d411f7da7918b77f8431b36f159064ef721aa5aa9f9db05f375b83376a75853303b10b11e3cf592e90736091eed8009d950aea9b0ada8629509a68519e8b2ef484cc60b00c385444df6347248fb624d752dc8d529267b3b9f174893fac352f196a161bc9fbd9a7121363b6b3baf464d5d3c8ae960aa7b050394100bd983b65e9dffff59ca4a1425c5c41cbe876756d2f58f4e683df9fc60817b2a9a90260ac7dd365528a4bd06bca0748eb20c37d952438b538c45c7d97a24eb413ab1e984bb5a7f22846d1a4ec2105b58173c5b88171fefbc9b2ec1fdea1ad1ee3432d5884fc11c6e8acf62b218fdc72148dfb792426713449654308c05a7219144254744d0bc6cbadbcb852c4e8495c4acad180786094e0420eb95ec70b4d6ede5c6705dce2c43c94478890f9a56f1ffc4e6eee7713d09279f57adb002fc40a500fcdb43f75bdef131dbe60d9fc216e57448a463707b4fcc70a252c216abf5078248e1ebd5eea2d160575ab90467f4b58ed69c77583b95b1e435d054e2d40be21e8d6fa83bcf0f8c29788092f2009bf105e822005ec168145c659ab0ccff16c5d66deceb841f76f1a1b1a4b8451c5bd8425e40f1a0c8db6b32d909ee32fbb32d87f3e8cd7fb117529f223e335bcf601a95a0a15de5c6126aa8831f5a5c2025e2a2aa81592fc08b72676196ede389c7c61d5271b51e6918f80e960e3fb20683f947684a4139e4e99234f52d4bbf956601f978f10ca1fbfc9e33fc3e19652d22279908d88ccb1d2dd795686ade7bf2e8916d8676849c8fb07444e09331e230e1f56336e92145e44b5e040869fe7b53cd9236cd4170f03e82891350c32242edc65c4c57448af0b19abd64022dcaba69c72bf8db5f20e2f788fd7b6a3260ac7a20382c263effb7835c46d0212b634dea1a15010c1d79818c7db93cd720f337fba7211afeab1158ab9763152feaeefec323990ec1d02a50a1d84c2ad83cd0476c64ffc305b13298422a980af0637b1f79272e59274a261aac4bf0b349ad4336ffdf7bf42966ffebd5c57c24f2974510204cd46a09f1544ebf1ef3a0516e076f6ea46256435d498254be41accb9ccad0368545f57f319c94b53875d80cce9770aae690c3e30dac57111e70fb4e3af039c0754953f480ff9cbad9c8f6575654e94de11cd4330eb655b8fe4b33a792ac3fa9623ac51ac93b985928e1b234947f959ce511b78e02223d5cf95e54a87d01a6e8b26309545eda943eb5cba8f9feae8f8157bcf279391d4d36b0dd660479ccb7ae69f52f0b1da03cc0aafb9e7dd13e6f9e8f1b01dc4004c5508daf9522d4c0c54ed12b69bf621b9c9868081567e2018af3cab5e1f0bda608f38348a3758131484c11e3c66f8d097e2df41ecddb55565f2b5b45abc8cf75f52a38757943dc9f53d2e0d5641639c5c143fa21e1bfa3643436e6134256e57563b5a0b0b54519b313cb36f6b09744fe025dbff11aa6a9dfb693540d39de4cb15dac07d79816302a56e0c58c317530f372797bb7041aa897205fa327e3d54da0c0282d313a9d3549dea113fe6f45e82d2f7ea0fcd131d754a2b3a2a9930f6c032071eb6dd6ef804404fbaeee9aa88aa41e29fb2d4a82b1e22ed9004b6bd1e129f7c2164b2413c86aa16822b53378fdd5ad0dab05cdf9465c0da9a3dd2c083c5384782eaef4087c5c822d20c5e8534d304357d9a0f0584517be8bab2d72be4a52dd3755dc1a4332ac6b422fc3913121a09d91e10ea2d5d63dbb78843e0a055f348cca74d43fe93e933079305c41c932510272e3654c9a37148b0af3fbd40f27826158b70f41ccaea22767dff4e5127146274c01cb88e225612f78bb0a0c71d9dd403ce5bae18e21c958edb1bd347404675d999ccb114559671a365cb9b598652cc937f590b99b6fc8b77d241d21d5399c6fdf1bcd92a894a4a883136a31cc8f7a71edb05dc87dfcb78b37f9a828d49bf0b868f7c37aa586f0fefb8c72d19854d1c53caae67b8582eba2a412644ffcc17dd4c19b1ca28a68b1a89274f6f8422f538e9b48dead609576057fd468f7f543c4acbd69d0d3887801e9773ee843ea857a9d3ca63e497d69fbf060eea471d188de9192f2fed608f1c23dc2ff223cda5e6ed75e7f47031ca29dec257da34917a58bf537b6134211279e21bf94423881de07a180127888116afc536c265dbb362ac42ad960cc7723de3995e21db1e5a2c88a39aa84a5411a237dbd316c8169897b47fb444bb38636d470f4a4236d7603fa0981860f061efde4bd4a0b0bb0dfef5e2670b359d7506cff940fad906664175a9d52008fd112bc5bb86fef79d40176ba91d831decaf4625db34aef4533867585f9acc0308fd9aacfddd1b477cde8128bc75b40f3af01241ca33b55cbf6399d9d81a5f1f2c5a9d7c44762bc80e44ce07f4ec23f982a1084b54839a819776853f86446982b30b053dc8d0d9865c990ce8ea3a48869f0b10b5f88c500bc5a76530b80a0a7ee2702ae63932a5078329b3aaffb7c72543d404968b0378ff299bb856b3a0413d6aa1bbe7db9cb52857ca575c2115f8b2112d0dd391987fe89a90bf598f7fb70a57b0fb9c0498bc5b5aee30743562c2aa9278b1747def6417f6686c8ce081260188bacc4da04fa25007526b854fc7c74fb4ba046026fb83e06efc00771cf8f27c2aba40f0f270bdf927588d55d71e963dc18b3481d7b311ae97645eb540acecdfcb059163ba6910c9c79b79adce383498b51d53311da042e7e2d664d3f550f40e1ad4a60ecd4106f62fddb6329fd60c1cf856e4e8c7cda7626c2a0dc6af12c728d50981d3c40703350325c0454b0cd3e6b95d63754cb789a0b3761e5a043d05f7ed58633f6f23ce764fc4747d0d0423bb480b17b501c35af577074ca8e3e86b540f19dd5cf6e201be8ea9eff5a17f77df4ba3293c05720fa3ac9572af05f5e05b97a803ac9397a76930b8a94d42a8aee6f7b83f17bfe0c7ae7e27941761aa49b61bc442da5240463e4c87e2c54c33fc8836aacc4630bc48e774906f4c0067c9efd836d1b4265dbde9bb225eacbac98eff449cf7238a50919818818416f972c6e091d22e6c5dabc9d9c530fc1334f4f1a7172f72d97205ac46a127db1a46e69924f9a5fb9e05bd51fef4e1cb473b0086928320a4a04fc71a0d5c71526008c0df092e241c9f6ec5c444a38496b6e33230b4d81b2e5c0872fc576d6a7d1fe0170fdce3530a615267ff067f349edad0b84c3fe7ff992e7324808edae89e4d976d235016e6875b2b2d8b683a460e409407e1edf6186532e09163993514e9753a0b022aea51e0f10ddef86c3db97d5ce94e7b8066a85dfc38e3a26c1196e861574d279157219f794965e84bd732d293ce29d08d8a205acddecb3f70da04de96668e716729f291a7e2e5e49fb1cbec9161f81ada1ce509624da546587a7b7bee2b71d4e6b03f39fcbb46acec8749f6ba78bb1d59584246ac5cc1c3bf4131bddc945bf57a61e47c12281556b4980cad2ae20d354edffe06229a899ec0faf559e83f2e7db04cc41196100cc14265eac72a7e9efda09463a6f45280745ca90239d663cf11fbb96a7fe9c6183cc3f3e6184b5814afc5fa37852702954fe1dce407942ac4c667148e0e6770791baf6b911b3e24a3891ca6face4f28d390f892470cbd535c2fb6f777eb293ae3c667bef55934810df1bb884ec72da8977face25c13829aee4569d8cae7cc1f075af2318614f6667b096f9c6ed7a03da45b605223dab57c3a7ddfa6687c51afe089cd1acafa8016dd6dbd0a522e971af2899035237af2874253b28220919cfaf40f761024c8be97da58cb9ff056f9dc83f42b131c615765c272381d9b1d99eca2000f4724f60a1091e32b252e2aaccf71fcca440858ad92abfc0e84b0b32c80587259e258a113b1ce2dc14c43e79ce6a2a5dac4ea01c09c457f8e72c3cf039f1c5a398da5156eca5577292a2c43f2ee735fddebce015e32f239a96af5d68be5539343c3a82b4395b0574a88b82f5d2f8b877720bef124fe03acb740c39a3d14ed17347c28fdf0f0831108d226d4f49c363b34d23c15394b91ead40f92af1995a89dfee08136e33be72e2d6871f95bf19f9534dbcfd4ac6389cb1f5524ca02cec80c95a661646fbc5d2874f80c9b5de31379bfe1033f348b1807580feb443c76135ec64ab380644103c2ba5adf1cca809c61210df985200bbe6cb0ed3e6aa05fc5cecc5de6af3081354ffd597768fc642c13da1426bb5c9882f90d1eb7d60c91b311ad95319aba", 0x1000}, {&(0x7f0000001e00)="19f38e1300d2c6b0edd45d47cd8585b5dd018640a3e3938e2c23bba5797cba9ed8d1b9702bc562dc9c6b4a82aacac0cfd90da73e6c074527f8ea98f8e36c684018a77118701483138e381c906b711261a30e994e4069f0ceec62e7e870c3fca3411ae6b7edbe894ac036b6ff61c0027fca7252109a0dd9fa2e1bea886e4efb56e40c94bab1ae", 0x86}], 0x6, &(0x7f0000001f40)=[@ip_tos_u8={{0x11, 0x0, 0x1, 0x2}}, @ip_ttl={{0x14, 0x0, 0x2, 0xcb07}}, @ip_ttl={{0x14, 0x0, 0x2, 0x5}}, @ip_ttl={{0x14, 0x0, 0x2, 0x4a7}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {r7, @rand_addr=0x64010101, @empty}}}], 0x80}}, {{&(0x7f0000001fc0)={0x2, 0x4e20, @empty}, 0x10, &(0x7f0000002340)=[{&(0x7f0000002000)="bf41225d351b53866c9a8542ac3cd1da8f92a821efeb9c142d091fc5dfa744bb2521ef379b2c6aff15f666d5c918dceef92da40ea6d23a064004604d4ef0fe1b4446d1102321fcf95f0839852b0df5e23dc1119d1bdea7de5154cd577f1d27d7bea24984120a3beef2bb73ef535dcec57224c16254933caeecf50737530edd040f6b0042458b8e6976c5c95b9d98c887ddf6e7da3041399ed4ade7f63635e20fcb92d763a885b5438b1605eaea570919c2d7664c24cab6372baaf6b544fe0e6cb6e6fc1c49ba6087a5c1dae2209f0542284d210e2bab12ff4cd6fbebd408f45c8470bfb71b0cfcfca5e735b46288e1ed923ec8daa30f", 0xf6}, {&(0x7f0000002100)="e746bfd8d30b7cde4d74ca7584522c50e32255f0ad9571f4a0c35941700281b4d50c7e9d9ddc660e6a617dcd52756733832deac7ad705150cc8353a6588a93730d020133ac2b56addb31e44231eb415f50efa489c5045de18efa52756425bfb4bae8564fabaa56044aba97bd279c138e3f9238f8dfe2f6a41b88f8b494408beb4b33dcecb889e2a0864a7dbeed1635bb0aacdd44e5c2eeb1a59d9bfdeb3815826953dc5c705e7974b1532ea7b6c7ef7cd534279a19c8713cee4d7cdd243f541b5dd07516afbae5b62e22e8f6ef8a8510395135224c443564a07ef5ffb523a0a04d32f353342319d06069b2799cbd73a25b70492b", 0xf4}, {&(0x7f0000002200)="48e657a827df08a03ec0ceeca120112baec9f4c73b6311bba76739565ae5ac06abf938fd38c37fa9115d78dd079f921eead788d9bbea7250c4714ce5e772aa2c67d4616f761d3f1cd94da8a1dd9e0c31f02d80a30b72449eb35ef138d67456a68e621769a684aebfd2062608915dbbc39e04ec2f6dc8eb91593afc9593218639e8ac6caa83593bca1dae0472df3d9a0817935324241f9355815221fdf4c8a683104594f14ff8f456391b57face4200063583b6c0bdfae5981ebcee7fea51529c3b86", 0xc2}, {&(0x7f0000002300)="4f9419434a2db344c1f18613", 0xc}], 0x4}}, {{&(0x7f0000002380)={0x2, 0x4e24, @local}, 0x10, &(0x7f0000003980)=[{&(0x7f0000002480)="097790777b339d777a1871a444ff5053a165e3c4808e1e996569a8d08b1cbc000fb73b9af4b33b92218952a6", 0x2c}, {&(0x7f00000024c0)="c455204a002ddd2294b744aab844aa3ad40314151991f19b3d659e1c7d55685263eca71682b8994a256bec40987d0ce1ba6b0ce5b484cee9bf27bf5c20eddcce2e9c268b7d7c721ae4030f02", 0x4c}, {&(0x7f0000002540)="8b9f6fb90823b3474f3985f91eca0be2f135f4032d8cedf8b1fea2f55b16b626ceaf63625e2ea06f4aa06666b89a33708795a34a2a39fcf8c16f4e4b98cc1f4f8eead59be7f97caeb20663835355aa201f545e412ad6233b3a53a629bfe1bfd29fe1952fd52b25e2b9995206123e2a94a757e7f61d0c96a9632359d682269227b795a29c7d28f4c6a4ff7e446c38dc5cc715b354f54e659268598226f6b58a06ee01f93e00e1b0b8a3a103b9460440ea9531b263e5e250bba2b76755b1ecc0", 0xbf}, {&(0x7f0000002600)="b2a39c28256d313df187bac168fe90f00225fd0c081c77ac76b7d33fc9999eb7046b9d1538db39ea729ddf93cda026b21bd5be5f5142428c1a9809885ee69f1715f4cfb35c851259a4d1fca32b3beb3a6863814487c503f6a0bf5079b0b7e89c2f2d0066506da2c25c1bd263b64844b987ec3b191813c00e11b24ba00cdd9cef6905b9a0573c149b", 0x88}, {&(0x7f00000026c0)="766a2c807f18553ef36cc14d656554bc29c901c7aeb775aad05bd1fa0d59cd32503e7a963ee6825f42f3117313d34f9ca65fb1cd8f0453a0a066d27480d15d4961632d2fcf29f5c0a247871c2551a041610183dfd75b4745454759e8a274da21c5f88a0d2484afffbddc9551c15ef13830569386d1b701d2f231e5d5e6019509f5aeb1ce930d2603234139a041cd3dac8da6dd2b9a68929d793fa694f2c5e75c173e1aed3f1ce82f1da457749f541a6d6baf89a1356a5670b2128cd563166c3f8896abaaf43760f4fd907e19c99d4f8a404e6610ee4e7e7d133522026994bd3da6e1021bd54445afb9ff9a920daf9cb34f709703b0c66ca0c0e802d2e7cd6ed3397ddb0b3816f5833513712118aabf011635f6cbf0392179f23abbfad35f831ec70bba36bcb2e40298c90cd09c02b5e4e9760d2afaa044b000b13eb1da798ceacf16e74671d92e8d9d992842c3cb6a2a68b0f218056b10ee3d51fa8e7fa9a4f5eb8121d73e18851e698082ad8fcc34bbe197976ca35459da24a0962fa4c8703063c5fdea6ec7d40e699c94082fbd83bb9c1c6547702f8b4ef8eae5381e85397688e96df3deee5ee1020ba8ff1619bb9de61e2d1be67e1dc9e0d647f877599b1fae5545ba54985038c06eb5443cb9c859ffcf16345d98d4881a6ac2bc0a515710f23fde5612144b8a852fadcf792068fc073f7fb91f40e15be794398504ab8e2f80f0964a1e8685cbf1032a8fec7fd7f631201cf2202de5a8dfba25cac6e9a7632d5220303453ba6500b73eb19b92affcce7ff45766e9b34a52056bcf2cb8d5199a31bbc7b1e6dc5ec813714cc38dc52cf6acb2d6b07793cfe5d9adc300bab7e095953171305aaa035bfe9e60f3d465cebeec49cf8fb3c356793a7a90075cfe85fa5c2ed65225b39cce3613a903f464178f14928deec16775753b1114da8c06e51ec94c357065f02e9680070b8abfc79b780cc9454e2534a3295bf34b74f03a8095712b52a0957ddaa5752709566991cc7541dc1671566b436aa5449b46d2c3bd07b19ea942849cf8ca530b038a48fde5b7cf6a79bfa5b2c5ca2cc49f94617d803b212dbfd60770feff3e08d8da1f18f9df0a91ccb474f637de7ed88ea659be5f8ddcca112a8021e2395ed4ef681674e7b193620f7fb2d1cd9a23b9a74658d055ded19ac99bac986c4aed97797ec86c248932346c8d1e879d47cae6591a3160fea9d2b7ebeca5fac9e257fbc66ebfbcce158b6021aa51d39c3e16f972bf77f32cda7923058173b65b1f860a1792bd40e7fc0786287697d5b44d0ce8ee238fde332d765b04661c4f040e9e7ed4e044b76f9610e251a080542e7f910e87b42fb4b21d99e4075ed4449d24ac098217a8ac1c182dddcea6fa70a27a3ba5cbd1c799f591732b4ade4664d4dffeae7359ca8d60da6cf80ed9cdd394e3b08c2a89c4bf86ce25c248671d86b4d0722bdab850fe649e693d133df3d050d447378032753fc64f25c4e66505adb7a693c215486eb2be2fa31028a9fe093c4cfb1ade41bf26662690ea7424cb3c57fd48f333c8ae55d7955e8bba0a7c07800083729b240df8ec14207c52f312ea79a07159d3d9f128921ec6c4d818d14ed9830822c2b01523e92036bc957564b7d4537cc894056f74c2acced089ef34be08618b5537d068d6da19b8cf380e53f69ec8bf59ab7ce8bcd5e0e04d0b7bfaec34debc617e8e97254c04c78212ac4a84af2c1ef1015b19fd729f666973bb222abed89f3c10df162ea678460330f35a963fd88ee5a8bf36de290924001a0c45bbda10f01389005fafac2a27a16874c9fc6915eabb16e9505f3892986a116e9cc1b010c3be9fcbf3d093d5c9bbdea9bbcd76c6fc508eeac341b4082b3b363cd048175dea2f08e70b2bb96fcd4d52ac45f7d38f58ffa5273ea4de359109aa19d6900783c1e78794452f90f8c21d61c17a7b07bf095c4cbb3d07d7f7a6ed31c7ea4ac9f779ffff2c9750b56ee9d8ee593ab3873858f78ad824fdd57d82463b47463252f80d240fedd5c5529347986c3688a008f5f804d3003c8c600d4e245c5796f03e69ae1973dddde766a798cb39b175c3ce8cda82d03e4b663bd765e92d6480e6c2c62690b1784e46d7ecc26cebe6717d4a44e3b7cfce1ffe2aaeff6e7ac8c90ee44cc17d09389e6a0ca0652867375c4ac9788ec4f3cdb7ce45bd0c7842e9c9f77bfb237170459d037cd276a0c9e5b33ae65c1946d5487710e9c1b29761d81a5d48b26bc8215583b9d32734761a7ca1a527160b5e89d2756c062667dc26207fdada831b828869e6c57303f8da71c8a08a607aae9ba0d792a9cdf936d65b5492cb504ef68a8ec2fa0356fdbb8c523674a1f05cba8f476edf5680597f1282ed627600835336394aff8a246568f76a06849d2f9aeb40ecbe43ac5bb11f01a2e83d08a18b689428e1f828a1818aa1186f410f91afc382f265056f052d6c70e40bff4f47d6ae9c32e66135867193fa5f921b543a3f8fbb9621ec10f2a5bd4c5b1fa47adfd59a1a8737a5fa18e37d387dcdbf68d6a4a56cf9f1f4734aeced70a46123912885da0d538bf303d30d3f1f258c6d79249aed25cd894210a2e33be95ceb10711385992a25ec761d892fc4e28bbb6f5936d79814885734adc2f7284e825f387bb5182a945ee88221962dc8d051f01ce9efc43f326bd9c91e570c6e09480e89509a24384d6694a8267e96b4147f162209914c9e84745204af0c8239f2c8237e8bfedb8cc276539a99c54ea7d2bfc8e535065982f85d78efddc0b56f121140968b20f08273d432edd4a51ece80c31d6344c7aae8b54f65e8d020486ebb6802b90a070bafc3af89b6bbdeef055aca1ebf86879fce387456e337b209b7cf42a5c46d4d48639ea96be63fa43a3e2982e3c0ad6fd7d96e1ac3c405086708da8f13bdfdd285bd1949d6d85b1ae2b827211a25f11d0208aa4b9ef12edb39f76d84a573303f4a2b9e9e1bcf1afc654f26d0ce695ab6f63c68f845eba1cb889e3eab55c954a5f754a14c26c2414d28208f86dfaa02f444dc1e6216b7c8dfa3a60ab91ae798e51336af7708dc45f0ceac37effc4970adb46a0e95dea491e7312e16ed99736bbbfd15c0daf70bd7d640f8536e6ac9a6a20a391595ecc0a0bf2c2acdf33fa2bfb921db0b62443d63e0b88fe1dab1cbf705cf8c224b67dcbacddcf429d555e8b393be3476774a693ecddbd5c0f2dda3aa67c19af7318edf36155d0187482c94c00adbd6078273e1079c1b0022d5c643f3083888505cec1842f0c33be111c0ec6139d76c024f13ec658692082049d0234fac9507af7e4f45de8886539c33216a6cc8cb9e3a90add378a06f3356ff9ff9ae6fcf06c1bf8b2cc2bfb9b2ab46754848305110c3a09d40038449c01b0c6abda0f84b644e93419a0c2e3b98c5f1a970d287ce5130a9561a8bd51fc2cb9726930c32d2380338ba187e292cb70923006e5cf546de90fa0cfb2dc1ac14bad15cf3aa4253129d180fa5cecffe8f7bb3a7e57fbecc9f98fe170e57ce87fd7bbd0f299284f85346e42b62946f4fc1d8f06401651b3d1cf3b7f38e5a5182f07440f85e7a003142a8c97bf976c106cd9ee47168a286f484114bcb27a584bc30c04f2d629b198cd3347f7151a1bc0c2d11636c5264e48aac5d8249c0be60bf44fefe7505b40c218dbb6837e40caef54e712203db2a5a5c59b639340a23ce8ee11dbbf2a8f10c9603139174e48681583e75fcc30d46f6d36daf2da6cad1fcfee2358f0622b8200abf2b8665a3486a8c234f2fc9678f25b564ad246c9db4efe663badf169b8dd590799dcf9b84f5c4cd8c47700b56d3575e70d61f08d415e4795288d78c5a255232afd6d6e5adc7b65feabf0f9bb198a197f45fc4da50f2f6f08e165a5da9dac39bea01aeb6dfedfa7492b696a5a80ea5baa7cb4fc07053631c86b1d439d5af19864bb2d15b85758c8099dd0eb363197815f21da0d453cfb7b95a3c08ad170aadc00a19fd0b6ce6d2af8a2300f2ed1bbcf4983578bcd531594cee08c22e64573371adf7c55e048e9a55e91a54e728987241980405d276b2e783b5414ec6ad42ecf4548a45196b1f81cf152a4a50b3b2cce29d8686737b81a1827a143c3fb7167f7f24ca9b45e9bb9538dff4f67b685b908c0d0e3f72cb2adb73ac6d20531914252d65e2fc6a4a263b438396db4983635874ca0a4aa3142465f7238be76ab9c6a25d1f30614ccb94cf962499fd20d58b7663f5507417e93111777bf629cd3ba9e405e588a05ee67e2e8fb57fbfca3031a815cc9457c841b50cbd3f29dc29b1dbe0debee085683f9a7f1a25a9b14395caf5f81746becd894622a03a6a3a025da66d8ab30a2c45a322ce46350de4ed2cd6d74c5808310b623a6ecf2a473329847114103b7c60db5144801b24de6dc4947f95506464ea53b955118bca2912b26129cab5e96180ff4938b8b5219ab2b669343670059f566cbeefdcb1906558adebcc3fa0171df8d814388dcf93dd818ea49ba02cdca7135c04497bda37dd69fb2f747c1d487546237e791f29e4cf70fb7e73707ee49e17078e18b41d613e89833b8ffa5c885c7e2e29957da46d1f4ff4b0b09a100c4cd72c1ec892b2cbb4a01fd8f595358f7cb5185f54bd35c6aac0905c615f48b309f43e12d665914995955b5806c122b29b2fdcbe05829804b03433fc093950b4dee85a7d2313d2a3fd360c68e8fca5cfed2c6b943fa50c5f4905eb9bff3d62e977e47d3899135d5c8f6a8dc7f071c14e07be11f85dae0085c1eddb372a2cbbdc8a3dd12fb46107ccf9174273ae05e10236c06fc946d5aa69d9dd76ccda3ebcd28a36d3ce00f212f22947cac116f4418903aac253909e66d4905745c9a8c1d7d590dacd096e847bd8560ce5e6d70d4d23a20518ea9f9f64f48bc49294a2b514214d48bdd566fcd56a32961e3e6a67c40929b882260fe8ca48ab8f3c35087298e20fcffab0cb17f8b9a95f060b302fbedaa892c0e8b30071a6c12f087a6881a244ceef80423bc76aa2e7fed9a4828fc52ab0743e644e19e92825df19bfb17a8c2dfd3e430124fda624eb1aeefa9f665981162ab3ee4db9386ba01d0b97de4bf2f54304169da5b62003891641957f0522ea8ad5cbfc6728c9dc1c5a9abe70053d55a5cf00c6051bee2a62ea9fb71708eb9b62f37d6bafcf87b17d3cad0d69a61d28c10349b6ebe60f14a3db3a1c3a64f1c7ffd0d9f69d462720d61774a098624c49ba0e0dfdc260c9ad07b9dcb7ddb8fc54366c2b128a89a95a461ba0657b2771b10ef5bf6dfb2a698d073e26bc5f579f76a24c91f58e1c1e6f1de9ff5375da6d646096767102c1782fa0587a0974a989b5dbe7e4323d9babd53a3804a2ab5c0b66ee04960a638e374f10bd5f7df785c9188bf16df96164ac3a13e37c4d1501736342b70257186c7a28b2a81ba8b90d02e8ac2c68d97ec86ac673e0cb9e95af73a55843487c81ff85ec0bbff5002c14da6eaa5b646a5bda7dcbc41973a2f5c7b82cdec8e8a162f9725e7278b3a07f93b8d985828e05499e1f9e5f96e7a8f068bdc984bc70a07e817285e789a5950a0e750a542d97895bf846591a8f763a599c4e69ab7d09720afba3b78a63df64125ab05308cb076babc2e58a9be3f006e399948792079be0739255a271888f4e6b5d2aa7717ebf0543a693426b7d0b00fa1c2a2aac761b91e7a10f47b7e7ab1547b663700f23ea071069950987e62222ca4c7f1a8fa8f053b7b97301e1201edcaff980ae6b06ef35a9c782c313a35201330ca7176049c7d4f636", 0x1000}, {&(0x7f00000036c0)="3221e6b4da0a9d1cc4de1240e3b425b7efde241b51f011b8a6dc34f1768114267aebfccd54891b38192bfc7cf2a6461b143a5d82ce59a95d2a9e9f32c67d65ca9ebef631baf268a01d2d37ba4b21973e8c37641b0bc0b618c983b202efc30bb84d90860e49e9d4f338abbe5ab6ed12a2f22084e1fc04b90f6aca3d3f7cfccf705b25f63f7c87d83e7779709bd3d8c0112522506a50b0562308920d869aed47753a9a070ece34f77a0f734aaffb43d3df1e96f8f48885ebabbb34aaec53bb371ea59a4565ece32afb866db9d80fc1e55f", 0xd0}, {&(0x7f00000037c0)="7894001e7f1c20ac67da179dc2639dffdbc7a0b586bbba7bdc6014b91c8185990421aa8ea32b74eb6013558a013a5fb159d3834964f23f55f014a6ecc8cf8596c0223e6a", 0x44}, {&(0x7f0000003840)="e1d3b912557e31f852cda407cbf89dd91acf9c4cbc4c2a1d9758d9ba7720ce238f8ab441b7047b9131e34be6e59acb24ff04de009048", 0x36}, {&(0x7f0000003880)="f7a51e3420a27545a33474d43f5934f0721ef46ce281a3027b6db537ec84ec263582ef42173cb42cbddfa2f9d298f34d99bc6bae1573d52618bd48c1e9e3fd1abdf7a865a12619db690d324b38c5c5a1e3222935d9b10ddbaca6394cde5ce28a70cc97b9b3ebb0f1cc22802a5d84b4a0076a92da18424490a332acd5c795e0f3e2b3558fa704f977b57cc64b493e8f9a9f29e708ea8788cc6f4d64b280b36a8198704f32bd219b2e0d32028542acd0f0f72ec91c0c6231b791f356c0070c3b5acd83fd2fbf808427f6ff5c5dd474e5cc4d2493", 0xd3}], 0x9, &(0x7f0000003a40)=[@ip_retopts={{0xd0, 0x0, 0x7, {[@rr={0x7, 0x17, 0x58, [@dev={0xac, 0x14, 0x14, 0x2a}, @remote, @loopback, @empty, @empty]}, @ra={0x94, 0x4, 0x1}, @timestamp_prespec={0x44, 0x54, 0xb5, 0x3, 0xe, [{@loopback, 0xe}, {@private=0xa010102, 0x5}, {@broadcast, 0x1000}, {@private=0xa010102}, {@dev={0xac, 0x14, 0x14, 0x1c}, 0xd0d}, {@multicast1}, {@broadcast, 0xf0c5}, {@multicast2, 0x9}, {@remote, 0xfffffff9}, {@local, 0x8}]}, @timestamp={0x44, 0x8, 0x54, 0x0, 0x8, [0x710b]}, @cipso={0x86, 0x2a, 0x3, [{0x0, 0xb, "b935221d7e09959d0b"}, {0x1, 0x3, "9f"}, {0x5, 0x2}, {0x0, 0x5, "d8706b"}, {0x1, 0xf, "7d950e665c95daec1abb794fcd"}]}, @ssrr={0x89, 0x1f, 0x4f, [@local, @local, @rand_addr=0x64010102, @dev={0xac, 0x14, 0x14, 0x2f}, @rand_addr=0x64010100, @remote, @rand_addr=0x64010100]}]}}}, @ip_ttl={{0x14, 0x0, 0x2, 0x3}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x6}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x1}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0x3}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x5}}], 0x148}}], 0x4, 0x800) r8 = socket$alg(0x26, 0x5, 0x0) bind$alg(r8, &(0x7f0000000940)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r8, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5", 0x4) accept4(r8, 0x0, 0x0, 0x800) r9 = socket$inet_tcp(0x2, 0x1, 0x0) r10 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0x5, 0x10001, 0x9, 0x1}, 0x48) r11 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x11, 0xc, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x4000}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r10}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0xd, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000002440)={{r10}, &(0x7f00000023c0), &(0x7f0000002400)=r11}, 0x20) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) r13 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000800)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={r13, r12, 0x25, 0x0, @void}, 0x10) syz_emit_ethernet(0xfdef, &(0x7f00000005c0)=ANY=[], 0x0) 5.395207707s ago: executing program 1 (id=3210): unshare(0x6a040000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000080)={0x84, @rand_addr=0x64010100, 0x4e21, 0x3, 'wrr\x00', 0x1, 0xa8a, 0x30}, 0x2c) r1 = socket$kcm(0xa, 0x2, 0x0) setsockopt$IP_VS_SO_SET_ADDDEST(r0, 0x0, 0x487, &(0x7f0000000000)={{0x84, @rand_addr=0x64010100, 0x4e24, 0x3, 'lc\x00', 0x8, 0x323b, 0x55}, {@remote, 0x4e24, 0x10000, 0x0, 0x12d5c, 0x12d4c}}, 0x44) sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e22, 0x0, @dev, 0x9}, 0x80, 0x0}, 0x0) (fail_nth: 1) 4.934297679s ago: executing program 4 (id=3212): socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r3, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r3, 0x0, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32, @ANYBLOB="01000000000000001c0012000c000100626f"], 0x3c}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010001fff0000", @ANYRES64=r0, @ANYBLOB="0000000000000000140012800900010076657468000000000400028008000a00", @ANYRES32], 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x1, 0x8, &(0x7f0000002fc0)=ANY=[@ANYBLOB="7a0af8ff75257078bfa100000000000007010000f8ffffffb702000005000000bf130000000000008500000006000000b700000000000000950000ff00000000b2595285faa6ead0169191d54f8196217fc560e2fc91f6da4dad4fdc2eb1b5986fc4a3f611a7c8edd3aa5d6ee7ab10b1a297cf52866651ddd73f30f2382f6cda4bfdd45be583823c0f09621f3c1c65ee19ee875daf45006a4c4ea5e15b2f9618d547244a22000000000000db453620ce72d75946c2b638d91dbef661962239c77edf2d34b12cd48a1b20fb7dd8432619f2c50d77bc0ea9b0af58e6fff4942eb613eff289026d5045ef76d7d864409eb2dc9518a09f4886afc26abba34635d0e8b598a51bc742135a6e1d33fe226c944bc76be40d435aa8b5208ff0df2db761014b1b999a12df6bee431a668135b8214afa5827b56a8074bf1e6cf5d84b35a3a3a4c66824fe12dbe20fcf50a194185b9e2d8b815fedb0d982936156be3cdda66fb977aef7c9cb92428ef25d9bf665bd60024c09e9eed544126fabe4cb8d826e1ec03cc492f5cad6227c94fea467aea7fa8b58abc37056433edf43fba5566a3e022034ac81fd48f9b7314ffa730017fbd37fdb23bc26992529402a520ef67e246415a6a8ca9d4aa797a95ca3314ded0d8a24abd57e042888a9141ab4e6c6b939aaefc248791464970c43120211b9bc82a85cd2fc18f535c7986c2d52ba62f74f00000000008000000000000000000000000040000000000000"], &(0x7f0000000100)='GPL\x00'}, 0x48) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x32, &(0x7f0000002900)=r4, 0x4) bind$netlink(0xffffffffffffffff, &(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = socket(0x10, 0x803, 0x4) sendmsg$IPVS_CMD_SET_INFO(r6, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r6, &(0x7f00000001c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[], 0x4c}, 0x1, 0x0, 0x0, 0x9c51ab03a598108c}, 0x40000) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000900)={'bridge0\x00', @remote}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r7, 0x89a1, &(0x7f0000000900)={'bridge0\x00', @broadcast}) 4.112902463s ago: executing program 3 (id=3214): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000080)={'syzkaller1\x00', @broadcast}) r2 = socket$igmp(0x2, 0x3, 0x2) connect$inet(r2, &(0x7f00000000c0)={0x2, 0x4e20, @multicast2}, 0x10) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='devices.list\x00', 0x26e1, 0x0) close(r3) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xf, 0x4, 0x4, 0x12}, 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0xe, 0x4, &(0x7f0000000400)=ANY=[@ANYBLOB="18020000801000000000000004000000850000000700000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0xfc65, 0x0, 0x40f00}, 0x80) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000100)=ANY=[@ANYRES32=r0, @ANYRESDEC=r1, @ANYBLOB="05"], 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000740)={{r5}, &(0x7f00000006c0), &(0x7f0000000700)=r4}, 0x20) sendmsg$unix(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000440)=[{&(0x7f00000004c0)="e60d", 0x2}], 0x1, 0x0, 0x0, 0x4000000}, 0x10044001) ioctl$TUNSETOWNER(r0, 0x400454cc, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) (async) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) (async) socket$kcm(0x2, 0x3, 0x2) (async) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000080)={'syzkaller1\x00', @broadcast}) (async) socket$igmp(0x2, 0x3, 0x2) (async) connect$inet(r2, &(0x7f00000000c0)={0x2, 0x4e20, @multicast2}, 0x10) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='devices.list\x00', 0x26e1, 0x0) (async) close(r3) (async) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xf, 0x4, 0x4, 0x12}, 0x48) (async) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0xe, 0x4, &(0x7f0000000400)=ANY=[@ANYBLOB="18020000801000000000000004000000850000000700000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0xfc65, 0x0, 0x40f00}, 0x80) (async) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000100)=ANY=[@ANYRES32=r0, @ANYRESDEC=r1, @ANYBLOB="05"], 0x10) (async) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000740)={{r5}, &(0x7f00000006c0), &(0x7f0000000700)=r4}, 0x20) (async) sendmsg$unix(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000440)=[{&(0x7f00000004c0)="e60d", 0x2}], 0x1, 0x0, 0x0, 0x4000000}, 0x10044001) (async) ioctl$TUNSETOWNER(r0, 0x400454cc, 0x0) (async) 4.004055299s ago: executing program 4 (id=3216): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmmsg$inet6(r0, &(0x7f00000008c0)=[{{&(0x7f0000000100)={0xa, 0x4e24, 0x66a5, @private1={0xfc, 0x1, '\x00', 0x1}, 0x1}, 0x1c, &(0x7f00000002c0)=[{&(0x7f0000000180)="bf", 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f0000000580)}}], 0x2, 0x931766f6319eed44) unshare(0x7c060200) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="5c00000002060108000000000000000000000000050005000a000000050001000700000005000400000000000900020073797a3100000000150003006861"], 0x5c}}, 0x20084884) bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-twofish-avx\x00'}, 0x58) r2 = accept$alg(0xffffffffffffffff, 0x0, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000300), r3) sendmsg$IEEE802154_LLSEC_DEL_KEY(r3, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000980)={&(0x7f0000000900)=ANY=[@ANYBLOB='0\x00', @ANYRES16=r4, @ANYBLOB="010025bd5b00ffdbdf25280000000a0001007770616e3100000005002b000300000005002e007e000000"], 0x30}, 0x1, 0x0, 0x0, 0x40}, 0x4094) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) recvmmsg(r2, &(0x7f0000002340)=[{{0x0, 0x0, 0x0}, 0x2}, {{0x0, 0x0, &(0x7f0000000a00)=[{&(0x7f0000000740)=""/4, 0x4}, {&(0x7f0000000780)=""/244, 0xf4}], 0x2}, 0xfff}], 0x2, 0x2021, 0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r5) r6 = socket$inet6_mptcp(0xa, 0x1, 0x106) r7 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000a40)={0x1, 0x2a, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000097000000000000000020001818110000", @ANYRES32=r7, @ANYBLOB="0000000000000000b7080000000000007baaf8fe00000000bfa200000000000007020000f8fffdffb703000000000000b704000000000000b5001c008200000018120000", @ANYRES32=r7, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018110000", @ANYRES32=r7, @ANYRES32=r7, @ANYBLOB="0000000000000000b7080000000000007b8a00fe00000000bfa200000000000007020000f8ffffffb703000008000000b7040000010000008500000082000000bf91000000000000b7020000010000008500000085000000b70000000000000095"], &(0x7f0000000040)='syzkaller\x00', 0xf, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bind$inet6(r5, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x1}, 0x1c) listen(r6, 0x0) r8 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r8, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) r9 = accept(r6, 0x0, 0x0) getsockname$packet(r6, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000140)=0x14) syz_init_net_socket$llc(0x1a, 0x2, 0x0) getgid() socket(0x2, 0xa, 0x300) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="18000000020000000000000000ee000095"], &(0x7f00000002c0)='GPL\x00'}, 0x90) sendmsg$TEAM_CMD_OPTIONS_SET(r9, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[], 0xfffffdef}, 0x1, 0x0, 0x0, 0x800}, 0x10) recvfrom(r8, &(0x7f0000000080)=""/60, 0xfffffffffffffeeb, 0x101, 0x0, 0x0) 3.546288044s ago: executing program 3 (id=3218): r0 = socket$nl_audit(0x10, 0x3, 0x9) ioctl$sock_SIOCETHTOOL(r0, 0x8993, &(0x7f0000000100)={'bond0\x00', &(0x7f00000002c0)=@ethtool_channels={0x0, 0x0, 0x0, 0x9, 0x800, 0x1ff, 0x0, 0x0, 0x1}}) r1 = socket$rxrpc(0x21, 0x2, 0x2) sendmsg(r1, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=ANY=[], 0xfffffffffffffe95}, 0x4000814) recvmmsg(r0, &(0x7f0000000640)=[{{&(0x7f0000000040)=@xdp, 0x80, &(0x7f0000000240)=[{&(0x7f0000000140)=""/194, 0xc2}], 0x1, &(0x7f0000000300)=""/218, 0xda}, 0x3}, {{&(0x7f0000000400)=@rxrpc=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x0, 0x0, @private2}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000480)=""/84, 0x54}, {&(0x7f0000000500)}], 0x2, &(0x7f0000000580)=""/166, 0xa6}, 0xff}], 0x2, 0x41, &(0x7f00000006c0)) ioctl$SIOCGSTAMP(r0, 0x8906, &(0x7f00000000c0)) 3.14560359s ago: executing program 3 (id=3220): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000140)={0x0, 0xa00, &(0x7f0000000600)={&(0x7f0000000300)=ANY=[@ANYBLOB="5c0000000206010800000000000000000100000005000100070000000900020073797a30000000000c0007800800120000fffffe050004000000000016000300686173683a6e65742c706f72742c6e6574000000050005000a"], 0x5c}, 0x1, 0x0, 0x0, 0x4020045}, 0x0) 2.962376409s ago: executing program 3 (id=3222): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmmsg$inet6(r0, &(0x7f00000008c0)=[{{&(0x7f0000000100)={0xa, 0x4e24, 0x66a5, @private1={0xfc, 0x1, '\x00', 0x1}, 0x1}, 0x1c, &(0x7f00000002c0)=[{&(0x7f0000000180)="bf", 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f0000000580)}}], 0x2, 0x931766f6319eed44) unshare(0x7c060200) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="5c00000002060108000000000000000000000000050005000a000000050001000700000005000400000000000900020073797a3100000000150003006861"], 0x5c}}, 0x20084884) bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-twofish-avx\x00'}, 0x58) r2 = accept$alg(0xffffffffffffffff, 0x0, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000300), r3) sendmsg$IEEE802154_LLSEC_DEL_KEY(r3, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000980)={&(0x7f0000000900)=ANY=[@ANYBLOB='0\x00', @ANYRES16=r4, @ANYBLOB="010025bd5b00ffdbdf25280000000a0001007770616e3100000005002b000300000005002e007e000000"], 0x30}, 0x1, 0x0, 0x0, 0x40}, 0x4094) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) recvmmsg(r2, &(0x7f0000002340)=[{{0x0, 0x0, 0x0}, 0x2}, {{0x0, 0x0, &(0x7f0000000a00)=[{&(0x7f0000000740)=""/4, 0x4}, {&(0x7f0000000780)=""/244, 0xf4}], 0x2}, 0xfff}], 0x2, 0x2021, 0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r5) r6 = socket$inet6_mptcp(0xa, 0x1, 0x106) r7 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000a40)={0x1, 0x2a, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000097000000000000000020001818110000", @ANYRES32=r7, @ANYBLOB="0000000000000000b7080000000000007baaf8fe00000000bfa200000000000007020000f8fffdffb703000000000000b704000000000000b5001c008200000018120000", @ANYRES32=r7, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018110000", @ANYRES32=r7, @ANYRES32=r7, @ANYBLOB="0000000000000000b7080000000000007b8a00fe00000000bfa200000000000007020000f8ffffffb703000008000000b7040000010000008500000082000000bf91000000000000b7020000010000008500000085000000b70000000000000095"], &(0x7f0000000040)='syzkaller\x00', 0xf, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bind$inet6(r5, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x1}, 0x1c) listen(r6, 0x0) r8 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r8, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) r9 = accept(r6, 0x0, 0x0) getsockname$packet(r6, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000140)=0x14) syz_init_net_socket$llc(0x1a, 0x2, 0x0) getgid() socket(0x2, 0xa, 0x300) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="18000000020000000000000000ee000095"], &(0x7f00000002c0)='GPL\x00'}, 0x90) sendmsg$TEAM_CMD_OPTIONS_SET(r9, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[], 0xfffffdef}, 0x1, 0x0, 0x0, 0x800}, 0x10) recvfrom(r8, &(0x7f0000000080)=""/60, 0xfffffffffffffeeb, 0x101, 0x0, 0x0) 2.748987238s ago: executing program 0 (id=3223): bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0300000004000000040000000100000013000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYRES64], 0x50) 2.74841765s ago: executing program 1 (id=3224): socket$netlink(0x10, 0x3, 0xf) r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r0, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000001700)=ANY=[@ANYBLOB="b702000004000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0f800000000b7060000ffffffff7b6405000000000065040400210000000404000001e37c60b7040000000000006a0a00fe000000008500000032000000850000000200000095000000000000000ce0de7621e5e832249c04112cf7af2b75d0d1f034b1b3fb6bd3ce8fa62c7941272ff49142d860010ab162aa2264ab67e55a00000000000000edfe0969a9ddc125b686a1e83c8790c893d713b3295dad0ea697181d1e85b64126b5d72f204754d1d4a93f24215dee354e93cfc3f50ff23f8432c72012f021c84c59a9d4c142f439d3040cfee621589fb3a2f1407c7cbed48e7026f8d52d4bca2608c79aa4a73732028f88ce07ed1075da4a2ef44e3d8b88873f0b1de87dfb6d15936ec0a27cb554def9e27396df6b7851ffa26237ea6730880f06371beb3b290b7d8629a6f0373fefa0acb60888fc14ad2b83ca03ac2aee792482ced58af4140cc4ce3efef26e00c5b2200a91cb80c6065a697d6fc8aa8b65aee0783b04cff0218ce82c9687b4474da89c474c23727555fc5e5f8ad0f2f7a261140440fce1f12cc6df312accd011d888384283092d987c40bbb46f68c2431b97906f00000000349834fa147bd5923bbd4e606708034931a8f1a89bdf77093a0000427aab8e21e1a33d3fe093547532fce6549dd648ad233e05a7b3ea178007c1c32e871ac81f287c4aabbd153390b16d1d41ee433e3a54ea9ee82cf14f3a4cc523ee000000000009e106d6b5289f0000000000000000000000f7bc9f46cb71f6b889d37807865e3b4e9916dd0f72c9d58ea333b90f8886dcbf5ddda0e42ca08e3303632401f2f5212b40c0e88c957fd767dbfc80b07ad668b4f6f92fb209d7c2dbac597843c8eb7bf92fe6d0bb0b72549795c2ed19e441eb69869844152ba9da0588e42cdbc5fcd245ce5e3ef0dca64931276702a312db7956f0a75eb9caa17d47a6331c7c963cbf86a845ce27c26b7136d3e7207318b1df7a6320c64f18ccd926eaeddcde8d5006d6c38db117fb1115221a66169172720ccca770bff37e59511b2606138377eda44b2f288b491ab8aae0e11a98303b0e407e0f9d21f4a3ebbd3fabf6da9a1a1f869a339fab465d8322b7280b0734fd115a19b33c8644fff71b3c62f2e1b827e2663e06a751182e968c8ab05fb1d0115d4b11d944f2c06acc023a02b7416a9a10218d21503cda13bb5df6c992e52e1c01793b728eac000058ab3b3900d279297dadc127e2f38fc60c23af2e1fefa5a83456647191ba1953d335f59aa261fe79613df6bf43884e9649691e32680d75a541c27ffe74f9d13340f2cf1c7dc2b7db01213216cd4ecfd30efe137641471987289b7e23482e026b26eacd1b97443e2ea2d1d6e31a01ee0ae7fa195a2152b2338b086423a3883f2ce3e2f84e04f4d52c985eac4b46336908599564b47db0e6aa97ee51a360f4382fd99745725d44c77d097f69d19fe86f71c38a0226d44ebe0ecbd959f14b540745cd03b8c9f02b825ba45ca85706c73115f70871db9d2a1bc2a517b39f9648123917a5db07ba4e27f961373767e1ea8f7cc558e483abef1a9923c5cfa2081e430680950b7d7c377726b557ad31fdee17ba7057741f39d29d8ab295222f96297a777bb235416e72c84afef2bdb08fb375147b028b89f15af45bc8976b91158c13c9876daa71e7db0f5a17376be39ea79ce1246c547c740e31c64e5d293e0e5a544dd166010061d6ccae46c173b8e11721e4bce22c96af00000021f80ac6c3971006db853e3c40a5417d6eac09eb0e01ac6bd4c6dacdcb1d6d2ef9c8bdea91c984022821e961236d08f8b9072ec6cb5d5a68833fd5b4e80a5ac2bc6ff323f5ce612b59ce8177956c1affcc8baf4c8b59ab959aff9a7bd81f7c7c1f1bb92ddbeed6bce8041c7f0c1c584e6ae027678ce3cfbfea938aecc3c5119c5875b7fb35dc20f5c7aaae1e276104f607a73fe501c1045873a2b1eb80e95c87f099d98028dc82bdc7ef08c871fb3061c3c5ebd613e6e5e8cf099bb6e8c0441a133c85138b36a02c47fbedf7ed1d3ce74c9ec2c676c0b2d4b5eca61dbf5769b483c2a9f6bec666dae4e81960e9bad7f17cfc3d5bcc7b7f437110ca8ffa908c12086b2227eb202a8d56e0925ba994b05c98c39de44d25932449ddf08e5377814a40877eab4440ca01b3f50d2014a61a7d32105254b424238122386424efa3a7041254f686a5faac120942287f75e8e3db569ce47b120059d774a37e11d013be50cd2cbb00f6d2a23af61ec7d30bb7dc33a92f900b6ff1d29dc61cc40b846040dbafd00c6bcfbcf7af8ea5b4bd9593f73c6c95dd6d59483763debf02ea36803976b6cc145338e1"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xfffffffffffffffe}, 0x48) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000000040)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x0, 0x0, 0xffffffff}, 0x1c) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x4000) socket$packet(0x11, 0x2, 0x300) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f0000000040)='syzkaller\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r2, 0x5, 0x14, 0x0, &(0x7f0000000000)="259a53f271a76d2608004c6588a80a3888ca2f15", 0x0, 0xd11, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x40}, 0x50) 2.595344373s ago: executing program 0 (id=3225): r0 = socket$igmp6(0xa, 0x3, 0x2) getsockopt$MRT6(r0, 0x29, 0x21, 0x0, &(0x7f0000001440)) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="f00000001000130725bd700000000000fe8000000000000000000000000000bb00000000000000000000ffffac1414aa4e2200018000000402000060", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="fe80000000000000000034b51ed500bb0000000032000000fe8000000000000000000000000000aa0000000000000000fcffffffff9179b996fe11760ecaac48aeffffff08000000000000000a0000008b7100002a00000000000000000000000000000000000000000000000300000000000000000000000000000000000000000000000600000000000000f8ffffffffffffff0c000000000000000200000029bd70000000000002000000ac00000000000000"], 0x35}, 0x1, 0x0, 0x0, 0x20004040}, 0x4000) socket$nl_route(0x10, 0x3, 0x0) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) ioctl$BTRFS_IOC_SEND(r1, 0x40489426, &(0x7f0000000300)={{r2}, 0x2, &(0x7f0000000180)=[0x629, 0x0], 0xec1a, 0x8, 0x1}) setsockopt$inet6_int(r2, 0x29, 0x35, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'xfrm0\x00'}) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r4, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) ioctl$PPPIOCGL2TPSTATS(r3, 0x80487436, &(0x7f0000000540)="43210098") r5 = socket$inet_icmp(0x2, 0x2, 0x1) ioctl$sock_SIOCADDRT(r5, 0x890b, &(0x7f0000000280)={0x0, @l2tp={0x2, 0x0, @rand_addr=0x64010101, 0x3}, @nl=@unspec, @isdn={0x22, 0x2, 0x7, 0x2, 0x9}, 0xa55c, 0x0, 0x0, 0x0, 0x1, &(0x7f0000000240)='ip6_vti0\x00', 0x7, 0x4, 0x3}) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010600000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff1b000000020000000900010073797a30000001000900030073797a320000000014000000110001"], 0x7c}}, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) bind$xdp(0xffffffffffffffff, &(0x7f0000000100)={0x2c, 0x2}, 0x10) socket$inet6_icmp(0xa, 0x2, 0x3a) sendmsg$NFT_BATCH(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="140000001000040000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000058000000160a01000000000000000000010000000900010073797a30000000000900020073797a30000000002c0003800800014000000000080002400000000010000380140001007465616d3000000000000000000000005c000000160a0101000b000000000000010000000900020073797a30000000000900010073797a3000000000300003802c00038014"], 0xfc}}, 0x0) r8 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r8, 0x800448d4, &(0x7f0000000400)) sendmsg$NFT_BATCH(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a3c000000120a01020000000000100000020000000900020073797a310000000008000440000000000900010073797a3000000000080003400000000a14000000110001"], 0x64}}, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls}, 0x94) sendmsg$NFT_BATCH(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a34000000140affffffff00000000000002000009080003400000000a0900010073797a30000000000c000640000000000000000214000000020a010100000000000000000000000a14000000110001"], 0x70}}, 0x0) 2.291619201s ago: executing program 4 (id=3226): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r3, 0x0, 0xf3a, 0x0) close(r2) write(r0, 0x0, 0x0) mmap(&(0x7f00009fd000/0x600000)=nil, 0x600000, 0x100000d, 0x6031, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x1, 0x3, &(0x7f0000000140)=ANY=[], &(0x7f00000000c0)='syzkaller\x00', 0x5, 0x72, &(0x7f00000002c0)=""/209, 0x0, 0x21, '\x00', 0x0, 0x0, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0x1c}, 0x94) r4 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000380)={&(0x7f0000000080)=ANY=[@ANYBLOB="9feb010018000000000000001c0000001c00000003000000010000000000000e0200000000000000000000000000000604000000002e"], 0x0, 0x37}, 0x28) syz_80211_inject_frame(&(0x7f0000000500)=@device_b, &(0x7f0000000540)=@ctrl_frame=@ba={{}, {0x7}, @broadcast, @device_a, @multi={{0x1, 0x1, 0x1, 0x0, 0x7}, [{0x0, 0x0, {0x7, 0x25}, "d938e9ae09e8a107"}, {0x0, 0xc, {0x5, 0x15a}, "095f7d9b73d1f1ea"}, {0x0, 0x7, {0x3, 0xa71}, "9c899c5b9b14c3e5"}, {0x0, 0x7, {0x7, 0xffd}, "156983dda0fff456"}, {0x0, 0x8, {0x7, 0xd16}, "7e56c3ef04ce71bb"}, {0x0, 0x1, {0x5, 0x3}, "a311b97c33f1fab7"}, {0x0, 0x7, {0x7, 0x7}, "557db25770600b0a"}], {0x0, 0x2, {0x1, 0x4}, "4b01dfaf81adebd0"}}}, 0x72) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000003980)={r4, 0x20, &(0x7f00000002c0)={0x0, 0x0, 0x0, &(0x7f0000002b00)=""/171, 0xab}}, 0x10) bpf$ENABLE_STATS(0x20, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x13, &(0x7f0000000380)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c1300000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b7030000faffffff850000002d0000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000400000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$kcm(0xa, 0x3, 0x87) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x40241, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'veth1_to_hsr\x00', 0x0}) r7 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@newqdisc={0x88, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r6, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x1, [], 0x0, [0x1, 0x2, 0xfffe, 0x4a88, 0x0, 0x0, 0x0, 0x8, 0x0, 0x5c4, 0x8000, 0x0, 0x0, 0x3dc], [0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000]}}}}]}, 0x88}}, 0x20000000) sendmsg$nl_route_sched(r7, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000640)=@deltclass={0x70, 0x29, 0x400, 0x70bd27, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0xffe0, 0xfff3}, {0xfff3, 0xfff1}, {0x10, 0x7}}, [@tclass_kind_options=@c_sfb={0x8}, @TCA_RATE={0x6, 0x5, {0xff, 0x6}}, @TCA_RATE={0x6, 0x5, {0x9, 0xcf}}, @TCA_RATE={0x6, 0x5, {0x1, 0xc4}}, @TCA_RATE={0x6, 0x5, {0x2, 0x6}}, @TCA_RATE={0x6, 0x5, {0x5}}, @tclass_kind_options=@c_netem={0xa}, @TCA_RATE={0x6, 0x5, {0x0, 0x40}}, @TCA_RATE={0x6, 0x5, {0x2, 0xe}}]}, 0x70}, 0x1, 0x0, 0x0, 0x40001}, 0x4080) r8 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000600), r2) sendmsg$TIPC_NL_BEARER_DISABLE(r7, &(0x7f0000000b00)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000ac0)={&(0x7f0000001300)={0x38c, r8, 0x2, 0x70bd25, 0x25dfdbfb, {}, [@TIPC_NLA_BEARER={0x5c, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e24, @remote}}, {0x20, 0x2, @in6={0xa, 0x4e21, 0xffffc9b3, @dev={0xfe, 0x80, '\x00', 0x42}, 0x2}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x10000}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1000}]}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}]}]}, @TIPC_NLA_LINK={0x18, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}, @TIPC_NLA_LINK={0x48, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0x0, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}]}, @TIPC_NLA_LINK={0x19c, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x4c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1e04}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x10e6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1f}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xff}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0x24, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffb}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1b}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x63bc}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf7e}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x50000}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xfc60}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x0, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x44, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x81}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffafd}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}]}, @TIPC_NLA_LINK_PROP={0x24, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xf2d}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x200}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x11}]}, @TIPC_NLA_LINK_NAME={0x0, 0x1, 'syz1\x00'}]}, @TIPC_NLA_LINK={0x4}, @TIPC_NLA_BEARER={0x11c, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e23, @local}}, {0x14, 0x2, @in={0x2, 0x4e22, @rand_addr=0x64010102}}}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x11}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_WIN={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x7, @loopback, 0x3}}, {0x20, 0x2, @in6={0xa, 0x4e21, 0x6, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x7f}}}}, @TIPC_NLA_BEARER_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x301}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}]}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e24, @multicast2}}, {0x20, 0x2, @in6={0xa, 0x4e21, 0x8, @remote, 0x7}}}}, @TIPC_NLA_BEARER_NAME={0x13, 0x1, @l2={'eth', 0x3a, 'syzkaller0\x00'}}, @TIPC_NLA_BEARER_NAME={0xb, 0x1, @l2={'eth', 0x3a, 'lo\x00'}}]}]}, 0x38c}, 0x1, 0x0, 0x0, 0x4}, 0x8000001) close(0x4) r9 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp_SCTP_RTOINFO(r3, 0x84, 0x0, &(0x7f00000001c0)={0x0, 0xc0, 0x3, 0x2}, &(0x7f0000000480)=0x10) setsockopt$inet_sctp6_SCTP_MAXSEG(r9, 0x84, 0xd, &(0x7f00000004c0)=@assoc_id=r10, 0x4) r11 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r11, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @random="2b0436d23321"}) write$tun(r5, &(0x7f0000000000)=ANY=[@ANYBLOB="034886dd120005000000140000006000000008008700fe88a43de1a400000000000000007d01ff020000000000000000000000000001", @ANYRES16, @ANYRES64=r11], 0xfdef) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x4, 0x4, &(0x7f0000000700)=ANY=[@ANYBLOB="18000000ff01000000000000080000008111600000000000fea75cec488ea7e0"], &(0x7f0000000c40)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 2.244868319s ago: executing program 1 (id=3227): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) connect$bt_rfcomm(0xffffffffffffffff, &(0x7f0000000000)={0x1f, @any, 0x1b}, 0xa) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x1, 0x0, 0xfffc}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1, 0x0, 0x4}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x54, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_EXPRESSIONS={0x2c, 0x4, 0x0, 0x1, [{0x28, 0x1, 0x0, 0x1, @fib={{0x8}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_FIB_RESULT={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_FIB_FLAGS={0x8, 0x3, 0x1, 0x0, 0x20}, @NFTA_FIB_DREG={0x8, 0x1, 0x1, 0x0, 0x9}]}}}]}, @NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0xc8}, 0x1, 0x0, 0x0, 0x24000890}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001580)={0x11, 0x9, &(0x7f0000000340)=@raw=[@printk={@li, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x5d0f3b67}, {0x85, 0x0, 0x0, 0x5d}}, @exit], &(0x7f0000000200)='GPL\x00', 0x7, 0x0, 0x0, 0x41000, 0x4}, 0x94) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r3 = socket(0x400000000010, 0x3, 0x0) socket$unix(0x1, 0x5, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x3}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x42}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001380)=@newtfilter={0xc4, 0x2c, 0xd27, 0x70bd24, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, {0x4}, {}, {0x1, 0xe}}, [@filter_kind_options=@f_u32={{0x8}, {0x98, 0x2, [@TCA_U32_SEL={0x94, 0x5, {0x0, 0x6, 0x8, 0x101, 0x4, 0xe, 0x7, 0x2, [{0x8e5, 0x8b39, 0x3a, 0x40}, {0x8, 0x7, 0x9, 0x2d}, {0xffffff89, 0x9d2, 0x2, 0x10000}, {0x9, 0x3, 0x8, 0x8}, {0x0, 0x8, 0x3b7, 0x5}, {0x553e3387, 0x3, 0x8000, 0x2}, {0x8001, 0x4, 0x1}, {0xffffffff, 0xa8c, 0xfffffff8, 0xd}]}}]}}]}, 0xc4}, 0x1, 0x0, 0x0, 0x20000010}, 0x80) r4 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000380)=@newtfilter={0x38, 0x2c, 0xd27, 0x70bd27, 0x25dfdbff, {0x0, 0x0, 0x0, r5, {}, {}, {0xffe0, 0x5}}, [@filter_kind_options=@f_u32={{0x8}, {0xfffffed3, 0x2, [@TCA_U32_HASH={0x8, 0x2, 0xffffffff}]}}]}, 0x38}, 0x1, 0x0, 0x0, 0x20000000}, 0x20048850) sendmsg$nl_route_sched(r3, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@gettfilter={0x24, 0x2e, 0x205, 0x70bd2c, 0x25dfdafd, {0x0, 0x0, 0x0, 0x0, {0xc, 0xc}, {0x0, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x20000801}, 0x4041080) connect$bt_l2cap(r0, &(0x7f0000000040)={0x1f, 0xfff9, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x12}, 0x0, 0x1}, 0xe) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)={0xac, 0x2, 0x6, 0x5, 0x0, 0x0, {}, [@IPSET_ATTR_TYPENAME={0x12, 0x3, 'bitmap:ip,mac\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_DATA={0x3c, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8, 0x8, 0x1, 0x0, 0xd0}, @IPSET_ATTR_NETMASK={0x5, 0x14, 0x2}, @IPSET_ATTR_PORT_TO={0x6, 0x5, 0x1, 0x0, 0x4e23}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0x6}, @IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0xd}, @IPSET_ATTR_MARKMASK={0x8, 0xb, 0x1, 0x0, 0xbc}, @IPSET_ATTR_MAXELEM={0x8, 0x13, 0x1, 0x0, 0x3}]}, @IPSET_ATTR_DATA={0x30, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP_TO={0x18, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @loopback}}, @IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @rand_addr=0x1c02}}, @IPSET_ATTR_TIMEOUT={0x8, 0x6, 0x1, 0x0, 0xfffffffd}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0xac}}, 0x0) r7 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) ioctl$FS_IOC_FSSETXATTR(r8, 0x401c5820, &(0x7f0000000040)={0x92, 0x1000000, 0x0, 0x4000}) ioctl$sock_bt_hidp_HIDPCONNADD(r7, 0x400448c8, &(0x7f0000000200)={r8, r0, 0x8, 0x72, &(0x7f0000000180)="6d285cd825683ba690653259e9524d5d28bd1906a7e0d05be0b5c5865bf9e1dcea66d8630e9fd3000cc0bb6d4ef3a6b0dc9915c3325fddd488ae6207da5671ce8ce20c36172c2a02ebc6cfc028c1826e1bc12d5a22e52d53ae0e7da926722242e7bdab9eda53599cb03466318a39a056e03c", 0x5, 0xac, 0xd, 0xfff, 0x8416, 0x3, 0x9, 'syz1\x00'}) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) ioctl$XFS_IOC_GET_RESBLKS(r8, 0x80105873, &(0x7f00000002c0)) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x4000880) 1.828676599s ago: executing program 0 (id=3228): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000e40), r0) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r0, &(0x7f0000000f00)={0x0, 0x0, &(0x7f0000000ec0)={&(0x7f0000000e80)={0x30, r1, 0x1, 0x70bd2d, 0x25dfdbfc, {{}, {}, {0x14, 0x19, {0xfffffffe, 0x0, 0x6, 0x5}}}}, 0x30}, 0x1, 0xa6, 0x0, 0x20040004}, 0x2404c094) 1.710224352s ago: executing program 0 (id=3229): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x24}}, 0x0) getsockname$packet(r3, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x11, 0x4, 0x4, 0xff}, 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000000c0)={0x3, 0x8, &(0x7f0000000180)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r5}, {}, {0x85, 0x0, 0x0, 0x21}}]}, &(0x7f0000000080)='syzkaller\x00'}, 0x94) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r4, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000005c0)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)=@delchain={0x24, 0x2e, 0x501, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {0xfff2, 0xffff}, {0x0, 0xa}}}, 0x24}, 0x1, 0x0, 0x0, 0x8011}, 0x0) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x14, &(0x7f0000000000)={@dev, 0x0}, &(0x7f0000000040)=0x14) sendmsg$nl_route(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000140)=@newlink={0xa0, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x4, 0x0, 0xa300, 0x4}, [@IFLA_LINKINFO={0x80, 0x12, 0x0, 0x1, @vti={{0x8}, {0x74, 0x2, 0x0, 0x1, [@IFLA_VTI_LOCAL={0x8, 0x4, @broadcast}, @vti_common_policy=[@IFLA_VTI_FWMARK={0x8, 0x6, 0xed}, @IFLA_VTI_LINK={0x8, 0x1, r6}, @IFLA_VTI_OKEY={0x8, 0x3, 0x1}], @IFLA_VTI_REMOTE={0x8, 0x5, @rand_addr=0x64010100}, @IFLA_VTI_REMOTE={0x8, 0x5, @private=0xa010102}, @IFLA_VTI_REMOTE={0x8, 0x5, @empty}, @vti_common_policy=[@IFLA_VTI_OKEY={0x8, 0x3, 0x78bc}, @IFLA_VTI_FWMARK={0x8, 0x6, 0x80000001}, @IFLA_VTI_OKEY={0x8, 0x3, 0x5}, @IFLA_VTI_IKEY={0x8, 0x2, 0xffffffff}], @vti_common_policy=[@IFLA_VTI_OKEY={0x8, 0x3, 0x800}, @IFLA_VTI_FWMARK={0x8, 0x6, 0xcb9b}, @IFLA_VTI_FWMARK={0x8, 0x6, 0x6}]]}}}]}, 0xa0}, 0x1, 0x0, 0x0, 0x24008000}, 0x20000080) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000080)=@assoc_value, &(0x7f00000000c0)=0x8) 1.584687222s ago: executing program 1 (id=3230): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000300)=ANY=[@ANYBLOB="5c0000000206010800000000000000000100000005000100070000000900020073797a30000000000c0007800800120000fffffe050004000000000016000300686173683a6e65742c706f72742c6e6574000000050005000a"], 0x5c}, 0x1, 0x0, 0x0, 0x4020045}, 0x0) (fail_nth: 5) 1.296287192s ago: executing program 3 (id=3231): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000000040)=@req3={0x2, 0x3a, 0x1000, 0x3a, 0x4bd1bfda, 0x0, 0x6}, 0x1c) (async, rerun: 64) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000100)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) (async, rerun: 64) r1 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_INIT(r1, 0x0, 0xc8, &(0x7f0000003d40), 0x4) (async) setsockopt$MRT_ADD_VIF(r1, 0x0, 0xca, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, @vifc_lcl_addr=@local, @dev}, 0x10) (async) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$inet_mreq(r2, 0x0, 0x23, &(0x7f0000000000)={@multicast1=0xe0000300, @local}, 0x8) (async, rerun: 32) socket$nl_route(0x10, 0x3, 0x0) (rerun: 32) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r3, 0x6, 0x13, &(0x7f0000000180)=0x100000001, 0x4) (async, rerun: 64) connect$inet6(r3, &(0x7f0000000300)={0xa, 0x4e22, 0x2, @loopback, 0x5}, 0x1c) (rerun: 64) setsockopt$inet6_tcp_TCP_ULP(r3, 0x6, 0x1f, &(0x7f0000000540), 0x3) (async) setsockopt$inet6_tcp_TLS_TX(r3, 0x11a, 0x1, &(0x7f0000000000)=@gcm_256={{0x304}, '\x00', "e8582491a0c4050000000000f6542a9b6800000000000000003967d2daa45b4e", "61241765", "9b1f80001b00"}, 0x38) (async) sendmsg$inet(r3, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=ANY=[], 0x3}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000007500)=ANY=[@ANYBLOB="280000003e00070128bd7000fddbdf25017c00000400fc800700018035d20000080002cbed47ad80"], 0x28}, 0x1, 0x0, 0x0, 0xc000}, 0xc040) (async) syz_emit_ethernet(0x1e8, &(0x7f0000000140)={@local, @remote, @void, {@ipv6={0x86dd, @icmpv6={0x2, 0x6, "dddb82", 0x1b2, 0x3a, 0x6ecca1fa3a329e20, @remote, @private1, {[@fragment={0x84, 0x0, 0x8, 0x0, 0x0, 0x6, 0x67}, @hopopts={0x2, 0xe, '\x00', [@generic={0x4, 0x5a, "1c2bc4c9a793848f40e5f8db79bc36789c023025768093c1adcd0db318240f88885df64a51ab30ad9df5119a36218eda9b1de2cd7052068bf736de9e76cae8be347ce1a70bee5c420ddbcba7ba119020b4c2b0b66e522da812d4"}, @generic={0xcc}, @hao={0xc9, 0x10, @dev={0xfe, 0x80, '\x00', 0x16}}]}, @dstopts={0x0, 0x15, '\x00', [@jumbo={0xc2, 0x4, 0x6}, @generic={0x0, 0x9f, "f95ae8f84c07351a27c9948b2b513b1c82c403ae782a1134eccaafbc6baa3d1c4e96b457c1bcc6f6575832937214d14d3ef5396cf516820616335bceacb78596467e169258ce79326f386d2fed94fd07d27e029708840c5490169aadc45c88db06caf89b50ae7800bdae84272e980c515b65675ae1964cb470eed17c109aa95e378992b594c0ff6ae9814d68738a66f94240b4254e6df6feb6d402320024cd"}, @padn={0x1, 0x1, [0x0]}, @pad1]}], @echo_reply={0x81, 0x0, 0x0, 0xc, 0x0, "8df3a25474dc1935c476e8ab638587d84ea7da1c420475c77cad79b862075ffd75225800c3d5ba16b6740d36c1d2960f6eae20b744a312103e0ac4925a2e00d975f46ff6ff87de8de4d2eba856ca7383e63e1d9631fe529dcc38ab3645ddb35fb6ac80e995e10befd060cd7ad0db8a735939"}}}}}}, 0x0) setsockopt$MRT_ADD_MFC_PROXY(r1, 0x0, 0xd2, &(0x7f00000000c0)={@multicast1=0x1c, @empty=0xe0000300, 0x0, "8a79348df081496d0420922f45a71c1daa8b610468cd140526c41efcd3a4a422", 0x3, 0x1, 0x85}, 0x3c) r5 = socket$netlink(0x10, 0x3, 0x4) (async, rerun: 64) r6 = socket$kcm(0x10, 0x2, 0x0) (rerun: 64) sendmsg$kcm(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000a80)="d80000001d0081044e81f777db44b904021d080201000000040000a1bc0001000000000000000e1208000f0100810401a8001600200001400300000803600cfab94dcf5c0461c16fb4007134cf6ee0809999691f801bcb090000001fb791643a5ee4001b146218a07445d6d930dfe1d9d322107c9fd600"/129, 0x81}, {&(0x7f00000003c0)="54f6d4d87e06f140c5f0cc61f6ab659b0a3fabae55153b05509ba735eb7a985d8caeeac70478239588ef6fc9faf9f3787be64ab2656caec0675ebf087a0075984e4c9d9b070a0bf82bc087529f7de2b7a310faca4944ecfc7de17791504569f3edc76b86660c00d5b0630e510723fdaf9a83baf43f4b6ee4763d6432c069feff3eb34cd93087f6868945ce9b808e1ae68c574b6dedb567fc6e451124f7a21d664aaca80ad01c32def4a9f0193a296cffc4906c984ad2805acef7668e60bc1162d503f70b7ea05271dc2f4e67f6939fd82ccf8b6c90e43220e077c293c40999f627", 0xffffffffffffffa6}], 0x2, 0x0, 0x0, 0x7400}, 0x10) (async) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000340), &(0x7f0000000380)=0xc) (async) write(r5, &(0x7f0000005c00)="2700000014000707030e0000120f0a0011000100f5fe0012ff000000078a151f75080039000500", 0x27) 1.172944969s ago: executing program 1 (id=3232): r0 = socket$kcm(0x29, 0x2, 0x0) sendmmsg$inet(r0, &(0x7f0000007ac0)=[{{&(0x7f0000000180)={0x2, 0x4e23, @remote}, 0x10, &(0x7f00000003c0)}}, {{0x0, 0x0, &(0x7f0000000940)=[{&(0x7f0000000480)="7349b402ed", 0x5}, {0x0}], 0x2}}, {{0x0, 0x0, &(0x7f0000000b40)}}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x5, 0x20004040) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000940)=ANY=[@ANYBLOB="daacf48190d6b8ee28bd7000ffdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="004000001883000008002e0003000000"], 0x28}, 0x1, 0x0, 0x0, 0x2000c014}, 0x0) 1.084066304s ago: executing program 1 (id=3233): r0 = socket(0x840000000002, 0x3, 0x100) ioctl$sock_inet6_tcp_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000640)) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) r1 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000000)={'vxcan1\x00', 0x0}) bind$can_j1939(r1, &(0x7f00000000c0)={0x1d, r2, 0x0, {0x0, 0x0, 0x3}, 0xfe}, 0x18) connect$can_j1939(r1, &(0x7f0000000140)={0x1d, r2, 0x1, {0x1, 0xff, 0xa8fe8ad4eea2351f}, 0x2}, 0x18) r3 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x50) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000140)={'erspan0\x00', &(0x7f0000000780)={'sit0\x00', 0x0, 0x8, 0x700, 0x2, 0x0, {{0xc, 0x4, 0x2, 0x2e, 0x30, 0x68, 0x0, 0xfc, 0x2f, 0x0, @remote, @initdev={0xac, 0x1e, 0x1, 0x0}, {[@lsrr={0x83, 0x13, 0xf2, [@dev={0xac, 0x14, 0x14, 0x24}, @rand_addr=0x64010101, @multicast2, @rand_addr=0x64010102]}, @end, @rr={0x7, 0x7, 0xd4, [@dev={0xac, 0x14, 0x14, 0x2c}]}]}}}}}) setsockopt$inet_mreqn(r0, 0x0, 0x24, &(0x7f00000003c0)={@rand_addr=0x64010101, @rand_addr=0x64010100, r4}, 0xc) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1f, 0x18, &(0x7f0000000580)=ANY=[@ANYBLOB="180000000000000000000000feffffff18010000786c6c2500000000002020207b1af8fe00000000bfa100000000000007010000f8ffffffb702000008000000b7030000070000008500000006000000b7080000000000007baaf8ff00000000b5080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r3, @ANYBLOB="0000000000000000b70500000800000085000000a700000095"], &(0x7f0000000740)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x10, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000000)={r5}, 0xc) sendmmsg$inet(r0, &(0x7f0000005240)=[{{0x0, 0x0, 0x0}, 0xfffffdef}], 0x4000095, 0x0) syz_emit_ethernet(0x5a, &(0x7f0000000400)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaabb08004e00004c00000000000690780a210104ac1414aa44140701e000000100000000e000000100800000070d064d291a00000000d05c4900000000000000", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="9689ae0b90780007"], 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0x13, 0x3, &(0x7f0000000040)=ANY=[@ANYBLOB="660a00000000000061114cfcffffffffffffffb73e683b26"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r6, &(0x7f0000000100)=ANY=[], 0x32600) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="1c00000007060108000000000000000000000000050001"], 0x1c}}, 0x0) r8 = socket$kcm(0x21, 0x2, 0xa) sendmsg$kcm(r8, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)=ANY=[], 0x18, 0x68000000}, 0x80fe) r9 = socket$kcm(0x21, 0x2, 0xa) sendmsg$kcm(r9, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)=ANY=[], 0x18, 0x68000000}, 0x80fe) close(0x4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) r10 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000005"], 0x48) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000180)={r10, &(0x7f0000001380), &(0x7f0000000000)=""/10, 0x2}, 0x20) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r6, 0x0) ioctl$sock_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000006c0)={0x0, @nl=@kern={0x10, 0x0, 0x0, 0x1000}, @vsock={0x28, 0x0, 0x2710, @my=0x1}, @hci={0x1f, 0x4, 0x2}, 0x4, 0x0, 0x0, 0x0, 0x2, &(0x7f0000000680)='gretap0\x00', 0x9, 0x10001, 0x20}) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000440)=@bpf_tracing={0x1a, 0x0, 0x0, 0x0, 0x1, 0x97, &(0x7f0000000240)=""/151, 0x41100, 0x0, '\x00', 0x0, 0x17, r6, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x26fbe, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0xf3}, 0x94) 891.960399ms ago: executing program 0 (id=3234): bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0300000004000000040000000100000000130000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYRES64], 0x50) 630.352312ms ago: executing program 0 (id=3235): r0 = socket$netlink(0x10, 0x3, 0x0) ioctl$XFS_IOC_PATH_TO_HANDLE(r0, 0xc0385869, &(0x7f0000000180)={r0, &(0x7f0000000000)='\x00', 0x0, &(0x7f0000000080)={@align=0x4, {0xf31, 0x1, 0xfffffffa, 0x80000000}}, 0xffffffff, &(0x7f0000000100)={@_ha_fsid}, &(0x7f0000000140)=0xff}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x320, 0x150, 0x168, 0x9, 0x150, 0xb, 0x250, 0x250, 0x250, 0x250, 0x250, 0x3, 0x0, {[{{@ipv6={@remote, @rand_addr=' \x01\x00', [], [], 'veth0_to_bridge\x00', 'sit0\x00', {}, {}, 0x6c}, 0x6000000, 0x108, 0x150, 0x0, {0x0, 0x28e}, [@common=@inet=@ipcomp={{0x30}, {[], 0x74c8aad696aabd1d}}, @common=@inet=@ipcomp={{0x30}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@mcast2, 'dvmrp0\x00'}}}, {{@uncond, 0x0, 0xd0, 0x100, 0x0, {}, [@common=@inet=@set2={{0x28}}]}, @common=@inet=@SET2={0x30, 'SET\x00', 0x2, {{}, {0x2}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x380) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=@dellink={0x28, 0x11, 0x1, 0x0, 0x0, {}, [@IFLA_NET_NS_PID={0x8}]}, 0x28}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) r5 = socket$inet6(0xa, 0x2, 0x0) unshare(0x2a020400) r6 = socket(0x1, 0x80801, 0x1) setsockopt$inet6_tcp_int(r6, 0x11e, 0x1, 0x0, 0x0) close(r5) r7 = socket$l2tp6(0xa, 0x2, 0x73) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r7, 0x29, 0x20, &(0x7f0000000080)={@remote, 0x800, 0x0, 0x3, 0x1, 0x8}, 0x20) shutdown(r6, 0x1) setsockopt$inet6_int(r5, 0x29, 0x1000000000021, &(0x7f0000000040)=0x2005, 0x4) sendmsg$inet6(r7, &(0x7f0000000140)={&(0x7f0000000100)={0xa, 0x4e60, 0x80000, @dev={0xfe, 0x80, '\x00', 0x3d}, 0xfffffffb}, 0x1c, 0x0, 0x0, &(0x7f00000001c0)=[@dstopts={{0x18, 0x29, 0x37, {0x16}}}], 0x18}, 0x3400c8d4) bind$inet(r4, &(0x7f0000000000)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x12}}, 0x10) r8 = socket$netlink(0x10, 0x3, 0x0) ioctl$XFS_IOC_FSINUMBERS(r4, 0xc0205867, &(0x7f0000000fc0)={&(0x7f0000000e80)=0x3, 0x3, &(0x7f0000000ec0)=[{}], &(0x7f0000000f80)}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000000)={'lo\x00'}) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000001000)=ANY=[@ANYBLOB="3c0000001c00070c002000000000000002000000", @ANYRES32=r10, @ANYBLOB="0800100014000100000000000000000000000000000000000a0202a1ce8e2928004f328a67ad89005b8c63101da88c7387a86bb0bc3fa500"], 0x3c}}, 0x20024090) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x13, &(0x7f0000000040)={0x0}}, 0x2004c010) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="3800000054000147880000000000000007008209", @ANYRES32=r0, @ANYBLOB="20000100", @ANYRES32, @ANYBLOB="00001000e000030000010001000000000000000008"], 0x38}}, 0x0) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0) 251.376152ms ago: executing program 4 (id=3236): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=@newqdisc={0x44, 0x24, 0x2, 0x200000, 0x0, {0x60, 0x0, 0x0, r2, {}, {0xffff, 0xffff}, {0x0, 0xd}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x14, 0x2, [@TCA_CAKE_DIFFSERV_MODE={0x8, 0x3, 0x2}, @TCA_CAKE_AUTORATE={0x8, 0x9, 0x9}]}}]}, 0x44}}, 0x24008004) ioctl$XFS_IOC_FSCOUNTS(r0, 0x80205871, &(0x7f0000000000)) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={0x0}, 0x9}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_GET_NEIGHBORS(r3, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x24, 0x0, 0x20, 0x70bd28, 0x25dfdbfd, {}, [@BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0xd3}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004}, 0x8800) 119.052902ms ago: executing program 4 (id=3237): r0 = socket$inet6(0xa, 0x2, 0x0) close(r0) r1 = socket$l2tp6(0xa, 0x2, 0x73) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f0000000040)=0x2005, 0x4) sendto$l2tp6(r1, 0x0, 0x0, 0x4000040, &(0x7f0000000540)={0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x100, 0x2}, 0x20) r2 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000140), 0xffffffffffffffff) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000440)={0xffffffffffffffff, 0xe0, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa, &(0x7f0000000000)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x8, 0x4, &(0x7f0000000080)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000100)=[0x0, 0x0, 0x0, 0x0], 0x0, 0x23, &(0x7f0000000240)=[{}], 0x8, 0x10, &(0x7f0000000280), &(0x7f00000002c0), 0x8, 0x7e, 0x8, 0x8, &(0x7f0000000300)}}, 0x10) sendmsg$ETHTOOL_MSG_LINKINFO_SET(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f00000000c0)={0x28, r3, 0x2, 0x70bd2a, 0x25dfdbfd, {}, [@ETHTOOL_A_LINKINFO_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}]}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x4}]}, 0x28}, 0x1, 0x0, 0x0, 0x20009805}, 0x40040c0) sendmsg$ETHTOOL_MSG_LINKMODES_SET(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[], 0x44}, 0x1, 0x0, 0x0, 0x2400c054}, 0x404c094) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x34, 0x10, 0x100, 0x0, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, 0x0, 0x1001}, [@IFLA_XDP={0x13, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8}]}, @IFLA_GROUP={0x8}]}, 0x34}, 0x1, 0x0, 0x0, 0x20048011}, 0x20000014) syz_emit_ethernet(0x56, &(0x7f0000000180)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaaaa88a800008100000086dd6076cd8a00180000fe80000000000000000000bf00000000000200000000000007080000000100000000c204ff"], 0x0) 0s ago: executing program 4 (id=3238): unshare(0x6a040000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000080)={0x84, @rand_addr=0x64010100, 0x4e21, 0x3, 'wrr\x00', 0x1, 0xa8a, 0x30}, 0x2c) r1 = socket$kcm(0xa, 0x2, 0x0) setsockopt$IP_VS_SO_SET_ADDDEST(r0, 0x0, 0x487, &(0x7f0000000000)={{0x84, @rand_addr=0x64010100, 0x4e24, 0x3, 'lc\x00', 0x8, 0x323b, 0x55}, {@remote, 0x4e24, 0x10000, 0x0, 0x12d5c, 0x12d4c}}, 0x44) sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e22, 0x0, @dev, 0x9}, 0x80, 0x0}, 0x0) kernel console output (not intermixed with test programs): 0x40c/0x560 [ 328.665795][T14192] should_failslab+0xa8/0x100 [ 328.665824][T14192] __kmalloc_cache_noprof+0xa8/0x660 [ 328.665851][T14192] ? ovs_ct_limit_cmd_set+0x2f8/0xb00 [ 328.665870][T14192] ? ovs_ct_limit_cmd_set+0x2f8/0xb00 [ 328.665897][T14192] ovs_ct_limit_cmd_set+0x2f8/0xb00 [ 328.665943][T14192] genl_family_rcv_msg_doit+0x233/0x340 [ 328.665973][T14192] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 328.666009][T14192] ? bpf_lsm_capable+0x9/0x20 [ 328.666033][T14192] ? security_capable+0x7e/0x2c0 [ 328.666058][T14192] genl_rcv_msg+0x614/0x7a0 [ 328.666081][T14192] ? __pfx_genl_rcv_msg+0x10/0x10 [ 328.666098][T14192] ? __pfx_ovs_ct_limit_cmd_set+0x10/0x10 [ 328.666118][T14192] ? __pfx_ref_tracker_free+0x10/0x10 [ 328.666156][T14192] netlink_rcv_skb+0x226/0x4a0 [ 328.666181][T14192] ? __pfx_genl_rcv_msg+0x10/0x10 [ 328.666199][T14192] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 328.666235][T14192] ? down_read+0x2be/0x330 [ 328.666268][T14192] genl_rcv+0x28/0x40 [ 328.666284][T14192] netlink_unicast+0x7bb/0x940 [ 328.666316][T14192] netlink_sendmsg+0x813/0xb40 [ 328.666346][T14192] ? __pfx_netlink_sendmsg+0x10/0x10 [ 328.666372][T14192] ? aa_sock_msg_perm+0xf1/0x1b0 [ 328.666399][T14192] ? __pfx_netlink_sendmsg+0x10/0x10 [ 328.666423][T14192] sock_sendmsg_nosec+0x13a/0x180 [ 328.666456][T14192] ____sys_sendmsg+0x54e/0x850 [ 328.666491][T14192] ? __pfx_____sys_sendmsg+0x10/0x10 [ 328.666526][T14192] ? import_iovec+0x73/0xa0 [ 328.666553][T14192] ___sys_sendmsg+0x2a5/0x360 [ 328.666577][T14192] ? __lock_acquire+0x683/0x2cf0 [ 328.666610][T14192] ? __pfx____sys_sendmsg+0x10/0x10 [ 328.666668][T14192] ? __fget_files+0x2a/0x420 [ 328.666701][T14192] ? __fget_files+0x3a2/0x420 [ 328.666734][T14192] __x64_sys_sendmsg+0x1b1/0x290 [ 328.666759][T14192] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 328.666801][T14192] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 328.666821][T14192] do_syscall_64+0x174/0x580 [ 328.666846][T14192] ? trace_irq_disable+0x3b/0x140 [ 328.666872][T14192] ? clear_bhb_loop+0x40/0x90 [ 328.666896][T14192] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 328.666916][T14192] RIP: 0033:0x7fabfe99e019 [ 328.666935][T14192] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 328.666952][T14192] RSP: 002b:00007fabff8f4028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 328.666973][T14192] RAX: ffffffffffffffda RBX: 00007fabfec25fa0 RCX: 00007fabfe99e019 [ 328.666987][T14192] RDX: 0000000004008094 RSI: 0000200000000100 RDI: 0000000000000003 [ 328.667000][T14192] RBP: 00007fabff8f4090 R08: 0000000000000000 R09: 0000000000000000 [ 328.667013][T14192] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 328.667025][T14192] R13: 00007fabfec26038 R14: 00007fabfec25fa0 R15: 00007fffbd0a2ce8 [ 328.667058][T14192] [ 329.056791][T14195] lo speed is unknown, defaulting to 1000 [ 329.303861][T14203] netlink: 7 bytes leftover after parsing attributes in process `syz.3.2234'. [ 329.520347][ T4940] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 329.547948][T14220] faux_driver regulatory: loading /lib/firmware/regulatory.db.p7s failed with error -4 [ 329.571011][T14220] faux_driver regulatory: Direct firmware load for regulatory.db.p7s failed with error -4 [ 329.589962][T14220] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db.p7s [ 329.610991][ T95] IPVS: starting estimator thread 0... [ 329.730500][T14227] IPVS: using max 30 ests per chain, 72000 per kthread [ 329.802735][T14236] netlink: 240 bytes leftover after parsing attributes in process `syz.4.2240'. [ 329.925454][T14235] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2243'. [ 330.188063][ T95] IPVS: stop unused estimator thread 0... [ 330.366448][T14242] vlan3: entered allmulticast mode [ 330.382077][T14242] veth1_to_hsr: entered allmulticast mode [ 330.431095][T14242] bridge6: trying to set multicast query interval below minimum, setting to 100 (1000ms) [ 330.725997][T14269] syzkaller0: entered promiscuous mode [ 330.744317][T14269] syzkaller0: entered allmulticast mode [ 331.115108][T14290] geneve0: entered promiscuous mode [ 331.132587][T14290] geneve0: entered allmulticast mode [ 331.210675][ T9078] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 331.233472][ T9078] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 331.264638][ T9078] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 331.294329][ T9078] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 331.559034][T14305] __nla_validate_parse: 11 callbacks suppressed [ 331.559054][T14305] netlink: 164 bytes leftover after parsing attributes in process `syz.3.2259'. [ 331.686345][T14305] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2259'. [ 332.024823][T14332] sctp: [Deprecated]: syz.0.2262 (pid 14332) Use of int in maxseg socket option. [ 332.024823][T14332] Use struct sctp_assoc_value instead [ 332.129672][T14335] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2267'. [ 332.321691][ T5871] net_ratelimit: 20 callbacks suppressed [ 332.321711][ T5871] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 332.483704][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 332.801451][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 332.802223][T14359] netlink: 36 bytes leftover after parsing attributes in process `syz.0.2272'. [ 332.831747][ T1025] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 332.837304][T14360] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2274'. [ 332.883334][T14360] ip6tnl1: entered allmulticast mode [ 333.361044][ T5871] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 333.583462][T14386] tipc: Enabling of bearer rejected, already enabled [ 333.713757][T14393] mac80211_hwsim hwsim9 wlan0: entered promiscuous mode [ 333.728447][T14393] mac80211_hwsim hwsim9 wlan0: entered allmulticast mode [ 333.813258][T14396] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 333.832109][ T5732] syzkaller1: tun_net_xmit 90 [ 333.843032][T14396] syzkaller1: Linktype set failed because interface is up [ 333.953304][T14407] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2288'. [ 333.964846][ T95] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 334.125164][T11496] syzkaller1: tun_net_xmit 86 [ 334.162011][ T5732] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 334.402115][ T42] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 334.512634][T14426] netlink: 44 bytes leftover after parsing attributes in process `syz.2.2291'. [ 334.569352][T14436] IPVS: set_ctl: invalid protocol: 28719 99.47.115.121:29487 [ 334.626284][T14440] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2297'. [ 334.947429][T14449] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2300'. [ 335.040719][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 335.112569][T11496] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 335.444312][ T5871] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 335.947510][T14466] netlink: 132 bytes leftover after parsing attributes in process `syz.4.2304'. [ 337.390939][ T9078] net_ratelimit: 3 callbacks suppressed [ 337.390959][ T9078] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 337.528219][ T5871] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 338.090943][T14453] hsr0: left promiscuous mode [ 338.099132][T14453] veth1_vlan: left promiscuous mode [ 338.106626][T14453] veth0_vlan: entered promiscuous mode [ 338.117810][T14453] veth1_vlan: entered promiscuous mode [ 338.128068][T14453] veth1_macvtap: left promiscuous mode [ 338.137605][T14453] veth0_macvtap: left promiscuous mode [ 338.154565][T14453] veth0_macvtap: entered promiscuous mode [ 338.170320][T14453] veth1_macvtap: entered promiscuous mode [ 338.200206][T14453] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 338.222076][T14453] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 338.248036][T14453] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 338.263893][T14453] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 338.298594][T14453] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 338.316739][T14453] 8021q: adding VLAN 0 to HW filter on device batadv2 [ 338.530977][ T9078] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 338.561418][ T42] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 338.918299][T14453] bond1: left promiscuous mode [ 338.923722][T14453] bridge0: left promiscuous mode [ 338.929037][T14453] ip6gre1: left promiscuous mode [ 338.941925][ T9078] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 338.961724][ T9] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 338.969338][T14467] netlink: 2 bytes leftover after parsing attributes in process `syz.4.2304'. [ 338.990635][ T95] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 339.001125][T14485] (: renamed from bridge_slave_0 (while UP) [ 339.100501][ T12] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 339.163157][ T12] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 339.174214][T14493] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2310'. [ 339.423369][ T5732] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 339.601776][ T42] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 339.644468][T14519] lo speed is unknown, defaulting to 1000 [ 339.650797][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 339.888217][T14522] virt_wifi0: default qdisc (pfifo_fast) fail, fallback to noqueue [ 339.923264][T14522] veth1_vlan: left promiscuous mode [ 339.947840][T14522] veth0_vlan: left promiscuous mode [ 339.969317][T14522] veth0_vlan: entered promiscuous mode [ 339.998345][T14522] veth1_vlan: entered promiscuous mode [ 340.072221][T14522] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 340.107171][T14522] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 340.140541][T14522] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 340.183180][T14522] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 340.226087][T14522] 8021q: adding VLAN 0 to HW filter on device bond1 [ 340.240559][ T5732] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 340.279491][T14522] 8021q: adding VLAN 0 to HW filter on device bond2 [ 340.314830][T14522] 8021q: adding VLAN 0 to HW filter on device bond3 [ 340.322648][T14530] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2319'. [ 340.347005][T14522] A link change request failed with some changes committed already. Interface geneve2 may have been left with an inconsistent configuration, please check. [ 340.370383][T14530] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2319'. [ 340.603447][T14536] netlink: 'syz.2.2320': attribute type 16 has an invalid length. [ 340.611474][T14536] netlink: 'syz.2.2320': attribute type 17 has an invalid length. [ 340.640602][ T5871] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 340.703386][T14540] netlink: 'syz.0.2323': attribute type 1 has an invalid length. [ 340.714798][T14533] tipc: Resetting bearer [ 340.721065][T14533] tipc: Resetting bearer [ 340.750626][ T95] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 340.898371][T14546] raw_sendmsg: syz.0.2323 forgot to set AF_INET. Fix it! [ 340.922296][T14546] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2323'. [ 341.708386][T14541] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 341.728135][T14541] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 341.820043][T14541] veth0_vlan: left promiscuous mode [ 342.731612][ T5739] net_ratelimit: 4 callbacks suppressed [ 342.731634][ T5739] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 342.745414][ T5739] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 343.040985][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 343.281865][ T5732] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 343.443531][T14536] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 343.471483][T14536] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 343.480190][T14536] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 343.492037][T14536] 0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 343.502402][T14536] 0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 343.516865][T14536] veth1_vlan: left promiscuous mode [ 343.523363][T14536] veth0_vlan: left promiscuous mode [ 343.529741][T14536] veth0_vlan: entered promiscuous mode [ 343.537136][T14536] veth1_vlan: entered promiscuous mode [ 343.546281][T14536] veth1_macvtap: left promiscuous mode [ 343.552819][T14536] veth0_macvtap: left promiscuous mode [ 343.559146][T14536] veth0_macvtap: entered promiscuous mode [ 343.568903][T14536] veth1_macvtap: entered promiscuous mode [ 343.579173][T14536] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 343.587888][T14536] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 343.598326][T14536] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 343.606666][T14536] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 343.632690][T14536] 8021q: adding VLAN 0 to HW filter on device bond1 [ 343.760900][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 344.098774][T14536] 8021q: adding VLAN 0 to HW filter on device bond2 [ 344.107833][T14536] 8021q: adding VLAN 0 to HW filter on device bond3 [ 344.117168][T14536] syzkaller0: left promiscuous mode [ 344.123801][T14536] syzkaller0: left allmulticast mode [ 344.129323][T14536] tipc: Resetting bearer [ 344.135331][T14536] tipc: Resetting bearer [ 344.142582][T14536] 8021q: adding VLAN 0 to HW filter on device bond4 [ 344.153833][T14536] geneve4: left promiscuous mode [ 344.158792][T14536] geneve4: left allmulticast mode [ 344.172567][ T13] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 344.188687][T14540] workqueue: Failed to create a rescuer kthread for wq "bond0": -EINTR [ 344.299304][ T42] lo speed is unknown, defaulting to 1000 [ 344.300620][ T12] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 344.320631][ T42] syz2: Port: 1 Link DOWN [ 344.328071][T14569] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2326'. [ 344.338551][T14569] netlink: 'syz.2.2326': attribute type 30 has an invalid length. [ 344.396929][T14572] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2326'. [ 344.406222][ T12] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 344.406281][ T12] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 344.406316][ T12] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 344.406349][ T12] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 344.406384][ T12] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 344.406418][ T12] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 344.500763][T14572] netlink: 'syz.2.2326': attribute type 30 has an invalid length. [ 344.523043][T14578] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2328'. [ 344.732353][ T42] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 344.740773][T11496] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 344.756656][ T42] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 344.766489][T11496] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 344.791941][ T42] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 344.824994][ T42] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 344.863298][ T42] openvswitch: cpu_id mismatch with handler threads [ 344.924292][ T42] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 344.982972][ T42] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 345.022206][T14594] sctp: [Deprecated]: syz.2.2329 (pid 14594) Use of struct sctp_assoc_value in delayed_ack socket option. [ 345.022206][T14594] Use struct sctp_sack_info instead [ 345.088559][T14594] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2329'. [ 345.107017][T14594] block nbd1: Unsupported socket: should be TCP or UNIX. [ 345.150776][T11496] openvswitch: cpu_id mismatch with handler threads [ 345.281592][T11496] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 345.371465][ T5871] openvswitch: cpu_id mismatch with handler threads [ 345.521332][T11496] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 345.692331][T14616] Unsupported ieee802154 address type: 0 [ 345.843380][ T42] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 345.870181][T14623] netlink: 80 bytes leftover after parsing attributes in process `syz.0.2336'. [ 346.162912][ T12] openvswitch: cpu_id mismatch with handler threads [ 346.163346][ T12] openvswitch: cpu_id mismatch with handler threads [ 346.321937][ T5732] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 346.563238][ T12] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 346.597643][ T12] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 346.799040][T14661] ipt_REJECT: TCP_RESET invalid for non-tcp [ 346.813543][T14662] trusted_key: syz.2.2344 sent an empty control message without MSG_MORE. [ 347.013648][T14666] No such timeout policy "syz0" [ 347.212048][ T5871] openvswitch: cpu_id mismatch with handler threads [ 347.401011][T14685] syzkaller0: entered promiscuous mode [ 347.420950][T14685] syzkaller0: entered allmulticast mode [ 347.454591][T14687] lo: entered allmulticast mode [ 347.472248][T14687] lo: left allmulticast mode [ 347.502137][T14685] tipc: Enabled bearer , priority 0 [ 347.550628][T14679] tipc: Resetting bearer [ 347.663150][T14679] tipc: Disabling bearer [ 347.923996][ T5871] net_ratelimit: 3 callbacks suppressed [ 347.924015][ T5871] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 348.177238][T14721] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 348.188400][T14721] IPv4: Oversized IP packet from 127.202.26.0 [ 348.246657][T14722] bond0: entered promiscuous mode [ 348.259724][T14722] 8021q: adding VLAN 0 to HW filter on device bond0 [ 348.678100][ T1025] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 348.756473][T14742] netlink: 32 bytes leftover after parsing attributes in process `syz.3.2367'. [ 348.784077][T14740] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2366'. [ 348.813060][T14743] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2366'. [ 348.910992][T14728] lo: entered allmulticast mode [ 348.927120][T14728] lo: left allmulticast mode [ 348.961521][ T5739] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 349.132691][ T29] audit: type=1804 audit(1785675289.656:9): pid=14752 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.4.2368" name="/newroot/486/cgroup.controllers" dev="tmpfs" ino=2502 res=1 errno=0 [ 349.173649][ T29] audit: type=1800 audit(1785675289.656:10): pid=14752 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.2368" name="cgroup.controllers" dev="tmpfs" ino=2502 res=0 errno=0 [ 349.369766][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 349.455004][T14758] netlink: 36 bytes leftover after parsing attributes in process `syz.3.2370'. [ 349.500147][T14756] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 349.655992][T14761] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 349.793224][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 349.913548][T14776] netlink: 'syz.0.2373': attribute type 2 has an invalid length. [ 349.935247][T14776] netlink: 'syz.0.2373': attribute type 1 has an invalid length. [ 349.978837][T14765] 8021q: adding VLAN 0 to HW filter on device team0 [ 349.997491][T14765] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 350.013904][ T5739] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 350.054218][T14765] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 350.069708][T14765] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 350.111011][T14765] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 350.141428][T14765] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 350.168815][ C1] openvswitch: cpu_id mismatch with handler threads [ 350.193391][T14765] veth1_vlan: left promiscuous mode [ 350.214640][T14765] veth0_vlan: entered promiscuous mode [ 350.222632][T14765] veth1_vlan: entered promiscuous mode [ 350.243041][T14765] veth1_macvtap: left promiscuous mode [ 350.259060][T14765] veth0_macvtap: left promiscuous mode [ 350.275264][T14765] veth0_macvtap: entered promiscuous mode [ 350.298646][T14765] veth1_macvtap: entered promiscuous mode [ 350.319789][T14765] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 350.335063][T14765] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 350.355752][T14765] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 350.368339][T14765] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 350.386981][T14765] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 350.399475][T14765] 8021q: adding VLAN 0 to HW filter on device batadv2 [ 350.747246][T14795] netlink: 736 bytes leftover after parsing attributes in process `syz.2.2379'. [ 350.781221][T14795] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2379'. [ 350.868012][T14798] ip6t_REJECT: TCP_RESET illegal for non-tcp [ 350.900842][ T13] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 350.960811][ C0] ip6_tnl_xmit_ctl: 2 callbacks suppressed [ 350.960831][ C0] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 351.051014][ T42] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 351.075554][T14765] 8021q: adding VLAN 0 to HW filter on device bond1 [ 351.089570][T14765] bond0: left promiscuous mode [ 351.096337][ T9] lo speed is unknown, defaulting to 1000 [ 351.107554][ T12] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 351.117918][ T9] syz2: Port: 1 Link ACTIVE [ 351.119501][ T12] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 351.136313][ T42] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 351.300554][ T5739] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 351.331603][ T5739] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 351.417861][T14777] lo speed is unknown, defaulting to 1000 [ 351.616906][T14814] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2382'. [ 351.620536][ T9078] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 351.676935][T14819] tipc: Failed to remove unknown binding: 66,0,0/1:1514747175/1514747177 [ 351.699710][T14815] pimreg9: entered allmulticast mode [ 351.706812][T14819] tipc: Failed to remove unknown binding: 66,0,0/1:1514747175/1514747176 [ 351.725462][T14822] bond0: entered promiscuous mode [ 351.738000][T14819] tipc: Failed to remove unknown binding: 66,0,0/1:1514747175/1514747177 [ 351.741834][T14822] batadv0: entered promiscuous mode [ 351.769211][T14822] debugfs: 'hsr1' already exists in 'hsr' [ 351.774663][T14819] tipc: Failed to remove unknown binding: 66,0,0/1:1514747175/1514747176 [ 351.793595][T14822] Cannot create hsr debugfs directory [ 351.807517][T14822] hsr1: Slave A (bond0) is not up; please bring it up to get a fully working HSR network [ 351.848669][T14822] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 351.866402][T14822] bond0: left promiscuous mode [ 351.875231][T14822] batadv0: left promiscuous mode [ 352.071842][ T12] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 352.170581][ T9078] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 352.196826][ T9078] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 352.489395][T14841] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2390'. [ 352.531573][T14841] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2390'. [ 352.575125][T14841] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2390'. [ 352.624561][T14841] netlink: 48 bytes leftover after parsing attributes in process `syz.2.2390'. [ 353.037000][ T12] tipc: Subscription rejected, illegal request [ 353.049481][T14867] netlink: 52 bytes leftover after parsing attributes in process `syz.2.2396'. [ 353.121871][ T42] net_ratelimit: 5 callbacks suppressed [ 353.121889][ T42] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 353.151246][ T9078] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 353.549861][T14881] syzkaller0: entered promiscuous mode [ 353.570943][T14881] syzkaller0: entered allmulticast mode [ 353.595530][T14889] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2404'. [ 353.625927][T14879] lo speed is unknown, defaulting to 1000 [ 353.638508][T14881] bridge0: port 1(veth1_to_bridge) entered blocking state [ 353.656524][T14881] bridge0: port 1(veth1_to_bridge) entered disabled state [ 353.672719][T14881] veth1_to_bridge: entered allmulticast mode [ 353.707156][T14881] veth1_to_bridge: entered promiscuous mode [ 353.733118][T14881] bridge0: port 1(veth1_to_bridge) entered blocking state [ 353.740521][T14881] bridge0: port 1(veth1_to_bridge) entered forwarding state [ 353.774250][T14889] netdevsim netdevsim4 netdevsim0: entered allmulticast mode [ 354.172291][ T5871] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 354.182268][T14911] netlink: 'syz.0.2407': attribute type 1 has an invalid length. [ 354.201048][T14908] 8021q: adding VLAN 0 to HW filter on device bond0 [ 354.273790][T14911] bond0 (unregistering): Released all slaves [ 354.282344][ T13] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 354.587698][T14920] tipc: Enabled bearer , priority 0 [ 354.616350][T14920] syzkaller0: entered promiscuous mode [ 354.632911][T14920] syzkaller0: entered allmulticast mode [ 354.658468][T14928] tipc: Failed to remove unknown binding: 66,0,0/3279913478:2298804260/2298804262 [ 354.671549][T14928] tipc: Failed to remove unknown binding: 66,0,0/3279913478:2298804260/2298804261 [ 354.692129][T14928] tipc: Failed to remove unknown binding: 66,0,0/3279913478:2298804260/2298804262 [ 354.706186][T14928] tipc: Failed to remove unknown binding: 66,0,0/3279913478:2298804260/2298804261 [ 354.735011][T14920] tipc: Resetting bearer [ 354.787535][T14919] tipc: Resetting bearer [ 354.888488][T14932] __nla_validate_parse: 6 callbacks suppressed [ 354.888509][T14932] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2414'. [ 354.931871][T14919] tipc: Disabling bearer [ 354.958932][T14932] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2414'. [ 354.970513][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 354.995559][T14932] netlink: 60 bytes leftover after parsing attributes in process `syz.0.2414'. [ 355.008614][T14934] netlink: 32 bytes leftover after parsing attributes in process `syz.3.2415'. [ 355.011371][T14932] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2414'. [ 355.083052][T14934] netlink: 128 bytes leftover after parsing attributes in process `syz.3.2415'. [ 355.138102][T14934] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 355.508463][T14959] tipc: Failed to remove unknown binding: 66,0,0/0:3429436577/3429436579 [ 355.540495][T14959] tipc: Failed to remove unknown binding: 66,0,0/0:3429436577/3429436578 [ 355.575817][T14959] tipc: Failed to remove unknown binding: 66,0,0/0:3429436577/3429436579 [ 355.603108][T14959] tipc: Failed to remove unknown binding: 66,0,0/0:3429436577/3429436578 [ 355.607398][T14961] lo speed is unknown, defaulting to 1000 [ 356.066610][T14967] lo speed is unknown, defaulting to 1000 [ 356.160569][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 356.304632][T14969] IPVS: wrr: FWM 3 0x00000003 - no destination available [ 356.324022][ T13] IPVS: starting estimator thread 0... [ 356.347081][T14992] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2432'. [ 356.363017][T14986] macsec0: entered allmulticast mode [ 356.377196][T14986] dummy0: entered allmulticast mode [ 356.384170][T14986] dummy0: entered promiscuous mode [ 356.394669][T14986] dummy0: left allmulticast mode [ 356.401565][T14994] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2432'. [ 356.440485][T14991] IPVS: using max 34 ests per chain, 81600 per kthread [ 356.488702][T14990] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 356.532700][T14997] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2432'. [ 356.567790][ T9] dummy0: left promiscuous mode [ 356.766281][T15003] FAULT_INJECTION: forcing a failure. [ 356.766281][T15003] name failslab, interval 1, probability 0, space 0, times 0 [ 356.787894][T15003] CPU: 1 UID: 0 PID: 15003 Comm: syz.4.2435 Not tainted syzkaller #0 PREEMPT(full) [ 356.787919][T15003] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 356.787929][T15003] Call Trace: [ 356.787936][T15003] [ 356.787943][T15003] dump_stack_lvl+0xe8/0x150 [ 356.787973][T15003] should_fail_ex+0x40c/0x560 [ 356.787999][T15003] should_failslab+0xa8/0x100 [ 356.788024][T15003] __kmalloc_cache_noprof+0xa8/0x660 [ 356.788048][T15003] ? prog_array_map_alloc+0x51/0x200 [ 356.788073][T15003] ? prog_array_map_alloc+0x51/0x200 [ 356.788099][T15003] prog_array_map_alloc+0x51/0x200 [ 356.788119][T15003] map_create+0xf2a/0x1b90 [ 356.788150][T15003] ? __pfx_map_create+0x10/0x10 [ 356.788182][T15003] ? bpf_lsm_bpf+0x9/0x20 [ 356.788201][T15003] ? security_bpf+0x7e/0x2d0 [ 356.788222][T15003] __sys_bpf+0xaea/0xd90 [ 356.788249][T15003] ? __pfx___sys_bpf+0x10/0x10 [ 356.788279][T15003] ? __fget_files+0x2a/0x420 [ 356.788318][T15003] ? ksys_write+0x242/0x270 [ 356.788347][T15003] ? __pfx_ksys_write+0x10/0x10 [ 356.788370][T15003] __x64_sys_bpf+0xba/0xd0 [ 356.788392][T15003] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 356.788412][T15003] do_syscall_64+0x174/0x580 [ 356.788435][T15003] ? trace_irq_disable+0x3b/0x140 [ 356.788457][T15003] ? clear_bhb_loop+0x40/0x90 [ 356.788480][T15003] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 356.788498][T15003] RIP: 0033:0x7f5f71d9e019 [ 356.788516][T15003] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 356.788531][T15003] RSP: 002b:00007f5f72beb028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 356.788551][T15003] RAX: ffffffffffffffda RBX: 00007f5f72025fa0 RCX: 00007f5f71d9e019 [ 356.788563][T15003] RDX: 0000000000000050 RSI: 0000200000000180 RDI: 0000000000000000 [ 356.788575][T15003] RBP: 00007f5f72beb090 R08: 0000000000000000 R09: 0000000000000000 [ 356.788585][T15003] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 356.788595][T15003] R13: 00007f5f72026038 R14: 00007f5f72025fa0 R15: 00007ffd19ac1658 [ 356.788621][T15003] [ 357.065625][T15006] netlink: 52 bytes leftover after parsing attributes in process `syz.3.2437'. [ 357.226830][T15008] tipc: Failed to remove unknown binding: 66,0,0/0:1547904215/1547904216 [ 357.253157][T15008] tipc: Failed to remove unknown binding: 66,0,0/0:1547904215/1547904216 [ 357.585665][T15031] FAULT_INJECTION: forcing a failure. [ 357.585665][T15031] name failslab, interval 1, probability 0, space 0, times 0 [ 357.643691][T15031] CPU: 1 UID: 0 PID: 15031 Comm: syz.3.2443 Not tainted syzkaller #0 PREEMPT(full) [ 357.643720][T15031] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 357.643731][T15031] Call Trace: [ 357.643738][T15031] [ 357.643746][T15031] dump_stack_lvl+0xe8/0x150 [ 357.643778][T15031] should_fail_ex+0x40c/0x560 [ 357.643808][T15031] should_failslab+0xa8/0x100 [ 357.643839][T15031] __kmalloc_cache_noprof+0xa8/0x660 [ 357.643866][T15031] ? ovs_ct_limit_cmd_set+0x2f8/0xb00 [ 357.643884][T15031] ? ovs_ct_limit_cmd_set+0x2f8/0xb00 [ 357.643909][T15031] ovs_ct_limit_cmd_set+0x2f8/0xb00 [ 357.643942][T15031] genl_family_rcv_msg_doit+0x233/0x340 [ 357.643970][T15031] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 357.644002][T15031] ? bpf_lsm_capable+0x9/0x20 [ 357.644026][T15031] ? security_capable+0x7e/0x2c0 [ 357.644053][T15031] genl_rcv_msg+0x614/0x7a0 [ 357.644078][T15031] ? __pfx_genl_rcv_msg+0x10/0x10 [ 357.644096][T15031] ? __pfx_ovs_ct_limit_cmd_set+0x10/0x10 [ 357.644116][T15031] ? __pfx_ref_tracker_free+0x10/0x10 [ 357.644151][T15031] netlink_rcv_skb+0x226/0x4a0 [ 357.644176][T15031] ? __pfx_genl_rcv_msg+0x10/0x10 [ 357.644197][T15031] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 357.644234][T15031] ? down_read+0x2be/0x330 [ 357.644265][T15031] genl_rcv+0x28/0x40 [ 357.644290][T15031] netlink_unicast+0x7bb/0x940 [ 357.644324][T15031] netlink_sendmsg+0x813/0xb40 [ 357.644357][T15031] ? __pfx_netlink_sendmsg+0x10/0x10 [ 357.644386][T15031] ? aa_sock_msg_perm+0xf1/0x1b0 [ 357.644412][T15031] ? __pfx_netlink_sendmsg+0x10/0x10 [ 357.644439][T15031] sock_sendmsg_nosec+0x13a/0x180 [ 357.644470][T15031] ____sys_sendmsg+0x54e/0x850 [ 357.644498][T15031] ? __pfx_____sys_sendmsg+0x10/0x10 [ 357.644527][T15031] ? import_iovec+0x73/0xa0 [ 357.644547][T15031] ___sys_sendmsg+0x2a5/0x360 [ 357.644566][T15031] ? __lock_acquire+0x683/0x2cf0 [ 357.644594][T15031] ? __pfx____sys_sendmsg+0x10/0x10 [ 357.644648][T15031] ? __fget_files+0x2a/0x420 [ 357.644670][T15031] ? __fget_files+0x3a2/0x420 [ 357.644699][T15031] __x64_sys_sendmsg+0x1b1/0x290 [ 357.644723][T15031] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 357.644763][T15031] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 357.644783][T15031] do_syscall_64+0x174/0x580 [ 357.644808][T15031] ? trace_irq_disable+0x3b/0x140 [ 357.644829][T15031] ? clear_bhb_loop+0x40/0x90 [ 357.644852][T15031] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 357.644870][T15031] RIP: 0033:0x7fb19dd9e019 [ 357.644887][T15031] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 357.644904][T15031] RSP: 002b:00007fb19ec64028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 357.644922][T15031] RAX: ffffffffffffffda RBX: 00007fb19e025fa0 RCX: 00007fb19dd9e019 [ 357.644936][T15031] RDX: 0000000004008094 RSI: 0000200000000100 RDI: 0000000000000003 [ 357.644948][T15031] RBP: 00007fb19ec64090 R08: 0000000000000000 R09: 0000000000000000 [ 357.644959][T15031] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 357.644971][T15031] R13: 00007fb19e026038 R14: 00007fb19e025fa0 R15: 00007ffde580d738 [ 357.645002][T15031] [ 357.687744][T15036] netlink: 'syz.1.2444': attribute type 1 has an invalid length. [ 358.030362][T15036] NCSI netlink: No device for ifindex 0 [ 358.082164][ C1] openvswitch: cpu_id mismatch with handler threads [ 358.389266][T15054] tipc: Failed to remove unknown binding: 66,0,0/1:3869135325/3869135327 [ 358.426652][T15049] block nbd1: Unsupported socket: should be TCP or UNIX. [ 358.430565][T15054] tipc: Failed to remove unknown binding: 66,0,0/1:3869135325/3869135326 [ 358.462279][T15054] tipc: Failed to remove unknown binding: 66,0,0/1:3869135325/3869135327 [ 358.491169][T15054] tipc: Failed to remove unknown binding: 66,0,0/1:3869135325/3869135326 [ 358.636630][T15061] lo speed is unknown, defaulting to 1000 [ 358.755926][T15070] netlink: 'syz.3.2455': attribute type 1 has an invalid length. [ 358.787741][T15065] gretap3: entered allmulticast mode [ 358.832017][T15069] ip6tnl0: Caught tx_queue_len zero misconfig [ 358.853851][T15069] netlink: 'syz.0.2457': attribute type 4 has an invalid length. [ 359.113936][ T95] IPVS: starting estimator thread 0... [ 359.121366][T15061] IPVS: wrr: FWM 3 0x00000003 - no destination available [ 359.212995][T15081] IPVS: using max 31 ests per chain, 74400 per kthread [ 359.394714][ T13] IPVS: stop unused estimator thread 0... [ 359.459034][T15088] FAULT_INJECTION: forcing a failure. [ 359.459034][T15088] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 359.486479][T15088] CPU: 0 UID: 0 PID: 15088 Comm: syz.0.2461 Not tainted syzkaller #0 PREEMPT(full) [ 359.486505][T15088] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 359.486516][T15088] Call Trace: [ 359.486523][T15088] [ 359.486531][T15088] dump_stack_lvl+0xe8/0x150 [ 359.486564][T15088] should_fail_ex+0x40c/0x560 [ 359.486593][T15088] _copy_to_user+0x31/0xb0 [ 359.486614][T15088] simple_read_from_buffer+0xe1/0x170 [ 359.486646][T15088] proc_fail_nth_read+0x1bb/0x230 [ 359.486686][T15088] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 359.486738][T15088] ? rw_verify_area+0x24a/0x4c0 [ 359.486756][T15088] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 359.486780][T15088] vfs_read+0x213/0xa80 [ 359.486802][T15088] ? __pfx___mutex_lock+0x10/0x10 [ 359.486834][T15088] ? __pfx_vfs_read+0x10/0x10 [ 359.486853][T15088] ? __fget_files+0x2a/0x420 [ 359.486882][T15088] ? __fget_files+0x3a2/0x420 [ 359.486905][T15088] ? __fget_files+0x2a/0x420 [ 359.486942][T15088] ksys_read+0x150/0x270 [ 359.486962][T15088] ? __pfx_ksys_read+0x10/0x10 [ 359.486985][T15088] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 359.487004][T15088] do_syscall_64+0x174/0x580 [ 359.487029][T15088] ? trace_irq_disable+0x3b/0x140 [ 359.487054][T15088] ? clear_bhb_loop+0x40/0x90 [ 359.487076][T15088] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 359.487095][T15088] RIP: 0033:0x7f2bd3b5e84e [ 359.487112][T15088] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 359.487129][T15088] RSP: 002b:00007f2bd4accfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 359.487150][T15088] RAX: ffffffffffffffda RBX: 00007f2bd4acd6c0 RCX: 00007f2bd3b5e84e [ 359.487162][T15088] RDX: 000000000000000f RSI: 00007f2bd4acd0a0 RDI: 0000000000000003 [ 359.487174][T15088] RBP: 00007f2bd4acd090 R08: 0000000000000000 R09: 0000000000000000 [ 359.487185][T15088] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 359.487196][T15088] R13: 00007f2bd3e26038 R14: 00007f2bd3e25fa0 R15: 00007ffc8b503398 [ 359.487227][T15088] [ 359.829950][T15098] netlink: 'syz.1.2462': attribute type 21 has an invalid length. [ 360.002246][ C0] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 360.203906][T15118] tipc: Failed to remove unknown binding: 66,0,0/1064416403:3711339562/3711339564 [ 360.213929][T15118] tipc: Failed to remove unknown binding: 66,0,0/1064416403:3711339562/3711339563 [ 360.224257][T15118] tipc: Failed to remove unknown binding: 66,0,0/1064416403:3711339562/3711339564 [ 360.234650][T15118] tipc: Failed to remove unknown binding: 66,0,0/1064416403:3711339562/3711339563 [ 360.438873][T15130] __nla_validate_parse: 6 callbacks suppressed [ 360.438893][T15130] netlink: 132 bytes leftover after parsing attributes in process `syz.3.2470'. [ 360.509641][T15127] lo speed is unknown, defaulting to 1000 [ 360.675227][T15138] netlink: 132 bytes leftover after parsing attributes in process `syz.3.2470'. [ 360.870950][T15132] lo speed is unknown, defaulting to 1000 [ 361.020389][T15137] syzkaller0: entered promiscuous mode [ 361.026188][T15137] syzkaller0: entered allmulticast mode [ 361.118410][T15140] bond4: option resend_igmp: invalid value (2878) [ 361.125624][T15140] bond4: option resend_igmp: allowed values 0 - 255 [ 361.144626][T15140] bond4 (unregistering): Released all slaves [ 361.210999][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 362.214895][T15180] netlink: 104 bytes leftover after parsing attributes in process `syz.3.2479'. [ 362.571873][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 364.883415][T15188] tipc: Failed to remove unknown binding: 66,0,0/0:283340737/283340739 [ 364.922559][T15188] tipc: Failed to remove unknown binding: 66,0,0/0:283340737/283340738 [ 364.954603][T15188] tipc: Failed to remove unknown binding: 66,0,0/0:283340737/283340739 [ 364.990156][T15188] tipc: Failed to remove unknown binding: 66,0,0/0:283340737/283340738 [ 365.053726][T15197] netlink: 'syz.3.2483': attribute type 28 has an invalid length. [ 365.285079][T15207] netlink: 'syz.4.2484': attribute type 10 has an invalid length. [ 365.323344][T15207] openvswitch: netlink: Flow key attr not present in new flow. [ 365.686804][T15231] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2490'. [ 365.719562][T15231] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 365.785634][T15238] netlink: 40 bytes leftover after parsing attributes in process `syz.4.2493'. [ 365.794983][T15238] netlink: 40 bytes leftover after parsing attributes in process `syz.4.2493'. [ 365.844685][T15238] A link change request failed with some changes committed already. Interface geneve2 may have been left with an inconsistent configuration, please check. [ 365.965359][T15244] tipc: Failed to remove unknown binding: 66,0,0/1:3002668377/3002668379 [ 365.981632][T15244] tipc: Failed to remove unknown binding: 66,0,0/1:3002668377/3002668378 [ 366.022804][T15244] tipc: Failed to remove unknown binding: 66,0,0/1:3002668377/3002668379 [ 366.070811][T15244] tipc: Failed to remove unknown binding: 66,0,0/1:3002668377/3002668378 [ 366.162033][T15238] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 366.186038][T15252] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2497'. [ 366.201910][T15252] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2497'. [ 366.258014][T15252] bond2: (slave ip6tnl2): The slave device specified does not support setting the MAC address [ 366.271777][T15252] bond2: (slave ip6tnl2): Error -95 calling set_mac_address [ 366.287685][T15254] lo speed is unknown, defaulting to 1000 [ 366.628984][T15274] FAULT_INJECTION: forcing a failure. [ 366.628984][T15274] name failslab, interval 1, probability 0, space 0, times 0 [ 366.653023][T15274] CPU: 1 UID: 0 PID: 15274 Comm: syz.1.2503 Not tainted syzkaller #0 PREEMPT(full) [ 366.653040][T15274] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 366.653053][T15274] Call Trace: [ 366.653057][T15274] [ 366.653063][T15274] dump_stack_lvl+0xe8/0x150 [ 366.653084][T15274] should_fail_ex+0x40c/0x560 [ 366.653101][T15274] should_failslab+0xa8/0x100 [ 366.653120][T15274] __kmalloc_cache_noprof+0xa8/0x660 [ 366.653135][T15274] ? ovs_ct_limit_cmd_set+0x2f8/0xb00 [ 366.653154][T15274] ? ovs_ct_limit_cmd_set+0x2f8/0xb00 [ 366.653167][T15274] ovs_ct_limit_cmd_set+0x2f8/0xb00 [ 366.653184][T15274] genl_family_rcv_msg_doit+0x233/0x340 [ 366.653200][T15274] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 366.653219][T15274] ? bpf_lsm_capable+0x9/0x20 [ 366.653233][T15274] ? security_capable+0x7e/0x2c0 [ 366.653248][T15274] genl_rcv_msg+0x614/0x7a0 [ 366.653261][T15274] ? __pfx_genl_rcv_msg+0x10/0x10 [ 366.653270][T15274] ? __pfx_ovs_ct_limit_cmd_set+0x10/0x10 [ 366.653281][T15274] ? __pfx_ref_tracker_free+0x10/0x10 [ 366.653301][T15274] netlink_rcv_skb+0x226/0x4a0 [ 366.653315][T15274] ? __pfx_genl_rcv_msg+0x10/0x10 [ 366.653326][T15274] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 366.653346][T15274] ? down_read+0x2be/0x330 [ 366.653365][T15274] genl_rcv+0x28/0x40 [ 366.653374][T15274] netlink_unicast+0x7bb/0x940 [ 366.653391][T15274] netlink_sendmsg+0x813/0xb40 [ 366.653410][T15274] ? __pfx_netlink_sendmsg+0x10/0x10 [ 366.653426][T15274] ? aa_sock_msg_perm+0xf1/0x1b0 [ 366.653440][T15274] ? __pfx_netlink_sendmsg+0x10/0x10 [ 366.653453][T15274] sock_sendmsg_nosec+0x13a/0x180 [ 366.653471][T15274] ____sys_sendmsg+0x54e/0x850 [ 366.653487][T15274] ? __pfx_____sys_sendmsg+0x10/0x10 [ 366.653504][T15274] ? import_iovec+0x73/0xa0 [ 366.653515][T15274] ___sys_sendmsg+0x2a5/0x360 [ 366.653528][T15274] ? __lock_acquire+0x683/0x2cf0 [ 366.653545][T15274] ? __pfx____sys_sendmsg+0x10/0x10 [ 366.653575][T15274] ? __fget_files+0x2a/0x420 [ 366.653589][T15274] ? __fget_files+0x3a2/0x420 [ 366.653608][T15274] __x64_sys_sendmsg+0x1b1/0x290 [ 366.653623][T15274] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 366.653648][T15274] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 366.653659][T15274] do_syscall_64+0x174/0x580 [ 366.653673][T15274] ? trace_irq_disable+0x3b/0x140 [ 366.653687][T15274] ? clear_bhb_loop+0x40/0x90 [ 366.653700][T15274] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 366.653710][T15274] RIP: 0033:0x7fabfe99e019 [ 366.653721][T15274] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 366.653730][T15274] RSP: 002b:00007fabff8f4028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 366.653742][T15274] RAX: ffffffffffffffda RBX: 00007fabfec25fa0 RCX: 00007fabfe99e019 [ 366.653749][T15274] RDX: 0000000004008094 RSI: 0000200000000100 RDI: 0000000000000003 [ 366.653756][T15274] RBP: 00007fabff8f4090 R08: 0000000000000000 R09: 0000000000000000 [ 366.653762][T15274] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 366.653768][T15274] R13: 00007fabfec26038 R14: 00007fabfec25fa0 R15: 00007fffbd0a2ce8 [ 366.653784][T15274] [ 367.229843][T11496] IPVS: starting estimator thread 0... [ 367.342192][T15288] IPVS: using max 28 ests per chain, 67200 per kthread [ 367.566653][T15300] netlink: 'syz.2.2511': attribute type 1 has an invalid length. [ 367.664154][T15300] bond0: entered promiscuous mode [ 367.669528][T15300] 8021q: adding VLAN 0 to HW filter on device bond0 [ 367.680831][ T95] IPVS: stop unused estimator thread 0... [ 367.756586][T15300] bond0: (slave veth7): making interface the new active one [ 367.788894][T15300] veth7: entered promiscuous mode [ 367.821533][T15300] bond0: (slave veth7): Enslaving as an active interface with an up link [ 368.385276][T15329] lo speed is unknown, defaulting to 1000 [ 368.457585][T15334] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2523'. [ 368.494497][T15335] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2523'. [ 368.517075][T15334] netlink: 47 bytes leftover after parsing attributes in process `syz.1.2523'. [ 368.544179][T15335] netlink: 47 bytes leftover after parsing attributes in process `syz.1.2523'. [ 368.601955][T15345] IPVS: set_ctl: invalid protocol: 22 255.255.255.255:20001 [ 368.706421][T15349] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2527'. [ 369.261603][ T95] IPVS: starting estimator thread 0... [ 369.275819][T15384] syzkaller0: entered promiscuous mode [ 369.292404][T15384] syzkaller0: entered allmulticast mode [ 369.310924][T15384] tipc: Resetting bearer [ 369.361490][T15385] IPVS: using max 34 ests per chain, 81600 per kthread [ 369.496021][T15384] sch_tbf: burst 3 is lower than device syzkaller0 mtu (313) ! [ 369.654616][T15390] syzkaller0: entered promiscuous mode [ 369.662365][T15399] netlink: 'syz.4.2541': attribute type 10 has an invalid length. [ 369.675232][T15390] syzkaller0: entered allmulticast mode [ 369.688587][T15399] bridge0: left promiscuous mode [ 369.696100][T15399] bridge0: left allmulticast mode [ 369.807923][ T95] IPVS: stop unused estimator thread 0... [ 370.527405][T15430] siw: device registration error -23 [ 370.723335][T15441] syzkaller0: entered promiscuous mode [ 370.739264][T15441] syzkaller0: entered allmulticast mode [ 370.880787][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 371.472118][T15469] netlink: 'syz.1.2565': attribute type 1 has an invalid length. [ 371.494389][T15469] __nla_validate_parse: 4 callbacks suppressed [ 371.494407][T15469] netlink: 84 bytes leftover after parsing attributes in process `syz.1.2565'. [ 371.512879][T15469] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2565'. [ 371.526513][T15469] xt_cgroup: invalid path, errno=-2 [ 371.822625][T15484] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2570'. [ 371.842009][T15484] xt_l2tp: invalid flags combination: 8 [ 371.869322][T15484] gre0: entered promiscuous mode [ 371.874694][T15484] gre0: entered allmulticast mode [ 372.243124][T15498] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2575'. [ 372.743371][T15508] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2577'. [ 372.784000][T15508] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2577'. [ 372.800713][ C1] openvswitch: cpu_id mismatch with handler threads [ 372.911430][T15517] x_tables: ip_tables: recent.0 match: invalid size 216 (kernel) != (user) 4096 [ 373.020096][T15517] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 373.069742][T15517] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 373.079400][T15517] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 373.086983][T15517] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 373.095821][T15517] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 373.109389][T15517] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 373.116477][T15517] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 373.137345][T15517] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 373.153629][T15517] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 373.169160][T15525] netlink: 'syz.3.2583': attribute type 1 has an invalid length. [ 373.173144][T15517] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 373.546085][T15534] syzkaller0: entered promiscuous mode [ 373.563626][T15534] syzkaller0: entered allmulticast mode [ 373.653063][T15542] syzkaller1: entered promiscuous mode [ 373.675950][T15542] syzkaller1: entered allmulticast mode [ 373.719563][T15543] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2588'. [ 375.775181][T15571] syzkaller0: entered promiscuous mode [ 375.795641][T15571] syzkaller0: entered allmulticast mode [ 376.358429][T15590] tipc: Enabling of bearer rejected, failed to enable media [ 376.402599][T15591] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2597'. [ 376.418764][T15594] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2598'. [ 376.441268][T15593] syzkaller0: entered promiscuous mode [ 376.447933][T15593] syzkaller0: entered allmulticast mode [ 376.457560][T15593] tipc: Enabled bearer , priority 0 [ 376.503212][T15592] tipc: Resetting bearer [ 376.608061][T15592] tipc: Disabling bearer [ 376.736530][T15601] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2601'. [ 376.744740][T15602] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2601'. [ 377.003520][T15605] lo speed is unknown, defaulting to 1000 [ 377.589388][T15625] netlink: 60 bytes leftover after parsing attributes in process `syz.4.2606'. [ 377.942686][T15639] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2612'. [ 377.948620][T15637] netlink: 'syz.1.2609': attribute type 1 has an invalid length. [ 377.977002][T15635] bond6: Unable to set up delay as MII monitoring is disabled [ 377.979127][T15637] netlink: 224 bytes leftover after parsing attributes in process `syz.1.2609'. [ 378.056075][T15635] bond6 (unregistering): Released all slaves [ 378.174467][T15645] netlink: 208 bytes leftover after parsing attributes in process `syz.3.2610'. [ 378.185076][T15645] netlink: 208 bytes leftover after parsing attributes in process `syz.3.2610'. [ 378.561155][ C0] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 378.562541][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 378.573317][ T1320] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.777316][T15675] netlink: 'syz.3.2621': attribute type 1 has an invalid length. [ 378.947480][T15679] veth7: entered allmulticast mode [ 379.031181][T15689] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2623'. [ 379.050245][T15679] bond6: (slave veth7): Enslaving as an active interface with a down link [ 379.093321][T15675] bond6: (slave veth0_to_bond): making interface the new active one [ 379.103975][T15695] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2623'. [ 379.118680][T15675] bond6: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 379.183629][T15684] net_ratelimit: 9 callbacks suppressed [ 379.183647][T15684] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 379.191749][T15696] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2623'. [ 379.286453][T15691] macvlan2: entered promiscuous mode [ 379.293434][T15691] macvlan2: entered allmulticast mode [ 379.299671][T15691] bond6: entered promiscuous mode [ 379.310983][T15691] veth0_to_bond: entered promiscuous mode [ 379.321943][T15691] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 379.373966][T15691] bond6: (slave macvlan2): the slave hw address is in use by the bond; giving it the hw address of veth7 [ 379.415125][T15691] bond6: left promiscuous mode [ 379.430432][T15691] veth0_to_bond: left promiscuous mode [ 379.915930][T15718] netlink: 'syz.0.2633': attribute type 46 has an invalid length. [ 380.786574][T15757] netlink: 'syz.1.2642': attribute type 1 has an invalid length. [ 381.028369][T15762] veth5: entered allmulticast mode [ 381.064259][T15762] bond3: (slave veth5): Enslaving as an active interface with a down link [ 381.107983][T15757] bond3: (slave veth0_to_bond): making interface the new active one [ 381.151959][T15757] bond3: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 381.600704][ T4940] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 381.694207][T15760] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 382.363363][T15816] netlink: 'syz.4.2656': attribute type 1 has an invalid length. [ 382.482236][T15822] bond4: (slave veth0_to_bond): making interface the new active one [ 382.507712][T15822] bond4: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 382.831283][T15829] openvswitch: netlink: IP tunnel dst address not specified [ 383.138089][T15839] tunl0: Caught tx_queue_len zero misconfig [ 383.267213][T15843] __nla_validate_parse: 4 callbacks suppressed [ 383.267233][T15843] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2663'. [ 383.343496][T15843] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2663'. [ 383.420919][T15843] bridge0: port 1(veth1_to_bridge) entered disabled state [ 383.444922][T15843] bridge0: left promiscuous mode [ 383.509240][T15853] veth1_to_bridge: left allmulticast mode [ 383.525045][T15853] veth1_to_bridge: left promiscuous mode [ 383.540962][T15853] bridge0: port 1(veth1_to_bridge) entered disabled state [ 383.853255][T15873] IPv6: NLM_F_CREATE should be specified when creating new route [ 383.938464][T15876] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2674'. [ 384.024360][T15876] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2674'. [ 384.679432][T15916] FAULT_INJECTION: forcing a failure. [ 384.679432][T15916] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 384.693126][T15916] CPU: 1 UID: 0 PID: 15916 Comm: syz.2.2687 Not tainted syzkaller #0 PREEMPT(full) [ 384.693150][T15916] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 384.693161][T15916] Call Trace: [ 384.693168][T15916] [ 384.693175][T15916] dump_stack_lvl+0xe8/0x150 [ 384.693208][T15916] should_fail_ex+0x40c/0x560 [ 384.693236][T15916] _copy_from_user+0x2d/0xb0 [ 384.693254][T15916] ___sys_sendmsg+0x1c6/0x360 [ 384.693277][T15916] ? __lock_acquire+0x683/0x2cf0 [ 384.693308][T15916] ? __pfx____sys_sendmsg+0x10/0x10 [ 384.693365][T15916] ? __fget_files+0x2a/0x420 [ 384.693389][T15916] ? __fget_files+0x3a2/0x420 [ 384.693423][T15916] __x64_sys_sendmsg+0x1b1/0x290 [ 384.693448][T15916] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 384.693488][T15916] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 384.693507][T15916] do_syscall_64+0x174/0x580 [ 384.693528][T15916] ? clear_bhb_loop+0x40/0x90 [ 384.693549][T15916] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 384.693567][T15916] RIP: 0033:0x7f53a2d9e019 [ 384.693585][T15916] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 384.693601][T15916] RSP: 002b:00007f53a0ff6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 384.693621][T15916] RAX: ffffffffffffffda RBX: 00007f53a3025fa0 RCX: 00007f53a2d9e019 [ 384.693635][T15916] RDX: 0000000020000080 RSI: 0000200000000580 RDI: 0000000000000004 [ 384.693648][T15916] RBP: 00007f53a0ff6090 R08: 0000000000000000 R09: 0000000000000000 [ 384.693660][T15916] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 384.693671][T15916] R13: 00007f53a3026038 R14: 00007f53a3025fa0 R15: 00007ffd15e63ee8 [ 384.693701][T15916] [ 385.811708][T15934] netlink: 228 bytes leftover after parsing attributes in process `syz.0.2693'. [ 386.060181][T15943] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2694'. [ 386.080856][ T4940] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 387.231856][T15893] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 387.280985][T15940] netlink: 'syz.0.2694': attribute type 1 has an invalid length. [ 387.306160][T15940] netlink: 84 bytes leftover after parsing attributes in process `syz.0.2694'. [ 387.352867][T15940] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2694'. [ 387.657161][T15955] ip6t_srh: unknown srh invflags 4000 [ 387.864384][T15965] netlink: 'syz.2.2704': attribute type 2 has an invalid length. [ 387.873240][T15965] netlink: 228 bytes leftover after parsing attributes in process `syz.2.2704'. [ 388.346755][T15986] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2711'. [ 388.459887][T15991] ip6t_srh: unknown srh invflags 4000 [ 388.678042][T16002] netdevsim netdevsim2 netdevsim0: entered allmulticast mode [ 388.704675][T16002] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 388.752475][T16003] netlink: 232 bytes leftover after parsing attributes in process `syz.0.2717'. [ 389.020515][T16025] netlink: 'syz.4.2725': attribute type 11 has an invalid length. [ 389.048457][T16025] netlink: 'syz.4.2725': attribute type 11 has an invalid length. [ 389.080508][T16025] netlink: 228 bytes leftover after parsing attributes in process `syz.4.2725'. [ 389.101141][T16027] netlink: 'syz.4.2725': attribute type 11 has an invalid length. [ 389.104338][T16034] "syz.3.2726" (16034) uses obsolete ecb(arc4) skcipher [ 389.124726][T16027] netlink: 'syz.4.2725': attribute type 11 has an invalid length. [ 389.141103][T16027] netlink: 228 bytes leftover after parsing attributes in process `syz.4.2725'. [ 389.151233][T16035] netlink: 'syz.2.2728': attribute type 11 has an invalid length. [ 389.335775][T16042] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 389.441107][T16046] bond0: (slave ip6gretap0): making interface the new active one [ 389.467212][T16046] bond0: (slave ip6gretap0): Enslaving as an active interface with an up link [ 389.480139][T16048] netlink: 180 bytes leftover after parsing attributes in process `syz.4.2735'. [ 389.512512][T16051] bond0 (unregistering): (slave ip6gretap0): Releasing active interface [ 389.536939][T16051] bond0 (unregistering): Released all slaves [ 389.547730][T16053] xt_TPROXY: Can be used only with -p tcp or -p udp [ 389.572287][T16044] syzkaller0: entered promiscuous mode [ 389.578033][T16044] syzkaller0: entered allmulticast mode [ 389.586043][T16048] ip_vti0: entered promiscuous mode [ 389.594091][T16048] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2735'. [ 389.622546][T16052] tipc: Enabled bearer , priority 0 [ 389.631828][T16043] tipc: Resetting bearer [ 389.696112][T16043] tipc: Disabling bearer [ 389.876815][T16059] netlink: 212 bytes leftover after parsing attributes in process `syz.4.2738'. [ 389.892908][T16059] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2738'. [ 389.923360][T16059] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2738'. [ 389.962640][T16067] netlink: 'syz.2.2741': attribute type 10 has an invalid length. [ 389.987976][T16067] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2741'. [ 390.222717][T16082] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 390.317740][T16087] netlink: 'syz.1.2748': attribute type 1 has an invalid length. [ 390.454013][T16091] veth7: entered allmulticast mode [ 390.476609][T16091] bond0: (slave veth7): Enslaving as an active interface with a down link [ 390.494335][T16098] batadv_slave_1: entered promiscuous mode [ 390.505690][T16099] tipc: Enabling of bearer rejected, failed to enable media [ 390.518975][T16092] batadv_slave_1: left promiscuous mode [ 390.627125][T16104] ieee802154 phy0 wpan0: encryption failed: -22 [ 390.650848][T16104] tipc: Enabled bearer , priority 0 [ 390.671611][T16111] FAULT_INJECTION: forcing a failure. [ 390.671611][T16111] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 390.700016][T16111] CPU: 1 UID: 0 PID: 16111 Comm: syz.2.2754 Not tainted syzkaller #0 PREEMPT(full) [ 390.700042][T16111] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 390.700053][T16111] Call Trace: [ 390.700060][T16111] [ 390.700068][T16111] dump_stack_lvl+0xe8/0x150 [ 390.700100][T16111] should_fail_ex+0x40c/0x560 [ 390.700128][T16111] _copy_from_user+0x2d/0xb0 [ 390.700154][T16111] ___sys_sendmsg+0x1c6/0x360 [ 390.700175][T16111] ? __lock_acquire+0x683/0x2cf0 [ 390.700203][T16111] ? __pfx____sys_sendmsg+0x10/0x10 [ 390.700258][T16111] ? __fget_files+0x2a/0x420 [ 390.700284][T16111] ? __fget_files+0x3a2/0x420 [ 390.700313][T16111] __x64_sys_sendmsg+0x1b1/0x290 [ 390.700336][T16111] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 390.700374][T16111] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 390.700394][T16111] do_syscall_64+0x174/0x580 [ 390.700418][T16111] ? trace_irq_disable+0x3b/0x140 [ 390.700442][T16111] ? clear_bhb_loop+0x40/0x90 [ 390.700464][T16111] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 390.700481][T16111] RIP: 0033:0x7f53a2d9e019 [ 390.700499][T16111] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 390.700515][T16111] RSP: 002b:00007f53a0ff6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 390.700535][T16111] RAX: ffffffffffffffda RBX: 00007f53a3025fa0 RCX: 00007f53a2d9e019 [ 390.700549][T16111] RDX: 0000000000000000 RSI: 0000200000000200 RDI: 0000000000000003 [ 390.700561][T16111] RBP: 00007f53a0ff6090 R08: 0000000000000000 R09: 0000000000000000 [ 390.700573][T16111] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 390.700584][T16111] R13: 00007f53a3026038 R14: 00007f53a3025fa0 R15: 00007ffd15e63ee8 [ 390.700614][T16111] [ 390.815398][T16104] syzkaller0: entered promiscuous mode [ 390.841610][T16115] IPv6: NLM_F_REPLACE set, but no existing node found! [ 390.894366][T16104] syzkaller0: entered allmulticast mode [ 390.908167][T16104] tipc: Resetting bearer [ 391.109993][ T95] tipc: Resetting bearer [ 391.126296][T16100] tipc: Resetting bearer [ 391.645331][T16146] netlink: 'syz.4.2761': attribute type 1 has an invalid length. [ 394.529465][T16100] tipc: Disabling bearer [ 394.610655][T16146] workqueue: Failed to create a rescuer kthread for wq "bond5": -EINTR [ 394.794074][T16156] netlink: 'syz.3.2763': attribute type 1 has an invalid length. [ 394.962662][T16173] netlink: 'syz.4.2766': attribute type 2 has an invalid length. [ 394.989878][T16165] veth9: entered allmulticast mode [ 395.001587][T16165] bond7: (slave veth9): Enslaving as an active interface with a down link [ 395.013693][T16177] tipc: Enabling of bearer rejected, already enabled [ 395.064784][T16173] : entered promiscuous mode [ 395.074668][T16167] xt_hashlimit: size too large, truncated to 1048576 [ 395.102041][T16179] __nla_validate_parse: 5 callbacks suppressed [ 395.102064][T16179] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2770'. [ 395.187632][T16184] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2771'. [ 395.253100][T16176] ksmbd: Unknown IPC event: 1, ignore. [ 395.393561][T16191] syzkaller0: entered promiscuous mode [ 395.399219][T16191] syzkaller0: entered allmulticast mode [ 395.499502][T16193] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2774'. [ 395.768117][T16201] syzkaller1: entered promiscuous mode [ 395.775041][T16201] syzkaller1: entered allmulticast mode [ 395.997992][T16213] netlink: 'syz.0.2781': attribute type 1 has an invalid length. [ 396.126854][T16215] veth7: entered allmulticast mode [ 396.142610][T16215] bond0: (slave veth7): Enslaving as an active interface with a down link [ 396.252971][ T1025] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 396.274630][ T1025] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 396.338528][T16233] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2787'. [ 396.448319][T16241] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2786'. [ 396.530096][T16243] nbd: must specify a device to reconfigure [ 396.875264][T16232] batman_adv: batadv0: Interface deactivated: gretap2 [ 397.099840][T16246] tipc: Enabling of bearer rejected, already enabled [ 397.242289][T16251] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2791'. [ 397.303652][T16258] netlink: 60 bytes leftover after parsing attributes in process `syz.2.2792'. [ 397.332620][ T29] audit: type=1804 audit(1785675337.856:11): pid=16260 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.1.2793" name="/newroot/545/cgroup.controllers" dev="tmpfs" ino=2794 res=1 errno=0 [ 397.378963][T16258] netlink: 60 bytes leftover after parsing attributes in process `syz.2.2792'. [ 397.408045][ T29] audit: type=1800 audit(1785675337.856:12): pid=16260 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.2793" name="cgroup.controllers" dev="tmpfs" ino=2794 res=0 errno=0 [ 397.443903][T16258] netlink: 500 bytes leftover after parsing attributes in process `syz.2.2792'. [ 397.494831][T16265] : renamed from bond_slave_0 [ 397.508066][T16264] netlink: 212408 bytes leftover after parsing attributes in process `syz.3.2795'. [ 397.536133][T16264] openvswitch: netlink: Message has 512 unknown bytes. [ 397.556438][T16269] netlink: 'syz.4.2797': attribute type 1 has an invalid length. [ 397.632731][T16269] bond4: (slave veth0_to_bond): Releasing active interface [ 397.666020][T16269] bond5: (slave veth0_to_bond): making interface the new active one [ 397.684812][T16269] bond5: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 398.453019][T16300] netlink: 'syz.4.2805': attribute type 1 has an invalid length. [ 398.747811][T16314] bond0: (slave ip6gretap0): Enslaving as a backup interface with an up link [ 398.926454][T16314] bond0 (unregistering): (slave veth7): Releasing backup interface [ 398.947018][T16314] veth7: left promiscuous mode [ 398.953053][T16320] netlink: 'syz.0.2810': attribute type 1 has an invalid length. [ 398.973998][T16314] bond0 (unregistering): (slave ip6gretap0): Releasing backup interface [ 398.995799][T16314] bond0 (unregistering): Released all slaves [ 399.040982][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 399.135875][T16322] bond4: (slave veth0_to_bond): Enslaving as an active interface with a down link [ 399.463045][T16337] netlink: 'syz.4.2816': attribute type 39 has an invalid length. [ 399.959639][T16354] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 400.303831][T16366] netlink: 'syz.1.2825': attribute type 1 has an invalid length. [ 400.404258][T16371] bond3: (slave veth0_to_bond): Releasing active interface [ 400.418755][T16377] __nla_validate_parse: 5 callbacks suppressed [ 400.418769][T16377] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2827'. [ 400.445369][T16371] bond5: (slave veth0_to_bond): making interface the new active one [ 400.457192][T16371] bond5: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 400.496569][T16376] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2827'. [ 400.686785][T16389] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 400.735616][T16389] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2830'. [ 400.794088][T16392] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2830'. [ 400.843537][T16389] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2830'. [ 400.880861][ T9078] wlan1: Trigger new scan to find an IBSS to join [ 401.086405][T16392] bridge0: entered promiscuous mode [ 401.408574][T16414] workqueue: Failed to create a rescuer kthread for wq "nfc3_nci_cmd_wq": -EINTR [ 401.409251][T16423] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 401.461848][T16429] netlink: 'syz.2.2840': attribute type 1 has an invalid length. [ 401.479920][T16424] smbdirect: ib_dev[syz1]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 401.510626][T16429] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2840'. [ 401.519933][T16424] smbdirect: ib_dev[syz1]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 401.542814][T16429] netlink: 'syz.2.2840': attribute type 1 has an invalid length. [ 401.557835][T16424] smbdirect: ib_dev[syz1]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 401.615845][T16424] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 401.743944][T16434] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 401.959302][T16439] veth1_to_batadv: mtu less than device minimum [ 402.047714][T16444] syzkaller0: entered promiscuous mode [ 402.067973][T16444] syzkaller0: entered allmulticast mode [ 402.121637][T16444] sch_tbf: burst 7 is lower than device syzkaller0 mtu (1500) ! [ 402.204954][T16462] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2850'. [ 402.366199][T16467] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2853'. [ 402.465468][T16469] netlink: 'syz.2.2854': attribute type 2 has an invalid length. [ 402.482125][ T9076] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 402.500512][ T9076] netdevsim netdevsim0 : set [0, 0] type 1 family 0 port 8472 - 0 [ 402.534141][T16469] netlink: 'syz.2.2854': attribute type 2 has an invalid length. [ 402.574559][T16477] netlink: 5408 bytes leftover after parsing attributes in process `syz.0.2855'. [ 402.584572][T16477] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 402.610436][ T3362] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 402.619896][T16476] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 402.637238][ T3362] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 402.745829][T16482] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2859'. [ 402.799684][T16482] netlink: 'syz.3.2859': attribute type 1 has an invalid length. [ 402.880932][ C1] openvswitch: cpu_id mismatch with handler threads [ 402.888778][T16487] xt_l2tp: v2 doesn't support IP mode [ 403.005610][T16482] A link change request failed with some changes committed already. Interface netpci0 may have been left with an inconsistent configuration, please check. [ 403.116053][T16498] netlink: 'syz.1.2864': attribute type 3 has an invalid length. [ 403.133819][ T29] audit: type=1107 audit(1785675343.656:13): pid=16499 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='貯5讕問_霠鏻0 c;飑C橽K,煥8刨O29Qk]賛C螪6K盷割觅櫩臒歑畑籡.1n=a 有5尚埍3 Gr媮_>*~厧x亊$R"愯0忱糩淚s0KZl祗2' [ 403.150628][T16498] netlink: 'syz.1.2864': attribute type 3 has an invalid length. [ 403.379518][T16504] lo speed is unknown, defaulting to 1000 [ 403.844169][ T1025] wlan1: Trigger new scan to find an IBSS to join [ 404.064045][T16525] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 404.782786][ T1025] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 404.904968][T16571] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 405.838548][T16609] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 405.948230][ T5636] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 405.961592][ T5636] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 405.972083][ T5636] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 405.984382][ T5636] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 405.994774][ T5636] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 406.060971][T16620] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 406.160840][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 406.169552][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 407.585315][T16614] lo speed is unknown, defaulting to 1000 [ 407.671356][T16689] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 407.837109][T16696] __nla_validate_parse: 3 callbacks suppressed [ 407.837127][T16696] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2914'. [ 407.898298][T16700] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2914'. [ 408.071871][T16707] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2915'. [ 408.084703][ T4940] Bluetooth: hci5: command tx timeout [ 408.106880][T16707] netlink: 36 bytes leftover after parsing attributes in process `syz.3.2915'. [ 408.239304][T16711] IPVS: wrr: FWM 3 0x00000003 - no destination available [ 408.245755][T16714] netlink: 'syz.2.2918': attribute type 1 has an invalid length. [ 408.318790][T16709] lo speed is unknown, defaulting to 1000 [ 408.388785][T16718] bond5: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 408.409795][T16718] bond5 (unregistering): Released all slaves [ 408.450561][T16614] bridge0: port 1(bridge_slave_0) entered blocking state [ 408.457934][T16614] bridge0: port 1(bridge_slave_0) entered disabled state [ 408.466562][T16614] bridge_slave_0: entered allmulticast mode [ 408.481349][T16614] bridge_slave_0: entered promiscuous mode [ 408.505023][T16614] bridge0: port 2(bridge_slave_1) entered blocking state [ 408.520839][T16614] bridge0: port 2(bridge_slave_1) entered disabled state [ 408.532750][T16614] bridge_slave_1: entered allmulticast mode [ 408.548142][T16614] bridge_slave_1: entered promiscuous mode [ 408.573146][T16724] bridge0: entered promiscuous mode [ 408.595486][T16724] bond0: (slave bridge0): making interface the new active one [ 408.604007][T16724] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 408.813148][T16614] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 408.847676][T16614] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 408.866748][T16732] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 408.944203][T16614] team0: Port device team_slave_0 added [ 408.982657][T16614] team0: Port device team_slave_1 added [ 409.252548][T16745] netlink: 'syz.3.2928': attribute type 1 has an invalid length. [ 409.315991][T16744] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2928'. [ 409.419533][T16745] 8021q: adding VLAN 0 to HW filter on device bond8 [ 409.444983][T16614] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 409.456811][T16614] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 409.486629][T16614] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 409.507456][T16749] bond8: entered promiscuous mode [ 409.524756][T16749] bond8: entered allmulticast mode [ 409.535923][T16614] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 409.544012][T16614] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 409.596186][T16614] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 409.797667][T16614] hsr_slave_0: entered promiscuous mode [ 409.812481][T16614] hsr_slave_1: entered promiscuous mode [ 409.827717][T16614] debugfs: 'hsr0' already exists in 'hsr' [ 409.839602][T16764] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 409.851940][T16614] Cannot create hsr debugfs directory [ 409.920708][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 410.160828][ T5636] Bluetooth: hci5: command tx timeout [ 410.178403][T16758] lo speed is unknown, defaulting to 1000 [ 410.245620][T16772] tipc: Resetting bearer [ 410.348249][T16614] netdevsim netdevsim4 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 410.360135][T16614] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 410.599333][T16614] netdevsim netdevsim4 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 410.624675][T16614] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 410.893634][T16614] netdevsim netdevsim4 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 410.935339][T16614] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 410.982440][T16792] FAULT_INJECTION: forcing a failure. [ 410.982440][T16792] name failslab, interval 1, probability 0, space 0, times 0 [ 411.014046][T16792] CPU: 0 UID: 0 PID: 16792 Comm: syz.0.2941 Not tainted syzkaller #0 PREEMPT(full) [ 411.014072][T16792] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 411.014083][T16792] Call Trace: [ 411.014090][T16792] [ 411.014099][T16792] dump_stack_lvl+0xe8/0x150 [ 411.014133][T16792] should_fail_ex+0x40c/0x560 [ 411.014163][T16792] should_failslab+0xa8/0x100 [ 411.014194][T16792] kmem_cache_alloc_node_noprof+0xb3/0x610 [ 411.014218][T16792] ? local_lock_release+0x9c/0x160 [ 411.014241][T16792] ? __alloc_skb+0x1d7/0x7a0 [ 411.014259][T16792] ? __alloc_skb+0x1d7/0x7a0 [ 411.014287][T16792] __alloc_skb+0x1d7/0x7a0 [ 411.014312][T16792] create_monitor_ctrl_close+0xbd/0x500 [ 411.014336][T16792] ? hci_sock_release+0xbb/0x560 [ 411.014361][T16792] hci_sock_release+0xd4/0x560 [ 411.014395][T16792] sock_close+0xad/0x220 [ 411.014423][T16792] ? __pfx_sock_close+0x10/0x10 [ 411.014449][T16792] __fput+0x418/0xa50 [ 411.014483][T16792] fput_close_sync+0x11f/0x240 [ 411.014510][T16792] ? __pfx_fput_close_sync+0x10/0x10 [ 411.014540][T16792] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 411.014568][T16792] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 411.014588][T16792] __x64_sys_close+0x7e/0x110 [ 411.014616][T16792] do_syscall_64+0x174/0x580 [ 411.014646][T16792] ? trace_irq_disable+0x3b/0x140 [ 411.014670][T16792] ? clear_bhb_loop+0x40/0x90 [ 411.014694][T16792] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 411.014713][T16792] RIP: 0033:0x7f2bd3b9e019 [ 411.014731][T16792] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 411.014748][T16792] RSP: 002b:00007f2bd4acd028 EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 411.014768][T16792] RAX: ffffffffffffffda RBX: 00007f2bd3e25fa0 RCX: 00007f2bd3b9e019 [ 411.014782][T16792] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004 [ 411.014793][T16792] RBP: 00007f2bd4acd090 R08: 0000000000000000 R09: 0000000000000000 [ 411.014804][T16792] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 411.014816][T16792] R13: 00007f2bd3e26038 R14: 00007f2bd3e25fa0 R15: 00007ffc8b503398 [ 411.014847][T16792] [ 411.386610][T16799] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2943'. [ 411.600691][ T4940] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 411.750833][T16806] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 412.262066][ T4940] Bluetooth: hci5: command tx timeout [ 414.320859][ T4940] Bluetooth: hci5: command tx timeout [ 415.229096][T16614] netdevsim netdevsim4 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 415.263197][T16614] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 415.725075][T16614] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 416.261095][T16614] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 416.288691][T16614] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 416.391565][T16614] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 416.535716][T16614] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 416.555995][T16614] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 416.578054][T16614] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 416.627300][T16614] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 416.829782][T16614] 8021q: adding VLAN 0 to HW filter on device bond0 [ 416.906577][T16614] 8021q: adding VLAN 0 to HW filter on device team0 [ 416.920097][T16870] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 416.936007][ T9071] bridge0: port 1(bridge_slave_0) entered blocking state [ 416.943601][ T9071] bridge0: port 1(bridge_slave_0) entered forwarding state [ 417.039169][T11488] bridge0: port 2(bridge_slave_1) entered blocking state [ 417.046458][T11488] bridge0: port 2(bridge_slave_1) entered forwarding state [ 417.292837][T16883] pim6reg0: tun_chr_ioctl cmd 1074025675 [ 417.305532][T16883] pim6reg0: persist disabled [ 417.359093][T16880] netlink: 'syz.2.2963': attribute type 1 has an invalid length. [ 417.397659][T16880] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2963'. [ 417.438145][T16885] can: request_module (can-proto-0) failed. [ 417.594700][T16893] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2966'. [ 417.719725][T16901] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2966'. [ 418.375232][T16921] netlink: 96 bytes leftover after parsing attributes in process `syz.0.2970'. [ 418.529038][T16927] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 418.548820][T16614] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 418.901020][T16946] netlink: 244 bytes leftover after parsing attributes in process `syz.0.2977'. [ 419.144405][T16950] syzkaller1: entered promiscuous mode [ 419.176861][T16950] syzkaller1: entered allmulticast mode [ 419.299053][T16956] smbdirect: ib_dev[syz2] removed [ 419.434776][T16614] veth0_vlan: entered promiscuous mode [ 419.463594][T16614] veth1_vlan: entered promiscuous mode [ 419.528385][T16614] veth0_macvtap: entered promiscuous mode [ 419.551322][T16614] veth1_macvtap: entered promiscuous mode [ 419.588851][T16614] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 419.657571][T16614] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 419.727167][ T9071] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 419.743760][ T9071] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 419.873131][ T9078] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 419.905105][ T9078] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 420.113515][T16978] netlink: 5408 bytes leftover after parsing attributes in process `syz.1.2985'. [ 420.168827][T16978] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 420.203935][ T43] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 420.222996][ T43] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 420.414973][ T6848] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 420.460160][ T6848] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 420.634412][T16994] netlink: 'syz.1.2989': attribute type 1 has an invalid length. [ 420.977475][T17003] netlink: 'syz.0.2993': attribute type 1 has an invalid length. [ 421.090981][T17003] 8021q: adding VLAN 0 to HW filter on device bond6 [ 421.166001][ T5636] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 421.187540][ T5636] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 421.202590][ T5636] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 421.229351][ T5636] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 421.239251][ T5636] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 421.636825][T17028] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 421.674826][T17028] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3000'. [ 421.751016][T17032] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3000'. [ 421.998364][T17036] bridge0: entered allmulticast mode [ 423.281036][ T4940] Bluetooth: hci3: command tx timeout [ 423.369482][T17096] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3015'. [ 423.392895][T17012] bridge0: port 1(bridge_slave_0) entered blocking state [ 423.412825][T17012] bridge0: port 1(bridge_slave_0) entered disabled state [ 423.430012][T17012] bridge_slave_0: entered allmulticast mode [ 423.439535][T17012] bridge_slave_0: entered promiscuous mode [ 423.447953][T17095] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 423.504819][T17100] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3015'. [ 423.585864][T17104] xt_ecn: cannot match TCP bits for non-tcp packets [ 423.609853][T17012] bridge0: port 2(bridge_slave_1) entered blocking state [ 423.623471][T17012] bridge0: port 2(bridge_slave_1) entered disabled state [ 423.637942][T17012] bridge_slave_1: entered allmulticast mode [ 423.654239][T17012] bridge_slave_1: entered promiscuous mode [ 423.808388][T17012] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 423.877896][T17012] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 423.935215][T17112] netlink: 'syz.0.3020': attribute type 4 has an invalid length. [ 423.941257][T17012] team0: Port device team_slave_0 added [ 423.953717][T17012] team0: Port device team_slave_1 added [ 424.026816][T17115] netlink: 'syz.0.3020': attribute type 4 has an invalid length. [ 424.045143][T17012] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 424.061567][T17012] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 424.104878][T17118] openvswitch: netlink: Encap mask attribute is set for non-VLAN frame. [ 424.107299][T17012] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 424.140213][T17012] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 424.159446][T17012] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 424.191019][T17012] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 424.261116][T17121] netdevsim netdevsim2 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 424.271754][T17121] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 424.352082][T17123] 8021q: VLANs not supported on ip6gre0 [ 424.419265][T17012] hsr_slave_0: entered promiscuous mode [ 424.442579][T17012] hsr_slave_1: entered promiscuous mode [ 424.450017][T17012] debugfs: 'hsr0' already exists in 'hsr' [ 424.470778][T17012] Cannot create hsr debugfs directory [ 424.511445][ T43] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 424.721609][ T995] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 424.729202][T17144] netlink: 'syz.2.3028': attribute type 3 has an invalid length. [ 424.765227][T17144] netlink: 224 bytes leftover after parsing attributes in process `syz.2.3028'. [ 424.989729][T17153] bond0: (slave ip6gretap0): making interface the new active one [ 425.011039][T17153] bond0: (slave ip6gretap0): Enslaving as an active interface with an up link [ 425.040980][ T5636] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 425.050662][ T43] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 425.068605][T17159] bond0 (unregistering): (slave veth7): Releasing active interface [ 425.082618][T17159] bond0 (unregistering): (slave ip6gretap0): Releasing active interface [ 425.105177][T17159] bond0 (unregistering): Released all slaves [ 425.117014][T17158] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3031'. [ 425.284969][T17012] netdevsim netdevsim3 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 425.361240][ T5636] Bluetooth: hci3: command tx timeout [ 425.490249][T17171] netlink: 16178 bytes leftover after parsing attributes in process `syz.4.3034'. [ 425.531224][ T995] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 425.676188][T17012] netdevsim netdevsim3 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 425.786227][T17185] GUP no longer grows the stack in syz.4.3037 (17185): 200000003000-200000004000 (200000001000) [ 425.805493][ T5285] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 425.816944][T17185] CPU: 0 UID: 0 PID: 17185 Comm: syz.4.3037 Not tainted syzkaller #0 PREEMPT(full) [ 425.816984][T17185] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 425.816997][T17185] Call Trace: [ 425.817005][T17185] [ 425.817013][T17185] dump_stack_lvl+0xe8/0x150 [ 425.817046][T17185] __get_user_pages+0x238c/0x2720 [ 425.817068][T17185] ? __gup_longterm_locked+0xc3b/0x15c0 [ 425.817111][T17185] __gup_longterm_locked+0xd52/0x15c0 [ 425.817133][T17185] ? lock_acquire+0x106/0x350 [ 425.817171][T17185] gup_fast_fallback+0x1d8c/0x20e0 [ 425.817190][T17185] ? lockdep_hardirqs_on+0x7a/0x110 [ 425.817244][T17185] ? __pfx_gup_fast_fallback+0x10/0x10 [ 425.817267][T17185] ? is_valid_gup_args+0x11f/0x200 [ 425.817290][T17185] ? get_user_pages_fast+0x4d/0xb0 [ 425.817313][T17185] __iov_iter_get_pages_alloc+0x378/0xa40 [ 425.817346][T17185] ? __pfx_pipe_clear_nowait+0x10/0x10 [ 425.817369][T17185] iov_iter_get_pages2+0x5e/0xa0 [ 425.817401][T17185] __se_sys_vmsplice+0x7b5/0x1660 [ 425.817449][T17185] ? __pfx___se_sys_vmsplice+0x10/0x10 [ 425.817486][T17185] ? __pfx_futex_wake+0x10/0x10 [ 425.817571][T17185] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 425.817593][T17185] do_syscall_64+0x174/0x580 [ 425.817618][T17185] ? trace_irq_disable+0x3b/0x140 [ 425.817647][T17185] ? clear_bhb_loop+0x40/0x90 [ 425.817667][T17185] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 425.817685][T17185] RIP: 0033:0x7f3a9539e019 [ 425.817702][T17185] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 425.817717][T17185] RSP: 002b:00007f3a935f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000116 [ 425.817736][T17185] RAX: ffffffffffffffda RBX: 00007f3a95625fa0 RCX: 00007f3a9539e019 [ 425.817751][T17185] RDX: 0000000000000001 RSI: 00002000000000c0 RDI: 000000000000000c [ 425.817763][T17185] RBP: 00007f3a9543500c R08: 0000000000000000 R09: 0000000000000000 [ 425.817775][T17185] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 [ 425.817785][T17185] R13: 00007f3a95626038 R14: 00007f3a95625fa0 R15: 00007ffdea9b7858 [ 425.817815][T17185] [ 426.067935][T17191] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3038'. [ 426.071796][T17185] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 426.087026][ T9076] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 426.095306][ T9076] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 426.276334][T17012] netdevsim netdevsim3 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 426.407468][T17012] netdevsim netdevsim3 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 426.862688][T17221] netlink: 'syz.2.3049': attribute type 1 has an invalid length. [ 426.900846][T17221] bond5: entered promiscuous mode [ 426.906027][T17221] bond5: entered allmulticast mode [ 426.912216][T17221] 8021q: adding VLAN 0 to HW filter on device bond5 [ 426.960625][ T5746] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 426.988229][T17012] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 427.006899][T17012] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 427.014956][T17012] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 427.029061][T17012] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 427.038811][T17012] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 427.059437][T17012] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 427.078123][T17012] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 427.098354][T17012] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 427.307608][T17240] bond0: (slave ip6gretap0): making interface the new active one [ 427.326513][T17240] bond0: (slave ip6gretap0): Enslaving as an active interface with an up link [ 427.433289][T17240] bond0 (unregistering): (slave veth7): Releasing active interface [ 427.446595][ T5636] Bluetooth: hci3: command tx timeout [ 427.480956][T17240] bond0 (unregistering): (slave ip6gretap0): Releasing active interface [ 427.556673][T17240] bond0 (unregistering): Released all slaves [ 427.564809][ T9071] smbdirect: ib_dev[syz1] removed [ 427.667780][ T42] infiniband syz1: ib_query_port failed (-19) [ 427.833582][T17012] 8021q: adding VLAN 0 to HW filter on device bond0 [ 427.914644][T17012] 8021q: adding VLAN 0 to HW filter on device team0 [ 427.978411][T11488] bridge0: port 1(bridge_slave_0) entered blocking state [ 427.985692][T11488] bridge0: port 1(bridge_slave_0) entered forwarding state [ 428.032021][T11488] bridge0: port 2(bridge_slave_1) entered blocking state [ 428.039344][T11488] bridge0: port 2(bridge_slave_1) entered forwarding state [ 428.618892][T17291] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3069'. [ 428.779425][T17291] 8021q: adding VLAN 0 to HW filter on device bond0 [ 428.824613][T17299] bond0: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 428.864117][T17303] netlink: 'syz.2.3071': attribute type 1 has an invalid length. [ 428.915189][T17295] tunl0: Caught tx_queue_len zero misconfig [ 428.986840][T17311] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3074'. [ 428.996938][T17311] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3074'. [ 429.010897][T17311] xt_CHECKSUM: CHECKSUM should be avoided. If really needed, restrict with "-p udp" and only use in OUTPUT [ 429.023415][T17311] xt_SECMARK: invalid mode: 9 [ 429.153857][T17303] bond6: (slave veth0_to_bond): making interface the new active one [ 429.208017][T17303] bond6: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 429.296356][T17316] netlink: 64 bytes leftover after parsing attributes in process `syz.1.3076'. [ 429.521927][ T4940] Bluetooth: hci3: command tx timeout [ 429.761845][ C0] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 429.986852][T17012] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 430.128564][T17012] veth0_vlan: entered promiscuous mode [ 430.173998][T17012] veth1_vlan: entered promiscuous mode [ 430.302176][T17012] veth0_macvtap: entered promiscuous mode [ 430.312914][T17363] syzkaller0: entered promiscuous mode [ 430.329946][T17363] syzkaller0: entered allmulticast mode [ 430.368931][T17012] veth1_macvtap: entered promiscuous mode [ 430.377447][T17363] tipc: Started in network mode [ 430.383224][T17363] tipc: Node identity ee20ea755f95, cluster identity 4711 [ 430.393922][T17363] tipc: Enabled bearer , priority 0 [ 430.446410][T17363] tipc: Resetting bearer [ 430.855905][T17370] ip6t_srh: unknown srh invflags 4000 [ 431.047637][T17362] tipc: Resetting bearer [ 431.214110][T17362] tipc: Disabling bearer [ 431.249808][T17012] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 431.278776][T17012] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 431.380496][ T43] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 431.422314][T17377] batadv0: entered promiscuous mode [ 431.438954][T17377] A link change request failed with some changes committed already. Interface batadv0 may have been left with an inconsistent configuration, please check. [ 431.513246][ T35] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 431.520600][ T5636] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 431.571863][ T43] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 431.625176][ T43] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 431.737138][ T9076] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 431.775125][ T9076] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 431.844705][ T43] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 431.869294][ T43] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 431.888786][T17386] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3099'. [ 432.214137][T17400] bond0: Error: Cannot enslave bond to itself. [ 432.601433][ T4940] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 432.616614][ T4940] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 432.625955][ T4940] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 432.644016][ T4940] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 432.655244][ T4940] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 432.980144][T17415] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3104'. [ 433.024161][T17413] ip6t_srh: unknown srh invflags 4000 [ 433.308229][T17423] bond0: (slave ip6gretap0): Enslaving as an active interface with an up link [ 433.376659][T17423] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 433.487534][T17423] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 433.546746][T17423] bond0 (unregistering): (slave ip6gretap0): Releasing backup interface [ 433.584668][T17423] bond0 (unregistering): Released all slaves [ 434.249963][T17433] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 434.525146][T17457] ip6t_srh: unknown srh invflags 4000 [ 434.721665][ T5636] Bluetooth: hci4: command tx timeout [ 434.748211][T17469] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3119'. [ 434.786256][T17407] bridge0: port 1(bridge_slave_0) entered blocking state [ 434.805491][T17407] bridge0: port 1(bridge_slave_0) entered disabled state [ 434.827829][T17407] bridge_slave_0: entered allmulticast mode [ 434.850151][T17407] bridge_slave_0: entered promiscuous mode [ 434.870095][T17407] bridge0: port 2(bridge_slave_1) entered blocking state [ 434.899246][T17407] bridge0: port 2(bridge_slave_1) entered disabled state [ 434.907564][T17407] bridge_slave_1: entered allmulticast mode [ 434.919424][T17407] bridge_slave_1: entered promiscuous mode [ 434.948064][T17474] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3121'. [ 435.020176][T17474] team0: Port device team_slave_0 removed [ 435.086210][T17407] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 435.114844][T17407] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 435.243411][T17407] team0: Port device team_slave_0 added [ 435.270033][T17407] team0: Port device team_slave_1 added [ 435.341287][T17484] ip6t_srh: unknown srh invflags 4000 [ 435.379388][T17407] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 435.395253][T17407] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 435.444656][T17407] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 435.466417][T17407] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 435.481758][T17407] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 435.508737][T17407] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 435.601861][ T4940] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 435.668947][T17407] hsr_slave_0: entered promiscuous mode [ 435.698200][T17407] hsr_slave_1: entered promiscuous mode [ 435.725704][T17407] debugfs: 'hsr0' already exists in 'hsr' [ 435.734626][T17495] netlink: 104 bytes leftover after parsing attributes in process `syz.0.3130'. [ 435.738072][T17493] netlink: 40 bytes leftover after parsing attributes in process `syz.2.3128'. [ 435.757660][T17407] Cannot create hsr debugfs directory [ 436.536043][T17514] ip6t_srh: unknown srh invflags 4000 [ 436.801315][ T4940] Bluetooth: hci4: command tx timeout [ 437.440643][ C0] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 438.140815][T17523] syzkaller0: entered promiscuous mode [ 438.162012][T17523] syzkaller0: entered allmulticast mode [ 438.218298][T17523] tipc: Started in network mode [ 438.244332][T17523] tipc: Node identity 0e4dfc16fa6c, cluster identity 4711 [ 438.288106][T17523] tipc: Enabled bearer , priority 0 [ 438.438828][T17407] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 438.619425][T17538] veth3: entered allmulticast mode [ 438.676924][T17523] tipc: Resetting bearer [ 438.700678][T17522] tipc: Resetting bearer [ 438.753190][T17522] tipc: Disabling bearer [ 438.881308][ T4940] Bluetooth: hci4: command tx timeout [ 438.886722][T17407] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 438.947840][T17552] ip6t_srh: unknown srh invflags 4000 [ 439.148091][T17558] netlink: 'syz.3.3149': attribute type 21 has an invalid length. [ 439.459816][T17407] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 439.473285][T17577] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 439.493501][T17577] netlink: 132 bytes leftover after parsing attributes in process `syz.0.3154'. [ 439.513525][T17577] netlink: 132 bytes leftover after parsing attributes in process `syz.0.3154'. [ 439.549872][T17407] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 439.887955][T17591] syzkaller0: entered promiscuous mode [ 439.897858][T17591] syzkaller0: entered allmulticast mode [ 440.010859][ T1320] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.015935][T17591] tipc: Enabled bearer , priority 0 [ 440.027536][T17599] netlink: 9 bytes leftover after parsing attributes in process `syz.3.3160'. [ 440.070017][T17599] gretap0: entered promiscuous mode [ 440.084544][T17604] netlink: 5 bytes leftover after parsing attributes in process `syz.3.3160'. [ 440.108152][T17591] tipc: Resetting bearer [ 440.123268][T17590] tipc: Resetting bearer [ 440.162310][T17590] tipc: Disabling bearer [ 440.178484][T17604] 0{X功: renamed from gretap0 [ 440.186358][T17604] 0{X功: left promiscuous mode [ 440.197575][T17604] 0{X功: entered allmulticast mode [ 440.206750][T17604] A link change request failed with some changes committed already. Interface 30{X功 may have been left with an inconsistent configuration, please check. [ 440.672697][T17619] netlink: 9 bytes leftover after parsing attributes in process `syz.0.3165'. [ 440.682603][T17619] gretap0: entered promiscuous mode [ 440.776329][T17622] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3165'. [ 440.796451][T17619] netlink: 5 bytes leftover after parsing attributes in process `syz.0.3165'. [ 440.808573][T17619] 0{X功: renamed from gretap0 [ 440.818494][T17619] 0{X功: left promiscuous mode [ 440.823968][T17619] 0{X功: entered allmulticast mode [ 440.830071][T17619] A link change request failed with some changes committed already. Interface 30{X功 may have been left with an inconsistent configuration, please check. [ 440.960841][ T4940] Bluetooth: hci4: command tx timeout [ 441.149128][T17632] netlink: 'syz.0.3169': attribute type 1 has an invalid length. [ 441.205402][T17632] bond0: (slave veth9): Enslaving as an active interface with a down link [ 441.276170][T17634] bond0: (slave vlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 442.855322][T17597] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 442.903387][T17407] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 442.959677][T17407] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 443.006154][T17407] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 443.085740][T17407] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 443.145033][T17407] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 443.196540][T17407] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 443.231985][T17651] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3170'. [ 443.252179][T17407] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 443.277987][T17407] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 443.381604][ T9071] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 443.421915][ T9071] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 443.466544][ T9071] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 443.497058][ T9071] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 443.611237][T17671] 8021q: adding VLAN 0 to HW filter on device team0 [ 443.622637][T17671] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 443.735796][T17680] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3176'. [ 443.768558][T17681] netlink: 104 bytes leftover after parsing attributes in process `syz.4.3177'. [ 443.789243][T17671] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 443.821882][T17671] virt_wifi0: default qdisc (pfifo_fast) fail, fallback to noqueue [ 443.856703][T17671] veth1_vlan: left promiscuous mode [ 443.876265][T17671] veth0_vlan: left promiscuous mode [ 443.884463][T17671] veth0_vlan: entered promiscuous mode [ 443.894496][T17671] veth1_vlan: entered promiscuous mode [ 443.906421][T17671] veth1_macvtap: left promiscuous mode [ 443.914650][T17671] veth0_macvtap: left promiscuous mode [ 443.921920][T17671] veth0_macvtap: entered promiscuous mode [ 443.932195][T17671] veth1_macvtap: entered promiscuous mode [ 443.965008][T17671] 8021q: adding VLAN 0 to HW filter on device  [ 443.983926][T17671] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 444.003919][T17671] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 444.013397][T17671] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 444.033508][T17671] 8021q: adding VLAN 0 to HW filter on device bond1 [ 444.044508][T17671] 8021q: adding VLAN 0 to HW filter on device bond2 [ 444.063276][T17671] batman_adv: batadv0: Interface activated: ip6gretap1 [ 444.096745][T17671] batman_adv: batadv0: Interface activated: gretap2 [ 444.108603][T17671] 8021q: adding VLAN 0 to HW filter on device bond3 [ 444.119078][T17671] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 444.129463][T17671] 8021q: adding VLAN 0 to HW filter on device bond4 [ 444.157488][T17671] 8021q: adding VLAN 0 to HW filter on device bond5 [ 444.167243][T17671] 8021q: adding VLAN 0 to HW filter on device bond0 [ 444.216784][ T5285] veth0_macvtap: left promiscuous mode [ 444.237904][ T9071] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 444.246559][ T9071] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 444.257606][ T9071] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 444.267467][ T8478] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 444.301276][T11488] netdevsim netdevsim0 : set [0, 1] type 1 family 0 port 2816 - 0 [ 444.321107][T11488] netdevsim netdevsim0 : set [1, 0] type 2 family 0 port 6081 - 0 [ 444.355884][ T9071] bond0: (slave veth9): link status definitely up, 10000 Mbps full duplex [ 444.368538][ T9071] bond0: (slave veth9): making interface the new active one [ 444.379252][ T9071] bond0: active interface up! [ 444.415422][ T9071] bond2: (slave veth5): link status definitely up, 10000 Mbps full duplex [ 444.427225][ T9071] bond2: (slave veth5): making interface the new active one [ 444.438569][ T9071] bond2: active interface up! [ 444.446673][ T6848] bond4: (slave veth0_to_bond): link status definitely up, 10000 Mbps full duplex [ 444.458538][ T6848] bond4: (slave veth0_to_bond): making interface the new active one [ 444.471083][ T6848] bond4: active interface up! [ 444.490561][T11488] netdevsim netdevsim0 netdevsim1: set [0, 1] type 1 family 0 port 2816 - 0 [ 444.499506][T11488] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 444.508761][T11488] netdevsim netdevsim0 netdevsim2: set [0, 1] type 1 family 0 port 2816 - 0 [ 444.517802][T11488] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 444.527005][T11488] netdevsim netdevsim0 netdevsim3: set [0, 1] type 1 family 0 port 2816 - 0 [ 444.536720][T11488] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 444.960942][ T8477] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 445.205437][ T8478] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 446.076131][T17639] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 446.085631][T17655] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 446.467173][T17712] netlink: 64 bytes leftover after parsing attributes in process `syz.4.3181'. [ 446.479091][ T9071] IPVS: starting estimator thread 0... [ 446.498850][T17712] netlink: 64 bytes leftover after parsing attributes in process `syz.4.3181'. [ 446.521727][T17708] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3182'. [ 446.559181][T17718] netlink: 'syz.0.3184': attribute type 1 has an invalid length. [ 446.580396][T17715] IPVS: using max 31 ests per chain, 74400 per kthread [ 446.598801][ T29] audit: type=1107 audit(1785675387.116:14): pid=17710 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='' [ 446.607378][T17722] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_rx_wq": -EINTR [ 446.647176][T17407] 8021q: adding VLAN 0 to HW filter on device bond0 [ 446.746285][T17708] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3182'. [ 446.819725][T17407] 8021q: adding VLAN 0 to HW filter on device team0 [ 446.865762][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 446.872828][T17740] sctp: [Deprecated]: syz.2.3187 (pid 17740) Use of int in max_burst socket option. [ 446.872828][T17740] Use struct sctp_assoc_value instead [ 446.873164][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 446.924015][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 446.931518][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 446.954153][T17740] netlink: 'syz.2.3187': attribute type 1 has an invalid length. [ 446.954430][T17743] netlink: 'syz.2.3187': attribute type 1 has an invalid length. [ 447.119236][T17750] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3189'. [ 447.170970][T17750] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3189'. [ 447.209497][T17750] bridge0: port 2(bridge_slave_1) entered disabled state [ 447.217587][T17750] bridge0: port 1(bridge_slave_0) entered disabled state [ 447.233294][T17750] bridge0: entered allmulticast mode [ 447.287636][T17753] bridge_slave_1: left allmulticast mode [ 447.295938][T17753] bridge_slave_1: left promiscuous mode [ 447.330160][T17753] bridge0: port 2(bridge_slave_1) entered disabled state [ 447.423949][T17753] bridge_slave_0: left allmulticast mode [ 447.473643][T17753] bridge_slave_0: left promiscuous mode [ 447.502459][T17753] bridge0: port 1(bridge_slave_0) entered disabled state [ 448.114559][T17784] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3193'. [ 448.117753][T17407] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 448.142056][T17784] netlink: 36 bytes leftover after parsing attributes in process `syz.3.3193'. [ 448.160982][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 448.194654][T17784] netlink: 36 bytes leftover after parsing attributes in process `syz.3.3193'. [ 448.229579][T17784] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3193'. [ 448.251821][T17407] veth0_vlan: entered promiscuous mode [ 448.276597][T17407] veth1_vlan: entered promiscuous mode [ 448.355962][T17407] veth0_macvtap: entered promiscuous mode [ 448.373748][T17407] veth1_macvtap: entered promiscuous mode [ 448.393936][T17407] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 448.408278][T17407] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 448.481809][ C1] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 448.492746][T11488] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 448.531778][T11488] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 448.544846][T11488] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 448.556655][T11488] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 450.263552][T17755] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 450.418568][ T43] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 450.439918][ T43] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 450.675723][T17802] geneve2: entered promiscuous mode [ 450.681527][T17802] geneve2: entered allmulticast mode [ 450.691340][ T9071] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 450.697533][T17801] bridge0: left promiscuous mode [ 450.715793][ T9071] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 450.762157][T17801] bond0: (slave bridge0): Releasing backup interface [ 451.844631][ T5636] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 451.864635][ T5636] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 451.875949][ T5636] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 451.887796][ T5636] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 451.899371][ T5636] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 452.348165][T17850] syzkaller0: entered promiscuous mode [ 452.379058][T17850] syzkaller0: entered allmulticast mode [ 452.461162][T17856] tipc: Enabled bearer , priority 0 [ 452.496026][T17849] tipc: Resetting bearer [ 452.545195][T17849] tipc: Disabling bearer [ 452.690446][T17860] __nla_validate_parse: 6 callbacks suppressed [ 452.690464][T17860] netlink: 52 bytes leftover after parsing attributes in process `syz.0.3211'. [ 452.791266][T17865] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3212'. [ 452.800789][ C0] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 452.844101][T17868] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3212'. [ 452.994785][ T6848] IPVS: starting estimator thread 0... [ 453.002179][T17855] FAULT_INJECTION: forcing a failure. [ 453.002179][T17855] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 453.006059][ T9071] netdevsim netdevsim2 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 453.036348][T17855] CPU: 1 UID: 0 PID: 17855 Comm: syz.1.3210 Not tainted syzkaller #0 PREEMPT(full) [ 453.036375][T17855] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 453.036386][T17855] Call Trace: [ 453.036393][T17855] [ 453.036401][T17855] dump_stack_lvl+0xe8/0x150 [ 453.036434][T17855] should_fail_ex+0x40c/0x560 [ 453.036463][T17855] _copy_from_user+0x2d/0xb0 [ 453.036482][T17855] ___sys_sendmsg+0x1c6/0x360 [ 453.036505][T17855] ? __lock_acquire+0x683/0x2cf0 [ 453.036533][T17855] ? __pfx____sys_sendmsg+0x10/0x10 [ 453.036589][T17855] ? __fget_files+0x2a/0x420 [ 453.036610][T17855] ? __fget_files+0x3a2/0x420 [ 453.036643][T17855] __x64_sys_sendmsg+0x1b1/0x290 [ 453.036668][T17855] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 453.036708][T17855] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 453.036727][T17855] do_syscall_64+0x174/0x580 [ 453.036748][T17855] ? trace_irq_disable+0x3b/0x140 [ 453.036767][T17855] ? clear_bhb_loop+0x40/0x90 [ 453.036785][T17855] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 453.036801][T17855] RIP: 0033:0x7f810ab9e019 [ 453.036814][T17855] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 453.036827][T17855] RSP: 002b:00007f810b9d7028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 453.036845][T17855] RAX: ffffffffffffffda RBX: 00007f810ae26090 RCX: 00007f810ab9e019 [ 453.036857][T17855] RDX: 0000000000000000 RSI: 0000200000000400 RDI: 0000000000000004 [ 453.036867][T17855] RBP: 00007f810b9d7090 R08: 0000000000000000 R09: 0000000000000000 [ 453.036876][T17855] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 453.036885][T17855] R13: 00007f810ae26128 R14: 00007f810ae26090 R15: 00007fffbb519848 [ 453.036910][T17855] [ 453.252318][T17877] IPVS: using max 37 ests per chain, 88800 per kthread [ 453.252388][T17872] bridge0: port 2(bridge_slave_1) entered disabled state [ 453.268369][T17872] bridge0: port 1(bridge_slave_0) entered disabled state [ 453.279923][T17872] bridge0: entered allmulticast mode [ 453.325672][T17874] bridge_slave_1: left allmulticast mode [ 453.336316][T17874] bridge_slave_1: left promiscuous mode [ 453.342485][T17874] bridge0: port 2(bridge_slave_1) entered disabled state [ 453.353007][T17874] bridge_slave_0: left allmulticast mode [ 453.359169][T17874] bridge_slave_0: left promiscuous mode [ 453.366608][T17874] bridge0: port 1(bridge_slave_0) entered disabled state [ 453.711097][T17893] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3216'. [ 453.722937][ T9071] netdevsim netdevsim2 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 453.781027][ T9071] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 453.939357][T17890] syzkaller1: entered promiscuous mode [ 453.953530][T17890] syzkaller1: entered allmulticast mode [ 454.016794][ T5636] Bluetooth: hci2: command tx timeout [ 454.288727][ T9071] netdevsim netdevsim2 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 454.324976][ T9071] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 454.796605][T17927] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3222'. [ 455.223466][T17936] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3225'. [ 455.285949][T17936] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3225'. [ 455.607586][T17941] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3227'. [ 455.864497][ T9078] netdevsim netdevsim2 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 455.984725][T17948] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 456.041530][ T9078] netdevsim netdevsim2 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 456.080475][ T5636] Bluetooth: hci2: command tx timeout [ 456.099112][T17959] FAULT_INJECTION: forcing a failure. [ 456.099112][T17959] name failslab, interval 1, probability 0, space 0, times 0 [ 456.117075][T17958] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3229'. [ 456.138312][T17944] sctp: [Deprecated]: syz.4.3226 (pid 17944) Use of int in maxseg socket option. [ 456.138312][T17944] Use struct sctp_assoc_value instead [ 456.163836][T17959] CPU: 1 UID: 0 PID: 17959 Comm: syz.1.3230 Not tainted syzkaller #0 PREEMPT(full) [ 456.163861][T17959] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 456.163873][T17959] Call Trace: [ 456.163880][T17959] [ 456.163888][T17959] dump_stack_lvl+0xe8/0x150 [ 456.163923][T17959] should_fail_ex+0x40c/0x560 [ 456.163952][T17959] should_failslab+0xa8/0x100 [ 456.163981][T17959] kmem_cache_alloc_noprof+0xa6/0x5f0 [ 456.164005][T17959] ? skb_clone+0x212/0x3a0 [ 456.164027][T17959] ? skb_clone+0x212/0x3a0 [ 456.164057][T17959] skb_clone+0x212/0x3a0 [ 456.164083][T17959] __netlink_deliver_tap+0x413/0x860 [ 456.164119][T17959] ? netlink_deliver_tap+0x2e/0x1b0 [ 456.164146][T17959] netlink_deliver_tap+0x19c/0x1b0 [ 456.164171][T17959] netlink_unicast+0x77f/0x940 [ 456.164209][T17959] netlink_sendmsg+0x813/0xb40 [ 456.164242][T17959] ? __pfx_netlink_sendmsg+0x10/0x10 [ 456.164271][T17959] ? aa_sock_msg_perm+0xf1/0x1b0 [ 456.164298][T17959] ? __pfx_netlink_sendmsg+0x10/0x10 [ 456.164321][T17959] sock_sendmsg_nosec+0x13a/0x180 [ 456.164352][T17959] ____sys_sendmsg+0x54e/0x850 [ 456.164383][T17959] ? __pfx_____sys_sendmsg+0x10/0x10 [ 456.164416][T17959] ? import_iovec+0x73/0xa0 [ 456.164438][T17959] ___sys_sendmsg+0x2a5/0x360 [ 456.164461][T17959] ? __lock_acquire+0x683/0x2cf0 [ 456.164494][T17959] ? __pfx____sys_sendmsg+0x10/0x10 [ 456.164551][T17959] ? __fget_files+0x2a/0x420 [ 456.164576][T17959] ? __fget_files+0x3a2/0x420 [ 456.164611][T17959] __x64_sys_sendmsg+0x1b1/0x290 [ 456.164637][T17959] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 456.164679][T17959] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 456.164700][T17959] do_syscall_64+0x174/0x580 [ 456.164725][T17959] ? trace_irq_disable+0x3b/0x140 [ 456.164749][T17959] ? clear_bhb_loop+0x40/0x90 [ 456.164773][T17959] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 456.164799][T17959] RIP: 0033:0x7f810ab9e019 [ 456.164816][T17959] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 456.164833][T17959] RSP: 002b:00007f810b9f8028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 456.164851][T17959] RAX: ffffffffffffffda RBX: 00007f810ae25fa0 RCX: 00007f810ab9e019 [ 456.164864][T17959] RDX: 0000000000000000 RSI: 0000200000000140 RDI: 0000000000000003 [ 456.164875][T17959] RBP: 00007f810b9f8090 R08: 0000000000000000 R09: 0000000000000000 [ 456.164885][T17959] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 456.164895][T17959] R13: 00007f810ae26038 R14: 00007f810ae25fa0 R15: 00007fffbb519848 [ 456.164922][T17959] [ 456.239185][T17832] bridge0: port 1(bridge_slave_0) entered blocking state [ 456.554934][T17832] bridge0: port 1(bridge_slave_0) entered disabled state [ 456.563728][T17832] bridge_slave_0: entered allmulticast mode [ 456.573937][T17832] bridge_slave_0: entered promiscuous mode [ 456.649251][T17968] syz_tun: entered allmulticast mode [ 456.651087][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 456.714406][ T9071] pim6reg: left allmulticast mode [ 457.003272][T17980] xt_ipcomp: unknown flags 1D [ 457.281878][ C1] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 458.083234][ T9071] BUG: MAX_LOCKDEP_KEYS too low! [ 458.088236][ T9071] turning off the locking correctness validator. [ 458.094926][ T9071] CPU: 1 UID: 0 PID: 9071 Comm: kworker/u8:16 Not tainted syzkaller #0 PREEMPT(full) [ 458.094942][ T9071] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 458.094950][ T9071] Workqueue: netns cleanup_net [ 458.094969][ T9071] Call Trace: [ 458.094975][ T9071] [ 458.094981][ T9071] dump_stack_lvl+0xe8/0x150 [ 458.094999][ T9071] register_lock_class+0x2aa/0x2e0 [ 458.095014][ T9071] ? add_lock_to_list+0xc7/0x100 [ 458.095025][ T9071] __lock_acquire+0xab/0x2cf0 [ 458.095044][ T9071] ? dev_reset_queue+0x138/0x1b0 [ 458.095057][ T9071] lock_acquire+0x106/0x350 [ 458.095071][ T9071] ? dev_reset_queue+0x138/0x1b0 [ 458.095084][ T9071] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 458.095096][ T9071] ? dev_reset_queue+0x138/0x1b0 [ 458.095108][ T9071] _raw_spin_lock_bh+0x36/0x50 [ 458.095121][ T9071] ? dev_reset_queue+0x138/0x1b0 [ 458.095133][ T9071] dev_reset_queue+0x138/0x1b0 [ 458.095146][ T9071] dev_deactivate_many+0x778/0xda0 [ 458.095159][ T9071] ? dev_deactivate_many+0x25d/0xda0 [ 458.095173][ T9071] __dev_close_many+0x180/0x6e0 [ 458.095183][ T9071] ? kasan_save_stack+0x3e/0x60 [ 458.095196][ T9071] ? kasan_record_aux_stack+0xbd/0xd0 [ 458.095207][ T9071] ? call_rcu+0xee/0x8b0 [ 458.095216][ T9071] ? ip_fib_net_exit+0x2c6/0x330 [ 458.095228][ T9071] ? process_scheduled_works+0xa8e/0x14e0 [ 458.095239][ T9071] ? worker_thread+0xa47/0xfb0 [ 458.095250][ T9071] ? __pfx___dev_close_many+0x10/0x10 [ 458.095262][ T9071] netif_close_many+0x249/0x660 [ 458.095273][ T9071] ? __pfx_netif_close_many+0x10/0x10 [ 458.095285][ T9071] unregister_netdevice_many_notify+0xb76/0x2150 [ 458.095303][ T9071] ? call_rcu+0x64b/0x8b0 [ 458.095313][ T9071] ? __pfx_unregister_netdevice_many_notify+0x10/0x10 [ 458.095330][ T9071] ? __pfx_nexthop_net_exit_rtnl+0x10/0x10 [ 458.095346][ T9071] ? rtnl_is_locked+0x15/0x20 [ 458.095359][ T9071] ? nexthop_net_exit_rtnl+0x258/0x2a0 [ 458.095375][ T9071] ops_undo_list+0x391/0x8d0 [ 458.095388][ T9071] ? __pfx_ops_undo_list+0x10/0x10 [ 458.095399][ T9071] ? idr_destroy+0x227/0x290 [ 458.095413][ T9071] cleanup_net+0x572/0x810 [ 458.095424][ T9071] ? __pfx_cleanup_net+0x10/0x10 [ 458.095435][ T9071] ? rcu_is_watching+0x15/0xb0 [ 458.095445][ T9071] ? process_scheduled_works+0xa20/0x14e0 [ 458.095456][ T9071] process_scheduled_works+0xa8e/0x14e0 [ 458.095474][ T9071] ? __pfx_process_scheduled_works+0x10/0x10 [ 458.095487][ T9071] ? assign_work+0x3cf/0x5d0 [ 458.095498][ T9071] worker_thread+0xa47/0xfb0 [ 458.095516][ T9071] kthread+0x388/0x470 [ 458.095530][ T9071] ? __pfx_worker_thread+0x10/0x10 [ 458.095541][ T9071] ? __pfx_kthread+0x10/0x10 [ 458.095555][ T9071] ret_from_fork+0x514/0xb70 [ 458.095571][ T9071] ? __pfx_ret_from_fork+0x10/0x10 [ 458.095585][ T9071] ? __switch_to+0xc89/0x1420 [ 458.095598][ T9071] ? __pfx_kthread+0x10/0x10 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 458.095613][ T9071] ret_from_fork_asm+0x1a/0x30 [ 458.095626][ T9071] [ 458.413140][ T5636] Bluetooth: hci2: command tx timeout [ 460.483589][ T5636] Bluetooth: hci2: command tx timeout [ 465.621470][ C1] openvswitch: cpu_id mismatch with handler threads [ 469.844292][ T9071] bond1 (unregistering): (slave geneve3): Releasing active interface [ 469.930050][ T9071] bond1 (unregistering): Released all slaves [ 469.942165][ T9071] bond2 (unregistering): Released all slaves [ 469.955285][ T9071] bond3 (unregistering): Released all slaves [ 469.967690][ T9071] bond4 (unregistering): Released all slaves [ 469.977327][ T9071] bond0 (unregistering): Released all slaves [ 469.986893][ T9071] bond5 (unregistering): Released all slaves [ 469.998024][ T9071] bond6 (unregistering): (slave veth0_to_bond): Releasing active interface [ 470.008410][ T9071] bond6 (unregistering): Released all slaves [ 470.026558][ T9071] bond7 (unregistering): Released all slaves [ 470.035461][T17832] bridge0: port 2(bridge_slave_1) entered blocking state [ 470.042855][T17832] bridge0: port 2(bridge_slave_1) entered disabled state [ 470.050036][T17832] bridge_slave_1: entered allmulticast mode [ 470.057364][T17832] bridge_slave_1: entered promiscuous mode [ 470.064980][T17968] syz_tun: left allmulticast mode [ 470.079296][T17980] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3235'. [ 470.268603][ T6848] netdevsim netdevsim2 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 470.299646][ T9071] : left promiscuous mode [ 470.511044][ T9071] tipc: Disabling bearer [ 470.518270][ T9071] tipc: Disabling bearer [ 470.541739][ T9071] tipc: Disabling bearer [ 470.549018][ T9071] tipc: Left network mode [ 470.712851][ T35] netdevsim netdevsim2 eth4: set [0, 0] type 1 family 0 port 8472 - 0 [ 470.827604][ T5285] 8021q: adding VLAN 0 to HW filter on device eth1 [ 471.002835][ T9071] hsr_slave_0: left promiscuous mode [ 471.015077][ T9071] hsr_slave_1: left promiscuous mode [ 471.027920][ T9071] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 471.035766][ T9071] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 471.054153][ T9071] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 471.070555][ T9071] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 471.085449][ T9071] veth1_vlan: left promiscuous mode [ 471.090908][ T9071] veth0_vlan: left promiscuous mode [ 471.447784][ T5285] 8021q: adding VLAN 0 to HW filter on device eth2 [ 471.766088][ T9071] IPVS: stop unused estimator thread 0... [ 471.823768][ T5285] 8021q: adding VLAN 0 to HW filter on device eth3 [ 471.849327][ T9071] netdevsim netdevsim4 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 471.862432][ T9071] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 471.897846][ T9071] netdevsim netdevsim4 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 471.910571][ T9071] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 471.967782][ T9071] netdevsim netdevsim4 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 471.979735][ T9071] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 472.010017][ T9071] netdevsim netdevsim4 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 472.020911][ T9071] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 472.112819][ T43] netdevsim netdevsim4 eth5: set [0, 0] type 1 family 0 port 8472 - 0 [ 472.134565][ T5285] 8021q: adding VLAN 0 to HW filter on device eth4 [ 472.170870][ T9071] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 472.190550][ T9078] netdevsim netdevsim4 eth7: set [0, 0] type 1 family 0 port 8472 - 0 [ 472.198797][ T9078] netdevsim netdevsim4 eth8: set [0, 0] type 1 family 0 port 8472 - 0 [ 472.211489][ T43] netdevsim netdevsim4 eth6: set [0, 0] type 1 family 0 port 8472 - 0 [ 472.249257][ T9071] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 472.298078][ T9071] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 472.337298][ T9071] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 472.447521][ T43] netdevsim netdevsim1 eth12: set [0, 0] type 1 family 0 port 8472 - 0 [ 472.463782][ T9071] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 472.490934][ T43] netdevsim netdevsim1 eth10: set [0, 0] type 1 family 0 port 8472 - 0 [ 472.499552][ T43] netdevsim netdevsim1 eth9: set [0, 0] type 1 family 0 port 8472 - 0 [ 472.508594][ T43] netdevsim netdevsim1 eth11: set [0, 0] type 1 family 0 port 8472 - 0 [ 472.529506][ T9071] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 472.567959][ T9071] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 472.626764][ T9071] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 472.640799][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 472.675982][ T43] netdevsim netdevsim3 eth13: set [0, 0] type 1 family 0 port 8472 - 0 [ 472.694447][ T43] netdevsim netdevsim3 eth14: set [0, 0] type 1 family 0 port 8472 - 0 [ 472.719734][ T9078] netdevsim netdevsim3 eth16: set [0, 0] type 1 family 0 port 8472 - 0 [ 472.737563][ T9071] bridge_slave_1: left allmulticast mode [ 472.748514][ T9071] bridge_slave_1: left promiscuous mode [ 472.754967][ T9071] bridge0: port 2(bridge_slave_1) entered disabled state [ 472.768722][ T9071] bridge_slave_0: left allmulticast mode [ 472.775358][ T9071] bridge_slave_0: left promiscuous mode [ 472.781336][ T9071] bridge0: port 1(bridge_slave_0) entered disabled state [ 472.793339][ T9071] bridge_slave_1: left allmulticast mode [ 472.799046][ T9071] bridge_slave_1: left promiscuous mode [ 472.805533][ T9071] bridge0: port 2(bridge_slave_1) entered disabled state [ 472.814375][ T9071] bridge_slave_0: left allmulticast mode [ 472.820138][ T9071] bridge_slave_0: left promiscuous mode [ 472.831687][ T9071] bridge0: port 1(bridge_slave_0) entered disabled state [ 472.953120][ T9071] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 472.967887][ T9071] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 472.983542][ T9071] bond0 (unregistering): Released all slaves [ 473.032651][ T9071] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 473.048097][ T9071] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 473.061988][ T9071] bond0 (unregistering): Released all slaves [ 473.081666][ T9071] bond0 (unregistering): Released all slaves [ 473.160729][ T9078] netdevsim netdevsim3 eth15: set [0, 0] type 1 family 0 port 8472 - 0 [ 473.210425][ T9071] tipc: Left network mode [ 473.241255][ T9071] tipc: Left network mode [ 473.458500][ T5285] 8021q: adding VLAN 0 to HW filter on device eth5 [ 473.589104][ T9071] hsr_slave_0: left promiscuous mode [ 473.594995][ T9071] hsr_slave_1: left promiscuous mode [ 473.601064][ T9071] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 473.608683][ T9071] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 473.622780][ T9071] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 473.630224][ T9071] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 473.645641][ T9071] hsr_slave_0: left promiscuous mode [ 473.651760][ T9071] hsr_slave_1: left promiscuous mode [ 473.657670][ T9071] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 473.665746][ T9071] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 473.673920][ T9071] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 473.681766][ T9071] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 473.693992][ T9071] hsr_slave_0: left promiscuous mode [ 473.699904][ T9071] hsr_slave_1: left promiscuous mode [ 473.706349][ T9071] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 473.714765][ T9071] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 473.722997][ T9071] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 473.731070][ T9071] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 473.746990][ T9071] veth1_macvtap: left promiscuous mode [ 473.753312][ T9071] veth0_macvtap: left promiscuous mode [ 473.758895][ T9071] veth1_vlan: left promiscuous mode [ 473.764617][ T9071] veth0_vlan: left promiscuous mode [ 473.771754][ T9071] veth1_macvtap: left promiscuous mode [ 473.777275][ T9071] veth0_macvtap: left promiscuous mode [ 473.783188][ T9071] veth1_vlan: left promiscuous mode [ 473.788464][ T9071] veth0_vlan: left promiscuous mode [ 473.794592][ T9071] veth1_macvtap: left promiscuous mode [ 473.800087][ T9071] veth0_macvtap: left promiscuous mode [ 473.805966][ T9071] veth1_vlan: left promiscuous mode [ 473.811770][ T9071] veth0_vlan: left promiscuous mode [ 473.920583][ C1] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 473.963639][ T9071] team0 (unregistering): Port device team_slave_1 removed [ 473.974156][ T9071] team0 (unregistering): Port device team_slave_0 removed [ 474.057271][ T9071] team0 (unregistering): Port device team_slave_1 removed [ 474.087359][ T9071] team0 (unregistering): Port device team_slave_0 removed [ 474.220855][ T9071] team0 (unregistering): Port device team_slave_1 removed [ 474.257464][ T5285] 8021q: adding VLAN 0 to HW filter on device eth6 [ 474.577287][ T5285] 8021q: adding VLAN 0 to HW filter on device eth7 [ 474.861279][ T5285] 8021q: adding VLAN 0 to HW filter on device eth8 [ 475.182383][ T5285] 8021q: adding VLAN 0 to HW filter on device eth9 [ 475.208411][ T9071] IPVS: stop unused estimator thread 0... [ 475.214762][ T9071] IPVS: stop unused estimator thread 0... [ 475.410009][ T5285] 8021q: adding VLAN 0 to HW filter on device eth10 [ 475.638878][ T5285] 8021q: adding VLAN 0 to HW filter on device eth11 [ 475.851349][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 475.861653][ T5285] 8021q: adding VLAN 0 to HW filter on device eth12 [ 476.093673][ T5285] 8021q: adding VLAN 0 to HW filter on device eth13 [ 476.303246][ T5285] 8021q: adding VLAN 0 to HW filter on device eth14 [ 476.513899][ T5285] 8021q: adding VLAN 0 to HW filter on device eth15 [ 476.725197][ T5285] 8021q: adding VLAN 0 to HW filter on device eth16 VM DIAGNOSIS: Connection timed out during banner exchange Connection to 10.128.1.38 port 22 timed out failed to run ["ssh" "-p" "22" "-F" "/dev/null" "-o" "UserKnownHostsFile=/dev/null" "-o" "IdentitiesOnly=yes" "-o" "BatchMode=yes" "-o" "StrictHostKeyChecking=no" "-o" "ConnectTimeout=10" "root@10.128.1.38" "cat" "/proc/lockdep_stats" "/proc/lockdep" "/proc/lockdep_chains"]: exit status 255