last executing test programs: 8m11.645689115s ago: executing program 2 (id=424): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x2}}, 0x2e) socket$inet_mptcp(0x2, 0x1, 0x106) r2 = syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000000)='ns/pid\x00') r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) connect$inet6(r3, &(0x7f0000000180)={0xa, 0x4001, 0x1, @dev={0xfe, 0x80, '\x00', 0x39}, 0x3e}, 0x1c) recvfrom(r3, 0x0, 0x0, 0xa0, 0x0, 0x0) r4 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r4, 0x8933, &(0x7f0000000000)={'vxcan1\x00', 0x0}) bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x10, 0x8, &(0x7f0000001340)=ANY=[], &(0x7f0000000480)='syzkaller\x00'}, 0x94) bind$can_j1939(r4, &(0x7f00000000c0)={0x1d, r5}, 0x18) sendmsg$can_j1939(r4, 0x0, 0x4000000) socket$l2tp6(0xa, 0x2, 0x73) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) socket$inet_mptcp(0x2, 0x1, 0x106) socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x30) r7 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r6, &(0x7f0000000040)={@val={0x0, 0x19}, @val={0x0, 0x3, 0x3, 0x3c5a, 0x2, 0x3}, @eth={@multicast, @multicast, @void, {@canfd={0xd, {{0x2}, 0x7, 0x2, 0x0, 0x0, "c81fcd17ec803cbb43e3d31bb41a0ec606d2c8b8ac7bdf836d4cf2cd00ddd73e7f5f83a48ad36e1b07d51d201687b1bbafb4d181091d1aeedd73a5d1de87ffc7"}}}}}, 0x64) sendto$inet6(r3, &(0x7f0000000380)="0d3c8d828d57dbfda8e65fc0112d5971f9dadbbadd9122bbd51b42b3383e962e95a47a5eed75d38dd92ed0230b4d4079e17e1bdf0cba92", 0x37, 0x90, 0x0, 0x0) ioctl$FICLONE(r2, 0x40049409, 0xffffffffffffffff) r8 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r9, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)={0x3c, r8, 0x1, 0x70bd26, 0x25dfdbfe, {0x5}, [@L2TP_ATTR_CONN_ID={0x8, 0x9, 0x2}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x5}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0xaaa}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x4}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x1}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20006911}, 0x0) 8m11.193644946s ago: executing program 2 (id=428): r0 = socket$alg(0x26, 0x5, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) bind$alg(r0, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'xchacha12\x00'}, 0x58) accept(r0, 0x0, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000540)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-twofish-avx\x00'}, 0x58) r2 = accept4(r1, 0x0, 0x0, 0x80800) ioctl$sock_SIOCSIFVLAN_GET_VLAN_REALDEV_NAME_CMD(r0, 0x8983, &(0x7f0000000040)={0x8, 'pim6reg1\x00', {'hsr0\x00'}, 0x1000}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = accept4$ax25(r2, &(0x7f0000000100)={{0x3, @null}, [@rose, @bcast, @remote, @netrom, @remote, @netrom, @remote, @rose]}, &(0x7f00000001c0)=0x48, 0x80000) ioctl$BTRFS_IOC_SNAP_DESTROY_V2(r0, 0x5000943f, &(0x7f00000005c0)={{r4}, 0x0, 0x8, @inherit={0x50, &(0x7f0000000200)={0x1, 0x1, 0x800, 0x7, {0x36, 0xffffffff, 0x5, 0xffffffffffffffff, 0xc38}, [0x6]}}, @name="ecaa6fce254a1d8f7ee730638c05bbc0df0680519ccbc587cf5ea8757a6d8b544b5bd7a27dbbce5aff0ac399e06e31c55fc63e683efb07436e5f14e752b7474bffaa68296468cdc016ff002eb4b9cb5a62b42cbc82d5cd0eb5e16b51e3df6e7e4fd9bd3d3828c8ecdc1f5fad9915c170a1260dd0bcdb8a658da962d8eed233b61496b20f3e332cf3818de677aa77bbe5acc090d6ce8dc393986a288445586c6ea5e69e9cbb6702edc8eb2efeb4daac10184457e0d2c95f67549337fcd805b213eb61d2c54f313e61dc16b081af1d8feda957d9113ea5398b502ffb666f7ebcbbd93d271c17c676be426c6787bc73c9a6e19903c70a88032faf5bf2168c0853b4eda7c3624b9c332bc74b2b470ceabd00ef10afd3c48278b6cf83bdce5872e5039993ee52e180d5ff0a822edffd74dd1e4c82630eff71ed4286e5461b67ff2317ef263ddb114864fbcd245e0a0dc13b84af77366d9b80b4eb57d860054b2a71717ecaf274c0d6c37c84fe4a4ac1b9c205e370df330ee67f1734e80811e49b64158240d442642ba7d0244bf15853f2f9155314611cbac9acfe286af13d882c9394dc367c6d48949ec67e0676ab5de28a97efef43dff19cbb3d8c499d129702ea9c7f29934cb7aae0923897ed7541b2aa0c477c79a3bd2682ba1ff659da5c4488315304e1b920c85e4ca38aae453bc9df42a38fe697c73a02712ad2bafc20b86517e94e5361ac927c295df9ec7ba70278ac4a6f193a20f1a66d80d6cf3719031ddcc6b8c96e489fc4ae03c4440f7d91ddce1410b4312c50f4c96b446a5e4482585330645758307ec73733d5709f239b68a44bbd10e81b0acdefe66fcbeea4fb9f282e1f465cb8b91032d2873cec0b07eb5177fe1b8e3f865e93da2c74c4b74c0e0d60bb125defdc407f22f881e8801660c4dcc1a8133d6c6f16303832430f9a3df8bfbb3dc685878ac2fe2898a6f75386f64808f2fe4216a253a8ea58598acc61da71ac2d7c08b988985decf7372759728cc28dfa502842106d3b9a70dc477469bfa3f98cb7d7e9190447056e0351182a34f2e4dab047e35cf6b6cb0ef49da7388529422ca2ffc928cb5d59d16fd7cdc87e5c402f252b0cfad1bd95f5c4805916640e1d35696c5e52838331577e54a9f0c633a0ca0814812b15deff2ab48e3a4db70b3b2dcbf8a30f3635d3cc27d10d2839ed342c61e133ad769225ecfda87650564b0f1f5b854e35943a12b6d8d962fc8e39def20adf316fe0b59056955ff00b84e46650fd0f15856915080c7239956a5b8fc4c912cedc1ec7646813e9e8a32d50ea1a9cba5ba1673c3a8e4340054b1fed70f629d9473973e19b5e2ee4d068c404c13a7db3d506922652f23519134dd1444a50e03b6288d1bd8065fddbd28b6ff4cc97cf5f7bcf1234b92df2c3ce408abcd30415468183e8426f3943f62fe5ac066b6e522244e5aadbfd2d766cd7283f27746c211d3eba07b414fb6b6971c16948a8ef8de7d00b9e3268ab0a37762b665de088c0f28fef19717add0bb4c3ddda44ca155aead172cecf9f8c44657d6d7df046f2d2f506fa153909efcfeddf372511884096d9f35e5d0b707fa193ff20239ac565493f4d2cbbb56b0a49d0dbf63fc347034d3aaaa3e073a4f9a0d3273dbe1f9598977c4e04dff1ae806751f491e99bc0e71cf9909513529dd50836855048790efb02b7c428914eab057de83ca4744e0cb652e292576c4668d84b3aecbcba3c02ddc9bd39349a6d53c6b7ed65225a32ff5cadcf17a307f3b6024e7df133504bb575aa0ccceae5426dec71025e0c39497811ca9bce0b46e66b07df3a4ab6dcf50f5d6d9538e63852c5558601383802b0d4a1e829d7c75264a00b3292c2e44e2cd5a23fb529e078dacdd98852abe0eb09576d4098dca9f46077e8e05ccded11cc29a5c5a1cd2d69849aae80e10db6f2a6327394d1bf2ec57292da5fa7baa8b58152b866c1e5ee2f1ba1664322ed168432b8facfb69e9fb03fe6c2889e79cbbd7263110c61bcd6b9be72cfad2e0e74f4c95ac3648f205d3a14c47ba8385e1ccbd6cfec48fe2c3e0ca67789d2b0add5a693882d568806fabdcc6062de574b3933ad2cfec13113013821d6be6eaa2af8419fa253dad9d2bf9db0765f38f082d07eeaf6c86f7bab366a6b5cc9eb37211f833a65512f05ae33271fd1b02d764e7dfaa93fa1ea12d442ede2459aecb0a30eba9d308c11429bcb0d8b45fb6e9a4e0a7c4d01b5dd4ab1a885d3ca9ee7051e31d81ac3a402bb853b153208c09c5793359cbe0d6db4c11cc5eb639abade104279f47d3b7bc80a87780866b1111a570a4cde67135490d28cc6e2d96dfd43d06924f05e71df9f36cd842198c6ac9dba4d537465ba79ed5ea6b8112a1cf1774b7b54108788befbddd38aa5584ab6342b9b8b653bbc2db86a89359643049468876f842e531766c63c5c8a497c25191dd2d0d1706cf9d26da3b4c1b028d6aa33b94d8afc7bb179396cd5f375dc1b769295e8e817d6383ad029ddb2b14b30ddb02c826b6b3ed113c2ff11bf880841640070886a9991356809f42e3f82d3254e996a1bc2cb065f92847c69418855bb90d4d96c5d4bbd7afa494b7635396151fce8d3bda93d7caaae85f5eeb99c3bd5191cd8386f7c8e906eb1cea66a7e831e79c3fa64cc7f14cfd80883cd62ac576b79f428c61e6f03daa81001f1c0cbcebb381353900cfdb309fb7e679adf2b83e5a09005b4b750c600b195c817465eee714efe489a385ccbd2fa11c9089a188812fd4e44398d20392d4d5fc90a3c0f4006cb9841e28e3197ae50ff77994ea8291e633c222f2506800b7d27ab2a8ba5eae2693b0be855032866c8880c43650196eb5e48ac850bfd608dbddbf6438eb2e7abc9a5a009ddb2729a9cc9f08618c676c7d9160f494d423b2b1a11ef3e1d6600921415ad462efd21bf8cf10feeeb0ce33503a5e4a34f70f80421c4977ea1635f13293bfed1adfced1055d31c0b14e5afc08aec6ba43b943445192a302b5824f904c1513df8bbaae2e0bf736002cd8950344cf011775e75bfb6baeaddc5ba45f1f15729983781bc9f8feceaacccfe4b10c929d3625d0c5afe68e64630101fb2f621cca5af378dd2146b036c1a042d7866af0da5917e37f76a3886bc2d8ef4fdb242f10d91be2d0a5bb4f557e74213a3c1512123a28ec0f644ec3f238c3d7c2815276134a54720847760abb4f42f4b246b977f24895f5dbabea153272ec4548f1e8862aac4009593851e899baf81e9e7fd9ee0f5402b6e186e9f520753261d5ccb0b2f60869477a159a1f1566d79879a8c19b0e7e67eb69bf7f42c30a6d19e14e28d68bdf36ea0cb21723e8d998bf47e7ed6a5be23e7e8843428e07eb1cebc60168d71b66fd71079654807193bf0b461665e0432d9a7914de04aeab4a1a084a0af9ecdb60cd34364d4513a37541e4e100181c53195f5833f3799d93761e2065f9c0db2fd900b9b8904adeddb35e9ad5a88103da5dd1eb31b62821cd1128583b097e07208095dfd4bc743410a89903b4b692c371ad4b02d30e503c5f649a70ee25efa6574b3af8b73ff406aa7bd6b69ff0db6b867e95c97e68529f673cc3a8e3a95ba95c8bec1bc288db8b21d2fc9dddca21bd7a7e35221cfc0d27e53a6eb9029eec83622d7cf5d06c7be9fc9a0a2ce467a2f475290ac9af7add7c99c80f91e727cf554bbcf3b81df01bf7d39730bd335ff41d61542fe6b0058df4d34d0283ddb2a487b46c800995a1ed1f1d104c9953227f0a38100bc194ba57f59f6575956b4f37a73b27808a5b30c6c3cf9a38dac67d6b244b1595b433b69f615d1b6f681ae232abcc40243f2704f8d6cf64275c8b62026fa1da1cca0cfce1ed71e078d0ea65f4a617b9d99c996fc22f67dd3df0fd3e4e3d0847f67d3bc01812d1fcf44d52c3cc155cf52566dccc0d2ee71c348f31eab87cdc7d2c0098adce6879ab7dc1e6021d95b689e762eac5188951078f9b3f4e9a3602747f6b926611475e0ac23c7901f94296865115c7d83b62a6595b98e527b0fecd9b197c5a1f206e22b071dcae46edc63ec99b1301258588cbecccb1d8a09fc1add1a2df6408155e7acfdc79af1be61eb9a16d892f01fe27bfcb6b90f3b790b3dbc71371907fa71d845f72226613d56512a15775d72ed96d6c76fdff3e3cda4615a302fa39da8399ce2cb41a18ef53e703820f92665ada783af5daa740085c9e9e0abeac72799300c1ec5ffd6de4392dd69f4b1450618d537130fbbef7404647c3a232fe6a9e0e6d6981d5880be72b199dc57c2cca80e3bb8813e1d54d6ae02f2ebc5d595a46599094f53c9a78f2c5e845ed26e490e37cac2bc836437a6705e7e39875292912e6e59a896fbaa4ad45cab6a8544418069a31eff70e76f30bc56affe189241428049ac730da39ced4ce0849f883c0bc5e25cad9f97711cd89a26434d493098b53c4ecc58f95a05b3449fc5d99fd65583f833731675daa43d0d9509cfec37a752c39e3521e846e3fd03b02d158cce3de0c69a3b79e7c569a09085a8e1d6b06f0b4ab73356c18e5270d9225f3196b20fa55d25720fed9f77a0cfcb54b2378bfa7f45fbdc54d79b859f49010fb2e04445e6f88a0111e85a32fdcfe714dd250dfdea8671cb8f6d6670e3ef7816f542c9e3f2151de07925c9bf5671b763f2389bfe359e240d6f77bfcc78016bc6f42fb846e532d2904cc51b7fc8b6267b262a723d182c0fe8c94a910b96f0d1d91cd250e88fb325eb2d88a5ce8e2da5e02ad25801430297c2ed434513abf112260154855f01146fba70bb00c248741aa7566092c7e7ab69f7657cb6d13eb2f58ee2c477dde93dd15f4452ac4fef56a5c60ccf58fdb7976e141f3a3c6bc4d136fe6ee049b42b08ee04cbdb77995e0def89dead517030e6a8c64296b2a9d77cf471419306c3c763d6750022df185b6df3007a5f8cf290fa44d170d788903502ba666a8ac97c1961c0f8920ee7d6ffaa86bd81e9fa4c4057d1d0f8330ebb7054201129558380ea815c393b6e61493e8751d34725e6668b2cb2ffacbbc758b595e1ef83eb5e01acdd22d36b19ecc05142ea4b72def6dfdf163ef0554c9bfac35b948f70d7707855ed6423f885390610fb6d0cfd4bb8f9c97589bd098508644140c68138ed9e000f7fbb18000b981cc2aee3feebd7ea2ac59b1ebf0e3a6390eea6f9797ac4aaa0ffb16d267bcab35d419c302f153457080b58977af540fcf7234c010f4c5110d9665bb66d8407a96c271b81351601218b3574b562116f7764e63e918f121bb816528c94485db4b38b43fdc041ba722bbbff152f2e6f5a28925dfa33cc9f51b510ebc46e5b464b7cc59dcb0b8a53a2311c3fb796e2e0d9f2e5daafd79c4a5026da13da934ab7be9cae4cf5fc02e8dac48ecba1b5b2fac9c0d22260e78369fa348bc3b09ec2ec4b32682781e994270fe5de46a7b977ab079f8b0952529c2cb724ddd76a174fd8b07e99c9ab6f72b57ed45bfec7b9f3905ef51df68911624fc62eab0fe65603e3d2455fd6f8a4b9b9d3ecd39e338d2a90c0d7101d2d75d82da31dd05c972b6b842ab92c4715221fa4ed02c2cd0e9a37700cd54a4e13764d01651ce6bc3144c4029b0f8b24c92d2ce1a45254dbfd1da3b1c91b555e3a4182899c6023a0a42f261e1232bfd901e6e8f0a4e39fc2bc84f9c51385f13d398ca205325015f9d17474801ba917e802"}) sendmsg$nl_generic(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000580)={0x34, 0x3e, 0x107, 0x70bd2b, 0x0, {0x1, 0x7c}, [@nested={0x4, 0xfc}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x8, 0x6, 0x0, 0x0, @pid}]}, @nested={0x8, 0x2, 0x0, 0x1, [@generic="7235ab62"]}, @typed={0x8, 0x7, 0x0, 0x0, @fd=r3}]}, 0x34}, 0x1, 0x0, 0x0, 0xc000}, 0x4040) 8m10.98047706s ago: executing program 2 (id=432): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_SET_LBT_MODE(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000740)={0x14, 0x0, 0x4, 0xfffffffc, 0x25dfdbfd}, 0x14}}, 0x0) syz_genetlink_get_family_id$nfc(&(0x7f0000000cc0), r0) r1 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000380), r0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)={0xa0, 0x0, 0x1, 0x401, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @empty}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @empty}, {0x14, 0x4, @local}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TIMEOUT={0x8}, @CTA_TUPLE_MASTER={0x4}, @CTA_MARK={0x8, 0x8, 0x1, 0x0, 0xc0000000}]}, 0xa0}, 0x1, 0xfffff000}, 0x0) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000800)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000380)=ANY=[@ANYBLOB="020101090800000000170006ffffff00030006001000000002000000e0000009f9ff0f0005000000030005007217440502000000e0000001"], 0x40}}, 0x0) sendmsg$key(r3, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000000080)={&(0x7f00000000c0)={0x2, 0x3, 0x0, 0x9, 0xa, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x0, 0x0, 0xe, @in={0x2, 0x0, @multicast1=0xe0000009}}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x0, 0x2}, @sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @multicast1}}]}, 0x50}}, 0x0) sendmsg$NLBL_MGMT_C_VERSION(r0, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000080)={0xb4, r1, 0xf03, 0x0, 0x0, {}, [@NLBL_MGMT_A_DOMAIN={0xa0, 0x1, '\x05\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xc1\x9fz\x14T\xd5o\xdd\xf9m3vH\xf7\xcf\xc3\xc0A?\xc7\xce^\x12\xbc\xba\xd6\x80\xb7\xa9\xbc\xc9\x0e\x8ek\x83a\xdb\x14\xf7\xe8\xfb\xa0\f\x12\xf3R\xf8\xeb\xfb\xa7\xc0j_[\xc0\x1d}M\x81\xc2\x02\xbc\x84\xd4&RTP\xa7\xfb\xefe+\xfcuy\x832i\x87m\tB\x86\xf24S[\x89\x7f\xe23\xc6bj\xa7\xe4\x9c\x8eH\x86\xd9\xd4#\xa6\xda\x88\xbf\xf3\xe4\f\xf1jT\x80j\xcd\x1a\x1b\xd8^\xef\x99\x14\x8a*\xe6K\x87c\x93my\x18\xe8H\x103\xf0'}]}, 0xb4}}, 0x0) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r4, 0x400448e4, 0x0) bind$bt_hci(r4, &(0x7f0000000040), 0x6) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r6, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x64, 0x2, 0x6, 0x801, 0x0, 0x0, {0x1, 0x0, 0xa}, [@IPSET_ATTR_TYPENAME={0x12, 0x3, 'hash:net,port\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_TYPENAME={0x13, 0x3, 'hash:net,iface\x00'}]}, 0x64}, 0x1, 0x0, 0x0, 0x2002c0c4}, 0x0) ioctl$SIOCSIFHWADDR(r5, 0x8b04, &(0x7f0000000040)={'wlan1\x00', @random="000e00"}) 8m10.791412681s ago: executing program 2 (id=435): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$NL80211_CMD_START_AP(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=0x0, @ANYBLOB="010027c61a7dd1dbdf250f000000080028"], 0x1c}, 0x1, 0x0, 0x0, 0x24001040}, 0x40010) sendmsg$nl_xfrm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)=ANY=[@ANYBLOB="c0010000100001000000000000000000000000000000000000000000000000002001000000000000000000000000000200000000000000000000008001000000", @ANYRES32, @ANYRES32=0x0, @ANYBLOB="e00000010000000000000000000000000000000032000000ac1414aa00000000000000000000000000000000000000000000206b000000000100000000000000000000000000000000000000000000000000000000000000ffffffffffffffff00000000000000000000000000000000ff030000000000000000000000000000000000000000800000000000000000000000000000000000000000000a000300af0000000000000048000200656362286369706865725f6e756c6c2900333f000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00"], 0x1c0}, 0x1, 0x0, 0x0, 0x240080d4}, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFVLAN_SET_VLAN_FLAG_CMD(r2, 0x8982, &(0x7f0000000000)={0x7, 'vlan1\x00', {0xe}, 0xc3c}) bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x5, @none, 0x0, 0x2}, 0xe) listen(r0, 0xa1) close(r0) 8m10.646940382s ago: executing program 2 (id=437): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x42}}}]}, 0x38}}, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) r5 = socket$kcm(0x11, 0x3, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r6) socket$unix(0x1, 0x2, 0x0) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r8 = socket(0x400000000010, 0x3, 0x0) r9 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000022c0)=@newtfilter={0x87c, 0x2c, 0xd3f, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r10, {0xb, 0xfff3}, {}, {0x8, 0x6}}, [@filter_kind_options=@f_basic={{0xa}, {0x84c, 0x2, [@TCA_BASIC_POLICE={0x848, 0x4, [@TCA_POLICE_TBF={0x3c, 0x1, {0x3, 0x2, 0x3, 0x8, 0x2000008, {0x8, 0x0, 0x6, 0x3ff, 0x1, 0x7ff}, {0x4, 0x2, 0x0, 0x100, 0xfae5, 0x1}, 0x18, 0x6c, 0x1}}, @TCA_POLICE_RATE={0x404, 0x2, [0x3, 0x6, 0xed08, 0xe8f, 0x4, 0x8, 0x2, 0x8, 0x2, 0x40, 0x94f, 0x9, 0x5, 0x4, 0x4, 0x9, 0x1000, 0x0, 0x9, 0xfffffff9, 0x300, 0x81, 0x1, 0x3, 0x0, 0x1ff, 0x65d, 0x4, 0x4, 0xa9c3, 0x4, 0x80000001, 0x9, 0x7, 0x2, 0x401, 0x2c440000, 0xc, 0x0, 0x7, 0x3, 0x8, 0x0, 0x2, 0x0, 0xfffffff7, 0x3, 0x5, 0x7, 0xfffff170, 0x7, 0x0, 0x0, 0x5, 0x2, 0x2, 0x7b, 0x1, 0x3, 0x401, 0x9, 0x80000001, 0x1aef, 0x2, 0xffff, 0x3, 0x9, 0x0, 0x8, 0xffffff80, 0x4000000, 0x10, 0x4, 0x1, 0x4, 0x8, 0x6, 0x68f0, 0x3, 0x9, 0x1, 0xf11, 0x7, 0x0, 0x8, 0x9237, 0x7, 0x7fffffff, 0xffffffa4, 0x2, 0x8, 0x9, 0x80000000, 0x1, 0x1, 0x8, 0x10000, 0x1, 0xfffffff7, 0x8, 0x800, 0x5, 0xfffffffd, 0x3b57, 0x2, 0x6, 0x2, 0x2fa4, 0x8, 0x80000000, 0x9, 0x45, 0x8, 0x0, 0x240c554f, 0xdf42, 0x7fffffff, 0x80, 0x10, 0x6, 0x5, 0xb9a, 0xc, 0x8001, 0x7, 0xff, 0x5, 0x10001, 0x38f9, 0x1, 0x10, 0xffff, 0x1c8, 0x5, 0x8000, 0x702ce66, 0x1, 0x8001, 0x0, 0x5, 0x200000, 0xff, 0x33, 0x8, 0x0, 0x4, 0x6, 0x61d, 0x2, 0xf, 0x1, 0x80000000, 0x1, 0x2, 0x80000000, 0x6, 0x7, 0x10c, 0xffffffff, 0xc, 0x9, 0x10, 0x7, 0xffffffdb, 0x1, 0x0, 0x1, 0x5, 0xff, 0x3, 0x7f, 0x80000001, 0x2, 0x4, 0x3, 0xd5, 0x8, 0xffffffcd, 0xd, 0x8, 0x3, 0x4, 0x5, 0x400, 0x7501, 0x4, 0xfffffffd, 0x7, 0x10000, 0x4, 0x8, 0x406, 0x8, 0x8000, 0x7fffffff, 0x0, 0x7, 0x7, 0x3ff, 0x1, 0x5bb92b8f, 0x9, 0x6, 0x6, 0x8, 0x0, 0x0, 0x6, 0x1, 0x1d, 0x2, 0x1bb4, 0x6, 0x7ad, 0x50, 0x0, 0x5, 0xffffffff, 0x3, 0x4e2, 0x7, 0x2, 0x6, 0x4, 0x10001, 0xff, 0xd3, 0x7f, 0x8, 0x9, 0x10, 0xffffffff, 0x200, 0x1, 0xf, 0x6, 0xfffff58b, 0x202, 0x4, 0x120, 0x9, 0x0, 0x3, 0xa, 0x4, 0x4, 0x5, 0x7, 0x4, 0x8, 0x4, 0x6f, 0x5, 0x8, 0x4, 0x5]}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x9, 0xf, 0x7f, 0xc1fc, 0x3, 0x3, 0x200, 0x77c0, 0x50c71046, 0x6, 0x4, 0x8, 0x67, 0xfffffffa, 0x39a, 0x4, 0xffffffff, 0x3, 0x8, 0xfffffffc, 0x1, 0x2, 0x3, 0x2, 0x9, 0x8, 0xfffffff8, 0x9, 0xffffffff, 0x7ff, 0x7, 0x8001, 0x5364, 0x6ec, 0x401, 0x1, 0x8001, 0x3, 0xc0, 0x117, 0x200, 0x4, 0x5, 0x6, 0x5, 0x4, 0x4040000, 0xffffffbc, 0x5, 0x10, 0xffff, 0xb65, 0x6, 0x2, 0x2, 0xfffffffd, 0x8, 0x9, 0x4, 0x6, 0xe800, 0x9, 0x80000001, 0x80000000, 0xa, 0x0, 0x2, 0x80000001, 0x8001, 0x8, 0x29d1, 0x0, 0x200, 0xfff, 0x0, 0x3, 0x3a1, 0x1, 0x1, 0x7ff, 0x5, 0x4, 0x800, 0x5, 0x2, 0x0, 0x6, 0xffff, 0x100, 0xef9e, 0x4, 0x5, 0x6fbb, 0x7, 0x8001, 0x9, 0x7e, 0x8, 0xe3c, 0x0, 0x4, 0x8001, 0x5, 0x0, 0x0, 0x0, 0x3, 0x0, 0x6, 0x0, 0x8, 0x101, 0x2, 0x0, 0x2, 0x1, 0x1, 0x4, 0x9, 0x4, 0x7, 0x9, 0xee, 0x8ee1, 0x9, 0x1, 0x9, 0x0, 0x60cd7584, 0x6, 0x553, 0x58ff, 0x9, 0xffffff80, 0xffff91c6, 0x8d, 0x9, 0x2, 0x7, 0x3, 0x4, 0x7f, 0x1, 0x800, 0x100, 0x71ef, 0xffffff9d, 0x6, 0x9, 0xebae, 0xfffffb39, 0xff, 0x2, 0x6, 0xfff, 0x4, 0x7, 0x200, 0x7ff, 0x7, 0x80000000, 0xfffffffa, 0x8, 0x8, 0x8001, 0x80, 0x3, 0xe70, 0x5, 0x9, 0x8, 0x5, 0x6, 0x9, 0xff0, 0x8, 0x7, 0x3, 0x102, 0x101, 0x424, 0x6, 0xffff208f, 0x4, 0x1, 0x81, 0x11c, 0x6, 0xfffff9e2, 0x3, 0x9, 0x400, 0x7fff, 0x6, 0x2, 0x80, 0xece, 0x8, 0x4, 0x0, 0x6842a920, 0xd3, 0x7, 0x7, 0x2, 0x7, 0x2, 0x2, 0x9, 0x1, 0x2, 0xc, 0x7, 0x7f, 0x0, 0xffffffff, 0xfff, 0xff, 0x7, 0x2, 0x7e84, 0x0, 0x1, 0xb, 0x5, 0x0, 0x0, 0x0, 0x7, 0x8, 0x5, 0x40, 0x8, 0xffffffff, 0xfffffff9, 0xfffffffb, 0xd, 0xfffffffe, 0x9, 0x1000, 0x8001, 0x7fffffff, 0x3, 0xff, 0x200, 0x5, 0xd894, 0x3, 0x3, 0x8, 0x7, 0x8, 0xe1, 0x81, 0x9, 0x6]}]}]}}]}, 0x87c}, 0x1, 0x0, 0x0, 0x10}, 0x0) setsockopt$sock_attach_bpf(r5, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r5, &(0x7f0000000280)={&(0x7f0000000380)=@xdp={0x2c, 0x0, r7, 0x3e}, 0x80, &(0x7f00000001c0)=[{&(0x7f0000000180)="27030200000214000e00002fb96dffff1144ee163cddcb00"/34, 0x22}, {&(0x7f00000004c0)="f058fe7dad777f8f", 0x8}], 0x2}, 0x5) sendmsg$nl_route_sched(r1, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@gettfilter={0x24, 0x2e, 0x205, 0x70bd2c, 0x25dfdafd, {0x0, 0x0, 0x0, r3, {0xc, 0x8}, {0x0, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x20000801}, 0x4041080) 8m10.239640466s ago: executing program 2 (id=444): r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000280), 0x10) sendmsg$can_bcm(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=ANY=[@ANYBLOB="0500"/16, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="0000200ecf4dce518669624a000001000000000000000000000025f87df99dc48af4"], 0x38}}, 0x0) r1 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000000)=0xffffffffffffffff, 0x4) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="480000001000370400"/20, @ANYRES32=0x0, @ANYBLOB="8b04040000000000280012800b00010065727370616e000018000280040012000600020001ab"], 0x48}}, 0x88890) bpf$TOKEN_CREATE(0x24, &(0x7f0000000140)={0x0, r0}, 0x8) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$l2tp(0x2, 0x2, 0x73) ioctl$BTRFS_IOC_GET_FEATURES(r5, 0x80189439, &(0x7f0000000240)) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f00000006c0), 0xffffffffffffffff) r7 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000000280)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB='`\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="0100000000000000000007000000080001006e00000008000300", @ANYRES32=r8, @ANYBLOB="0c0099000000000000000000050053000100000014000400776c616e310000000000000000000000140006"], 0x60}}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x10, 0x4, &(0x7f0000001300)=ANY=[@ANYBLOB="1800000000000000000000000000000071103500000000009500000000000000"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x9}, 0x80) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001240)=ANY=[@ANYBLOB="a800000000010104000000000000000002000000240001801400018008000100e000000108000200ac1e01010c00028005000100000009002400028014000180080001000000010008000200ac1e00010c0002800500010000000000440010800800014000000006080003400000002b080003400000000808000240000000400800014000000000fb0001400000000708000140000044f10800034000000003080007"], 0xa8}}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x2000000000000002, &(0x7f0000000040)=ANY=[@ANYRES64=r1, @ANYRESOCT=r2, @ANYRES64=r3, @ANYRESHEX=r3], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, 0x0, r1, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) 8m9.99053353s ago: executing program 32 (id=444): r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000280), 0x10) sendmsg$can_bcm(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=ANY=[@ANYBLOB="0500"/16, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="0000200ecf4dce518669624a000001000000000000000000000025f87df99dc48af4"], 0x38}}, 0x0) r1 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000000)=0xffffffffffffffff, 0x4) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="480000001000370400"/20, @ANYRES32=0x0, @ANYBLOB="8b04040000000000280012800b00010065727370616e000018000280040012000600020001ab"], 0x48}}, 0x88890) bpf$TOKEN_CREATE(0x24, &(0x7f0000000140)={0x0, r0}, 0x8) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$l2tp(0x2, 0x2, 0x73) ioctl$BTRFS_IOC_GET_FEATURES(r5, 0x80189439, &(0x7f0000000240)) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f00000006c0), 0xffffffffffffffff) r7 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000000280)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB='`\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="0100000000000000000007000000080001006e00000008000300", @ANYRES32=r8, @ANYBLOB="0c0099000000000000000000050053000100000014000400776c616e310000000000000000000000140006"], 0x60}}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x10, 0x4, &(0x7f0000001300)=ANY=[@ANYBLOB="1800000000000000000000000000000071103500000000009500000000000000"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x9}, 0x80) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001240)=ANY=[@ANYBLOB="a800000000010104000000000000000002000000240001801400018008000100e000000108000200ac1e01010c00028005000100000009002400028014000180080001000000010008000200ac1e00010c0002800500010000000000440010800800014000000006080003400000002b080003400000000808000240000000400800014000000000fb0001400000000708000140000044f10800034000000003080007"], 0xa8}}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x2000000000000002, &(0x7f0000000040)=ANY=[@ANYRES64=r1, @ANYRESOCT=r2, @ANYRES64=r3, @ANYRESHEX=r3], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, 0x0, r1, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) 5.266111978s ago: executing program 4 (id=5928): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000840)=ANY=[@ANYBLOB="440000004600070128bd700000000000017c000030000480", @ANYRESDEC, @ANYRESDEC=r0], 0x44}, 0x1, 0x0, 0x0, 0x4048011}, 0x20004000) 5.039493437s ago: executing program 4 (id=5933): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$TIPC_NL_MEDIA_SET(r0, &(0x7f0000002440)={0x0, 0x0, &(0x7f0000002400)={&(0x7f0000002080)={0x18, r1, 0xd01, 0x0, 0x0, {}, [@TIPC_NLA_MEDIA={0x4}]}, 0x18}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000003c0)=@newtfilter={0x43c, 0x2c, 0xd27, 0x70bd2d, 0x0, {0x0, 0x0, 0x0, 0x0, {0x5}, {}, {0x8, 0xffe0}}, [@filter_kind_options=@f_basic={{0xa}, {0x40c, 0x2, [@TCA_BASIC_POLICE={0x408, 0x4, [@TCA_POLICE_RATE={0x404, 0x2, [0x3, 0x8, 0x62, 0x2, 0x0, 0xc, 0x2, 0x7fff, 0x0, 0xffffff70, 0x19, 0xffffffa9, 0x2, 0x7, 0x80000001, 0x7, 0x3, 0x36, 0xc, 0x6, 0x6, 0x5d0bef1f, 0x400, 0x1, 0x837, 0xffffffff, 0x9fec, 0x401, 0x68, 0x9, 0xdd64, 0x1, 0x4, 0x8001, 0xfffffffe, 0x2, 0x0, 0x200, 0xfff, 0xfffffff1, 0x7, 0x4, 0xf, 0x7, 0x7469, 0xb, 0x2, 0x200, 0xff32, 0x6, 0xca, 0x4ec1, 0x1, 0x9, 0x80, 0x0, 0x10000, 0x0, 0xb4, 0x7, 0x6, 0x0, 0x0, 0x8156b2a, 0x2, 0xd5c, 0x4, 0xa0, 0x2, 0x7, 0x4, 0x0, 0x81, 0xfe, 0x2, 0xe6b, 0x9, 0xa, 0xc8c, 0x1, 0x92a, 0x6, 0xf4e, 0x9, 0x3a0, 0x3, 0x10000, 0x7ff, 0x44, 0x1, 0x2, 0x800, 0x3, 0x8, 0x0, 0x6, 0x922e, 0x0, 0x10001, 0x3, 0xf, 0x4, 0x2, 0x2c000, 0x80, 0x5, 0x7, 0x2, 0x5, 0x0, 0x9, 0x6, 0x0, 0x3365, 0x1, 0x5, 0xffffffff, 0x1000, 0x0, 0x4, 0x0, 0x1, 0x2, 0x81, 0x111, 0x2, 0x5c20, 0x7f, 0x0, 0xe, 0xfffffffb, 0x6, 0x391, 0x0, 0x0, 0x3, 0x9, 0xc95d90e, 0xff, 0x2, 0x5, 0x7fffffff, 0xc7, 0x4, 0x7, 0x0, 0x9, 0xffffffff, 0x9, 0x1, 0x4, 0x3, 0x7, 0xfffffff9, 0x10, 0x2, 0xfff, 0x2, 0x6, 0x8b4, 0x600000, 0x1, 0x6, 0x0, 0x10000, 0x0, 0x3, 0x5, 0x0, 0x1000, 0x6, 0x6, 0x0, 0x1, 0x81, 0x2, 0xffff6c4b, 0x800, 0x7, 0x5, 0x7fff, 0x8, 0xffffffff, 0x9, 0x6, 0x0, 0x40, 0x67e1, 0x80000000, 0x2, 0x603c, 0x4, 0x4, 0x0, 0xfffffff8, 0x7, 0x3, 0x10, 0x400, 0xfffffe00, 0x1, 0x3, 0x0, 0xffff, 0x4, 0x6, 0x8, 0x0, 0x400, 0x1, 0x87, 0x10, 0x2, 0x0, 0xfffffffd, 0x3, 0x7, 0x616, 0x2, 0x2, 0xd1, 0x2, 0xfffffffc, 0x8, 0xc, 0x800, 0x1, 0x4, 0xd87, 0x80000001, 0x48e0, 0x8, 0x9, 0x40, 0x400, 0x5, 0x2, 0x4e1b, 0x1, 0x1000, 0x8, 0x4, 0x3, 0x0, 0x2, 0x10000009, 0x2, 0x3, 0x10001, 0xffff, 0x4d, 0x100000d, 0x8, 0x2, 0x2, 0x8]}]}]}}]}, 0x43c}}, 0x4000) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="5c000000020605000000000000000000000000000c00078005001500267d00000500010007000000050005000a000000050004"], 0x5c}}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000380), r2) sendmsg$ETHTOOL_MSG_DEBUG_SET(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000001500)={&(0x7f0000000580)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="01000000040200f2c8dc1b000000180001801400020073797a5f74756e0003000000000000000c000280"], 0x38}, 0x1, 0x0, 0x0, 0x20000844}, 0x0) 4.917296103s ago: executing program 4 (id=5936): r0 = socket$inet_icmp(0x2, 0x2, 0x1) setsockopt$IP_VS_SO_SET_FLUSH(r0, 0x0, 0x485, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) bind$xdp(0xffffffffffffffff, &(0x7f0000000100)={0x2c, 0x2}, 0x10) sendmsg$NFT_BATCH(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="140000001000040000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000058000000160a01000000000000000000010000000900010073797a30000000000900020073797a30000000002c0003800800014000000000080002400000000018000380140001007465616d3000000000000000000000005c000000160a0101000b000000000000010000000900020073797a30000000000900010073797a3000000000300003802c00038014"], 0xfc}}, 0x0) 4.736207606s ago: executing program 4 (id=5942): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000180), r0) sendmsg$NLBL_CIPSOV4_C_ADD(r0, &(0x7f0000001740)={0x0, 0x6, &(0x7f0000001700)={&(0x7f0000000440)={0x30, r1, 0x1, 0x0, 0x0, {}, [@NLBL_CIPSOV4_A_TAGLST={0xc, 0x4, 0x0, 0x1, [{0x4}]}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x2}, @NLBL_CIPSOV4_A_DOI={0x8}]}, 0x30}}, 0x0) syz_emit_ethernet(0xfffffffffffffe80, &(0x7f0000000080)={@local, @dev, @void, {@llc_tr={0x11, {@snap={0x0, 0x0, '0K', "330df5", 0x88f8, "d371797527dbb1de7636f36c421804867ad9498437551d616ae7ae02865b4e41b825a29bed4d4d0daa99427f12c79685b15a3870429e68208a4a9410fb2765f78c4788d2705eea0e06c93e6558030e2b8b7b8111f25c3f178165889a547f8e8a8eb4476c641e2ba38759e19c0811f51a5dad46b829164c518bb8041be7ebd71a5c69ff7d3fc72e5a5c65e5fe916202654c110de69b00"}}}}}, 0x0) 4.549937127s ago: executing program 4 (id=5944): mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800006, 0x7000001, 0x6e073, 0xffffffffffffffff, 0x2000) mmap(&(0x7f00001b2000/0x3000)=nil, 0x3000, 0x0, 0x2010, 0xffffffffffffffff, 0xe08b8000) 4.446450482s ago: executing program 4 (id=5947): sendto$inet6(0xffffffffffffffff, &(0x7f0000000080)="7800000018002507b9409b14ffff0b7a0204be04020714056406040c5c0009003f0006180a0200000d0085a168d0bf46d32345653610648d270005000a06024e49935ade4a460c89b6ec0cff3959547f5090", 0x52, 0x0, 0x0, 0x0) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f00000000c0), 0x49) r0 = socket(0x2a, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000005c0)=@newqdisc={0x24}, 0x24}}, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000000)={'sit0\x00', 0x200}) getsockname$packet(r0, &(0x7f0000000240)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0x14) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000480)=@gettaction={0x28, 0x30, 0x1, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'sample\x00'}}]}]}, 0x28}}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_SET_LIMITS(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r4, @ANYBLOB="010000000000ffdbdf25298a8730d783d05921270500b9590000080002000500"], 0x1c}, 0x1, 0x0, 0x0, 0x20040011}, 0x20004080) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r0, &(0x7f0000000440)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000003c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r4, @ANYBLOB="00012dbd7000fbdbdf2506000000050005000b40a7fc890db2bf3d17828dd3aa5b6d8c000000"], 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x40) r5 = socket$inet(0x2, 0x2, 0x0) setsockopt$sock_int(r5, 0x1, 0x2e, &(0x7f0000000180)=0x7b, 0x4) socket$packet(0x11, 0x2, 0x300) shutdown(r5, 0x0) recvmmsg(r5, &(0x7f00000066c0), 0xa0d, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=@newqdisc={0x2c, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=@newtfilter={0x44, 0x2c, 0xd27, 0x2, 0x0, {0x0, 0x0, 0x0, r1, {0xb, 0x9}, {}, {0x1c, 0xfff1}}, [@filter_kind_options=@f_flower={{0xb}, {0x14, 0x2, [@TCA_FLOWER_KEY_CT_MARK_MASK={0x8, 0x60, 0x80}, @TCA_FLOWER_KEY_CT_MARK={0x8, 0x5f, 0x31cf}]}}]}, 0x44}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r6, &(0x7f00000002c0), 0x40000000000009f, 0x0) 3.741393188s ago: executing program 1 (id=5956): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$rds(0x15, 0x5, 0x0) setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f0000000380), 0x4) setsockopt$RDS_FREE_MR(r1, 0x114, 0x3, &(0x7f00000007c0), 0x10) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000400)=ANY=[@ANYBLOB="740000001200030600"/20, @ANYRES32=0x0, @ANYBLOB="2fedaa88000000003800128009000100766c616e000000002800028006000100000000000c0002000000000000000000100004800c00010000000000", @ANYRES32, @ANYBLOB='\b\x00\n\x00', @ANYRES32], 0x74}, 0x1, 0x0, 0x0, 0x84}, 0x8801) 3.574342763s ago: executing program 1 (id=5959): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f00000000c0)={'macsec0\x00', 0x400}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={'veth0_to_bridge\x00', 0x400}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000180)={'pimreg0\x00', 0x0}) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x6, 0x3, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x100}}, &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={r4, r3, 0x25, 0x0, @void}, 0x10) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000009c0)=ANY=[@ANYBLOB="b8010000160011040000000000000000ffffffff000000000000000000000000ffffffff0000000000000000000000000000000000000000000000003b000000", @ANYRES32, @ANYRES32=0xee01, @ANYBLOB="fe8000000000000000000000000000aa0000000033000000ac14141a000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200"/158, @ANYRES32=r5, @ANYBLOB="00000000ac0007"], 0x1b8}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETRULE(r6, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400040}, 0xc, &(0x7f0000000180)={&(0x7f0000000000)={0x30, 0x7, 0xa, 0x201, 0x0, 0x0, {0x1, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_POSITION_ID={0x8, 0xa, 0x1, 0x0, 0x2}, @NFTA_RULE_CHAIN_ID={0x8, 0xb, 0x1, 0x0, 0x2}]}, 0x30}, 0x1, 0x0, 0x0, 0x4080}, 0x4000850) 2.549830155s ago: executing program 1 (id=5962): pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r0, &(0x7f0000000800)=[{&(0x7f0000000f80)="4191062c1421f8d286fea25179d3bff47ffb95a24f597e0388f330e7dfb81fde917ae89f97d5fde0855ce2942ff541f21652a7409dad35f8886d587bb6e698986ca5f808b1b92c1a374dbc7424a26c0ad2b6840cf3049fc728f9109eb576c388dca33df6129f9efd43ccbd58a93f146ce183a410b8959fe192652e32068e0d8e24d8eab4ecbd5ebaa165771a07c890804037074a1ebad3bcdd46b8f34ecb2f4a6e1bbc6ac3d80ea44fbfedf338583f63ba4607f430acc0a98b4fcbb501006052cb83625cbf60ebf28e9095458c1e9971417b2912bbe30037dd5c1ac06f612816e97ac304404619b0c75222e9339f6ba14eac3c1486ac997f919248490b14a5e12ef47e61857f6d43ebc490155bf06e801547ed96f1264b5c220cf3f66d", 0x11d}, {&(0x7f0000000280)="09ec8b684fbd9f0a18960e84defd08b28dc2f98b5aad5cfeb075441d6d15233b802af831523479391b7297416ddff60a6500da9864b052a3105e6fa49014cb2ce5f295aaff14d9077735f34eaec042e8252a6456999297ed02a01da56a3809f0c58184192ebf4bead7e8618412536273bf08e0f6847e436dc74fd4450e8ff88199f35a0c759aff55639834dc4c945dfb330a7b92b049700cb67e0f14337d8390091514253c2f2d4499d89b5f04759319e2c7b6856f03c69029b689f0be37093c79e8ff2405eb93cbfe5487143a294c3e61b0c9be8323cd4d01c37e5f5d4bf94546d02d4dc988dbb4717ee61e5be16f4c7701cc671d25", 0xf6}, {&(0x7f00000001c0)="f3ba9e8346ddfd46f5ba7fbc25c6aed71214dcfaa44b98dfdbc07b1c8dc80c42d5501285b1bc305d7f699524d78bca1a151bfd74ca3d4f468f1244e6951083a7e19dec984cc37874a28db922c628a534fb91191d25f636a589", 0x59}, {&(0x7f0000001780)="12dfbd793db81fe455d97618c2aedf67f1b166ec59876a1fbbe13986e69655d6f600262371ef8dae091786d7f9a4d7ca234f8852df8f05000f02b5258ec56ec5fdd5f3531f795bf2f172d6fb23f3549b9734f2eef416b7698a93335a94b8cda61325b62cda1807b03675c6347b431f2d71baa6bc59e9047069153d70ffba20956e58971501c2d9f299fdfa3a38fa73a5da43ba2506d8704592ee5c19ca0d2075ddc9313d8bd2202a89dae6a689d3900818f892f3f17957cd53023399810da5655e0fd0f0f394c9a8bedc", 0xca}, {&(0x7f0000000500)="0f15ce0e2a894e2afb7a77dc4a4ec84b8109b2c95397d40adb9d5e8df8fd9a3167faa56aa764e61ba1a6cc8fd041bb89bee6d17105e169dd8d68d5b79eb5958574299b9035fbed2942a75e731b7571c29a760623e725792c", 0x58}, {&(0x7f0000000b00)="ed48f08c19f5d937fe3f92802a25b07496a34825b6d3fbf57fec343be7e4b6531b0e0f0637b3c46e072578521ad417549bae2e00ad7b67f769ec533e3c9c62b6955e9005ca02506938aeb5adac5798e85f440385c7f26cced77e12ecffa7b98c962259e08cffa0eb0ad803bfdf8336da8df2e85a2a8b407329650ee71f68ca7de83df1c45914bedd1b8add5bc677e5590af05aea657a8b2b7dd4fc76010e259917ab727d4065cee39115ca3d322533bb48b5b8a23e8557688d783d0e5c444fd5ae3e02d7245c498d9c6675c8a9626ecde62915d6ada50bb3a0496c87f77457a664a250ba9d037a463f44057ad767bb933fa0790f660401baa257", 0xfa}, {&(0x7f0000000cc0)="be5af0a1b77fdb78379e4aed4f731b0f88920d1b033228f04a8d7f22afacc5c5014861b7715c3de8745083b4869ba515422c01c49a3eea697223ac78b4a3a20fc9364c30aacbebb3c28dedbf525eecad1436bb61f54dd04b7623dd1369e86bcf162595858a39618ac38f8766af0430a83e786a00eb966ffb0cd5a5af2f88781da8c146b566692815d64c86a50d395e6c8c4cea408323066e100694eac314590b63aa97afdfc99a5f3198be8347fe7664ca80f2d586576ece61cf5e334d43a1449f4eb920030e615a06baa50100e3962897b3af4ad468ec87671c0f706bcd47b06ce112f8b19465dbbdff78bea7af7d7bc3cf65b8dd45aeb9e55783bb550679f7ff68e94308492ef12024d7e7677d1a4239cecc3545bfb424fd9f57815a7030041088b74d082f3e0b294951c8d1", 0x12d}, {&(0x7f00000005c0)="23c8f8e7bb8d0ba65b2d53e1b98cbeae874b769afbb97c7f46c8969c2772e02e5d80add492fdba14dee6fbc6f2cdc93b86fb8199b61a03a801c262c343c6bbf5856dc1d3c7dd7eeb196ddcf13456cff281c807953060a280f32e718b432d2031c73f6ca657519e04cf1b39497f7d785fff277a2a5612abf6c830c8b72579207ac0dda5", 0x83}, {&(0x7f0000000780)="ca3fcea77620b98213d60f78fe2e503ccb6662d189d191886f4fe8db857b07f574782f7bb888b8333220361011eec01501a2772a0392eaa06aca70b89b89f7ffd6ad7838ab27f246f9b78fa61a5ee5", 0x4f}], 0x9, 0x8) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='sched_switch\x00'}, 0x18) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) ppoll(&(0x7f0000000500)=[{r1}], 0x1, 0x0, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000480)='kfree\x00', 0xffffffffffffffff, 0x0, 0x1843}, 0x18) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000380)='memory.events\x00', 0x275a, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) r4 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_MAKE_EQUIV(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000004d40)={&(0x7f00000000c0)={0x28, 0x3ea, 0x400, 0x70bd20, 0x25dfdbff, {0x7, 0x7, './file0', './file0'}}, 0x28}, 0x1, 0x0, 0x0, 0x20000844}, 0x10) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) r6 = socket(0x840000000002, 0x3, 0x100) connect$inet(r6, &(0x7f00000005c0)={0x2, 0x0, @local}, 0x10) sendmmsg$inet(r6, &(0x7f0000005240)=[{{0x0, 0x0, 0x0}, 0xfffffdef}], 0x4000095, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0x1b, 0x10, &(0x7f0000000540)=ANY=[@ANYBLOB="1833000004000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b702000000362d0085000000860000001801000020646c2500000000002020207b1af8ff00010000f8ffffffb702000008000000b7030000ff7fffff8500000006000000851000000400"], &(0x7f00000004c0)='syzkaller\x00', 0xe, 0x68, &(0x7f0000000600)=""/104, 0x41000, 0x47, '\x00', 0x0, @fallback=0x19, r5, 0x8, &(0x7f0000000680)={0x3, 0x3}, 0x8, 0x10, &(0x7f00000006c0)={0x4, 0xc, 0xffffffbc, 0xba}, 0x10, 0x0, r3, 0x0, &(0x7f0000000840)=[r1, r3, r2, 0xffffffffffffffff, r2, r5], 0x0, 0x10, 0x7fffffff}, 0x94) write(0xffffffffffffffff, &(0x7f00000002c0)="fc0000001c000704ab5b2509b868030002ab087a0100000001481093210001c0f0030584050060100000000000039815fa2c53c28648000000b9d95662537a00bc000c00f0ff7f0000b400600033d44000040560916a0033f436313012dafd5a32e273fc83ab82d710f74cec184406f90d435ef8b29d3ef3d92c94170e5bba2e177312e081bea05d3a021e8ca062914a46ccfc510bb73c9455cdc8363ae4f5df77bc4cfd6239ec2a0f0d1bcae5fa0f5f9dcdd51af51af8502943283f4bb102b2b8f5566791cf190201ded815b2ccd243f395ed94e0ad91bd6433802e0784f2013cd1890058a10000c880ac801fe4af000049f0d4796f0000090548de", 0xfc) sendmsg$kcm(0xffffffffffffffff, 0x0, 0xff00) r7 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSARP(r7, 0x8953, &(0x7f0000000180)={{0x2, 0x0, @empty}, {}, 0x0, {0x2, 0x0, @multicast1=0xe000cc02}}) 2.071010255s ago: executing program 3 (id=5971): r0 = epoll_create(0x7) r1 = epoll_create1(0x0) r2 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r3) ioctl$IOCTL_GET_NCIDEV_IDX(r2, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000740)=ANY=[@ANYRES16=r4, @ANYBLOB="010026bd70003c0200000200000008000100", @ANYRES32=r5], 0x1c}}, 0x0) write$nci(r2, &(0x7f0000001800)=ANY=[@ANYBLOB="7240082b0102020681055a03997713fa06070202267a"], 0x16) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000180)) epoll_create1(0x0) shutdown(0xffffffffffffffff, 0x0) r6 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) sendmsg$alg(r6, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18, 0x40010}, 0x14000012) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180100001c0000000000000000000000850000006d00000095"], &(0x7f0000000380)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x20}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f00000000c0)='sys_enter\x00', r7}, 0x10) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r8, &(0x7f00000000c0)=[{&(0x7f0000000180)='w', 0x1}], 0x1, 0x0) close(r9) 1.914386335s ago: executing program 0 (id=5972): bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b400000000000000791048000000000071043b000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) (async) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b400000000000000791048000000000071043b000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000000), r0) sendmsg$WG_CMD_SET_DEVICE(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000080)=ANY=[@ANYBLOB="286569a29d5caa9628adf594000000f0a2e47ca7805260ab0a3f3e031ee5f87f2c5f7c07940e2b354ebe19f8d6d11a31", @ANYRES16=r1, @ANYBLOB="010000000000030000000100000008000700400000001400020077673000000000000000000000000000060006004e2300001c000880180000801400040002004e240a01010100000000000000001400020077673100000000000000000000000000080007003db7000024000300"/142], 0x94}}, 0x0) 1.893619079s ago: executing program 0 (id=5973): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000180)={'sit0\x00', &(0x7f0000000080)={'syztnl1\x00', 0x0, 0x8, 0x20, 0x3, 0x7, {{0x2a, 0x4, 0x0, 0x2, 0xa8, 0x64, 0x0, 0x2, 0x2f, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @multicast1, {[@ssrr={0x89, 0xb, 0xd5, [@broadcast, @broadcast]}, @generic={0x94, 0x5, "b893eb"}, @end, @lsrr={0x83, 0x7, 0x9e, [@remote]}, @timestamp_prespec={0x44, 0x1c, 0x2c, 0x3, 0x5, [{@remote, 0x3ff}, {@empty, 0x6}, {@dev={0xac, 0x14, 0x14, 0x37}, 0x7ff}]}, @rr={0x7, 0x3, 0xe0}, @cipso={0x86, 0x4f, 0xffffffffffffffff, [{0x5, 0xe, "acb359b6fd457beacd22303e"}, {0x5, 0x2}, {0x2, 0xd, "25d4544a27d33d440f989e"}, {0x1, 0xe, "43b2c481c2307a1f7018288d"}, {0x5, 0x7, "d854f61454"}, {0x1, 0xf, "9426dcbc42b5b2e507c30e5619"}, {0x2, 0x6, "0353a141"}, {0x7, 0x2}]}, @timestamp_prespec={0x44, 0xc, 0x22, 0x3, 0x5, [{@empty, 0x3}]}]}}}}}) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0xc, 0xf, &(0x7f00000005c0)=ANY=[@ANYRES64=r4], 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, '\x00', 0x0, @fallback=0x12, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$BATADV_CMD_GET_VLAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="00002cbd7000c40d0000000000000800bf38953200ff020000050033000300000008", @ANYRES32=r2, @ANYBLOB="05002d000100", @ANYRES32=r4, @ANYBLOB="08003a0007000000050033000200000005002a0001"], 0x54}, 0x1, 0x0, 0x0, 0x1}, 0x0) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff) r7 = syz_genetlink_get_family_id$ethtool(&(0x7f00000003c0), r0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$ETHTOOL_MSG_PRIVFLAGS_GET(r0, &(0x7f0000000540)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000500)={&(0x7f0000000400)={0xec, r7, 0x2, 0x70bd2a, 0x25dfdbff, {}, [@HEADER={0x78, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bridge_slave_1\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'team0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan1\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}, @HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}]}, @HEADER={0x54, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'virt_wifi0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r9}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6gretap0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}]}]}, 0xec}, 0x1, 0x0, 0x0, 0x400}, 0x804) r10 = gettid() sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000002400)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="010028bd7000ffdbdf2514000000080001000100000008001c00", @ANYRES32=r10], 0x24}, 0x1, 0x0, 0x0, 0x20000040}, 0x4000000) (fail_nth: 5) 1.868808728s ago: executing program 3 (id=5974): r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r0, 0x29, 0xce, 0x0, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r2, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffd, 0x2ffffffff}, 0xc) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000540)={0x18, 0xb, &(0x7f00000002c0)=ANY=[@ANYBLOB="18000000000080000000000000000000180100002520702500000000690000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f00000003c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x3, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000040)='percpu_alloc_percpu\x00', r3}, 0x10) bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000140)=@base={0xa, 0x7, 0xb3, 0x7f}, 0x50) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) listen(r4, 0x7d4165c9) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000480), r1) sendmsg$IEEE802154_START_REQ(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f00000004c0)={0x14, r6, 0x1, 0x70bd27, 0x25dfdbfe}, 0x14}}, 0x4008104) 1.351917179s ago: executing program 1 (id=5975): socket$nl_route(0x10, 0x3, 0x0) socket$xdp(0x2c, 0x3, 0x0) socket$xdp(0x2c, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$inet_sctp(0x2, 0x5, 0x84) socket$inet_mptcp(0x2, 0x1, 0x106) r0 = socket(0x10, 0x80002, 0x0) setsockopt$bt_hci_HCI_FILTER(r0, 0x0, 0x2, &(0x7f0000000180)={0x4, [0x1], 0xe}, 0x10) openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x48) setsockopt$inet_tcp_int(r1, 0x6, 0x210000000013, 0x0, 0x0) connect$inet(r1, 0x0, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/ipc\x00') mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x9, 0x3032, 0xffffffffffffffff, 0x0) socket$netlink(0x10, 0x3, 0xb) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x4048801) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="2000000011000101000000000000030000000000", @ANYRES32=r2], 0x20}, 0x1, 0x0, 0x0, 0x80d5}, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) socket$kcm(0xa, 0x922000000003, 0x11) 1.285742968s ago: executing program 5 (id=5976): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000780)=ANY=[@ANYBLOB="48010000100001000000000000000000e00000020000000000000000000000000a010101000000000000000000000000000000004e2100"/64, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ffffdfff0000000000000000000400000000000033000000fe8000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fcffffffffffffff000000000000000000000000000004000000010000000000000000000a000000000000000000000048000100736861323536000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000048460000000000000000000000000008001d00000000000800220003"], 0x148}}, 0x0) 1.249027455s ago: executing program 0 (id=5977): r0 = socket$alg(0x26, 0x5, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)={0x54, 0x2, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8, 0x8, 0x1, 0x0, 0xa0}]}, @IPSET_ATTR_FAMILY={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0xd, 0x3, 'hash:mac\x00'}]}, 0x54}}, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000003c0)={0x0, 0x24}}, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffff00f687000000", @ANYRES32=r5, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000940)=@newqdisc={0x78, 0x24, 0xe0b, 0x70bd28, 0x0, {0x0, 0x0, 0x0, r5, {}, {0xffff, 0xffff}, {0xffe0}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x4c, 0x2, [@TCA_TBF_RATE64={0xc, 0x4, 0x4e1e2563543d84f9}, @TCA_TBF_PBURST={0x8, 0x7, 0x14d6}, @TCA_TBF_PARMS={0x28, 0x1, {{0x0, 0x0, 0x0, 0xffff}, {0x0, 0x0, 0x0, 0x8, 0x2, 0x3}, 0xfffffffe, 0x81}}, @TCA_TBF_PRATE64={0xc, 0x5, 0xcb59372f370e8465}]}}]}, 0x78}}, 0x4000080) r6 = socket(0x10, 0x803, 0x6) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r6) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) r8 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r8, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x129, 0xfffffffd, 0x0, {0x0, 0x0, 0x0, r7, {0x7, 0xfff2}, {}, {0x8, 0xfff1}}}, 0x24}}, 0x40004) sendmsg$nl_generic(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000003c0)={0x14, 0x3a, 0x229, 0x0, 0x25dfdbfc, {0xa}}, 0x14}}, 0x8000) bind$alg(r0, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-twofish-3way\x00'}, 0x58) r9 = socket$inet6_udplite(0xa, 0x2, 0x88) getsockopt$inet6_buf(r9, 0x29, 0x2e, &(0x7f0000000440)=""/222, &(0x7f00000001c0)=0xde) accept4(r0, 0x0, 0x0, 0x0) r10 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000100), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r10, 0x8933, &(0x7f0000000000)) r11 = socket$inet(0xa, 0x801, 0x84) connect$inet(r11, &(0x7f0000000340)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r11, 0xffffffff) r12 = accept4(r11, 0x0, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r12, 0x84, 0x1f, &(0x7f0000000740)={0x0, @in6={{0xa, 0x4e24, 0xf29e, @empty, 0x5}}, 0xfff7, 0x9}, &(0x7f0000000000)=0x90) syz_genetlink_get_family_id$nl802154(&(0x7f0000000080), 0xffffffffffffffff) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) 1.208520497s ago: executing program 3 (id=5978): r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) (async) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_GET(r1, &(0x7f0000002100)={0x0, 0x0, &(0x7f00000020c0)={&(0x7f0000000080)={0x5c, 0x1, 0x8, 0x3, 0x0, 0x0, {0x1, 0x0, 0x2}, [@CTA_TIMEOUT_DATA={0x4, 0x4, 0x0, 0x1, @icmp}, @CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x21}, @CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}, @CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}, @CTA_TIMEOUT_DATA={0x1c, 0x4, 0x0, 0x1, @tcp=[@CTA_TIMEOUT_TCP_SYN_SENT={0x8, 0x1, 0x1, 0x0, 0x4}, @CTA_TIMEOUT_TCP_SYN_SENT2={0x8, 0x9, 0x1, 0x0, 0x200}, @CTA_TIMEOUT_TCP_CLOSE={0x8, 0x8, 0x1, 0x0, 0x9}]}, @CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x84}]}, 0x5c}, 0x1, 0x0, 0x0, 0x4010}, 0x8000) (async) sendmsg$netlink(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000001880)={0x18, 0x2f, 0x1, 0x70bd2b, 0x25dfdbff, "", [@typed={0x8, 0xe9, 0x0, 0x0, @uid}]}, 0x18}], 0x1, 0x0, 0x0, 0x1}, 0x0) 1.149956961s ago: executing program 5 (id=5979): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x7c}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x20000080) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f00000000c0)=[@in6={0xa, 0x4e23, 0x401, @loopback, 0x2}], 0x1c) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x44, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="01000000120000007f00000001"], 0x48) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000000)={r1, 0x58, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000008c0)={0x6, 0x3, &(0x7f0000000600)=ANY=[@ANYBLOB="1818000004000000000000000000000095"], &(0x7f0000000040)='GPL\x00', 0x5, 0x0, 0x0, 0x1f00, 0x0, '\x00', r2, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7}, 0x94) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$packet(0x11, 0x3, 0x300) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r6, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=@ipv6_newnexthop={0x20, 0x68, 0x5fb9a818fb7378e9, 0x0, 0x0, {}, [@NHA_OIF={0x8, 0x5, r7}]}, 0x20}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)=@ipv6_newrule={0x24, 0x18, 0x409, 0x0, 0x0, {}, [@FIB_RULE_POLICY=@FRA_GOTO={0x8, 0x1e, 0x1}]}, 0x24}}, 0x80) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000640)=ANY=[@ANYBLOB="6c0000001000370400"/20, @ANYRES32=0x0, @ANYBLOB="00000000280802004c0012800e00010069703665727370616e00000038000280140006002001000000000000000000000000000214000700fc0200400000000000000000000800fc0400120008000100395bed87cbb192549b5d501043da06f6e1748f2e8e597cd7ce6ac0177b1cfac18078ab5356a23732b63db7e36ba5092dad037f344bb3e10933a2aa7386ec2b14736aa0252216ae634242d761d4b302901646dde30d35c462669d73bec8eee27d0e80b3a39a71b5922d7f36b2934d02b6a4d21b945d0d715adde3bcc6242f277fd57181ce69f3221a33b73adc0a920dd4da90d5b1dcc7a1a004258c99f5119d15b00a16031836c90b90dec68eaecb592dd2c6604eee27e0ca3ee32186a9234853ca9b1b504a4b061fd5b536e012cd835bb05c51620e7f13664a369af1774f0d7c1ad41315f8fa7ee221168a672d3f56dc2fa9a6a1d1", @ANYRES32=r7, @ANYBLOB], 0x6c}}, 0x0) (fail_nth: 13) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r8, &(0x7f0000002f80)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000004}, 0x0) bpf$ITER_CREATE(0x21, 0x0, 0x0) 1.105796844s ago: executing program 5 (id=5980): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000100)=0x207, 0x4) r1 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$inet_sctp_SCTP_AUTH_DEACTIVATE_KEY(r1, 0x84, 0x1d, &(0x7f0000000380), 0x8) socket$nl_netfilter(0x10, 0x3, 0xc) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x0, 0x32, 0xffffffffffffffff, 0x8528c000) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'ip6tnl0\x00', 0x0}) r3 = socket$tipc(0x1e, 0x5, 0x0) socket$kcm(0x10, 0x400000002, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=ANY=[@ANYBLOB="f80000001600010000000000000000000a01010000000000000000000000000000000000000000000000ffff000000000000000000000000000080a000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000000ffffac141428000000003300000000"], 0xf8}}, 0x0) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="20010000120013070000000000000000e0000001000000000000000000000000fc00"/64, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fc020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000072c42572f64a264410b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fbc18c8582fc7800000000000000000000000050019000000000028001a"], 0x120}}, 0x0) setsockopt$SO_TIMESTAMPING(r3, 0x1, 0x41, &(0x7f0000000080)=0x504, 0x4) sendto$packet(r0, &(0x7f0000000180)="05031600d3fc140000004788031c09103c28ab256bfe3f860ad7fc569ce808335b96b7c5c3d1c7da5b88098e0b9cab1cc1ea98109fa42de4d310954ea36bc2e45211706703317aab0010ff2e9f154d142782954f67b1b1d5daa37ac21e36ff6d57a722a1c8528f510998dcf7459f212dd9d5c6016a49b2a1fd5490e52901de8cdb9f79d4699494217e1c0fbdf5bc6b838741cd4fc30c1786786658b445a1d15dfbe375acaba15fd1834ffec6fc50f15fe4cc94bcc9a427e3f7f0aada5191644544df436e72047f0d79b0bf71f58c1cf9700a82d3f9df1040fd74c5b0e1402a14f2da75e967af23078c29822aeee20744bce13106e765b6c94a83eca28b4953f0cc9a7912669e95867d9f9eeb9ef6d9293d8fcf486660eb88af825d9a93cc1e363fdd44e27673476dd4764231e1e26e884049ab5a1c9634ecb81535c663341fc3ff24fe3836b43e5223d2d670257ccec8feaa58f9683b6402f7f43a18ad481a11150a050000000000000076679b723d42a315f7eaeec380f354dd93ae3a84625a01fb5b3c26afe4e87abf6cdf018fbd209e87b46dd7a3d5ebf6b3eb928611e62b9045b4dccef13feb73fe1c4f77c13f4a9feb8469b2fbc8004871f957b1bed585", 0x1c0, 0x4004084, &(0x7f0000000140)={0x11, 0x7, r2, 0x1, 0x0, 0x6, @multicast}, 0x14) 1.074563009s ago: executing program 3 (id=5981): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x2a, 0x2, 0x0) getsockname$packet(r2, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=@newqdisc={0x24, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}}, 0x24}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000000c0)=@newtfilter={0x48, 0x2c, 0xd27, 0x0, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0xfffa}, {}, {0x1c, 0xfff9}}, [@filter_kind_options=@f_flower={{0xb}, {0x18, 0x2, [@TCA_FLOWER_INDEV={0x14, 0x2, 'ip6tnl0\x00'}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x24000000) sendmsg$nl_route(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=@newlink={0x44, 0x10, 0x421, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0xb3a024127545a0ff}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @erspan={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GRE_LINK={0x8, 0x1, r3}]}}}, @IFLA_GSO_MAX_SIZE={0x8, 0x29, 0x738c5}]}, 0x44}}, 0x0) setsockopt$sock_int(r0, 0x1, 0x2a, &(0x7f0000000080)=0x2, 0x4) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$gtp(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$GTP_CMD_NEWPDP(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000002c0)={0x2c, r5, 0x3c1ef5685f8d0157, 0x0, 0x0, {}, [@GTPA_I_TEI={0x8}, @GTPA_VERSION={0x8, 0x2, 0x1}, @GTPA_LINK={0x8}]}, 0x2c}}, 0x0) r6 = ioctl$NS_GET_PARENT(0xffffffffffffffff, 0xb702, 0x0) sendmsg$GTP_CMD_ECHOREQ(r0, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000040)={&(0x7f0000000140)={0x74, r5, 0x730, 0x70bd2b, 0x25dfdbff, {}, [@GTPA_O_TEI={0x8, 0x9, 0x1}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_PEER_ADDR6={0x14, 0xb, @mcast2}, @GTPA_PEER_ADDRESS={0x8, 0x4, @private=0xa010100}, @GTPA_I_TEI={0x8, 0x8, 0x4}, @GTPA_MS_ADDR6={0x14, 0xc, @mcast1}, @GTPA_FAMILY={0x5, 0xd, 0x29}, @GTPA_NET_NS_FD={0x8, 0x7, r6}, @GTPA_FLOW={0x6, 0x6, 0x3}]}, 0x74}}, 0x800) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000080)={0x10, 0x4, &(0x7f00000009c0)=@framed={{}, [@ldst={0x1, 0x2, 0x4, 0x0, 0x1, 0x3f}]}, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x90) 997.554589ms ago: executing program 5 (id=5982): unshare(0x22020600) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="08000000040000000400000001"], 0x50) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000000)={r0, &(0x7f0000000140), &(0x7f0000000200)=""/221}, 0x20) r1 = socket$inet_sctp(0x2, 0x5, 0x84) sendto(r1, &(0x7f00000000c0)="4922eb760ae816f274e5adbb394b0e33e2de273870a5a59aa19721b4fa3ec71b139a317bffee149def97439cbd5d3eb359ebccb51fd43ec03221a76cf92f680b4becbb9d012fd1c5c5f5b50fdbe4c01a2ebc61b4cf02c3898ed0cf3422376090cf967472a9e9dffc723b0335d8b72695a01f95b5d1409f2e0236986505216c82d5e8947831f7e051d52332435d43589fa579c8aaefe3d0b5dabca94669e31761186247ee4097aa1e9e9dbd3668fbab70b0da1d", 0xb3, 0x4008000, &(0x7f0000000000)=@l2tp={0x2, 0x0, @multicast1, 0x1}, 0x80) socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) r2 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'syz_tun\x00', 0x0}) setsockopt$SO_TIMESTAMPING(r2, 0x1, 0x25, &(0x7f00000005c0)=0x2c17, 0x4) sendto$packet(r2, 0x0, 0x0, 0x40001, &(0x7f0000000240)={0x11, 0xf7, r3, 0x1, 0x20, 0x6, @local}, 0x14) recvfrom$packet(r2, 0x0, 0x0, 0x2000, 0x0, 0x0) unshare(0x2000100) close(0x4) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f0000000540)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(cast6)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d49100dc6626c892b6bc436a", 0x10) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r6 = socket(0x400000000010, 0x3, 0x0) r7 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, r8, {0x5, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0xc}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r6, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000001380)=@newtfilter={0x54, 0x2c, 0xd27, 0x70bd28, 0x7fff, {0x0, 0x0, 0x0, r8, {0x0, 0xffe0}, {}, {0xfff3, 0xfff3}}, [@filter_kind_options=@f_basic={{0xa}, {0x24, 0x2, [@TCA_BASIC_EMATCHES={0x20, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x3}}, @TCA_EMATCH_TREE_LIST={0x14, 0x2, 0x0, 0x1, [@TCF_EM_IPSET={0x10, 0x1, 0x0, 0x0, {{0xf6, 0x8, 0x9}, {0x1, 0x4}}}]}]}]}}]}, 0x54}, 0x1, 0x0, 0x0, 0x22044028}, 0x0) r9 = accept4(r4, 0x0, 0x0, 0x0) sendmsg$alg(r9, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)=[@iv={0x18}], 0x18, 0x2400c098}, 0x4000010) syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/ipc\x00') r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="4400000010000304000000000000000000007400", @ANYRES32=r11, @ANYBLOB="0000000000000000240012800b00010062726964676500001400028006002700000f"], 0x44}, 0x1, 0x0, 0x0, 0x40800}, 0x0) 969.161708ms ago: executing program 0 (id=5983): r0 = epoll_create(0x7) r1 = epoll_create1(0x0) r2 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r3) ioctl$IOCTL_GET_NCIDEV_IDX(r2, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000740)=ANY=[@ANYBLOB, @ANYRES16=r4, @ANYBLOB="010026bd70003c0200000200000008000100", @ANYRES32=r5], 0x1c}}, 0x0) write$nci(r2, &(0x7f0000001800)=ANY=[@ANYBLOB="7240082b0102020681055a03997713fa06070202267a"], 0x16) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000180)) epoll_create1(0x0) shutdown(0xffffffffffffffff, 0x0) r6 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) sendmsg$alg(r6, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18, 0x40010}, 0x14000012) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180100001c0000000000000000000000850000006d00000095"], &(0x7f0000000380)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x20}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f00000000c0)='sys_enter\x00', r7}, 0x10) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r8, &(0x7f00000000c0)=[{&(0x7f0000000180)='w', 0x1}], 0x1, 0x0) close(r9) 949.676222ms ago: executing program 1 (id=5984): pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r0, &(0x7f0000000800)=[{&(0x7f0000000f80)="4191062c1421f8d286fea25179d3bff47ffb95a24f597e0388f330e7dfb81fde917ae89f97d5fde0855ce2942ff541f21652a7409dad35f8886d587bb6e698986ca5f808b1b92c1a374dbc7424a26c0ad2b6840cf3049fc728f9109eb576c388dca33df6129f9efd43ccbd58a93f146ce183a410b8959fe192652e32068e0d8e24d8eab4ecbd5ebaa165771a07c890804037074a1ebad3bcdd46b8f34ecb2f4a6e1bbc6ac3d80ea44fbfedf338583f63ba4607f430acc0a98b4fcbb501006052cb83625cbf60ebf28e9095458c1e9971417b2912bbe30037dd5c1ac06f612816e97ac304404619b0c75222e9339f6ba14eac3c1486ac997f919248490b14a5e12ef47e61857f6d43ebc490155bf06e801547ed96f1264b5c220cf3f66d", 0x11d}, {&(0x7f0000000280)="09ec8b684fbd9f0a18960e84defd08b28dc2f98b5aad5cfeb075441d6d15233b802af831523479391b7297416ddff60a6500da9864b052a3105e6fa49014cb2ce5f295aaff14d9077735f34eaec042e8252a6456999297ed02a01da56a3809f0c58184192ebf4bead7e8618412536273bf08e0f6847e436dc74fd4450e8ff88199f35a0c759aff55639834dc4c945dfb330a7b92b049700cb67e0f14337d8390091514253c2f2d4499d89b5f04759319e2c7b6856f03c69029b689f0be37093c79e8ff2405eb93cbfe5487143a294c3e61b0c9be8323cd4d01c37e5f5d4bf94546d02d4dc988dbb4717ee61e5be16f4c7701cc671d25", 0xf6}, {&(0x7f00000001c0)="f3ba9e8346ddfd46f5ba7fbc25c6aed71214dcfaa44b98dfdbc07b1c8dc80c42d5501285b1bc305d7f699524d78bca1a151bfd74ca3d4f468f1244e6951083a7e19dec984cc37874a28db922c628a534fb91191d25f636a589", 0x59}, {&(0x7f0000001780)="12dfbd793db81fe455d97618c2aedf67f1b166ec59876a1fbbe13986e69655d6f600262371ef8dae091786d7f9a4d7ca234f8852df8f05000f02b5258ec56ec5fdd5f3531f795bf2f172d6fb23f3549b9734f2eef416b7698a93335a94b8cda61325b62cda1807b03675c6347b431f2d71baa6bc59e9047069153d70ffba20956e58971501c2d9f299fdfa3a38fa73a5da43ba2506d8704592ee5c19ca0d2075ddc9313d8bd2202a89dae6a689d3900818f892f3f17957cd53023399810da5655e0fd0f0f394c9a8bedc", 0xca}, {&(0x7f0000000500)="0f15ce0e2a894e2afb7a77dc4a4ec84b8109b2c95397d40adb9d5e8df8fd9a3167faa56aa764e61ba1a6cc8fd041bb89bee6d17105e169dd8d68d5b79eb5958574299b9035fbed2942a75e731b7571c29a760623e725792c", 0x58}, {&(0x7f0000000b00)="ed48f08c19f5d937fe3f92802a25b07496a34825b6d3fbf57fec343be7e4b6531b0e0f0637b3c46e072578521ad417549bae2e00ad7b67f769ec533e3c9c62b6955e9005ca02506938aeb5adac5798e85f440385c7f26cced77e12ecffa7b98c962259e08cffa0eb0ad803bfdf8336da8df2e85a2a8b407329650ee71f68ca7de83df1c45914bedd1b8add5bc677e5590af05aea657a8b2b7dd4fc76010e259917ab727d4065cee39115ca3d322533bb48b5b8a23e8557688d783d0e5c444fd5ae3e02d7245c498d9c6675c8a9626ecde62915d6ada50bb3a0496c87f77457a664a250ba9d037a463f44057ad767bb933fa0790f660401baa257", 0xfa}, {&(0x7f0000000cc0)="be5af0a1b77fdb78379e4aed4f731b0f88920d1b033228f04a8d7f22afacc5c5014861b7715c3de8745083b4869ba515422c01c49a3eea697223ac78b4a3a20fc9364c30aacbebb3c28dedbf525eecad1436bb61f54dd04b7623dd1369e86bcf162595858a39618ac38f8766af0430a83e786a00eb966ffb0cd5a5af2f88781da8c146b566692815d64c86a50d395e6c8c4cea408323066e100694eac314590b63aa97afdfc99a5f3198be8347fe7664ca80f2d586576ece61cf5e334d43a1449f4eb920030e615a06baa50100e3962897b3af4ad468ec87671c0f706bcd47b06ce112f8b19465dbbdff78bea7af7d7bc3cf65b8dd45aeb9e55783bb550679f7ff68e94308492ef12024d7e7677d1a4239cecc3545bfb424fd9f57815a7030041088b74d082f3e0b294951c8d1", 0x12d}, {&(0x7f00000005c0)="23c8f8e7bb8d0ba65b2d53e1b98cbeae874b769afbb97c7f46c8969c2772e02e5d80add492fdba14dee6fbc6f2cdc93b86fb8199b61a03a801c262c343c6bbf5856dc1d3c7dd7eeb196ddcf13456cff281c807953060a280f32e718b432d2031c73f6ca657519e04cf1b39497f7d785fff277a2a5612abf6c830c8b72579207ac0dda5", 0x83}, {&(0x7f0000000780)="ca3fcea77620b98213d60f78fe2e503ccb6662d189d191886f4fe8db857b07f574782f7bb888b8333220361011eec01501a2772a0392eaa06aca70b89b89f7ffd6ad7838ab27f246f9b78fa61a5ee5", 0x4f}], 0x9, 0x8) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='sched_switch\x00'}, 0x18) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) ppoll(&(0x7f0000000500)=[{r1}], 0x1, 0x0, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000480)='kfree\x00', 0xffffffffffffffff, 0x0, 0x1843}, 0x18) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000380)='memory.events\x00', 0x275a, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) r4 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_MAKE_EQUIV(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000004d40)={&(0x7f00000000c0)={0x28, 0x3ea, 0x400, 0x70bd20, 0x25dfdbff, {0x7, 0x7, './file0', './file0'}}, 0x28}, 0x1, 0x0, 0x0, 0x20000844}, 0x10) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) r6 = socket(0x840000000002, 0x3, 0x100) connect$inet(r6, &(0x7f00000005c0)={0x2, 0x0, @local}, 0x10) sendmmsg$inet(r6, &(0x7f0000005240)=[{{0x0, 0x0, 0x0}, 0xfffffdef}], 0x4000095, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0x1b, 0x10, &(0x7f0000000540)=ANY=[@ANYBLOB="1833000004000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b702000000362d0085000000860000001801000020646c2500000000002020207b1af8ff00010000f8ffffffb702000008000000b7030000ff7fffff8500000006000000851000000400"], &(0x7f00000004c0)='syzkaller\x00', 0xe, 0x68, &(0x7f0000000600)=""/104, 0x41000, 0x47, '\x00', 0x0, @fallback=0x19, r5, 0x8, &(0x7f0000000680)={0x3, 0x3}, 0x8, 0x10, &(0x7f00000006c0)={0x4, 0xc, 0xffffffbc, 0xba}, 0x10, 0x0, r3, 0x0, &(0x7f0000000840)=[r1, r3, r2, 0xffffffffffffffff, r2, r5], 0x0, 0x10, 0x7fffffff}, 0x94) write(0xffffffffffffffff, &(0x7f00000002c0)="fc0000001c000704ab5b2509b868030002ab087a0100000001481093210001c0f0030584050060100000000000039815fa2c53c28648000000b9d95662537a00bc000c00f0ff7f0000b400600033d44000040560916a0033f436313012dafd5a32e273fc83ab82d710f74cec184406f90d435ef8b29d3ef3d92c94170e5bba2e177312e081bea05d3a021e8ca062914a46ccfc510bb73c9455cdc8363ae4f5df77bc4cfd6239ec2a0f0d1bcae5fa0f5f9dcdd51af51af8502943283f4bb102b2b8f5566791cf190201ded815b2ccd243f395ed94e0ad91bd6433802e0784f2013cd1890058a10000c880ac801fe4af000049f0d4796f0000090548de", 0xfc) sendmsg$kcm(0xffffffffffffffff, 0x0, 0xff00) r7 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSARP(r7, 0x8953, &(0x7f0000000180)={{0x2, 0x0, @empty}, {}, 0x0, {0x2, 0x0, @multicast1=0xe000cc02}}) 878.335359ms ago: executing program 3 (id=5985): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x2) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r1) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_GET_WOWLAN(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={0x0, 0x28}}, 0x0) getsockname$packet(r1, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=@newlink={0x34, 0x10, 0x439, 0x0, 0x0, {0x0, 0x0, 0x0, r5, 0x10681, 0x20000}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}]}, 0x34}}, 0x20044002) r6 = socket(0x10, 0x803, 0x0) r7 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@ipv6_newaddr={0x2c, 0x14, 0x9535393fea6295b5, 0x0, 0x0, {0xa, 0x40, 0x0, 0x0, r8}, [@IFA_LOCAL={0x14, 0x2, @ipv4}]}, 0x2c}}, 0x0) r9 = socket(0x10, 0x803, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) sendmsg$nl_route(r9, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000002a80)=ANY=[@ANYBLOB="340000001400b59500000000000000000a000000", @ANYRES32=r10, @ANYBLOB="1400024000000000000000000000ff"], 0x34}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffff11ffffffff000000", @ANYRES32=r2, @ANYBLOB="01"], 0x3c}, 0x1, 0x0, 0x10000000}, 0x0) 649.934813ms ago: executing program 3 (id=5986): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000180)={'sit0\x00', &(0x7f0000000080)={'syztnl1\x00', 0x0, 0x8, 0x20, 0x3, 0x7, {{0x2a, 0x4, 0x0, 0x2, 0xa8, 0x64, 0x0, 0x2, 0x2f, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @multicast1, {[@ssrr={0x89, 0xb, 0xd5, [@broadcast, @broadcast]}, @generic={0x94, 0x5, "b893eb"}, @end, @lsrr={0x83, 0x7, 0x9e, [@remote]}, @timestamp_prespec={0x44, 0x1c, 0x2c, 0x3, 0x5, [{@remote, 0x3ff}, {@empty, 0x6}, {@dev={0xac, 0x14, 0x14, 0x37}, 0x7ff}]}, @rr={0x7, 0x3, 0xe0}, @cipso={0x86, 0x4f, 0xffffffffffffffff, [{0x5, 0xe, "acb359b6fd457beacd22303e"}, {0x5, 0x2}, {0x2, 0xd, "25d4544a27d33d440f989e"}, {0x1, 0xe, "43b2c481c2307a1f7018288d"}, {0x5, 0x7, "d854f61454"}, {0x1, 0xf, "9426dcbc42b5b2e507c30e5619"}, {0x2, 0x6, "0353a141"}, {0x7, 0x2}]}, @timestamp_prespec={0x44, 0xc, 0x22, 0x3, 0x5, [{@empty, 0x3}]}]}}}}}) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0xc, 0xf, &(0x7f00000005c0)=ANY=[@ANYRES64=r4], 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, '\x00', 0x0, @fallback=0x12, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$BATADV_CMD_GET_VLAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="00002cbd7000c40d0000000000000800bf38953200ff020000050033000300000008", @ANYRES32=r2, @ANYBLOB="05002d000100", @ANYRES32=r4, @ANYBLOB="08003a0007000000050033000200000005002a0001"], 0x54}, 0x1, 0x0, 0x0, 0x1}, 0x0) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff) r7 = syz_genetlink_get_family_id$ethtool(&(0x7f00000003c0), r0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$ETHTOOL_MSG_PRIVFLAGS_GET(r0, &(0x7f0000000540)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000500)={&(0x7f0000000400)={0xec, r7, 0x2, 0x70bd2a, 0x25dfdbff, {}, [@HEADER={0x78, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bridge_slave_1\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'team0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan1\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}, @HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}]}, @HEADER={0x54, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'virt_wifi0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r9}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6gretap0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}]}]}, 0xec}, 0x1, 0x0, 0x0, 0x400}, 0x804) r10 = gettid() sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000002400)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="010028bd7000ffdbdf2514000000080001000100000008001c00", @ANYRES32=r10], 0x24}, 0x1, 0x0, 0x0, 0x20000040}, 0x4000000) (fail_nth: 6) 619.100133ms ago: executing program 0 (id=5987): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r2 = socket$packet(0x11, 0x3, 0x300) r3 = socket(0x10, 0x803, 0x0) sendmsg$SMC_PNETID_GET(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={0x0, 0x14}}, 0x0) sendmsg$IPCTNL_MSG_CT_DELETE(r0, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000080)={&(0x7f00000003c0)={0x100, 0x2, 0x1, 0x5, 0x0, 0x0, {0x0, 0x0, 0x9}, [@CTA_TUPLE_ORIG={0x20, 0x1, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @rand_addr=0x64010101}, {0x8, 0x2, @initdev={0xac, 0x1e, 0x1, 0x0}}}}]}, @CTA_MARK={0x8, 0x8, 0x1, 0x0, 0x9}, @CTA_NAT_SRC={0x80, 0x6, 0x0, 0x1, [@CTA_NAT_V4_MAXIP={0x8, 0x2, @multicast2}, @CTA_NAT_V4_MINIP={0x8, 0x1, @local}, @CTA_NAT_V6_MINIP={0x14, 0x4, @dev={0xfe, 0x80, '\x00', 0x17}}, @CTA_NAT_V4_MAXIP={0x8, 0x2, @private=0xa010102}, @CTA_NAT_PROTO={0x2c, 0x3, 0x0, 0x1, [@CTA_PROTONAT_PORT_MIN={0x6, 0x1, 0x4e21}, @CTA_PROTONAT_PORT_MAX={0x6, 0x2, 0x4e23}, @CTA_PROTONAT_PORT_MAX={0x6, 0x2, 0x4e23}, @CTA_PROTONAT_PORT_MIN={0x6, 0x1, 0x4e24}, @CTA_PROTONAT_PORT_MIN={0x6, 0x1, 0x4e23}]}, @CTA_NAT_V6_MAXIP={0x14, 0x5, @private2}, @CTA_NAT_V4_MAXIP={0x8, 0x2, @empty}, @CTA_NAT_V4_MAXIP={0x8, 0x2, @rand_addr=0x64010100}]}, @CTA_LABELS={0x20, 0x16, 0x1, 0x0, [0xf, 0x4, 0x9, 0x8e, 0x914, 0x3, 0x3c3f4100]}, @CTA_SEQ_ADJ_REPLY={0x24, 0x10, 0x0, 0x1, [@CTA_SEQADJ_OFFSET_BEFORE={0x8, 0x2, 0x1, 0x0, 0x1c0}, @CTA_SEQADJ_OFFSET_AFTER={0x8, 0x3, 0x1, 0x0, 0x62}, @CTA_SEQADJ_CORRECTION_POS={0x8, 0x1, 0x1, 0x0, 0x1}, @CTA_SEQADJ_CORRECTION_POS={0x8, 0x1, 0x1, 0x0, 0x200}]}]}, 0x100}, 0x1, 0x0, 0x0, 0x20000083}, 0x8000) getsockname$packet(r3, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000200)=@newlink={0x3c, 0x10, 0x437, 0x3, 0xffffffff, {0x0, 0x0, 0x0, r4, 0x41b0b}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ip6gretap={{0xe}, {0x8, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x48800}, 0x4000010) sendto$packet(r2, &(0x7f0000000000)="6f3d12caa129b05b93fadda088a856d286dd", 0x12, 0x4, &(0x7f0000000180)={0x11, 0x8100, r4, 0x1, 0xe9, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, 0x14) r5 = socket(0x15, 0x80000, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x35, 0x0, 0x0) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x9, 0x8c4b815a5465c2b1, r1, 0xb0260000) mmap(&(0x7f0000691000/0x4000)=nil, 0x4000, 0x3, 0x28011, r0, 0xc6e9f000) mmap(&(0x7f0000d8c000/0x1000)=nil, 0x1000, 0x1000001, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x11, r5, 0xffffe000) r6 = socket$nl_rdma(0x10, 0x3, 0x14) ioctl$BTRFS_IOC_BALANCE_CTL(r6, 0x40049421, 0x5) 576.726172ms ago: executing program 5 (id=5988): r0 = socket(0x10, 0x803, 0x0) sendmsg$SMC_PNETID_GET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={0x0, 0x14}}, 0x0) (async) getsockname$packet(r0, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000580)=0x14) sendmsg$nl_route(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000740)=@newlink={0x50, 0x10, 0x437, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r1, 0x40c89}, [@IFLA_LINKINFO={0x30, 0x12, 0x0, 0x1, @ipip={{0x9}, {0x20, 0x2, 0x0, 0x1, [@IFLA_IPTUN_ENCAP_FLAGS={0x6, 0x10, 0x1}, @IFLA_IPTUN_LINK={0x8}, @IFLA_IPTUN_COLLECT_METADATA={0x4}, @IFLA_IPTUN_PMTUDISC={0x5}]}}}]}, 0x50}, 0x1, 0x0, 0x0, 0x44801}, 0x0) (async) r2 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000000)='hybla', 0x5) sendmmsg$inet(r2, &(0x7f00000017c0)=[{{&(0x7f0000000040)={0x2, 0x4e1c, @loopback}, 0x10, 0x0, 0x0, &(0x7f00000004c0)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r1, @empty, @loopback}}}], 0x20}}], 0x1, 0x4040880) 457.962254ms ago: executing program 0 (id=5989): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000096c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newtaction={0x6c, 0x30, 0x9, 0x0, 0x0, {}, [{0x58, 0x1, [@m_vlan={0x54, 0x1, 0x0, 0x0, {{0x9}, {0x28, 0x2, 0x0, 0x1, [@TCA_VLAN_PARMS={0x1c, 0x2, {{0x2}, 0x3}}, @TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0x1100}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x6c}}, 0x0) syz_genetlink_get_family_id$nl802154(&(0x7f0000000080), 0xffffffffffffffff) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=@newlink={0x58, 0x10, 0x1, 0x0, 0x0, {}, [@IFLA_VFINFO_LIST={0x30, 0x16, 0x0, 0x1, [{0x2c, 0x1, 0x0, 0x1, [@IFLA_VF_MAC={0x28, 0x1, {0x0, @local}}]}]}, @IFLA_GROUP={0x8}]}, 0x58}}, 0x0) getsockopt$bt_hci(r0, 0x84, 0x81, &(0x7f0000000080)=""/4076, &(0x7f00000010c0)=0xfec) 437.282287ms ago: executing program 5 (id=5990): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'lo\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000040)={&(0x7f0000000240)=@delchain={0x94, 0x65, 0x200, 0x70bd2c, 0x25dfdbfc, {0x0, 0x0, 0x0, r2, {0x0, 0xa}, {0x2, 0x2}, {0x4, 0x4}}, [@TCA_CHAIN={0x8, 0xb, 0x9}, @filter_kind_options=@f_fw={{0x7}, {0x20, 0x2, [@TCA_FW_INDEV={0x14, 0x3, 'syzkaller1\x00'}, @TCA_FW_MASK={0x8, 0x5, 0xc8f}]}}, @TCA_CHAIN={0x8, 0xb, 0x10}, @TCA_RATE={0x6, 0x5, {0xbd, 0xf}}, @TCA_RATE={0x6, 0x5, {0x3, 0x94}}, @filter_kind_options=@f_fw={{0x7}, {0x18, 0x2, [@TCA_FW_INDEV={0x14, 0x3, 'bridge_slave_0\x00'}]}}, @TCA_RATE={0x6, 0x5, {0xa1, 0x4}}]}, 0x94}, 0x1, 0x0, 0x0, 0x8884}, 0x4050) sendmsg$nl_route(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=@bridge_newneigh={0x30, 0x1c, 0x1, 0x70bd28, 0x25dfdbfe, {0x2, 0x0, 0x0, r2, 0x3f, 0x0, 0x4}, [@NDA_DST_IPV4={0x8, 0x1, @empty}, @NDA_LLADDR={0xa, 0x2, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}]}, 0x30}}, 0x4000004) 0s ago: executing program 1 (id=5991): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="1400000010000100000000000000000000e815a4e5f9817200000a20000000000a01080000000000000000010000000900010073797a300000000078000000090a0104849c424f8122d8fa95252d6c12253b00080000000000000100000008000a40000000000900020073797a30000000000900010073797a300000000008000540000000213c0011800a0001006c696d69740000002c0002800c00000000000008000540000040000c0001400000080000000400080004400000d732a1c71d6c94f4975770fcdfc4d32dc66b20f1e4f572a9c0fb262e0a6c52fd4dc5415263af13eb462b79f91efafb486db6223ed72938960f450bdea1bb35c54027c0e6757866eb8d0eb95e3a5f12444b4f8ae7825ae8177339e49189e7c203d31a3546cd27ec247a92a83a8abe547441ac0abcbbdd70b372059e9eeb59d791d2cf165db56de3446e7e3f87", @ANYRESHEX=r0, @ANYRESDEC=r0], 0xc0}}, 0x240041c1) r1 = getpid() write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000040)=r1, 0x12) kernel console output (not intermixed with test programs): sabling bearer [ 492.623206][T19961] syz_tun (unregistering): left allmulticast mode [ 493.773259][T20047] block nbd4: not configured, cannot reconfigure [ 494.095428][T20075] netlink: 'syz.0.4234': attribute type 1 has an invalid length. [ 494.719106][T20115] xfrm1: entered promiscuous mode [ 494.724168][T20115] xfrm1: entered allmulticast mode [ 494.750994][T20119] netlink: 'syz.0.4248': attribute type 13 has an invalid length. [ 494.779143][T20119] gretap0: refused to change device tx_queue_len [ 494.795433][T20119] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 495.237437][T20144] __nla_validate_parse: 10 callbacks suppressed [ 495.237456][T20144] netlink: 44 bytes leftover after parsing attributes in process `syz.0.4256'. [ 495.243929][T20135] netlink: 14 bytes leftover after parsing attributes in process `syz.4.4253'. [ 495.599801][T20160] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 495.617451][T20157] tipc: Enabled bearer , priority 0 [ 495.648820][T20163] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 495.665076][T20157] syzkaller0: entered promiscuous mode [ 495.681247][T20157] syzkaller0: entered allmulticast mode [ 495.804703][T20157] tipc: Resetting bearer [ 495.849196][T20156] tipc: Resetting bearer [ 496.016187][T20156] tipc: Disabling bearer [ 496.166982][T20187] netlink: 44 bytes leftover after parsing attributes in process `syz.4.4267'. [ 496.347685][T20197] netlink: 14 bytes leftover after parsing attributes in process `syz.0.4269'. [ 496.691277][T20206] netlink: 60 bytes leftover after parsing attributes in process `syz.0.4273'. [ 496.700912][T20206] netlink: 60 bytes leftover after parsing attributes in process `syz.0.4273'. [ 496.716648][T20205] netlink: 44 bytes leftover after parsing attributes in process `syz.3.4272'. [ 497.003545][T20222] netlink: 68 bytes leftover after parsing attributes in process `syz.0.4279'. [ 497.072949][T20225] wg1: entered promiscuous mode [ 497.100859][T20225] wg1: entered allmulticast mode [ 497.153537][T20226] netlink: 'syz.0.4279': attribute type 1 has an invalid length. [ 497.174571][T20233] netlink: 16 bytes leftover after parsing attributes in process `syz.3.4280'. [ 497.215773][T20233] vti0: entered promiscuous mode [ 497.390054][T20241] netlink: 60 bytes leftover after parsing attributes in process `syz.5.4285'. [ 497.412728][T20241] geneve1: entered promiscuous mode [ 497.420560][T20241] geneve1: entered allmulticast mode [ 497.549831][T20249] Cannot find add_set index 0 as target [ 497.585605][T20249] Cannot find add_set index 0 as target [ 497.592456][T20249] Cannot find add_set index 0 as target [ 497.599273][T20249] Cannot find add_set index 0 as target [ 497.608164][T20249] Cannot find add_set index 0 as target [ 497.614115][T20249] Cannot find add_set index 0 as target [ 497.620637][T20249] Cannot find add_set index 0 as target [ 498.062796][T20276] veth0: entered promiscuous mode [ 498.336556][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 498.398109][T20300] xt_TPROXY: Can be used only with -p tcp or -p udp [ 498.404952][T20295] xt_TPROXY: Can be used only with -p tcp or -p udp [ 498.472082][T20306] netlink: 'syz.5.4304': attribute type 1 has an invalid length. [ 498.506913][T20307] netlink: 'syz.3.4303': attribute type 2 has an invalid length. [ 498.542216][T20307] netlink: 'syz.3.4303': attribute type 1 has an invalid length. [ 498.632534][T20307] bond0: entered promiscuous mode [ 498.643218][T20307] 8021q: adding VLAN 0 to HW filter on device bond0 [ 498.707127][T20319] bond0: (slave bridge4): making interface the new active one [ 498.716512][T20319] bridge4: entered promiscuous mode [ 498.727684][T20319] bond0: (slave bridge4): Enslaving as an active interface with an up link [ 498.770600][T20316] bond0: (slave bridge5): Enslaving as a backup interface with an up link [ 498.813275][T20322] bond2: option ad_actor_sys_prio: mode dependency failed, not supported in mode balance-rr(0) [ 498.827129][T20322] bond2 (unregistering): Released all slaves [ 498.862900][ T139] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 498.886611][T20275] veth0: left promiscuous mode [ 498.893693][ T139] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 498.941136][ T139] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 498.970416][ T139] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 499.894160][T20411] syzkaller0: entered promiscuous mode [ 499.904667][T20411] syzkaller0: entered allmulticast mode [ 499.911832][T20414] netlink: 'syz.0.4333': attribute type 2 has an invalid length. [ 500.434836][T20446] __nla_validate_parse: 10 callbacks suppressed [ 500.434857][T20446] netlink: 28 bytes leftover after parsing attributes in process `syz.5.4344'. [ 500.704370][T20468] openvswitch: netlink: Missing valid actions attribute. [ 500.734983][T20472] netlink: 56 bytes leftover after parsing attributes in process `syz.0.4352'. [ 500.749693][T20468] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 500.764764][ T5830] Bluetooth: hci4: link tx timeout [ 500.770323][T20472] bridge0: port 1(batadv1) entered blocking state [ 500.771783][ T5830] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 500.789239][T20472] bridge0: port 1(batadv1) entered disabled state [ 500.795856][T20472] batadv1: entered allmulticast mode [ 500.840916][T20472] batadv1: entered promiscuous mode [ 500.873191][T20468] netlink: 'syz.5.4348': attribute type 10 has an invalid length. [ 501.001002][T20489] ip6t_REJECT: TCP_RESET illegal for non-tcp [ 501.020328][T20489] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4355'. [ 501.090008][T20489] : entered promiscuous mode [ 501.119640][T20499] netlink: 60 bytes leftover after parsing attributes in process `syz.0.4359'. [ 501.133893][T20499] netlink: 60 bytes leftover after parsing attributes in process `syz.0.4359'. [ 501.155008][T20489] netlink: 'syz.4.4355': attribute type 10 has an invalid length. [ 501.181321][T20489] netlink: 40 bytes leftover after parsing attributes in process `syz.4.4355'. [ 501.270242][ T139] batman_adv: batadv1: No IGMP Querier present - multicast optimizations disabled [ 501.280629][ T139] batman_adv: batadv1: No MLD Querier present - multicast optimizations disabled [ 501.289045][T20489] team0: Port device geneve0 added [ 501.319924][T20511] tipc: Enabled bearer , priority 0 [ 501.337196][T20511] syzkaller0: entered promiscuous mode [ 501.342719][T20511] syzkaller0: entered allmulticast mode [ 501.388542][T20511] tipc: Resetting bearer [ 501.430097][T20511] tipc: Disabling bearer [ 501.725164][T20542] netlink: 'syz.0.4371': attribute type 1 has an invalid length. [ 501.924428][T20556] netlink: 'syz.3.4375': attribute type 1 has an invalid length. [ 502.002663][T20562] netlink: 16 bytes leftover after parsing attributes in process `syz.1.4376'. [ 502.154309][T20568] tipc: Enabled bearer , priority 0 [ 502.168010][T20568] syzkaller0: entered promiscuous mode [ 502.180433][T20568] syzkaller0: entered allmulticast mode [ 502.201727][T20568] tipc: Resetting bearer [ 502.203976][T20570] openvswitch: netlink: IPv4 tunnel dst address is zero [ 502.228574][T20572] openvswitch: netlink: Unexpected mask (mask=1040, allowed=10048) [ 502.258220][T20568] tipc: Disabling bearer [ 502.476501][T20585] netlink: 248 bytes leftover after parsing attributes in process `syz.3.4387'. [ 502.790807][T20602] tipc: Enabled bearer , priority 0 [ 502.810019][T20607] syzkaller0: entered promiscuous mode [ 502.816667][ T5832] Bluetooth: hci4: command 0x0405 tx timeout [ 502.822815][T20607] syzkaller0: entered allmulticast mode [ 502.838739][T20606] netlink: 28 bytes leftover after parsing attributes in process `syz.0.4392'. [ 502.859009][T20602] tipc: Resetting bearer [ 502.875553][T20602] tipc: Disabling bearer [ 503.053389][T20623] netlink: 'syz.3.4401': attribute type 1 has an invalid length. [ 503.068072][T20623] netlink: 228 bytes leftover after parsing attributes in process `syz.3.4401'. [ 503.618694][T20657] tipc: Enabled bearer , priority 0 [ 503.647806][T20657] syzkaller0: entered promiscuous mode [ 503.653325][T20657] syzkaller0: entered allmulticast mode [ 503.736794][T20657] tipc: Resetting bearer [ 503.844243][T20657] tipc: Disabling bearer [ 504.257204][ T30] audit: type=1804 audit(1768476571.630:3): pid=20693 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.4.4421" name="/newroot/276/memory.events" dev="tmpfs" ino=1418 res=1 errno=0 [ 504.356295][ T30] audit: type=1800 audit(1768476571.640:4): pid=20693 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.4421" name="memory.events" dev="tmpfs" ino=1418 res=0 errno=0 [ 504.512118][T20715] tipc: New replicast peer: 255.255.255.255 [ 504.539286][T20715] tipc: Enabled bearer , priority 10 [ 504.666889][T20722] tipc: Enabled bearer , priority 0 [ 504.700292][T20722] syzkaller0: entered promiscuous mode [ 504.717413][T20722] syzkaller0: entered allmulticast mode [ 504.817301][T20722] tipc: Resetting bearer [ 504.898131][T20722] tipc: Disabling bearer [ 505.267556][T20759] tipc: Failed to remove unknown binding: 66,1,1/2682449390:3937046358/3937046360 [ 505.332727][T20759] tipc: Failed to remove unknown binding: 66,1,1/2682449390:3937046358/3937046360 [ 505.595395][T20781] __nla_validate_parse: 5 callbacks suppressed [ 505.595417][T20781] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4447'. [ 505.646756][T16673] tipc: Node number set to 1861799929 [ 505.666364][T20781] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4447'. [ 505.715244][T20781] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4447'. [ 505.732693][T20790] smc: adding net device macvlan1 with user defined pnetid SYZ1 [ 505.742062][T20781] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4447'. [ 505.751708][ T36] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 505.775359][ T36] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 505.806578][ T13] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 505.835468][T20796] tipc: Enabled bearer , priority 0 [ 505.847728][T20791] tipc: Enabling of bearer rejected, already enabled [ 505.858585][ T13] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 505.869992][T20785] syzkaller0: entered promiscuous mode [ 505.875468][T20785] syzkaller0: entered allmulticast mode [ 505.952219][T20785] tipc: Resetting bearer [ 505.982493][T20784] tipc: Resetting bearer [ 506.045902][T20784] tipc: Disabling bearer [ 506.604010][T20845] Unsupported ieee802154 address type: 0 [ 506.640479][T20845] netlink: 'syz.3.4461': attribute type 10 has an invalid length. [ 506.650973][T20845] netlink: 24 bytes leftover after parsing attributes in process `syz.3.4461'. [ 506.753951][T20856] tipc: Enabled bearer , priority 0 [ 506.788166][T20856] syzkaller0: entered promiscuous mode [ 506.830020][T20856] syzkaller0: entered allmulticast mode [ 506.933488][T20860] tipc: Enabling of bearer rejected, already enabled [ 506.999019][T20855] tipc: Resetting bearer [ 507.102879][T20877] netlink: 'syz.1.4471': attribute type 1 has an invalid length. [ 507.114581][T20855] tipc: Disabling bearer [ 507.213841][T20877] bond2: entered promiscuous mode [ 507.233085][T20877] bond2: entered allmulticast mode [ 507.271727][T20877] 8021q: adding VLAN 0 to HW filter on device bond2 [ 507.332820][T20882] macvlan2: entered promiscuous mode [ 507.358193][T20882] macvlan2: entered allmulticast mode [ 507.376237][T20882] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 507.817610][T20908] netlink: 40 bytes leftover after parsing attributes in process `syz.0.4477'. [ 508.175217][T20931] rdma_rxe: rxe_newlink: failed to add team_slave_0 [ 508.226667][T20933] openvswitch: netlink: IPv4 tun info is not correct [ 508.276393][T20936] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4486'. [ 508.332696][T20936] netlink: 'syz.0.4486': attribute type 21 has an invalid length. [ 508.361245][T20936] netlink: 152 bytes leftover after parsing attributes in process `syz.0.4486'. [ 508.471145][T20952] netlink: 'syz.5.4488': attribute type 1 has an invalid length. [ 508.736734][ T5832] Bluetooth: hci3: command 0x0406 tx timeout [ 508.981041][T20984] IPv6: NLM_F_CREATE should be specified when creating new route [ 509.000761][T20986] netlink: 16 bytes leftover after parsing attributes in process `syz.3.4497'. [ 509.084296][T20986] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 509.288451][T20996] netlink: 'syz.1.4498': attribute type 1 has an invalid length. [ 509.428844][T21007] netlink: 44 bytes leftover after parsing attributes in process `syz.1.4502'. [ 509.445979][T21010] netlink: 'syz.5.4500': attribute type 4 has an invalid length. [ 509.787646][T21031] netlink: 'syz.3.4506': attribute type 30 has an invalid length. [ 509.871117][T21035] netlink: 'syz.3.4506': attribute type 30 has an invalid length. [ 509.879419][T21038] lo: entered promiscuous mode [ 509.900055][T21038] tunl0: entered promiscuous mode [ 509.920532][T21038] gre0: entered promiscuous mode [ 509.937811][T21046] netlink: 'syz.0.4507': attribute type 2 has an invalid length. [ 509.946157][T21038] gretap0: entered promiscuous mode [ 509.962553][T21038] erspan0: entered promiscuous mode [ 509.998512][T21038] ip_vti0: entered promiscuous mode [ 510.026158][T21041] : renamed from hsr0 (while UP) [ 510.052291][T21043] netlink: 'syz.4.4509': attribute type 3 has an invalid length. [ 510.141345][T21046] 9: entered promiscuous mode [ 510.323223][T21060] delete_channel: no stack [ 510.613135][T21079] __nla_validate_parse: 3 callbacks suppressed [ 510.613155][T21079] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4520'. [ 510.630227][T21079] openvswitch: netlink: IP tunnel dst address not specified [ 510.795938][T21090] tipc: Enabling of bearer rejected, already enabled [ 510.895399][T21098] netlink: 277 bytes leftover after parsing attributes in process `syz.0.4527'. [ 510.908862][T21099] netlink: 277 bytes leftover after parsing attributes in process `syz.0.4527'. [ 510.975263][T21107] netlink: 'syz.0.4529': attribute type 1 has an invalid length. [ 510.985131][T21107] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4529'. [ 511.128636][T21120] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4534'. [ 511.145826][T21120] netlink: 40 bytes leftover after parsing attributes in process `syz.0.4534'. [ 511.159650][T21120] netlink: 136 bytes leftover after parsing attributes in process `syz.0.4534'. [ 511.324080][T21129] netlink: 'syz.3.4538': attribute type 1 has an invalid length. [ 511.364505][T21129] 8021q: adding VLAN 0 to HW filter on device bond6 [ 511.383889][T21129] veth3: entered promiscuous mode [ 511.392086][T21129] bond6: (slave veth3): Enslaving as an active interface with an up link [ 511.443020][T21136] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4540'. [ 511.486929][T21138] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4540'. [ 511.632016][T21147] tipc: Enabling of bearer rejected, already enabled [ 511.665641][T21152] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4545'. [ 511.745998][T21152] team1: entered promiscuous mode [ 511.753541][T21152] team1: entered allmulticast mode [ 512.077266][T21169] geneve3: entered promiscuous mode [ 512.162870][T21177] tipc: Enabling of bearer rejected, already enabled [ 512.566816][T16673] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 512.783914][T21208] IPv6: sit2: Disabled Multicast RS [ 512.876484][T16673] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 513.184834][T21220] team1: entered promiscuous mode [ 513.201143][T21220] team1: entered allmulticast mode [ 513.224840][T21226] tipc: Enabled bearer , priority 0 [ 513.237609][T21228] gretap0: entered promiscuous mode [ 513.278968][T21220] syzkaller0: entered promiscuous mode [ 513.298186][T21220] syzkaller0: entered allmulticast mode [ 513.340731][T21228] tunl0: left promiscuous mode [ 513.378971][T21228] gretap0: left promiscuous mode [ 513.441609][T21228] wg0: left promiscuous mode [ 513.446318][T21228] wg0: left allmulticast mode [ 513.451877][T21228] wg1: left promiscuous mode [ 513.457916][T21228] wg1: left allmulticast mode [ 513.514512][T21228] bridge1: left promiscuous mode [ 513.523699][T21228] bridge1: left allmulticast mode [ 513.559682][T21228] mac80211_hwsim hwsim56 syzkaller0: left promiscuous mode [ 513.569419][T21228] mac80211_hwsim hwsim56 syzkaller0: left allmulticast mode [ 513.578027][T21228] A link change request failed with some changes committed already. Interface syzkaller0 may have been left with an inconsistent configuration, please check. [ 513.622224][T21240] tipc: Resetting bearer [ 513.696630][T21219] tipc: Resetting bearer [ 513.885784][T21219] tipc: Disabling bearer [ 514.350409][T21282] tipc: Enabling of bearer rejected, already enabled [ 514.362634][T21282] syzkaller0: mtu less than device minimum [ 515.022222][T21330] vxcan1 speed is unknown, defaulting to 1000 [ 515.031813][T21330] vxcan1 speed is unknown, defaulting to 1000 [ 515.063026][T21330] vxcan1 speed is unknown, defaulting to 1000 [ 515.537480][T21360] validate_nla: 2 callbacks suppressed [ 515.537499][T21360] netlink: 'syz.4.4611': attribute type 10 has an invalid length. [ 515.569188][T21330] infiniband syz2: set active [ 515.592809][T17605] vxcan1 speed is unknown, defaulting to 1000 [ 515.617334][T21330] infiniband syz2: added vxcan1 [ 515.663191][T21365] __nla_validate_parse: 14 callbacks suppressed [ 515.663210][T21365] netlink: 132 bytes leftover after parsing attributes in process `syz.5.4614'. [ 515.709083][T21330] RDS/IB: syz2: added [ 515.713182][T21330] smc: adding ib device syz2 with port count 1 [ 515.746266][T21330] smc: ib device syz2 port 1 has no pnetid [ 515.767252][T21374] netlink: 132 bytes leftover after parsing attributes in process `syz.5.4614'. [ 515.787874][T21377] netlink: 212368 bytes leftover after parsing attributes in process `syz.0.4615'. [ 515.811789][ T5899] vxcan1 speed is unknown, defaulting to 1000 [ 515.828411][T21330] vxcan1 speed is unknown, defaulting to 1000 [ 516.002509][T21385] ip6t_REJECT: TCP_RESET illegal for non-tcp [ 516.059085][T21390] netlink: 'syz.0.4619': attribute type 13 has an invalid length. [ 516.424724][T21390] macvtap0: left allmulticast mode [ 516.520771][T21390] mac80211_hwsim hwsim53 syzkaller0: left promiscuous mode [ 516.539270][T21390] mac80211_hwsim hwsim53 syzkaller0: left allmulticast mode [ 516.560275][T21390] ip6gre1: left promiscuous mode [ 516.577826][T21390] ip6gre1: left allmulticast mode [ 516.585532][T21390] veth3: left allmulticast mode [ 516.606943][ T978] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 516.616962][T21390] gre1: left promiscuous mode [ 516.621837][T21390] gre1: left allmulticast mode [ 516.742695][T21330] vxcan1 speed is unknown, defaulting to 1000 [ 517.307578][T17605] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 518.793281][T21330] vxcan1 speed is unknown, defaulting to 1000 [ 518.800685][T21431] vlan2: entered promiscuous mode [ 518.808131][T21431] veth0_to_team: entered promiscuous mode [ 519.070469][T21439] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4629'. [ 519.090072][T21439] openvswitch: netlink: nsh attribute has 4 unknown bytes. [ 519.116796][T21447] netlink: 'syz.4.4631': attribute type 39 has an invalid length. [ 519.135568][T21330] vxcan1 speed is unknown, defaulting to 1000 [ 519.320761][T21456] tipc: Enabled bearer , priority 2 [ 519.544379][T21330] vxcan1 speed is unknown, defaulting to 1000 [ 519.860741][T21479] Cannot find set identified by id 3 to match [ 519.932187][T21330] vxcan1 speed is unknown, defaulting to 1000 [ 520.112357][T21488] netlink: 'syz.4.4647': attribute type 9 has an invalid length. [ 520.195217][T21496] netlink: 44 bytes leftover after parsing attributes in process `syz.3.4649'. [ 520.206080][T21497] netlink: 272 bytes leftover after parsing attributes in process `syz.0.4648'. [ 520.240086][T21497] netlink: 'syz.0.4648': attribute type 1 has an invalid length. [ 520.367127][T21501] netlink: 'syz.0.4651': attribute type 1 has an invalid length. [ 520.762815][T21527] netlink: 28 bytes leftover after parsing attributes in process `syz.0.4661'. [ 520.767246][T21528] netlink: 'syz.1.4660': attribute type 29 has an invalid length. [ 520.798052][T21527] mac80211_hwsim hwsim53 syzkaller0: entered promiscuous mode [ 520.807669][T21527] mac80211_hwsim hwsim53 syzkaller0: entered allmulticast mode [ 520.898544][T21533] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4663'. [ 521.126839][T21542] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4665'. [ 521.306892][T21560] bridge4: entered promiscuous mode [ 521.312321][T21560] bridge4: entered allmulticast mode [ 521.333570][T21560] team0: Port device bridge4 added [ 521.738594][T21590] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4678'. [ 521.786505][T21590] netlink: 12 bytes leftover after parsing attributes in process `syz.5.4678'. [ 521.837260][ T36] netdevsim netdevsim5 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 521.846401][T21590] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4678'. [ 521.855304][T21590] netlink: 12 bytes leftover after parsing attributes in process `syz.5.4678'. [ 521.886583][ T36] netdevsim netdevsim5 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 521.906158][ T36] netdevsim netdevsim5 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 521.920971][ T36] netdevsim netdevsim5 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 521.939538][T21596] netdevsim netdevsim3 netdevsim0: entered promiscuous mode [ 521.943822][T21599] netlink: 'syz.1.4681': attribute type 1 has an invalid length. [ 522.029505][T21599] 8021q: adding VLAN 0 to HW filter on device bond4 [ 522.082294][T21602] 8021q: adding VLAN 0 to HW filter on device bond4 [ 522.089781][T21602] bond4: (slave vxcan3): The slave device specified does not support setting the MAC address [ 522.101985][T21602] bond4: (slave vxcan3): Error -95 calling set_mac_address [ 522.160569][T21599] veth7: entered promiscuous mode [ 522.175302][T21608] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap1 [ 522.188276][T21608] gretap1: default qdisc (pfifo_fast) fail, fallback to noqueue [ 522.196911][T21608] gretap1: entered promiscuous mode [ 522.202453][T21608] gretap1: entered allmulticast mode [ 522.218840][T21604] vlan2: entered allmulticast mode [ 522.226366][T21604] bond4: entered allmulticast mode [ 522.271049][T21614] netlink: 40 bytes leftover after parsing attributes in process `syz.0.4685'. [ 522.346088][T21619] llcp: llcp_sock_recvmsg: Recv datagram failed state 4 -107 0 [ 522.476180][T21628] netlink: 60 bytes leftover after parsing attributes in process `syz.4.4692'. [ 522.508398][T21628] netlink: 60 bytes leftover after parsing attributes in process `syz.4.4692'. [ 522.905713][T21659] netlink: 'syz.4.4700': attribute type 10 has an invalid length. [ 522.961658][T21659] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 523.078757][T21672] geneve1: entered promiscuous mode [ 523.084010][T21672] geneve1: entered allmulticast mode [ 523.168143][T21679] erspan0: entered promiscuous mode [ 523.178931][T21679] gretap0: entered promiscuous mode [ 523.236850][T21681] syzkaller0: entered promiscuous mode [ 523.242869][T21681] syzkaller0: entered allmulticast mode [ 523.520401][T21692] PF_CAN: dropped non conform CAN XL skbuff: dev type 280, len 40 [ 523.552371][T21696] netlink: 'syz.1.4713': attribute type 1 has an invalid length. [ 523.678608][T21701] IPVS: set_ctl: invalid protocol: 59 172.20.20.170:20002 [ 523.929766][T21711] geneve1: entered promiscuous mode [ 523.951413][T21711] geneve1: entered allmulticast mode [ 523.960108][T21714] netlink: 'syz.5.4720': attribute type 1 has an invalid length. [ 524.131784][T21723] digital: digital_start_poll: Unknown protocol [ 524.393535][T21741] netlink: 'syz.3.4728': attribute type 2 has an invalid length. [ 524.419889][T21741] netdevsim netdevsim3: loading /lib/firmware/. failed with error -22 [ 524.429812][T21741] netdevsim netdevsim3: Direct firmware load for . failed with error -22 [ 524.447393][T21741] netdevsim netdevsim3: Falling back to sysfs fallback for: . [ 524.686020][T21759] geneve1: entered promiscuous mode [ 524.723295][T21759] geneve1: entered allmulticast mode [ 525.381461][T21805] openvswitch: netlink: Unknown key attributes 2 [ 525.416452][T21807] geneve1: left promiscuous mode [ 525.426909][T21807] geneve1: left allmulticast mode [ 525.752894][T21829] netlink: 'syz.3.4755': attribute type 2 has an invalid length. [ 525.795186][T21834] netlink: 'syz.0.4757': attribute type 21 has an invalid length. [ 525.803255][T21829] netdevsim netdevsim3: loading /lib/firmware/. failed with error -22 [ 525.818251][T21829] netdevsim netdevsim3: Direct firmware load for . failed with error -22 [ 525.837182][T21834] netlink: 'syz.0.4757': attribute type 6 has an invalid length. [ 525.839015][T21829] netdevsim netdevsim3: Falling back to sysfs fallback for: . [ 525.844947][T21834] __nla_validate_parse: 14 callbacks suppressed [ 525.844965][T21834] netlink: 132 bytes leftover after parsing attributes in process `syz.0.4757'. [ 525.924876][T21839] bond6 (unregistering): Released all slaves [ 526.154104][T21854] tipc: Failed to remove unknown binding: 66,1,1/726205401:2660097557/2660097559 [ 526.228304][T21861] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 526.241765][T21861] IPVS: length: 216 != 8 [ 526.446852][T21869] IPv6: sit1: Disabled Multicast RS [ 526.476789][T21869] sit1: entered allmulticast mode [ 526.673013][T21883] netlink: 60 bytes leftover after parsing attributes in process `syz.4.4771'. [ 526.684298][T21885] netlink: 'syz.3.4773': attribute type 1 has an invalid length. [ 526.708732][T21885] netlink: 'syz.3.4773': attribute type 1 has an invalid length. [ 526.721618][T21883] geneve1: left promiscuous mode [ 526.724311][T21885] netlink: 'syz.3.4773': attribute type 1 has an invalid length. [ 526.739237][T21883] geneve1: left allmulticast mode [ 526.767013][T21883] netlink: 60 bytes leftover after parsing attributes in process `syz.4.4771'. [ 527.009830][T21909] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 527.150349][T21922] netlink: 'syz.3.4783': attribute type 2 has an invalid length. [ 527.183803][T21925] netlink: 184 bytes leftover after parsing attributes in process `syz.4.4785'. [ 527.202010][T21922] netdevsim netdevsim3: loading /lib/firmware/. failed with error -22 [ 527.212285][T21922] netdevsim netdevsim3: Direct firmware load for . failed with error -22 [ 527.223128][T21922] netdevsim netdevsim3: Falling back to sysfs fallback for: . [ 527.385489][T21938] netlink: 60 bytes leftover after parsing attributes in process `syz.5.4790'. [ 527.419378][T21938] geneve1: left promiscuous mode [ 527.437600][T21938] netlink: 60 bytes leftover after parsing attributes in process `syz.5.4790'. [ 527.780807][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 528.008124][T21981] netlink: 4 bytes leftover after parsing attributes in process `syz.5.4803'. [ 528.297514][T22002] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 528.392540][T22010] netlink: 'syz.0.4814': attribute type 2 has an invalid length. [ 528.720612][T22040] netlink: 184 bytes leftover after parsing attributes in process `syz.5.4821'. [ 528.830615][T22048] netlink: 16 bytes leftover after parsing attributes in process `syz.3.4824'. [ 529.317740][T22074] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4830'. [ 529.445923][T22083] netlink: 'syz.1.4832': attribute type 2 has an invalid length. [ 529.495572][T22083] ip6gre1: entered promiscuous mode [ 529.520526][T22083] ip6gre1: entered allmulticast mode [ 529.535350][ T13] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 529.575108][T17605] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 529.577740][T22094] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 529.582959][ T13] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 529.651373][T22083] netdevsim netdevsim1: loading /lib/firmware/. failed with error -22 [ 529.665353][T22077] smc: net device gre0 applied user defined pnetid SYZ1 [ 529.678025][T22083] netdevsim netdevsim1: Direct firmware load for . failed with error -22 [ 529.679887][T22077] smc: net device gre0 erased user defined pnetid SYZ1 [ 529.696074][T17605] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 529.706514][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 529.724888][T22083] netdevsim netdevsim1: Falling back to sysfs fallback for: . [ 529.788480][T17605] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 530.211713][T22113] bond0 (unregistering): Released all slaves [ 530.660171][T22146] netlink: 'syz.3.4853': attribute type 4 has an invalid length. [ 530.710791][T22146] tipc: Enabling not permitted [ 530.723817][T22146] tipc: Enabling of bearer rejected, failed to enable media [ 531.104235][T22173] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 531.204226][T22185] __nla_validate_parse: 8 callbacks suppressed [ 531.204247][T22185] netlink: 104 bytes leftover after parsing attributes in process `syz.4.4866'. [ 531.331739][T22194] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4867'. [ 531.449581][T22203] netlink: 44 bytes leftover after parsing attributes in process `syz.0.4870'. [ 531.461084][T22203] netlink: 35 bytes leftover after parsing attributes in process `syz.0.4870'. [ 531.470243][T22203] netlink: 'syz.0.4870': attribute type 5 has an invalid length. [ 531.481060][T22203] netlink: 'syz.0.4870': attribute type 6 has an invalid length. [ 531.489235][T22203] netlink: 35 bytes leftover after parsing attributes in process `syz.0.4870'. [ 531.505372][T22203] netlink: 40 bytes leftover after parsing attributes in process `syz.0.4870'. [ 531.622620][T22213] netlink: 16 bytes leftover after parsing attributes in process `syz.0.4873'. [ 531.643676][T22213] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 532.168522][T22243] pimreg: entered allmulticast mode [ 532.410233][T22258] netlink: 16 bytes leftover after parsing attributes in process `syz.0.4885'. [ 532.460697][T22253] 8021q: adding VLAN 0 to HW filter on device bond0 [ 532.480636][T22230] vxcan1 speed is unknown, defaulting to 1000 [ 532.492905][T22258] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 533.042225][T22284] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4894'. [ 533.082408][T22284] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4894'. [ 533.599796][T22302] team0: Port device team_slave_0 removed [ 533.660728][T22302] team0: Port device team_slave_1 removed [ 533.696664][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 533.707257][T22302] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 534.110216][T22332] netlink: 'syz.0.4909': attribute type 21 has an invalid length. [ 534.128713][T22332] netlink: 'syz.0.4909': attribute type 1 has an invalid length. [ 534.225687][T22340] bridge7: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 534.259357][T22345] netlink: 'syz.3.4912': attribute type 2 has an invalid length. [ 534.287584][T22345] 9: entered promiscuous mode [ 534.303972][T22344] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 534.937433][T22368] netlink: 'syz.5.4924': attribute type 3 has an invalid length. [ 534.946485][T22368] netlink: 'syz.5.4924': attribute type 2 has an invalid length. [ 535.092413][T22372] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 535.167096][T22376] netlink: 'syz.5.4928': attribute type 11 has an invalid length. [ 535.193444][T22378] netlink: 'syz.1.4929': attribute type 2 has an invalid length. [ 535.209494][T22378] netdevsim netdevsim1: loading /lib/firmware/. failed with error -22 [ 535.219335][T22378] netdevsim netdevsim1: Direct firmware load for . failed with error -22 [ 535.229265][T22378] netdevsim netdevsim1: Falling back to sysfs fallback for: . [ 535.285961][T22380] netlink: 'syz.5.4928': attribute type 39 has an invalid length. [ 535.512377][T22394] tipc: Enabling of bearer rejected, already enabled [ 535.611604][T22405] tipc: Enabled bearer , priority 0 [ 535.620095][T22405] syzkaller0: entered promiscuous mode [ 535.625678][T22405] syzkaller0: entered allmulticast mode [ 535.648404][T22405] tipc: Resetting bearer [ 535.678880][T22405] tipc: Disabling bearer [ 535.701285][T22411] : entered promiscuous mode [ 535.734111][T22414] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 535.924996][T22421] netlink: 'syz.0.4946': attribute type 2 has an invalid length. [ 536.148773][T22439] syzkaller0: entered promiscuous mode [ 536.159011][T22439] syzkaller0: entered allmulticast mode [ 536.260100][T22446] tipc: Enabled bearer , priority 0 [ 536.271528][T22449] __nla_validate_parse: 23 callbacks suppressed [ 536.271551][T22449] netlink: 16 bytes leftover after parsing attributes in process `syz.0.4956'. [ 536.287983][T22446] syzkaller0: entered promiscuous mode [ 536.295909][T22446] syzkaller0: entered allmulticast mode [ 536.313717][T22449] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 536.343391][T22446] tipc: Resetting bearer [ 536.389496][T22446] tipc: Disabling bearer [ 536.478911][T22457] bond3: (slave gretap1): making interface the new active one [ 536.505554][T22457] bond3: (slave gretap1): Enslaving as an active interface with an up link [ 536.529799][T22464] validate_nla: 3 callbacks suppressed [ 536.529816][T22464] netlink: 'syz.5.4961': attribute type 2 has an invalid length. [ 536.532033][T22459] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 536.566003][T22464] ip6gre2: entered promiscuous mode [ 536.611894][T22464] ip6gre2: entered allmulticast mode [ 536.615189][T22465] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 536.624257][T18220] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 536.632897][T18220] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 536.646786][ T5918] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 536.678074][T22464] netdevsim netdevsim5: loading /lib/firmware/. failed with error -22 [ 536.697039][T22464] netdevsim netdevsim5: Direct firmware load for . failed with error -22 [ 536.705518][T22464] netdevsim netdevsim5: Falling back to sysfs fallback for: . [ 536.886793][T17605] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 536.906081][ T30] audit: type=1107 audit(1768476604.270:5): pid=22481 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa [ 536.907715][T22484] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 537.033254][T22487] netlink: 16 bytes leftover after parsing attributes in process `syz.0.4969'. [ 537.057314][T17605] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 537.057376][T22483] bond4: entered allmulticast mode [ 537.070824][T22483] 8021q: adding VLAN 0 to HW filter on device bond4 [ 537.088830][T22487] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 537.147405][T22489] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4970'. [ 537.175617][T22491] tipc: Enabling of bearer rejected, already enabled [ 537.423783][T22510] xt_CT: You must specify a L4 protocol and not use inversions on it [ 537.451763][T22510] netlink: 'syz.1.4978': attribute type 2 has an invalid length. [ 537.497691][T22516] netlink: 16 bytes leftover after parsing attributes in process `syz.5.4981'. [ 537.521801][T22516] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 537.543692][T22519] sctp: [Deprecated]: syz.1.4978 (pid 22519) Use of int in max_burst socket option deprecated. [ 537.543692][T22519] Use struct sctp_assoc_value instead [ 537.603986][T22522] tipc: Enabling of bearer rejected, already enabled [ 537.623429][T22523] netlink: 'syz.0.4982': attribute type 14 has an invalid length. [ 537.641871][T22522] mac80211_hwsim hwsim56 syzkaller0: entered promiscuous mode [ 537.675841][T22522] mac80211_hwsim hwsim56 syzkaller0: entered allmulticast mode [ 537.684985][T22523] netlink: 'syz.0.4982': attribute type 14 has an invalid length. [ 538.001548][T22548] netlink: 'syz.4.4992': attribute type 2 has an invalid length. [ 538.022996][T22548] netdevsim netdevsim4: loading /lib/firmware/. failed with error -22 [ 538.034118][T22548] netdevsim netdevsim4: Direct firmware load for . failed with error -22 [ 538.042771][T22548] netdevsim netdevsim4: Falling back to sysfs fallback for: . [ 538.046936][T22552] openvswitch: netlink: IP tunnel dst address not specified [ 538.272675][T22555] netlink: 16 bytes leftover after parsing attributes in process `syz.1.4994'. [ 538.294061][T22555] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 538.310582][ T5918] vxcan1 speed is unknown, defaulting to 1000 [ 538.868427][T22560] netlink: 'syz.4.4996': attribute type 7 has an invalid length. [ 538.887834][T22560] netlink: 140 bytes leftover after parsing attributes in process `syz.4.4996'. [ 538.927915][T22562] FAULT_INJECTION: forcing a failure. [ 538.927915][T22562] name failslab, interval 1, probability 0, space 0, times 0 [ 538.942109][T22562] CPU: 1 UID: 0 PID: 22562 Comm: syz.0.4997 Not tainted syzkaller #0 PREEMPT(full) [ 538.942138][T22562] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 538.942150][T22562] Call Trace: [ 538.942159][T22562] [ 538.942168][T22562] dump_stack_lvl+0xe8/0x150 [ 538.942199][T22562] should_fail_ex+0x414/0x560 [ 538.942234][T22562] should_failslab+0xa8/0x100 [ 538.942258][T22562] kmem_cache_alloc_node_noprof+0x8c/0x720 [ 538.942288][T22562] ? __alloc_skb+0x198/0x3a0 [ 538.942308][T22562] ? __alloc_skb+0x1dc/0x3a0 [ 538.942325][T22562] ? __local_bh_enable_ip+0xd0/0x130 [ 538.942344][T22562] ? __alloc_skb+0x198/0x3a0 [ 538.942364][T22562] __alloc_skb+0x1dc/0x3a0 [ 538.942389][T22562] netlink_sendmsg+0x5c6/0xb30 [ 538.942425][T22562] ? __pfx_netlink_sendmsg+0x10/0x10 [ 538.942453][T22562] ? aa_sock_msg_perm+0xf1/0x1b0 [ 538.942479][T22562] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 538.942497][T22562] ? __pfx_netlink_sendmsg+0x10/0x10 [ 538.942522][T22562] __sock_sendmsg+0x21c/0x270 [ 538.942551][T22562] ____sys_sendmsg+0x505/0x820 [ 538.942577][T22562] ? __pfx_____sys_sendmsg+0x10/0x10 [ 538.942608][T22562] ? import_iovec+0x74/0xa0 [ 538.942636][T22562] ___sys_sendmsg+0x21f/0x2a0 [ 538.942660][T22562] ? __pfx____sys_sendmsg+0x10/0x10 [ 538.942717][T22562] ? __fget_files+0x2a/0x420 [ 538.942740][T22562] ? __fget_files+0x3a0/0x420 [ 538.942773][T22562] __x64_sys_sendmsg+0x19b/0x260 [ 538.942804][T22562] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 538.942837][T22562] ? __pfx_ksys_write+0x10/0x10 [ 538.942867][T22562] do_syscall_64+0xec/0xf80 [ 538.942887][T22562] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 538.942906][T22562] ? trace_irq_disable+0x37/0x100 [ 538.942931][T22562] ? clear_bhb_loop+0x60/0xb0 [ 538.942954][T22562] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 538.942973][T22562] RIP: 0033:0x7f1cac58f749 [ 538.942991][T22562] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 538.943009][T22562] RSP: 002b:00007f1cad376038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 538.943030][T22562] RAX: ffffffffffffffda RBX: 00007f1cac7e5fa0 RCX: 00007f1cac58f749 [ 538.943046][T22562] RDX: 0000000000000000 RSI: 0000200000000200 RDI: 0000000000000003 [ 538.943058][T22562] RBP: 00007f1cad376090 R08: 0000000000000000 R09: 0000000000000000 [ 538.943071][T22562] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 538.943083][T22562] R13: 00007f1cac7e6038 R14: 00007f1cac7e5fa0 R15: 00007ffff97a5118 [ 538.943122][T22562] [ 539.261114][T22566] tipc: Enabled bearer , priority 0 [ 539.269656][T22566] syzkaller0: entered promiscuous mode [ 539.275242][T22566] syzkaller0: entered allmulticast mode [ 539.291895][T22568] netlink: 'syz.5.4998': attribute type 30 has an invalid length. [ 539.338982][T22566] tipc: Resetting bearer [ 539.397557][T22566] tipc: Disabling bearer [ 539.435668][T22568] bond0: option arp_missed_max: invalid value (0) [ 539.442401][T22568] bond0: option arp_missed_max: allowed values 1 - 255 [ 539.451467][T22568] bond0 (unregistering): Released all slaves [ 539.460661][ T5830] Bluetooth: hci2: command 0x0406 tx timeout [ 539.599912][T22584] netlink: 16 bytes leftover after parsing attributes in process `syz.4.5005'. [ 539.635291][T22588] netlink: 'syz.3.5006': attribute type 2 has an invalid length. [ 539.668594][T22588] netdevsim netdevsim3: loading /lib/firmware/. failed with error -22 [ 539.679158][T22588] netdevsim netdevsim3: Direct firmware load for . failed with error -22 [ 539.697466][T22588] netdevsim netdevsim3: Falling back to sysfs fallback for: . [ 539.733399][T22584] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 539.755626][T22593] IPVS: length: 129 != 24 [ 539.818844][T22598] syzkaller1: entered promiscuous mode [ 539.828749][T22598] syzkaller1: entered allmulticast mode [ 539.871093][T22601] netlink: 'syz.4.5010': attribute type 1 has an invalid length. [ 539.905870][T22601] 8021q: adding VLAN 0 to HW filter on device bond5 [ 539.918161][T22605] syzkaller1: left promiscuous mode [ 539.926547][T22605] syzkaller1: left allmulticast mode [ 540.035141][T22601] bond5: (slave gretap2): making interface the new active one [ 540.067008][T22601] bond5: (slave gretap2): Enslaving as an active interface with an up link [ 540.096934][T22607] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5010'. [ 540.131736][T22601] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5010'. [ 540.132481][T22599] netdevsim netdevsim1: Direct firmware load for .. failed with error -2 [ 540.150094][T22599] netdevsim netdevsim1: Falling back to sysfs fallback for: .. [ 540.162866][T22601] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5010'. [ 540.336364][ C0] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 540.609581][T22595] lec:lec_atm_close: lec0: Shut down! [ 540.641775][T22629] tipc: Enabled bearer , priority 0 [ 540.669359][T22629] syzkaller0: entered promiscuous mode [ 540.683931][T22629] syzkaller0: entered allmulticast mode [ 540.706044][T22629] tipc: Resetting bearer [ 540.759075][T22629] tipc: Disabling bearer [ 540.929927][T22642] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 540.955421][T22639] syzkaller0: entered promiscuous mode [ 540.962369][T22639] syzkaller0: entered allmulticast mode [ 540.989109][T22648] netlink: 'syz.3.5023': attribute type 21 has an invalid length. [ 541.182422][T22657] netdevsim netdevsim4: loading /lib/firmware/. failed with error -22 [ 541.198555][T22657] netdevsim netdevsim4: Direct firmware load for . failed with error -22 [ 541.238721][T22657] netdevsim netdevsim4: Falling back to sysfs fallback for: . [ 541.404708][T22671] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable [ 541.430222][T22673] __nla_validate_parse: 6 callbacks suppressed [ 541.430241][T22673] netlink: 60 bytes leftover after parsing attributes in process `syz.3.5032'. [ 541.461498][T22673] netlink: 60 bytes leftover after parsing attributes in process `syz.3.5032'. [ 541.498088][T22675] tipc: Enabled bearer , priority 0 [ 541.514901][T22675] syzkaller0: entered promiscuous mode [ 541.521115][T22678] netlink: 16 bytes leftover after parsing attributes in process `syz.0.5035'. [ 541.532215][T22675] syzkaller0: entered allmulticast mode [ 541.543346][T22679] netlink: 9 bytes leftover after parsing attributes in process `syz.1.5034'. [ 541.554724][T22678] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 541.574437][T22675] tipc: Resetting bearer [ 541.643149][T22675] tipc: Disabling bearer [ 541.744602][T22692] lo: left promiscuous mode [ 541.753775][T22692] tunl0: left promiscuous mode [ 541.761124][T22692] gre0: left promiscuous mode [ 541.819373][T22692] gretap0: left promiscuous mode [ 541.827214][T22692] erspan0: left promiscuous mode [ 541.834913][T22692] ip_vti0: left promiscuous mode [ 541.853085][T22692] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 541.856406][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 541.888288][T22699] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5037'. [ 541.933055][T22696] netlink: 28 bytes leftover after parsing attributes in process `syz.3.5037'. [ 542.079345][T22708] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5041'. [ 542.239736][T22727] netlink: 44 bytes leftover after parsing attributes in process `syz.4.5047'. [ 542.387111][T22734] tipc: Enabled bearer , priority 0 [ 542.394683][T22734] syzkaller0: entered promiscuous mode [ 542.402605][T22734] syzkaller0: entered allmulticast mode [ 542.421532][T22734] tipc: Resetting bearer [ 542.441766][T22734] tipc: Disabling bearer [ 542.550682][T22742] nbd: must specify an index to disconnect [ 542.557715][T22742] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5052'. [ 542.570370][T22742] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5052'. [ 543.100915][T22763] validate_nla: 1 callbacks suppressed [ 543.100934][T22763] netlink: 'syz.5.5058': attribute type 5 has an invalid length. [ 543.172443][T22761] bridge_slave_1: entered allmulticast mode [ 543.424944][T22777] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 543.509501][T22781] bond7: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 543.527998][T22781] bond7: (slave lo): Enslaving as a backup interface with an up link [ 543.539882][T22781] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 543.605318][T22789] tipc: Enabling of bearer rejected, already enabled [ 543.693328][T22793] netlink: 'syz.1.5072': attribute type 7 has an invalid length. [ 543.733457][T22799] netlink: 'syz.0.5071': attribute type 10 has an invalid length. [ 543.782073][T22799] geneve0: entered promiscuous mode [ 543.806443][T22799] team0: Port device geneve0 added [ 544.103731][T22816] netlink: 'syz.4.5078': attribute type 2 has an invalid length. [ 544.203444][T22818] bond6: option lp_interval: invalid value (0) [ 544.210102][T22818] bond6: option lp_interval: allowed values 1 - 2147483647 [ 544.228861][T22818] bond6 (unregistering): Released all slaves [ 544.251357][T22816] netdevsim netdevsim4: loading /lib/firmware/. failed with error -22 [ 544.261989][T22816] netdevsim netdevsim4: Direct firmware load for . failed with error -22 [ 544.271347][T22816] netdevsim netdevsim4: Falling back to sysfs fallback for: . [ 544.297865][T22827] netlink: 'syz.3.5080': attribute type 1 has an invalid length. [ 544.435710][T22835] tipc: Enabled bearer , priority 0 [ 544.453100][T22835] syzkaller0: entered promiscuous mode [ 544.465179][T22835] syzkaller0: entered allmulticast mode [ 544.487577][T22838] syzkaller0: entered promiscuous mode [ 544.493373][T22838] syzkaller0: entered allmulticast mode [ 544.502584][T22835] tipc: Resetting bearer [ 544.537984][T22835] tipc: Disabling bearer [ 544.767455][T22849] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap1 [ 544.795032][T22849] gretap1: default qdisc (pfifo_fast) fail, fallback to noqueue [ 544.826660][T22849] gretap1: entered promiscuous mode [ 544.832007][T22849] gretap1: entered allmulticast mode [ 545.194776][T22867] tipc: Enabling of bearer rejected, already enabled [ 545.335582][T22875] netlink: 'syz.3.5104': attribute type 29 has an invalid length. [ 545.357569][T22875] netlink: 'syz.3.5104': attribute type 29 has an invalid length. [ 545.481290][T22888] netlink: 'syz.0.5105': attribute type 2 has an invalid length. [ 545.697563][T22900] netlink: 'syz.3.5109': attribute type 7 has an invalid length. [ 545.725229][T22900] netlink: 'syz.3.5109': attribute type 7 has an invalid length. [ 546.024759][T22922] x_tables: duplicate underflow at hook 3 [ 546.190817][T22931] netdevsim netdevsim5: loading /lib/firmware/. failed with error -22 [ 546.216940][T22931] netdevsim netdevsim5: Direct firmware load for . failed with error -22 [ 546.247182][T22931] netdevsim netdevsim5: Falling back to sysfs fallback for: . [ 546.641040][T22962] tipc: Enabling of bearer rejected, failed to enable media [ 546.651999][T22962] __nla_validate_parse: 24 callbacks suppressed [ 546.652016][T22962] netlink: 14 bytes leftover after parsing attributes in process `syz.1.5134'. [ 546.774726][T22966] tipc: Enabling of bearer rejected, already enabled [ 547.350245][T23000] ipt_ECN: cannot use operation on non-tcp rule [ 547.518873][T23008] netlink: 8 bytes leftover after parsing attributes in process `syz.5.5152'. [ 547.710494][T23020] netlink: 24 bytes leftover after parsing attributes in process `syz.1.5156'. [ 547.799291][T23025] IPVS: set_ctl: invalid protocol: 51 224.0.0.2:20002 [ 548.184156][T23049] netlink: 8 bytes leftover after parsing attributes in process `syz.5.5167'. [ 548.233919][T23055] validate_nla: 6 callbacks suppressed [ 548.233938][T23055] netlink: 'syz.0.5169': attribute type 2 has an invalid length. [ 548.256475][ C0] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 548.278105][T23055] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5169'. [ 548.366423][T23061] netlink: 4 bytes leftover after parsing attributes in process `syz.5.5171'. [ 548.399896][T23063] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5172'. [ 548.415532][T23063] netlink: 28 bytes leftover after parsing attributes in process `syz.3.5172'. [ 548.504047][T23073] netlink: 'syz.0.5175': attribute type 10 has an invalid length. [ 548.523327][T23073] netlink: 40 bytes leftover after parsing attributes in process `syz.0.5175'. [ 548.569590][T23077] mac80211_hwsim hwsim53 syzkaller0: left promiscuous mode [ 548.596483][T23077] mac80211_hwsim hwsim53 syzkaller0: left allmulticast mode [ 548.699789][T23088] netlink: 288 bytes leftover after parsing attributes in process `syz.0.5180'. [ 548.728185][T23088] netlink: 'syz.0.5180': attribute type 83 has an invalid length. [ 548.783467][T23091] netlink: 'syz.3.5181': attribute type 1 has an invalid length. [ 548.803091][T23093] netlink: 'syz.0.5180': attribute type 9 has an invalid length. [ 548.823948][T23093] netlink: 'syz.0.5180': attribute type 11 has an invalid length. [ 548.845670][T23093] netlink: 'syz.0.5180': attribute type 12 has an invalid length. [ 548.847501][T23096] bond8: entered promiscuous mode [ 548.858880][T23096] bond8: entered allmulticast mode [ 548.880573][T23091] vlan2: entered promiscuous mode [ 548.895425][T23091] bridge0: entered promiscuous mode [ 549.102189][T23104] syzkaller1: entered promiscuous mode [ 549.120587][T23104] syzkaller1: entered allmulticast mode [ 549.614186][T23135] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 549.795977][T23145] geneve1: left promiscuous mode [ 549.815198][T23145] geneve1: left allmulticast mode [ 549.834152][ T36] netdevsim netdevsim0 : unset [1, 0] type 2 family 0 port 6081 - 0 [ 549.857033][ T36] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 549.889408][ T36] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 549.910185][ T36] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 550.053323][T23156] mac80211_hwsim hwsim60 : renamed from wlan1 (while UP) [ 550.882794][T23212] IPVS: set_ctl: invalid protocol: 135 10.1.1.0:20000 [ 550.967671][T23215] workqueue: Failed to create a rescuer kthread for wq "nfc3_nci_rx_wq": -EINTR [ 551.419060][T23249] bond7: (slave lo): Releasing backup interface [ 551.444014][T23249] bond7: (slave lo): last VLAN challenged slave left bond - VLAN blocking is removed [ 551.525610][T23249] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 551.605036][T23262] mac80211_hwsim hwsim53 syzkaller0: entered promiscuous mode [ 551.613092][T23262] mac80211_hwsim hwsim53 syzkaller0: entered allmulticast mode [ 551.889319][T23276] team_slave_0: left promiscuous mode [ 551.895073][T23276] team_slave_1: left promiscuous mode [ 551.912843][T23284] __nla_validate_parse: 27 callbacks suppressed [ 551.912864][T23284] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5244'. [ 551.931006][T23284] netlink: 'syz.0.5244': attribute type 5 has an invalid length. [ 551.939251][T23284] netlink: 48 bytes leftover after parsing attributes in process `syz.0.5244'. [ 551.988987][T23276] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 552.001552][T23276] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 552.149451][T23276] mac80211_hwsim hwsim53 syzkaller0: left promiscuous mode [ 552.158325][T23276] mac80211_hwsim hwsim53 syzkaller0: left allmulticast mode [ 552.227605][T23276] vlan2: left promiscuous mode [ 552.232441][T23276] veth0_to_team: left promiscuous mode [ 552.249665][T23276] bridge4: left promiscuous mode [ 552.255191][T23276] bridge4: left allmulticast mode [ 552.319133][T23284] geneve2: entered promiscuous mode [ 552.324510][T23284] geneve2: entered allmulticast mode [ 552.344124][T23295] syzkaller0: entered promiscuous mode [ 552.366718][T23295] syzkaller0: entered allmulticast mode [ 552.374785][ T8474] netdevsim netdevsim0 : unset [0, 0] type 1 family 0 port 8472 - 0 [ 552.409172][ T8474] netdevsim netdevsim0 : set [1, 0] type 2 family 0 port 256 - 0 [ 552.438640][ T8474] netdevsim netdevsim0 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 552.459838][ T8474] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 256 - 0 [ 552.535937][T23311] netlink: 244 bytes leftover after parsing attributes in process `syz.0.5253'. [ 552.596159][ T8474] netdevsim netdevsim0 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 552.606158][ T8474] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 256 - 0 [ 552.618804][ T8474] netdevsim netdevsim0 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 552.643884][ T8474] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 256 - 0 [ 552.674492][T23302] netlink: 112 bytes leftover after parsing attributes in process `syz.3.5252'. [ 552.724658][T23320] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 553.151317][T23342] netlink: 'syz.1.5264': attribute type 10 has an invalid length. [ 553.377247][T23355] netlink: 28 bytes leftover after parsing attributes in process `syz.3.5267'. [ 553.627105][T23331] netlink: 212340 bytes leftover after parsing attributes in process `syz.0.5259'. [ 553.643235][T23331] openvswitch: netlink: Port 167772160 exceeds max allowable 65535 [ 553.692548][T23375] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5271'. [ 553.707497][T23353] netlink: 'syz.3.5267': attribute type 32 has an invalid length. [ 553.775321][T23354] netlink: 200072 bytes leftover after parsing attributes in process `syz.3.5267'. [ 553.807911][T23354] netlink: 200072 bytes leftover after parsing attributes in process `syz.3.5267'. [ 553.825638][T23354] netlink: 200072 bytes leftover after parsing attributes in process `syz.3.5267'. [ 554.489165][T23409] workqueue: Failed to create a rescuer kthread for wq "nfc4_nci_cmd_wq": -EINTR [ 554.576677][T23422] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 554.614605][T23421] geneve1: left allmulticast mode [ 555.262741][T23458] tipc: Enabled bearer , priority 0 [ 555.292965][T23458] syzkaller0: entered promiscuous mode [ 555.303159][T23458] syzkaller0: entered allmulticast mode [ 555.345406][T23458] tipc: Resetting bearer [ 555.357198][T23456] tipc: Resetting bearer [ 555.408350][T23456] tipc: Disabling bearer [ 556.530365][T23539] netlink: 'syz.4.5321': attribute type 10 has an invalid length. [ 556.549819][T23539] netlink: 'syz.4.5321': attribute type 10 has an invalid length. [ 556.561399][T23539] netlink: 'syz.4.5321': attribute type 10 has an invalid length. [ 556.563512][T23541] netlink: 'syz.4.5321': attribute type 10 has an invalid length. [ 557.209184][T23574] __nla_validate_parse: 81 callbacks suppressed [ 557.209204][T23574] netlink: 40 bytes leftover after parsing attributes in process `syz.4.5333'. [ 557.452894][T23591] Bluetooth: MGMT ver 1.23 [ 558.372179][T23614] netlink: 16 bytes leftover after parsing attributes in process `syz.0.5347'. [ 558.379015][T23613] netlink: 60 bytes leftover after parsing attributes in process `syz.1.5346'. [ 558.407130][T23613] netlink: 60 bytes leftover after parsing attributes in process `syz.1.5346'. [ 558.448241][T23614] netlink: 16 bytes leftover after parsing attributes in process `syz.0.5347'. [ 558.473689][T23614] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5347'. [ 558.483345][T23614] netlink: 'syz.0.5347': attribute type 5 has an invalid length. [ 558.493925][T23614] netlink: 48 bytes leftover after parsing attributes in process `syz.0.5347'. [ 558.496388][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 558.505392][T23618] x_tables: duplicate entry at hook 2 [ 558.689214][T23629] netlink: 44 bytes leftover after parsing attributes in process `syz.5.5354'. [ 559.018681][T23660] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5358'. [ 559.039846][T23650] bond0: ARP target 1.0.0.0 is already present [ 559.050721][T23660] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5358'. [ 559.071016][T23650] bond0: option arp_ip_target: invalid value (1) [ 559.093141][T23650] bond0 (unregistering): Released all slaves [ 559.118479][T23666] netlink: 'syz.3.5362': attribute type 1 has an invalid length. [ 559.473278][T23681] netlink: 'syz.0.5367': attribute type 12 has an invalid length. [ 559.537697][T23681] netlink: 'syz.0.5367': attribute type 11 has an invalid length. [ 559.996719][T23702] syzkaller1: entered promiscuous mode [ 560.002334][T23702] syzkaller1: entered allmulticast mode [ 560.153899][T23707] : entered promiscuous mode [ 560.480058][T23727] netlink: 'syz.5.5384': attribute type 1 has an invalid length. [ 560.489145][T23727] netlink: 'syz.5.5384': attribute type 2 has an invalid length. [ 560.500665][T23727] netlink: 'syz.5.5384': attribute type 1 has an invalid length. [ 560.875817][T23756] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 560.890605][T23757] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 560.985581][T23761] netlink: 'syz.0.5397': attribute type 2 has an invalid length. [ 561.475490][T23785] netlink: 'syz.4.5410': attribute type 2 has an invalid length. [ 561.491232][T23785] netdevsim netdevsim4: loading /lib/firmware/. failed with error -22 [ 561.508989][T23785] netdevsim netdevsim4: Direct firmware load for . failed with error -22 [ 561.523430][T23785] netdevsim netdevsim4: Falling back to sysfs fallback for: . [ 562.079737][T23822] xt_time: invalid argument - start or stop time greater than 23:59:59 [ 562.093632][T23825] IPVS: set_ctl: invalid protocol: 58 172.20.20.43:20004 [ 562.277783][T23828] __nla_validate_parse: 16 callbacks suppressed [ 562.277801][T23828] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5425'. [ 562.312640][T23841] netlink: 'syz.3.5428': attribute type 2 has an invalid length. [ 562.430026][T23845] netlink: 24 bytes leftover after parsing attributes in process `syz.3.5430'. [ 562.483453][T23852] netlink: 16 bytes leftover after parsing attributes in process `syz.3.5430'. [ 562.679411][T23863] sch_tbf: burst 4 is lower than device syzkaller0 mtu (1514) ! [ 563.080313][T23833] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 563.292291][T23877] netlink: 5 bytes leftover after parsing attributes in process `syz.5.5438'. [ 563.347670][T23879] netlink: 'syz.0.5439': attribute type 2 has an invalid length. [ 563.388935][T23875] bond6 (unregistering): Released all slaves [ 563.616413][ C0] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 563.672588][T23874] bond6 (unregistering): Released all slaves [ 564.077023][T23922] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5450'. [ 564.119184][T23930] netlink: 244 bytes leftover after parsing attributes in process `syz.5.5449'. [ 564.362517][T23945] validate_nla: 1 callbacks suppressed [ 564.362536][T23945] netlink: 'syz.0.5454': attribute type 2 has an invalid length. [ 564.509585][T23958] netlink: 'syz.3.5456': attribute type 3 has an invalid length. [ 564.633645][T23953] netlink: 'syz.3.5456': attribute type 11 has an invalid length. [ 564.667681][T23953] netlink: 224 bytes leftover after parsing attributes in process `syz.3.5456'. [ 564.865108][T23979] netlink: 7 bytes leftover after parsing attributes in process `syz.4.5465'. [ 564.900302][T23979] netlink: 'syz.4.5465': attribute type 8 has an invalid length. [ 564.995870][T23991] netlink: 96 bytes leftover after parsing attributes in process `syz.0.5468'. [ 565.049040][T23997] IPVS: set_ctl: invalid protocol: 22 224.0.0.2:20000 [ 565.068589][T23997] x_tables: duplicate underflow at hook 1 [ 565.352369][T24025] netlink: 'syz.4.5474': attribute type 29 has an invalid length. [ 565.459445][T24031] netlink: 'syz.4.5474': attribute type 11 has an invalid length. [ 565.485444][T24031] netlink: 224 bytes leftover after parsing attributes in process `syz.4.5474'. [ 565.582499][T24035] netlink: 'syz.0.5479': attribute type 2 has an invalid length. [ 565.750519][T24048] bridge0: entered allmulticast mode [ 566.366096][T24092] syzkaller0: entered promiscuous mode [ 566.373403][T24092] syzkaller0: entered allmulticast mode [ 566.749806][T24122] netlink: 'syz.4.5508': attribute type 17 has an invalid length. [ 566.749973][T24116] 8021q: adding VLAN 0 to HW filter on device ipvlan4 [ 566.832898][T24128] netlink: 'syz.3.5507': attribute type 4 has an invalid length. [ 567.061594][T24133] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 567.079519][T24138] netdevsim netdevsim5: Direct firmware load for .. failed with error -2 [ 567.090491][T24138] netdevsim netdevsim5: Falling back to sysfs fallback for: .. [ 567.303959][T24155] __nla_validate_parse: 13 callbacks suppressed [ 567.303980][T24155] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5520'. [ 567.337001][T24155] netlink: 28 bytes leftover after parsing attributes in process `syz.0.5520'. [ 567.481116][T24169] netlink: 5 bytes leftover after parsing attributes in process `syz.4.5525'. [ 567.620312][T24181] netlink: 'syz.3.5528': attribute type 1 has an invalid length. [ 567.639390][T24180] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5527'. [ 567.656857][T24183] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 567.752259][T24188] netlink: 212360 bytes leftover after parsing attributes in process `syz.4.5531'. [ 567.770524][T24182] bond9: (slave gretap1): making interface the new active one [ 567.780766][T24182] bond9: (slave gretap1): Enslaving as an active interface with an up link [ 567.801070][T24190] netlink: 60 bytes leftover after parsing attributes in process `syz.1.5532'. [ 567.812346][T24190] netlink: 60 bytes leftover after parsing attributes in process `syz.1.5532'. [ 568.187673][T24214] netlink: 5 bytes leftover after parsing attributes in process `syz.4.5540'. [ 568.224823][T24217] sctp: [Deprecated]: syz.0.5539 (pid 24217) Use of struct sctp_assoc_value in delayed_ack socket option. [ 568.224823][T24217] Use struct sctp_sack_info instead [ 568.399436][T24225] netlink: 'syz.1.5543': attribute type 1 has an invalid length. [ 568.430906][T24229] netlink: 'syz.4.5545': attribute type 1 has an invalid length. [ 568.447545][T24225] netlink: 9462 bytes leftover after parsing attributes in process `syz.1.5543'. [ 568.456147][T24230] netlink: 9462 bytes leftover after parsing attributes in process `syz.1.5543'. [ 568.571110][T24229] bond6: (slave erspan0): making interface the new active one [ 568.600714][T24229] bond6: (slave erspan0): Enslaving as an active interface with an up link [ 568.613854][T24242] bond6: entered promiscuous mode [ 568.620073][T24242] erspan0: entered promiscuous mode [ 568.625900][T24242] bond6: entered allmulticast mode [ 568.631641][T24242] erspan0: entered allmulticast mode [ 568.688979][T24229] bond7 (unregistering): Released all slaves [ 568.783425][T24242] ip6tnl3: entered promiscuous mode [ 568.806695][T24242] ip6tnl3: entered allmulticast mode [ 569.498099][T24294] validate_nla: 6 callbacks suppressed [ 569.498121][T24294] netlink: 'syz.4.5567': attribute type 1 has an invalid length. [ 570.192075][T24344] Bluetooth: hci1: too big key_count value 32778 [ 570.352138][T24356] netlink: 'syz.1.5586': attribute type 10 has an invalid length. [ 571.133040][T24401] bond0: entered allmulticast mode [ 571.145558][T24401] 8021q: adding VLAN 0 to HW filter on device bond0 [ 571.447046][T24426] netlink: 'syz.4.5611': attribute type 1 has an invalid length. [ 571.549376][T24426] 8021q: adding VLAN 0 to HW filter on device bond7 [ 571.787738][ T5832] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 571.801955][ T5832] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 571.837061][ T5832] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 571.867397][ T5832] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 571.876968][ T5832] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 572.037237][T24455] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 572.044535][T24455] IPv6: NLM_F_CREATE should be set when creating new route [ 572.051942][T24455] IPv6: NLM_F_CREATE should be set when creating new route [ 572.061886][T24454] syzkaller1: entered promiscuous mode [ 572.086812][T24454] syzkaller1: entered allmulticast mode [ 572.137025][T24455] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 572.264247][T24444] vxcan1 speed is unknown, defaulting to 1000 [ 572.424787][ T139] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 572.457970][T24470] gtp0: entered promiscuous mode [ 572.463363][T24470] gtp0: entered allmulticast mode [ 572.520219][ T139] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 572.624087][ T139] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 572.641016][T24474] netlink: 'syz.1.5625': attribute type 4 has an invalid length. [ 572.730164][ T139] netdevsim netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 572.799890][T24480] __nla_validate_parse: 14 callbacks suppressed [ 572.799909][T24480] netlink: 16 bytes leftover after parsing attributes in process `syz.1.5626'. [ 572.986840][T24488] netlink: 'syz.5.5627': attribute type 11 has an invalid length. [ 572.994704][T24488] netlink: 224 bytes leftover after parsing attributes in process `syz.5.5627'. [ 573.017337][T24486] netlink: 'syz.5.5627': attribute type 11 has an invalid length. [ 573.038941][T24486] netlink: 224 bytes leftover after parsing attributes in process `syz.5.5627'. [ 573.111645][T24444] chnl_net:caif_netlink_parms(): no params data found [ 573.139586][T24490] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5628'. [ 573.186142][ T139] batadv1: left allmulticast mode [ 573.203578][ T139] batadv1: left promiscuous mode [ 573.209725][ T139] bridge0: port 1(batadv1) entered disabled state [ 573.294467][T24499] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5630'. [ 573.551213][T24504] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5630'. [ 573.634941][ T139] erspan0 (unregistering): left promiscuous mode [ 573.674487][ T139] gretap0 (unregistering): left promiscuous mode [ 573.875864][ T139] team0: Port device geneve0 removed [ 573.907196][ T139] bridge0 (unregistering): left allmulticast mode [ 573.939234][ T5830] Bluetooth: hci0: command tx timeout [ 574.101693][ T139] team0: Port device bridge4 removed [ 574.531724][ T139] bond1 (unregistering): Released all slaves [ 574.559157][ T139] bond0 (unregistering): Released all slaves [ 574.829065][T24444] bridge0: port 1(bridge_slave_0) entered blocking state [ 574.841049][T24444] bridge0: port 1(bridge_slave_0) entered disabled state [ 574.848923][T24444] bridge_slave_0: entered allmulticast mode [ 574.857503][T24444] bridge_slave_0: entered promiscuous mode [ 574.866974][T24444] bridge0: port 2(bridge_slave_1) entered blocking state [ 574.880156][T24444] bridge0: port 2(bridge_slave_1) entered disabled state [ 574.888003][T24444] bridge_slave_1: entered allmulticast mode [ 574.895761][T24444] bridge_slave_1: entered promiscuous mode [ 574.997926][T24444] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 575.303012][T24522] bond1: left promiscuous mode [ 575.308458][T24522] bond1: left allmulticast mode [ 575.317552][T24522] bond2: left promiscuous mode [ 575.322422][T24522] bond2: left allmulticast mode [ 575.331914][T24522] veth7: left promiscuous mode [ 575.338201][T24522] ip6gre1: left promiscuous mode [ 575.343215][T24522] ip6gre1: left allmulticast mode [ 575.355092][T24522] gretap1: left promiscuous mode [ 575.360496][T24522] gretap1: left allmulticast mode [ 575.370255][T24522] gtp0: left promiscuous mode [ 575.375052][T24522] gtp0: left allmulticast mode [ 575.384447][T24444] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 575.394018][T24524] netlink: 60 bytes leftover after parsing attributes in process `syz.5.5636'. [ 575.403655][T24524] netlink: 60 bytes leftover after parsing attributes in process `syz.5.5636'. [ 575.415045][ T5918] vxcan1 speed is unknown, defaulting to 1000 [ 575.415116][ T8474] netdevsim netdevsim1 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 575.423957][ T5918] syz2: Port: 1 Link DOWN [ 575.473448][ T8474] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 575.534076][ T8474] netdevsim netdevsim1 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 575.544372][T17605] vxcan1 speed is unknown, defaulting to 1000 [ 575.569254][ T8474] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 575.592572][ T8474] netdevsim netdevsim1 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 575.614651][ T8474] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 575.652163][ T8474] netdevsim netdevsim1 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 575.661714][ T8474] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 575.673256][T24444] team0: Port device team_slave_0 added [ 575.683025][T24444] team0: Port device team_slave_1 added [ 575.741326][T24444] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 575.756630][T24444] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 575.798702][T24444] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 575.813148][T24444] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 575.821168][T24444] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 575.851748][T24444] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 575.891158][T24549] ip6gretap1: entered allmulticast mode [ 575.907503][T24549] bond0: (slave ip6gretap1): Enslaving as an active interface with an up link [ 576.017551][ T5830] Bluetooth: hci0: command tx timeout [ 576.051603][T24444] hsr_slave_0: entered promiscuous mode [ 576.068354][T24444] hsr_slave_1: entered promiscuous mode [ 576.080656][T24444] debugfs: 'hsr0' already exists in 'hsr' [ 576.090275][T24444] Cannot create hsr debugfs directory [ 576.105713][T24562] xt_CT: You must specify a L4 protocol and not use inversions on it [ 576.125049][ T139] 9: left promiscuous mode [ 576.133954][T24563] xt_CT: You must specify a L4 protocol and not use inversions on it [ 576.155545][T24557] netlink: 'syz.1.5648': attribute type 2 has an invalid length. [ 576.168088][T24562] netlink: 'syz.1.5648': attribute type 2 has an invalid length. [ 576.202695][ T139] 9: left promiscuous mode [ 576.220401][T24566] netlink: 8 bytes leftover after parsing attributes in process `syz.5.5651'. [ 576.297893][ T139] tipc: Disabling bearer [ 576.369565][ T139] tipc: Left network mode [ 576.508868][T24574] netlink: 16 bytes leftover after parsing attributes in process `syz.3.5655'. [ 576.575467][T24574] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 576.794747][T24588] netlink: 'syz.5.5660': attribute type 1 has an invalid length. [ 576.871518][T24585] tipc: Enabling of bearer rejected, already enabled [ 576.903936][T24590] tipc: Enabling of bearer rejected, already enabled [ 577.647167][T24444] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 577.695798][T24444] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 577.749515][T24626] netlink: 'syz.4.5671': attribute type 1 has an invalid length. [ 577.790842][ T139] hsr_slave_0: left promiscuous mode [ 577.803849][ T139] hsr_slave_1: left promiscuous mode [ 577.818319][ T139] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 577.862417][ T139] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 577.938753][T24640] __nla_validate_parse: 5 callbacks suppressed [ 577.938791][T24640] netlink: 16 bytes leftover after parsing attributes in process `syz.1.5673'. [ 578.015309][T24643] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5674'. [ 578.096932][ T5830] Bluetooth: hci0: command tx timeout [ 578.422222][ T139] team0 (unregistering): Port device team_slave_1 removed [ 578.465416][ T139] team0 (unregistering): Port device team_slave_0 removed [ 578.474074][ T8474] smc: removing ib device !yz! [ 578.760514][T24444] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 578.817269][T24444] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 578.997932][T24651] bond0: (slave ip6gretap1): Enslaving as an active interface with an up link [ 579.071598][T24656] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5679'. [ 579.239578][T24666] netlink: 28 bytes leftover after parsing attributes in process `syz.5.5682'. [ 579.442908][T24444] 8021q: adding VLAN 0 to HW filter on device bond0 [ 579.533566][T24444] 8021q: adding VLAN 0 to HW filter on device team0 [ 579.663349][ T3450] bridge0: port 1(bridge_slave_0) entered blocking state [ 579.670666][ T3450] bridge0: port 1(bridge_slave_0) entered forwarding state [ 579.743948][T24697] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5689'. [ 579.960903][T24704] dvmrp6: entered allmulticast mode [ 579.990780][ T3450] bridge0: port 2(bridge_slave_1) entered blocking state [ 579.997990][ T3450] bridge0: port 2(bridge_slave_1) entered forwarding state [ 580.115257][T24716] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5693'. [ 580.150638][T24715] sctp: [Deprecated]: syz.5.5694 (pid 24715) Use of struct sctp_assoc_value in delayed_ack socket option. [ 580.150638][T24715] Use struct sctp_sack_info instead [ 580.184356][ T5830] Bluetooth: hci0: command tx timeout [ 580.552931][T24730] netlink: 212368 bytes leftover after parsing attributes in process `syz.1.5699'. [ 580.952496][T24755] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5704'. [ 581.060009][T24444] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 581.080099][T24759] netlink: 'syz.5.5706': attribute type 1 has an invalid length. [ 581.214975][T24764] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5708'. [ 581.239095][T24444] veth0_vlan: entered promiscuous mode [ 581.269406][T24769] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 581.301383][T24765] bond0: (slave macvlan2): Error -98 calling set_mac_address [ 581.407130][T24444] veth1_vlan: entered promiscuous mode [ 581.739616][T24761] team0 (unregistering): Port device batadv1 removed [ 581.815351][ T139] IPVS: stop unused estimator thread 0... [ 581.833185][T24783] netlink: 8 bytes leftover after parsing attributes in process `syz.5.5714'. [ 581.860821][T24444] veth0_macvtap: entered promiscuous mode [ 581.899296][T24444] veth1_macvtap: entered promiscuous mode [ 581.951634][T24444] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 582.016116][T24444] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 582.077906][ T139] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 582.116929][ T139] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 582.144341][ T139] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 582.371245][ T139] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 582.595821][T24821] openvswitch: netlink: IP tunnel dst address not specified [ 582.637199][T18220] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 582.645574][T18220] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 582.769837][T18220] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 582.780034][T24830] bond6: (slave erspan0): Releasing active interface [ 582.789630][T18220] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 582.803350][T24830] erspan0: left promiscuous mode [ 582.836746][T24830] erspan0: left allmulticast mode [ 582.881826][T24830] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 583.030471][T24843] __nla_validate_parse: 2 callbacks suppressed [ 583.030489][T24843] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5731'. [ 583.458846][T24863] bond1: option packets_per_slave: invalid value (18446744073709551615) [ 583.468504][T24863] bond1: option packets_per_slave: allowed values 0 - 65535 [ 583.483132][T24863] bond1 (unregistering): Released all slaves [ 583.561916][T24871] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5739'. [ 583.607337][T24871] netlink: 14 bytes leftover after parsing attributes in process `syz.0.5739'. [ 583.680759][T24879] netlink: 16 bytes leftover after parsing attributes in process `syz.1.5741'. [ 583.718461][T24879] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 583.737278][T24877] netlink: 40 bytes leftover after parsing attributes in process `syz.4.5740'. [ 584.242189][T24911] netlink: 28 bytes leftover after parsing attributes in process `syz.1.5752'. [ 584.267710][T24916] netlink: 60 bytes leftover after parsing attributes in process `syz.3.5755'. [ 584.272349][T24917] netlink: 16 bytes leftover after parsing attributes in process `syz.4.5754'. [ 584.278024][T24916] netlink: 60 bytes leftover after parsing attributes in process `syz.3.5755'. [ 584.299521][T24911] IPVS: Error connecting to the multicast addr [ 584.343259][T24917] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 584.361713][T24920] netlink: 16 bytes leftover after parsing attributes in process `syz.0.5756'. [ 584.381006][T24920] netlink: 'syz.0.5756': attribute type 1 has an invalid length. [ 584.484136][T24925] netlink: 'syz.1.5758': attribute type 1 has an invalid length. [ 584.522910][T24925] bond8: entered promiscuous mode [ 584.529263][T24925] 8021q: adding VLAN 0 to HW filter on device bond8 [ 584.557635][T24929] bond8: (slave bridge5): making interface the new active one [ 584.560571][T24931] xt_TCPMSS: path-MTU clamping only supported in FORWARD, OUTPUT and POSTROUTING hooks [ 584.565338][T24929] bridge5: entered promiscuous mode [ 584.585782][T24929] bond8: (slave bridge5): Enslaving as an active interface with an up link [ 584.783587][T24937] tipc: Invalid UDP bearer configuration [ 584.783650][T24937] tipc: Enabling of bearer rejected, failed to enable media [ 584.878755][T24943] xt_CT: You must specify a L4 protocol and not use inversions on it [ 584.909988][T24942] 8021q: adding VLAN 0 to HW filter on device bond9 [ 584.922276][T24946] block nbd0: NBD_DISCONNECT [ 584.928800][T24943] netlink: 'syz.5.5765': attribute type 2 has an invalid length. [ 584.957368][T24946] block nbd0: Send disconnect failed -32 [ 584.964702][T24946] block nbd0: shutting down sockets [ 585.112385][T24959] netlink: 'syz.4.5767': attribute type 12 has an invalid length. [ 585.143240][T24959] netlink: 'syz.4.5767': attribute type 11 has an invalid length. [ 585.302092][T24974] batman_adv: batadv0: adding TT local entry ba:e1:05:00:07:00 to non-existent VLAN 1280 [ 585.543157][T24978] SET target dimension over the limit! [ 585.593819][ T3450] bond0 (unregistering): (slave geneve2): Releasing active interface [ 586.164991][ T3450] bond0 (unregistering): Released all slaves [ 586.290000][ T3450] bond1 (unregistering): Released all slaves [ 586.303272][ T3450] bond2 (unregistering): (slave vlan1): Releasing backup interface [ 586.312986][ T3450] bond2 (unregistering): Released all slaves [ 586.335379][T24975] bridge_slave_0: left allmulticast mode [ 586.368278][T24975] bridge_slave_0: left promiscuous mode [ 586.395425][T24975] bridge0: port 1(bridge_slave_0) entered disabled state [ 586.475483][T24975] bridge_slave_1: left allmulticast mode [ 586.491790][T24975] bridge_slave_1: left promiscuous mode [ 586.509637][T24975] bridge0: port 2(bridge_slave_1) entered disabled state [ 586.534311][T24975] bond0: (slave bond_slave_0): Releasing backup interface [ 586.548528][T24975] bond0: (slave bond_slave_1): Releasing backup interface [ 586.568809][T24975] team0: Port device team_slave_0 removed [ 586.580943][T24975] team0: Port device team_slave_1 removed [ 586.594515][T24975] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 586.603572][T24975] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 586.614180][T24975] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 586.622681][T24975] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 586.634067][T24975] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 586.709076][ T3450] tipc: Left network mode [ 586.882463][ T3450] IPVS: stopping master sync thread 11941 ... [ 586.932014][T25010] netlink: 'syz.3.5781': attribute type 9 has an invalid length. [ 586.972846][T25012] netlink: 'syz.4.5782': attribute type 3 has an invalid length. [ 587.023426][T25012] netlink: 'syz.4.5782': attribute type 1 has an invalid length. [ 587.660211][T25050] netlink: 'syz.0.5793': attribute type 21 has an invalid length. [ 587.747175][T25053] netlink: 'syz.4.5794': attribute type 33 has an invalid length. [ 587.766852][T25055] macvlan0: mtu less than device minimum [ 587.923673][T25061] ipt_ECN: cannot use operation on non-tcp rule [ 588.120417][T25077] FAULT_INJECTION: forcing a failure. [ 588.120417][T25077] name failslab, interval 1, probability 0, space 0, times 0 [ 588.148626][T25077] CPU: 0 UID: 0 PID: 25077 Comm: syz.4.5802 Not tainted syzkaller #0 PREEMPT(full) [ 588.148655][T25077] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 588.148668][T25077] Call Trace: [ 588.148676][T25077] [ 588.148685][T25077] dump_stack_lvl+0xe8/0x150 [ 588.148714][T25077] should_fail_ex+0x414/0x560 [ 588.148748][T25077] should_failslab+0xa8/0x100 [ 588.148774][T25077] kmem_cache_alloc_noprof+0x88/0x710 [ 588.148802][T25077] ? __netlink_lookup+0xbd/0x8a0 [ 588.148828][T25077] ? skb_clone+0x212/0x3a0 [ 588.148855][T25077] skb_clone+0x212/0x3a0 [ 588.148882][T25077] __netlink_deliver_tap+0x404/0x850 [ 588.148918][T25077] ? netlink_deliver_tap+0x2e/0x1b0 [ 588.148943][T25077] netlink_deliver_tap+0x19c/0x1b0 [ 588.148968][T25077] netlink_unicast+0x7fa/0x9e0 [ 588.148997][T25077] ? __pfx_netlink_unicast+0x10/0x10 [ 588.149016][T25077] ? __alloc_skb+0x198/0x3a0 [ 588.149034][T25077] ? netlink_sendmsg+0x642/0xb30 [ 588.149054][T25077] ? skb_put+0x11b/0x210 [ 588.149075][T25077] netlink_sendmsg+0x805/0xb30 [ 588.149105][T25077] ? __pfx_netlink_sendmsg+0x10/0x10 [ 588.149131][T25077] ? aa_sock_msg_perm+0xf1/0x1b0 [ 588.149156][T25077] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 588.149174][T25077] ? __pfx_netlink_sendmsg+0x10/0x10 [ 588.149200][T25077] __sock_sendmsg+0x21c/0x270 [ 588.149231][T25077] ____sys_sendmsg+0x505/0x820 [ 588.149259][T25077] ? __pfx_____sys_sendmsg+0x10/0x10 [ 588.149292][T25077] ? import_iovec+0x74/0xa0 [ 588.149326][T25077] ___sys_sendmsg+0x21f/0x2a0 [ 588.149352][T25077] ? __pfx____sys_sendmsg+0x10/0x10 [ 588.149409][T25077] ? __fget_files+0x2a/0x420 [ 588.149433][T25077] ? __fget_files+0x3a0/0x420 [ 588.149467][T25077] __x64_sys_sendmsg+0x19b/0x260 [ 588.149493][T25077] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 588.149526][T25077] ? __pfx_ksys_write+0x10/0x10 [ 588.149573][T25077] do_syscall_64+0xec/0xf80 [ 588.149593][T25077] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 588.149612][T25077] ? trace_irq_disable+0x37/0x100 [ 588.149640][T25077] ? clear_bhb_loop+0x60/0xb0 [ 588.149663][T25077] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 588.149682][T25077] RIP: 0033:0x7f40f1d8f749 [ 588.149700][T25077] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 588.149717][T25077] RSP: 002b:00007f40f2bb2038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 588.149738][T25077] RAX: ffffffffffffffda RBX: 00007f40f1fe5fa0 RCX: 00007f40f1d8f749 [ 588.149753][T25077] RDX: 0000000000000000 RSI: 0000200000000380 RDI: 0000000000000005 [ 588.149766][T25077] RBP: 00007f40f2bb2090 R08: 0000000000000000 R09: 0000000000000000 [ 588.149778][T25077] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 588.149788][T25077] R13: 00007f40f1fe6038 R14: 00007f40f1fe5fa0 R15: 00007ffcf474a1d8 [ 588.149818][T25077] [ 588.664076][T25089] __nla_validate_parse: 6 callbacks suppressed [ 588.664095][T25089] netlink: 224 bytes leftover after parsing attributes in process `syz.3.5807'. [ 588.754758][T25089] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5807'. [ 588.811784][T25098] GUP no longer grows the stack in syz.4.5811 (25098): 200000003000-20000000a000 (200000001000) [ 588.855986][T25098] CPU: 0 UID: 0 PID: 25098 Comm: syz.4.5811 Not tainted syzkaller #0 PREEMPT(full) [ 588.856013][T25098] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 588.856025][T25098] Call Trace: [ 588.856032][T25098] [ 588.856040][T25098] dump_stack_lvl+0xe8/0x150 [ 588.856070][T25098] __get_user_pages+0x2465/0x29f0 [ 588.856117][T25098] ? __gup_longterm_locked+0xc63/0x1660 [ 588.856141][T25098] ? down_read_killable+0x1bc/0x350 [ 588.856165][T25098] ? try_get_folio+0xec/0x660 [ 588.856191][T25098] __gup_longterm_locked+0xde4/0x1660 [ 588.856233][T25098] gup_fast_fallback+0x1d26/0x2290 [ 588.856286][T25098] ? __pfx_gup_fast_fallback+0x10/0x10 [ 588.856314][T25098] ? is_valid_gup_args+0x11f/0x200 [ 588.856350][T25098] ? get_user_pages_fast+0x4d/0xb0 [ 588.856378][T25098] __iov_iter_get_pages_alloc+0x39f/0xb40 [ 588.856410][T25098] ? __pfx_pipe_clear_nowait+0x10/0x10 [ 588.856436][T25098] ? wait_for_space+0x248/0x2d0 [ 588.856464][T25098] iov_iter_get_pages2+0x5e/0xa0 [ 588.856491][T25098] __se_sys_vmsplice+0x548/0x10d0 [ 588.856537][T25098] ? __pfx___se_sys_vmsplice+0x10/0x10 [ 588.856563][T25098] ? __pfx_futex_wait+0x10/0x10 [ 588.856600][T25098] ? irqentry_exit+0x5e8/0x670 [ 588.856677][T25098] do_syscall_64+0xec/0xf80 [ 588.856696][T25098] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 588.856715][T25098] ? trace_irq_disable+0x37/0x100 [ 588.856740][T25098] ? clear_bhb_loop+0x60/0xb0 [ 588.856763][T25098] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 588.856782][T25098] RIP: 0033:0x7f40f1d8f749 [ 588.856800][T25098] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 588.856818][T25098] RSP: 002b:00007f40f2bb2038 EFLAGS: 00000246 ORIG_RAX: 0000000000000116 [ 588.856839][T25098] RAX: ffffffffffffffda RBX: 00007f40f1fe5fa0 RCX: 00007f40f1d8f749 [ 588.856854][T25098] RDX: 0000000000000001 RSI: 00002000000000c0 RDI: 000000000000000a [ 588.856868][T25098] RBP: 00007f40f1e13f91 R08: 0000000000000000 R09: 0000000000000000 [ 588.856880][T25098] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 [ 588.856892][T25098] R13: 00007f40f1fe6038 R14: 00007f40f1fe5fa0 R15: 00007ffcf474a1d8 [ 588.856925][T25098] [ 589.192821][ T3450] hsr_slave_0: left promiscuous mode [ 589.244828][ T3450] veth1_macvtap: left promiscuous mode [ 589.251163][ T3450] veth0_macvtap: left promiscuous mode [ 589.258202][ T3450] veth1_vlan: left promiscuous mode [ 589.263607][ T3450] veth0_vlan: left promiscuous mode [ 589.303623][T25115] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5812'. [ 589.479709][T25127] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5817'. [ 589.585306][ T3450] batadv2 (unregistering): left promiscuous mode [ 589.609172][ T3450] team0 (unregistering): Port device batadv2 removed [ 589.623960][T25139] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5817'. [ 589.685625][ T3450] batadv1 (unregistering): left promiscuous mode [ 589.693519][ T3450] team0 (unregistering): Port device batadv1 removed [ 590.547865][T25121] bond4: option mode: unable to set because the bond device is up [ 590.555891][T25124] bond4: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 590.588279][T25124] 8021q: adding VLAN 0 to HW filter on device bond4 [ 590.603945][T25124] lo: entered allmulticast mode [ 590.610414][T25124] bond4: (slave lo): Enslaving as a backup interface with an up link [ 590.627827][T25124] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 590.663589][T25141] validate_nla: 1 callbacks suppressed [ 590.663609][T25141] netlink: 'syz.5.5819': attribute type 3 has an invalid length. [ 590.691606][T25141] netlink: 766 bytes leftover after parsing attributes in process `syz.5.5819'. [ 590.701944][T18621] bond4: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 590.719045][T18621] bond4: (slave lo): link status up again after 0 ms [ 590.768581][ T3497] bond4: (slave lo): link status up again after 0 ms [ 590.790852][ T3497] bond4: (slave lo): link status up again after 0 ms [ 590.797447][T25151] netlink: 'syz.4.5821': attribute type 1 has an invalid length. [ 590.830265][ T3497] bond4: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 590.863496][ T3497] bond4: (slave lo): link status up again after 0 ms [ 590.909030][ T3497] bond4: (slave lo): link status up again after 0 ms [ 590.910042][T25155] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5824'. [ 590.937982][ T3482] bond4: (slave lo): link status up again after 0 ms [ 590.950990][T25151] 8021q: adding VLAN 0 to HW filter on device bond8 [ 591.021584][T25158] macvlan2: entered promiscuous mode [ 591.042720][T25158] macvlan2: entered allmulticast mode [ 591.064216][T25158] bond8: entered allmulticast mode [ 591.070742][T25158] bond8: entered promiscuous mode [ 591.077664][T25158] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 591.087074][T25158] team0: Port device macvlan2 added [ 591.125770][T25167] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for ip6erspan0 [ 591.371352][T25189] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5831'. [ 591.419857][T25189] vlan2: entered allmulticast mode [ 591.434634][T25189] mac80211_hwsim hwsim75 wlan0: entered allmulticast mode [ 591.441842][T25191] netlink: 8 bytes leftover after parsing attributes in process `syz.5.5833'. [ 591.441865][T25191] netlink: 4 bytes leftover after parsing attributes in process `syz.5.5833'. [ 591.441889][T25191] netlink: 'syz.5.5833': attribute type 15 has an invalid length. [ 591.550393][T25191] netlink: 'syz.5.5833': attribute type 15 has an invalid length. [ 591.550616][T18621] netdevsim netdevsim5 netdevsim0: set [0, 1] type 1 family 0 port 256 - 0 [ 591.579997][T18621] netdevsim netdevsim5 netdevsim1: set [0, 1] type 1 family 0 port 256 - 0 [ 591.593422][T25195] netlink: 'syz.3.5835': attribute type 3 has an invalid length. [ 591.601376][T18621] netdevsim netdevsim5 netdevsim2: set [0, 1] type 1 family 0 port 256 - 0 [ 591.601420][T18621] netdevsim netdevsim5 netdevsim3: set [0, 1] type 1 family 0 port 256 - 0 [ 592.407648][T25254] bond6: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 592.435353][T25254] bond6: (slave lo): speed changed to 0 on port 1 [ 592.448777][T25254] bond6: (slave lo): Enslaving as a backup interface with an up link [ 592.537125][T25267] 8021q: VLANs not supported on ip_vti0 [ 593.055007][ T36] net_ratelimit: 18 callbacks suppressed [ 593.055031][ T36] bond4: (slave lo): failed to get link speed/duplex [ 593.216655][T18220] bond4: (slave lo): failed to get link speed/duplex [ 593.330693][T18220] bond4: (slave lo): failed to get link speed/duplex [ 593.344474][T25317] tipc: Enabled bearer , priority 2 [ 593.447685][ T3450] bond4: (slave lo): failed to get link speed/duplex [ 593.596969][ T3450] bond4: (slave lo): failed to get link speed/duplex [ 593.675439][T25347] bridge25: port 1(veth9) entered blocking state [ 593.694993][T25347] bridge25: port 1(veth9) entered disabled state [ 593.702872][ C0] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 593.706430][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 593.721876][T25347] veth9: entered allmulticast mode [ 593.730158][T25347] veth9: entered promiscuous mode [ 593.740697][T25351] bridge25: port 2(veth0_to_bond) entered blocking state [ 593.787207][T25351] bridge25: port 2(veth0_to_bond) entered disabled state [ 593.794584][T25351] veth0_to_bond: entered allmulticast mode [ 593.862692][T25351] veth0_to_bond: entered promiscuous mode [ 593.887012][T18220] bond4: (slave lo): failed to get link speed/duplex [ 593.908828][T25345] ip_vti0: entered allmulticast mode [ 593.929769][T25350] vxcan1 speed is unknown, defaulting to 1000 [ 593.986974][T25365] __nla_validate_parse: 6 callbacks suppressed [ 593.986993][T25365] netlink: 24 bytes leftover after parsing attributes in process `syz.5.5882'. [ 594.003793][ T36] bond4: (slave lo): failed to get link speed/duplex [ 594.120266][T18220] bond4: (slave lo): failed to get link speed/duplex [ 594.237156][ T1315] bond4: (slave lo): failed to get link speed/duplex [ 594.293656][T25382] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5888'. [ 594.348904][ T1315] bond4: (slave lo): failed to get link speed/duplex [ 594.370471][T25382] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 594.395949][T25382] team0: Port device batadv1 added [ 594.440955][T25384] netdevsim netdevsim1 : renamed from netdevsim0 [ 594.547536][T25393] Bluetooth: MGMT ver 1.23 [ 594.570053][T25391] netlink: 16 bytes leftover after parsing attributes in process `syz.5.5891'. [ 594.738973][T25404] netlink: 'syz.5.5896': attribute type 10 has an invalid length. [ 594.771377][T25407] netlink: 16 bytes leftover after parsing attributes in process `syz.1.5895'. [ 594.818717][T25409] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5897'. [ 594.881199][T25404] team0: Device veth0_macvtap failed to register rx_handler [ 595.194910][T25426] netlink: 'syz.0.5903': attribute type 11 has an invalid length. [ 595.279575][T25433] netlink: 'syz.5.5905': attribute type 1 has an invalid length. [ 595.292651][T25431] bond0: entered promiscuous mode [ 595.314600][T25431] batadv0: entered promiscuous mode [ 595.322208][T25431] debugfs: 'hsr0' already exists in 'hsr' [ 595.335006][T25431] Cannot create hsr debugfs directory [ 595.339696][T25437] netlink: 12 bytes leftover after parsing attributes in process `syz.5.5905'. [ 595.342956][T25431] hsr0: Slave A (bond0) is not up; please bring it up to get a fully working HSR network [ 595.355462][T25437] netlink: 12 bytes leftover after parsing attributes in process `syz.5.5905'. [ 595.363470][T25431] 8021q: adding VLAN 0 to HW filter on device hsr0 [ 595.401083][T25433] bond1: entered promiscuous mode [ 595.407543][T25433] 8021q: adding VLAN 0 to HW filter on device bond1 [ 595.474610][T25443] bond1: (slave bridge7): making interface the new active one [ 595.482854][T25443] bridge7: entered promiscuous mode [ 595.493298][T25443] bond1: (slave bridge7): Enslaving as an active interface with an up link [ 595.556721][T25445] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5909'. [ 595.638800][T25455] netlink: 'syz.5.5912': attribute type 72 has an invalid length. [ 595.655436][T25455] netlink: 16 bytes leftover after parsing attributes in process `syz.5.5912'. [ 595.735985][T25461] netlink: 'syz.4.5914': attribute type 4 has an invalid length. [ 595.873136][T25472] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5918'. [ 595.972611][T25473] syzkaller0: entered promiscuous mode [ 595.988217][T25473] syzkaller0: entered allmulticast mode [ 596.020533][T25488] FAULT_INJECTION: forcing a failure. [ 596.020533][T25488] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 596.039985][T25488] CPU: 1 UID: 0 PID: 25488 Comm: syz.4.5922 Not tainted syzkaller #0 PREEMPT(full) [ 596.040016][T25488] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 596.040035][T25488] Call Trace: [ 596.040043][T25488] [ 596.040051][T25488] dump_stack_lvl+0xe8/0x150 [ 596.040083][T25488] should_fail_ex+0x414/0x560 [ 596.040117][T25488] _copy_from_user+0x2d/0xb0 [ 596.040141][T25488] ___sys_sendmsg+0x158/0x2a0 [ 596.040167][T25488] ? __pfx____sys_sendmsg+0x10/0x10 [ 596.040224][T25488] ? __fget_files+0x2a/0x420 [ 596.040246][T25488] ? __fget_files+0x3a0/0x420 [ 596.040278][T25488] __x64_sys_sendmsg+0x19b/0x260 [ 596.040304][T25488] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 596.040336][T25488] ? __pfx_ksys_write+0x10/0x10 [ 596.040364][T25488] do_syscall_64+0xec/0xf80 [ 596.040384][T25488] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 596.040402][T25488] ? trace_irq_disable+0x37/0x100 [ 596.040427][T25488] ? clear_bhb_loop+0x60/0xb0 [ 596.040450][T25488] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 596.040468][T25488] RIP: 0033:0x7f40f1d8f749 [ 596.040486][T25488] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 596.040503][T25488] RSP: 002b:00007f40f2bb2038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 596.040524][T25488] RAX: ffffffffffffffda RBX: 00007f40f1fe5fa0 RCX: 00007f40f1d8f749 [ 596.040539][T25488] RDX: 0000000004000000 RSI: 0000200000000280 RDI: 0000000000000007 [ 596.040552][T25488] RBP: 00007f40f2bb2090 R08: 0000000000000000 R09: 0000000000000000 [ 596.040565][T25488] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 596.040576][T25488] R13: 00007f40f1fe6038 R14: 00007f40f1fe5fa0 R15: 00007ffcf474a1d8 [ 596.040606][T25488] [ 596.874987][T25518] IPVS: set_ctl: invalid protocol: 2 224.0.0.2:20001 [ 597.195833][T25542] 8021q: adding VLAN 0 to HW filter on device bond10 [ 597.225842][T25548] netlink: 'syz.4.5942': attribute type 3 has an invalid length. [ 597.239087][T25540] pimreg: left allmulticast mode [ 597.545058][T25563] FAULT_INJECTION: forcing a failure. [ 597.545058][T25563] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 597.591139][T25566] sit0: entered allmulticast mode [ 597.594688][T25563] CPU: 1 UID: 0 PID: 25563 Comm: syz.1.5946 Not tainted syzkaller #0 PREEMPT(full) [ 597.594720][T25563] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 597.594732][T25563] Call Trace: [ 597.594741][T25563] [ 597.594750][T25563] dump_stack_lvl+0xe8/0x150 [ 597.594779][T25563] should_fail_ex+0x414/0x560 [ 597.594813][T25563] _copy_from_iter+0x1cd/0x1630 [ 597.594845][T25563] ? __pfx__copy_from_iter+0x10/0x10 [ 597.594866][T25563] ? __build_skb_around+0x22d/0x3c0 [ 597.594888][T25563] ? __alloc_skb+0x198/0x3a0 [ 597.594915][T25563] ? netlink_sendmsg+0x642/0xb30 [ 597.594937][T25563] ? skb_put+0x11b/0x210 [ 597.594960][T25563] netlink_sendmsg+0x6b2/0xb30 [ 597.594993][T25563] ? __pfx_netlink_sendmsg+0x10/0x10 [ 597.595021][T25563] ? aa_sock_msg_perm+0xf1/0x1b0 [ 597.595046][T25563] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 597.595064][T25563] ? __pfx_netlink_sendmsg+0x10/0x10 [ 597.595089][T25563] __sock_sendmsg+0x21c/0x270 [ 597.595120][T25563] ____sys_sendmsg+0x505/0x820 [ 597.595147][T25563] ? __pfx_____sys_sendmsg+0x10/0x10 [ 597.595177][T25563] ? import_iovec+0x74/0xa0 [ 597.595203][T25563] ___sys_sendmsg+0x21f/0x2a0 [ 597.595228][T25563] ? __pfx____sys_sendmsg+0x10/0x10 [ 597.595281][T25563] ? __fget_files+0x2a/0x420 [ 597.595305][T25563] ? __fget_files+0x3a0/0x420 [ 597.595337][T25563] __x64_sys_sendmsg+0x19b/0x260 [ 597.595362][T25563] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 597.595393][T25563] ? __pfx_ksys_write+0x10/0x10 [ 597.595422][T25563] do_syscall_64+0xec/0xf80 [ 597.595443][T25563] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 597.595460][T25563] ? trace_irq_disable+0x37/0x100 [ 597.595485][T25563] ? clear_bhb_loop+0x60/0xb0 [ 597.595506][T25563] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 597.595521][T25563] RIP: 0033:0x7f8e6c98f749 [ 597.595536][T25563] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 597.595551][T25563] RSP: 002b:00007f8e6d7e9038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 597.595572][T25563] RAX: ffffffffffffffda RBX: 00007f8e6cbe6090 RCX: 00007f8e6c98f749 [ 597.595588][T25563] RDX: 0000000004000000 RSI: 0000200000000280 RDI: 0000000000000007 [ 597.595601][T25563] RBP: 00007f8e6d7e9090 R08: 0000000000000000 R09: 0000000000000000 [ 597.595613][T25563] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 597.595624][T25563] R13: 00007f8e6cbe6128 R14: 00007f8e6cbe6090 R15: 00007fff1b6e4658 [ 597.595657][T25563] [ 598.076962][T18621] net_ratelimit: 19 callbacks suppressed [ 598.076983][T18621] bond4: (slave lo): failed to get link speed/duplex [ 598.239134][T18621] bond4: (slave lo): failed to get link speed/duplex [ 598.311792][T25596] FAULT_INJECTION: forcing a failure. [ 598.311792][T25596] name failslab, interval 1, probability 0, space 0, times 0 [ 598.400274][T25596] CPU: 0 UID: 0 PID: 25596 Comm: syz.0.5955 Not tainted syzkaller #0 PREEMPT(full) [ 598.400303][T25596] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 598.400315][T25596] Call Trace: [ 598.400322][T25596] [ 598.400331][T25596] dump_stack_lvl+0xe8/0x150 [ 598.400360][T25596] should_fail_ex+0x414/0x560 [ 598.400394][T25596] should_failslab+0xa8/0x100 [ 598.400420][T25596] kmem_cache_alloc_noprof+0x88/0x710 [ 598.400449][T25596] ? security_inode_alloc+0x39/0x330 [ 598.400487][T25596] security_inode_alloc+0x39/0x330 [ 598.400516][T25596] inode_init_always_gfp+0x9ed/0xdc0 [ 598.400546][T25596] ? __pfx_debugfs_alloc_inode+0x10/0x10 [ 598.400567][T25596] alloc_inode+0x82/0x1b0 [ 598.400592][T25596] new_inode+0x22/0x170 [ 598.400622][T25596] __debugfs_create_file+0xb8/0x400 [ 598.400648][T25596] debugfs_create_file_full+0x3f/0x60 [ 598.400672][T25596] ref_tracker_dir_debugfs+0x14e/0x2d0 [ 598.400693][T25596] ? __pfx_ref_tracker_dir_debugfs+0x10/0x10 [ 598.400743][T25596] ? trace_kmalloc+0x1f/0xb0 [ 598.400759][T25596] ? __kvmalloc_node_noprof+0x5f5/0x920 [ 598.400786][T25596] ? __raw_spin_lock_init+0x45/0x100 [ 598.400817][T25596] alloc_netdev_mqs+0x272/0x11b0 [ 598.400853][T25596] ? __pfx_ip6erspan_tap_setup+0x10/0x10 [ 598.400887][T25596] rtnl_create_link+0x31f/0xcf0 [ 598.400923][T25596] rtnl_newlink_create+0x25c/0xb00 [ 598.400961][T25596] ? __pfx_rtnl_newlink_create+0x10/0x10 [ 598.400989][T25596] ? __pfx___mutex_lock+0x10/0x10 [ 598.401020][T25596] ? ns_capable+0x8a/0xf0 [ 598.401044][T25596] rtnl_newlink+0x16e7/0x1c90 [ 598.401083][T25596] ? __pfx_rtnl_newlink+0x10/0x10 [ 598.401102][T25596] ? do_syscall_64+0xec/0xf80 [ 598.401122][T25596] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 598.401181][T25596] ? kasan_quarantine_put+0xbb/0x1f0 [ 598.401200][T25596] ? lockdep_hardirqs_on+0x7b/0x110 [ 598.401225][T25596] ? kmem_cache_free+0x197/0x620 [ 598.401244][T25596] ? nlmon_xmit+0xb0/0x100 [ 598.401280][T25596] ? __lock_acquire+0x6b6/0x2cf0 [ 598.401311][T25596] ? __local_bh_enable_ip+0xd0/0x130 [ 598.401330][T25596] ? lockdep_hardirqs_on+0x7b/0x110 [ 598.401348][T25596] ? __dev_queue_xmit+0x280/0x3100 [ 598.401371][T25596] ? __local_bh_enable_ip+0xd0/0x130 [ 598.401398][T25596] ? rtnetlink_rcv_msg+0x1ab/0xb70 [ 598.401433][T25596] ? __pfx_rtnl_newlink+0x10/0x10 [ 598.401454][T25596] rtnetlink_rcv_msg+0x7cf/0xb70 [ 598.401480][T25596] ? rtnetlink_rcv_msg+0x1ab/0xb70 [ 598.401501][T25596] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 598.401520][T25596] ? ref_tracker_free+0x63a/0x7d0 [ 598.401540][T25596] ? __asan_memcpy+0x40/0x70 [ 598.401569][T25596] ? __pfx_ref_tracker_free+0x10/0x10 [ 598.401600][T25596] netlink_rcv_skb+0x208/0x470 [ 598.401628][T25596] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 598.401651][T25596] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 598.401689][T25596] ? netlink_deliver_tap+0x2e/0x1b0 [ 598.401724][T25596] netlink_unicast+0x82f/0x9e0 [ 598.401754][T25596] ? __pfx_netlink_unicast+0x10/0x10 [ 598.401774][T25596] ? __alloc_skb+0x198/0x3a0 [ 598.401792][T25596] ? netlink_sendmsg+0x642/0xb30 [ 598.401814][T25596] ? skb_put+0x11b/0x210 [ 598.401846][T25596] netlink_sendmsg+0x805/0xb30 [ 598.401881][T25596] ? __pfx_netlink_sendmsg+0x10/0x10 [ 598.401911][T25596] ? aa_sock_msg_perm+0xf1/0x1b0 [ 598.401939][T25596] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 598.401959][T25596] ? __pfx_netlink_sendmsg+0x10/0x10 [ 598.401986][T25596] __sock_sendmsg+0x21c/0x270 [ 598.402019][T25596] ____sys_sendmsg+0x505/0x820 [ 598.402047][T25596] ? __pfx_____sys_sendmsg+0x10/0x10 [ 598.402078][T25596] ? import_iovec+0x74/0xa0 [ 598.402106][T25596] ___sys_sendmsg+0x21f/0x2a0 [ 598.402131][T25596] ? __pfx____sys_sendmsg+0x10/0x10 [ 598.402184][T25596] ? __fget_files+0x2a/0x420 [ 598.402207][T25596] ? __fget_files+0x3a0/0x420 [ 598.402238][T25596] __x64_sys_sendmsg+0x19b/0x260 [ 598.402264][T25596] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 598.402298][T25596] ? __pfx_ksys_write+0x10/0x10 [ 598.402327][T25596] do_syscall_64+0xec/0xf80 [ 598.402346][T25596] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 598.402365][T25596] ? trace_irq_disable+0x37/0x100 [ 598.402389][T25596] ? clear_bhb_loop+0x60/0xb0 [ 598.402412][T25596] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 598.402430][T25596] RIP: 0033:0x7f18acd8f749 [ 598.402448][T25596] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 598.402464][T25596] RSP: 002b:00007f18adc40038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 598.402485][T25596] RAX: ffffffffffffffda RBX: 00007f18acfe5fa0 RCX: 00007f18acd8f749 [ 598.402499][T25596] RDX: 0000000000000000 RSI: 0000200000000380 RDI: 0000000000000005 [ 598.402513][T25596] RBP: 00007f18adc40090 R08: 0000000000000000 R09: 0000000000000000 [ 598.402525][T25596] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 598.402535][T25596] R13: 00007f18acfe6038 R14: 00007f18acfe5fa0 R15: 00007ffe674d51c8 [ 598.402565][T25596] [ 598.402609][T25596] debugfs: out of free dentries, can not create file 'netdev@ffff88805957c618' [ 598.530198][ T5832] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 598.952461][ T5832] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 598.961812][ T5832] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 598.980353][ T5832] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 599.000617][ T5832] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 599.008612][T25598] : entered promiscuous mode [ 599.019998][T25604] syzkaller1: entered promiscuous mode [ 599.050295][T25604] syzkaller1: entered allmulticast mode [ 599.113288][T25618] FAULT_INJECTION: forcing a failure. [ 599.113288][T25618] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 599.127021][T25618] CPU: 1 UID: 0 PID: 25618 Comm: syz.0.5960 Not tainted syzkaller #0 PREEMPT(full) [ 599.127049][T25618] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 599.127062][T25618] Call Trace: [ 599.127071][T25618] [ 599.127079][T25618] dump_stack_lvl+0xe8/0x150 [ 599.127110][T25618] should_fail_ex+0x414/0x560 [ 599.127146][T25618] _copy_from_iter+0x1cd/0x1630 [ 599.127178][T25618] ? __pfx__copy_from_iter+0x10/0x10 [ 599.127201][T25618] ? __build_skb_around+0x22d/0x3c0 [ 599.127224][T25618] ? __alloc_skb+0x198/0x3a0 [ 599.127245][T25618] ? netlink_sendmsg+0x642/0xb30 [ 599.127269][T25618] ? skb_put+0x11b/0x210 [ 599.127293][T25618] netlink_sendmsg+0x6b2/0xb30 [ 599.127327][T25618] ? __pfx_netlink_sendmsg+0x10/0x10 [ 599.127356][T25618] ? aa_sock_msg_perm+0xf1/0x1b0 [ 599.127384][T25618] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 599.127403][T25618] ? __pfx_netlink_sendmsg+0x10/0x10 [ 599.127429][T25618] __sock_sendmsg+0x21c/0x270 [ 599.127491][T25618] ____sys_sendmsg+0x505/0x820 [ 599.127519][T25618] ? __pfx_____sys_sendmsg+0x10/0x10 [ 599.127550][T25618] ? import_iovec+0x74/0xa0 [ 599.127577][T25618] ___sys_sendmsg+0x21f/0x2a0 [ 599.127603][T25618] ? __pfx____sys_sendmsg+0x10/0x10 [ 599.127660][T25618] ? __fget_files+0x2a/0x420 [ 599.127684][T25618] ? __fget_files+0x3a0/0x420 [ 599.127718][T25618] __x64_sys_sendmsg+0x19b/0x260 [ 599.127745][T25618] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 599.127778][T25618] ? __pfx_ksys_write+0x10/0x10 [ 599.127816][T25618] do_syscall_64+0xec/0xf80 [ 599.127837][T25618] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 599.127856][T25618] ? trace_irq_disable+0x37/0x100 [ 599.127881][T25618] ? clear_bhb_loop+0x60/0xb0 [ 599.127905][T25618] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 599.127924][T25618] RIP: 0033:0x7f18acd8f749 [ 599.127942][T25618] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 599.127960][T25618] RSP: 002b:00007f18adc1f038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 599.127981][T25618] RAX: ffffffffffffffda RBX: 00007f18acfe6090 RCX: 00007f18acd8f749 [ 599.127997][T25618] RDX: 0000000004000000 RSI: 0000200000000280 RDI: 0000000000000007 [ 599.128011][T25618] RBP: 00007f18adc1f090 R08: 0000000000000000 R09: 0000000000000000 [ 599.128024][T25618] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 599.128037][T25618] R13: 00007f18acfe6128 R14: 00007f18acfe6090 R15: 00007ffe674d51c8 [ 599.128070][T25618] [ 599.408075][ T139] bond4: (slave lo): failed to get link speed/duplex [ 599.464036][T25607] vxcan1 speed is unknown, defaulting to 1000 [ 599.517014][ T3450] bond4: (slave lo): failed to get link speed/duplex [ 599.610095][T25632] __nla_validate_parse: 8 callbacks suppressed [ 599.610115][T25632] netlink: 60 bytes leftover after parsing attributes in process `syz.3.5963'. [ 599.626109][T25632] netlink: 60 bytes leftover after parsing attributes in process `syz.3.5963'. [ 599.679066][ T1123] bond4: (slave lo): failed to get link speed/duplex [ 599.787113][ T1123] bond4: (slave lo): failed to get link speed/duplex [ 599.896485][ T1123] bond4: (slave lo): failed to get link speed/duplex [ 599.930446][T25649] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5970'. [ 600.141226][T25663] FAULT_INJECTION: forcing a failure. [ 600.141226][T25663] name failslab, interval 1, probability 0, space 0, times 0 [ 600.158617][T25663] CPU: 0 UID: 0 PID: 25663 Comm: syz.0.5973 Not tainted syzkaller #0 PREEMPT(full) [ 600.158644][T25663] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 600.158655][T25663] Call Trace: [ 600.158663][T25663] [ 600.158672][T25663] dump_stack_lvl+0xe8/0x150 [ 600.158700][T25663] should_fail_ex+0x414/0x560 [ 600.158742][T25663] should_failslab+0xa8/0x100 [ 600.158766][T25663] __kmalloc_noprof+0xdf/0x800 [ 600.158784][T25663] ? genl_family_rcv_msg_attrs_parse+0xa3/0x2a0 [ 600.158801][T25663] ? rcu_is_watching+0x15/0xb0 [ 600.158827][T25663] genl_family_rcv_msg_attrs_parse+0xa3/0x2a0 [ 600.158850][T25663] genl_family_rcv_msg_doit+0xb8/0x300 [ 600.158872][T25663] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 600.158896][T25663] ? apparmor_capable+0x137/0x1a0 [ 600.158925][T25663] ? bpf_lsm_capable+0x9/0x20 [ 600.158946][T25663] ? security_capable+0x7e/0x2e0 [ 600.158974][T25663] genl_rcv_msg+0x60e/0x790 [ 600.159010][T25663] ? __pfx_genl_rcv_msg+0x10/0x10 [ 600.159036][T25663] ? __pfx_nl802154_pre_doit+0x10/0x10 [ 600.159062][T25663] ? __pfx_nl802154_wpan_phy_netns+0x10/0x10 [ 600.159079][T25663] ? __pfx_nl802154_post_doit+0x10/0x10 [ 600.159116][T25663] netlink_rcv_skb+0x208/0x470 [ 600.159139][T25663] ? __pfx_genl_rcv_msg+0x10/0x10 [ 600.159168][T25663] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 600.159188][T25663] ? genl_rcv+0x19/0x40 [ 600.159229][T25663] ? down_read+0x274/0x2e0 [ 600.159248][T25663] ? genl_rcv+0xd/0x40 [ 600.159277][T25663] genl_rcv+0x28/0x40 [ 600.159302][T25663] netlink_unicast+0x82f/0x9e0 [ 600.159330][T25663] ? __pfx_netlink_unicast+0x10/0x10 [ 600.159350][T25663] ? __alloc_skb+0x198/0x3a0 [ 600.159371][T25663] ? netlink_sendmsg+0x642/0xb30 [ 600.159394][T25663] ? skb_put+0x11b/0x210 [ 600.159417][T25663] netlink_sendmsg+0x805/0xb30 [ 600.159449][T25663] ? __pfx_netlink_sendmsg+0x10/0x10 [ 600.159476][T25663] ? aa_sock_msg_perm+0xf1/0x1b0 [ 600.159503][T25663] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 600.159521][T25663] ? __pfx_netlink_sendmsg+0x10/0x10 [ 600.159546][T25663] __sock_sendmsg+0x21c/0x270 [ 600.159578][T25663] ____sys_sendmsg+0x505/0x820 [ 600.159607][T25663] ? __pfx_____sys_sendmsg+0x10/0x10 [ 600.159640][T25663] ? import_iovec+0x74/0xa0 [ 600.159665][T25663] ___sys_sendmsg+0x21f/0x2a0 [ 600.159689][T25663] ? __pfx____sys_sendmsg+0x10/0x10 [ 600.159755][T25663] ? __fget_files+0x2a/0x420 [ 600.159780][T25663] ? __fget_files+0x3a0/0x420 [ 600.159815][T25663] __x64_sys_sendmsg+0x19b/0x260 [ 600.159842][T25663] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 600.159876][T25663] ? __pfx_ksys_write+0x10/0x10 [ 600.159908][T25663] do_syscall_64+0xec/0xf80 [ 600.159929][T25663] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 600.159948][T25663] ? trace_irq_disable+0x37/0x100 [ 600.159972][T25663] ? clear_bhb_loop+0x60/0xb0 [ 600.159996][T25663] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 600.160015][T25663] RIP: 0033:0x7f18acd8f749 [ 600.160034][T25663] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 600.160053][T25663] RSP: 002b:00007f18adc1f038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 600.160076][T25663] RAX: ffffffffffffffda RBX: 00007f18acfe6090 RCX: 00007f18acd8f749 [ 600.160092][T25663] RDX: 0000000004000000 RSI: 0000200000000280 RDI: 0000000000000007 [ 600.160105][T25663] RBP: 00007f18adc1f090 R08: 0000000000000000 R09: 0000000000000000 [ 600.160116][T25663] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 600.160126][T25663] R13: 00007f18acfe6128 R14: 00007f18acfe6090 R15: 00007ffe674d51c8 [ 600.160156][T25663] [ 600.527806][ T3077] bond4: (slave lo): failed to get link speed/duplex [ 600.564920][T25607] chnl_net:caif_netlink_parms(): no params data found [ 600.758738][T25672] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5978'. [ 600.781680][T25676] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5977'. [ 600.845344][T25680] netlink: 8 bytes leftover after parsing attributes in process `syz.5.5980'. [ 600.898069][ T13] bond4: (slave lo): failed to get link speed/duplex [ 601.060913][ T5832] Bluetooth: hci5: command tx timeout [ 601.103368][T25607] bridge0: port 1(bridge_slave_0) entered blocking state [ 601.112174][T25607] bridge0: port 1(bridge_slave_0) entered disabled state [ 601.123728][T25607] bridge_slave_0: entered allmulticast mode [ 601.143230][T25607] bridge_slave_0: entered promiscuous mode [ 601.161035][T25698] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5985'. [ 601.162488][ T13] bond4: (slave lo): failed to get link speed/duplex [ 601.177969][T25607] bridge0: port 2(bridge_slave_1) entered blocking state [ 601.180459][T25694] netlink: 8 bytes leftover after parsing attributes in process `syz.5.5982'. [ 601.185795][T25607] bridge0: port 2(bridge_slave_1) entered disabled state [ 601.205309][T25607] bridge_slave_1: entered allmulticast mode [ 601.214743][T25607] bridge_slave_1: entered promiscuous mode [ 601.331365][T25607] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 601.358331][T25706] ip6gretap1: entered promiscuous mode [ 601.364272][T25706] ip6gretap1: entered allmulticast mode [ 601.381358][T25607] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 601.481873][T25713] FAULT_INJECTION: forcing a failure. [ 601.481873][T25713] name failslab, interval 1, probability 0, space 0, times 0 [ 601.496929][T25713] CPU: 1 UID: 0 PID: 25713 Comm: syz.3.5986 Not tainted syzkaller #0 PREEMPT(full) [ 601.496960][T25713] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 601.496973][T25713] Call Trace: [ 601.496981][T25713] [ 601.496990][T25713] dump_stack_lvl+0xe8/0x150 [ 601.497019][T25713] should_fail_ex+0x414/0x560 [ 601.497052][T25713] should_failslab+0xa8/0x100 [ 601.497077][T25713] __kmalloc_noprof+0xdf/0x800 [ 601.497097][T25713] ? kobject_get_path+0xc5/0x2f0 [ 601.497117][T25713] ? kernfs_rename_ns+0x2d9/0x7a0 [ 601.497146][T25713] kobject_get_path+0xc5/0x2f0 [ 601.497175][T25713] kobject_rename+0x18b/0x510 [ 601.497199][T25713] ? kernfs_put+0x40e/0x470 [ 601.497220][T25713] ? __pfx_kobject_rename+0x10/0x10 [ 601.497247][T25713] ? sysfs_rename_link_ns+0x178/0x1b0 [ 601.497269][T25713] device_rename+0x15d/0x220 [ 601.497291][T25713] cfg802154_switch_netns+0x1ff/0x3d0 [ 601.497321][T25713] nl802154_wpan_phy_netns+0x13e/0x3d0 [ 601.497344][T25713] genl_family_rcv_msg_doit+0x215/0x300 [ 601.497369][T25713] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 601.497400][T25713] ? bpf_lsm_capable+0x9/0x20 [ 601.497422][T25713] ? security_capable+0x7e/0x2e0 [ 601.497453][T25713] genl_rcv_msg+0x60e/0x790 [ 601.497489][T25713] ? __pfx_genl_rcv_msg+0x10/0x10 [ 601.497518][T25713] ? __pfx_nl802154_pre_doit+0x10/0x10 [ 601.497550][T25713] ? __pfx_nl802154_wpan_phy_netns+0x10/0x10 [ 601.497567][T25713] ? __pfx_nl802154_post_doit+0x10/0x10 [ 601.497609][T25713] netlink_rcv_skb+0x208/0x470 [ 601.497635][T25713] ? __pfx_genl_rcv_msg+0x10/0x10 [ 601.497667][T25713] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 601.497690][T25713] ? genl_rcv+0x19/0x40 [ 601.497732][T25713] ? down_read+0x274/0x2e0 [ 601.497752][T25713] ? genl_rcv+0xd/0x40 [ 601.497781][T25713] genl_rcv+0x28/0x40 [ 601.497808][T25713] netlink_unicast+0x82f/0x9e0 [ 601.497839][T25713] ? __pfx_netlink_unicast+0x10/0x10 [ 601.497861][T25713] ? __alloc_skb+0x198/0x3a0 [ 601.497882][T25713] ? netlink_sendmsg+0x642/0xb30 [ 601.497906][T25713] ? skb_put+0x11b/0x210 [ 601.497931][T25713] netlink_sendmsg+0x805/0xb30 [ 601.497967][T25713] ? __pfx_netlink_sendmsg+0x10/0x10 [ 601.497996][T25713] ? aa_sock_msg_perm+0xf1/0x1b0 [ 601.498022][T25713] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 601.498041][T25713] ? __pfx_netlink_sendmsg+0x10/0x10 [ 601.498068][T25713] __sock_sendmsg+0x21c/0x270 [ 601.498100][T25713] ____sys_sendmsg+0x505/0x820 [ 601.498127][T25713] ? __pfx_____sys_sendmsg+0x10/0x10 [ 601.498156][T25713] ? import_iovec+0x74/0xa0 [ 601.498180][T25713] ___sys_sendmsg+0x21f/0x2a0 [ 601.498206][T25713] ? __pfx____sys_sendmsg+0x10/0x10 [ 601.498264][T25713] ? __fget_files+0x2a/0x420 [ 601.498286][T25713] ? __fget_files+0x3a0/0x420 [ 601.498319][T25713] __x64_sys_sendmsg+0x19b/0x260 [ 601.498344][T25713] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 601.498376][T25713] ? __pfx_ksys_write+0x10/0x10 [ 601.498406][T25713] do_syscall_64+0xec/0xf80 [ 601.498425][T25713] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 601.498444][T25713] ? trace_irq_disable+0x37/0x100 [ 601.498469][T25713] ? clear_bhb_loop+0x60/0xb0 [ 601.498494][T25713] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 601.498513][T25713] RIP: 0033:0x7f961eb8f749 [ 601.498543][T25713] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 601.498560][T25713] RSP: 002b:00007f961f95b038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 601.498580][T25713] RAX: ffffffffffffffda RBX: 00007f961ede6090 RCX: 00007f961eb8f749 [ 601.498595][T25713] RDX: 0000000004000000 RSI: 0000200000000280 RDI: 0000000000000007 [ 601.498609][T25713] RBP: 00007f961f95b090 R08: 0000000000000000 R09: 0000000000000000 [ 601.498621][T25713] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 601.498633][T25713] R13: 00007f961ede6128 R14: 00007f961ede6090 R15: 00007ffefba4d128 [ 601.498668][T25713] [ 601.499956][T25713] ------------[ cut here ]------------ [ 601.909651][T25713] WARNING: net/ieee802154/core.c:258 at cfg802154_switch_netns+0x3c7/0x3d0, CPU#1: syz.3.5986/25713 [ 601.921000][T25713] Modules linked in: [ 601.927715][T25713] CPU: 1 UID: 0 PID: 25713 Comm: syz.3.5986 Not tainted syzkaller #0 PREEMPT(full) [ 601.938082][T25713] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 601.948301][T25713] RIP: 0010:cfg802154_switch_netns+0x3c7/0x3d0 [ 601.955545][T25713] Code: e1 07 38 c1 7c 8d 4c 89 e7 e8 55 35 17 f7 eb 83 e8 ae 15 b1 f6 e9 62 fe ff ff e8 a4 15 b1 f6 e9 58 fe ff ff e8 9a 15 b1 f6 90 <0f> 0b 90 e9 4a fe ff ff 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 601.975644][T25713] RSP: 0018:ffffc9000e95f340 EFLAGS: 00010293 [ 601.982298][T25713] RAX: ffffffff8b0fe226 RBX: 00000000fffffff4 RCX: ffff8880589dbd00 [ 601.991648][T25713] RDX: 0000000000000000 RSI: 00000000fffffff4 RDI: 0000000000000000 [ 602.000239][T25713] RBP: 0000000000000000 R08: ffffffff8f822c77 R09: 1ffffffff1f0458e [ 602.008811][T25713] R10: dffffc0000000000 R11: fffffbfff1f0458f R12: ffff8880275a4198 [ 602.017889][T25713] R13: dffffc0000000000 R14: dffffc0000000000 R15: ffff888031634b80 [ 602.025912][T25713] FS: 00007f961f95b6c0(0000) GS:ffff888125f1f000(0000) knlGS:0000000000000000 [ 602.035430][T25713] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 602.042332][T25713] CR2: 00007f33007b42f8 CR3: 00000000583a0000 CR4: 00000000003526f0 [ 602.050934][T25713] Call Trace: [ 602.054509][T25713] [ 602.058115][T25713] nl802154_wpan_phy_netns+0x13e/0x3d0 [ 602.063615][T25713] genl_family_rcv_msg_doit+0x215/0x300 [ 602.069514][T25713] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 602.075689][T25713] ? bpf_lsm_capable+0x9/0x20 [ 602.080700][T25713] ? security_capable+0x7e/0x2e0 [ 602.085688][T25713] genl_rcv_msg+0x60e/0x790 [ 602.090654][T25713] ? __pfx_genl_rcv_msg+0x10/0x10 [ 602.095705][T25713] ? __pfx_nl802154_pre_doit+0x10/0x10 [ 602.101339][T25713] ? __pfx_nl802154_wpan_phy_netns+0x10/0x10 [ 602.107390][T25713] ? __pfx_nl802154_post_doit+0x10/0x10 [ 602.112952][T25713] netlink_rcv_skb+0x208/0x470 [ 602.117840][T25713] ? __pfx_genl_rcv_msg+0x10/0x10 [ 602.122869][T25713] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 602.128467][T25713] ? genl_rcv+0x19/0x40 [ 602.132650][T25713] ? down_read+0x274/0x2e0 [ 602.137363][T25713] ? genl_rcv+0xd/0x40 [ 602.141448][T25713] genl_rcv+0x28/0x40 [ 602.145447][T25713] netlink_unicast+0x82f/0x9e0 [ 602.150579][T25713] ? __pfx_netlink_unicast+0x10/0x10 [ 602.156558][T25713] ? __alloc_skb+0x198/0x3a0 [ 602.161197][T25713] ? netlink_sendmsg+0x642/0xb30 [ 602.166779][T25713] ? skb_put+0x11b/0x210 [ 602.171050][T25713] netlink_sendmsg+0x805/0xb30 [ 602.175821][T25713] ? __pfx_netlink_sendmsg+0x10/0x10 [ 602.181517][T25713] ? aa_sock_msg_perm+0xf1/0x1b0 [ 602.187048][T25713] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 602.192363][T25713] ? __pfx_netlink_sendmsg+0x10/0x10 [ 602.198224][T25713] __sock_sendmsg+0x21c/0x270 [ 602.202946][T25713] ____sys_sendmsg+0x505/0x820 [ 602.208122][T25713] ? __pfx_____sys_sendmsg+0x10/0x10 [ 602.213432][T25713] ? import_iovec+0x74/0xa0 [ 602.218290][T25713] ___sys_sendmsg+0x21f/0x2a0 [ 602.222980][T25713] ? __pfx____sys_sendmsg+0x10/0x10 [ 602.228496][T25713] ? __fget_files+0x2a/0x420 [ 602.233092][T25713] ? __fget_files+0x3a0/0x420 [ 602.238098][T25713] __x64_sys_sendmsg+0x19b/0x260 [ 602.243066][T25713] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 602.248839][T25713] ? __pfx_ksys_write+0x10/0x10 [ 602.253742][T25713] do_syscall_64+0xec/0xf80 [ 602.258890][T25713] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 602.264975][T25713] ? trace_irq_disable+0x37/0x100 [ 602.270670][T25713] ? clear_bhb_loop+0x60/0xb0 [ 602.275380][T25713] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 602.281628][T25713] RIP: 0033:0x7f961eb8f749 [ 602.286052][T25713] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 602.306044][T25713] RSP: 002b:00007f961f95b038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 602.314771][T25713] RAX: ffffffffffffffda RBX: 00007f961ede6090 RCX: 00007f961eb8f749 [ 602.323043][T25713] RDX: 0000000004000000 RSI: 0000200000000280 RDI: 0000000000000007 [ 602.331371][T25713] RBP: 00007f961f95b090 R08: 0000000000000000 R09: 0000000000000000 [ 602.339739][T25713] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 602.348140][T25713] R13: 00007f961ede6128 R14: 00007f961ede6090 R15: 00007ffefba4d128 [ 602.356218][T25713] [ 602.359255][T25713] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 602.366535][T25713] CPU: 1 UID: 0 PID: 25713 Comm: syz.3.5986 Not tainted syzkaller #0 PREEMPT(full) [ 602.375917][T25713] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 602.386020][T25713] Call Trace: [ 602.389322][T25713] [ 602.392264][T25713] vpanic+0x1e0/0x670 [ 602.396254][T25713] panic+0xb9/0xc0 [ 602.399987][T25713] ? __pfx_panic+0x10/0x10 [ 602.404420][T25713] __warn+0x317/0x4b0 [ 602.408405][T25713] ? cfg802154_switch_netns+0x3c7/0x3d0 [ 602.413965][T25713] ? cfg802154_switch_netns+0x3c7/0x3d0 [ 602.419518][T25713] __report_bug+0x288/0x500 [ 602.424024][T25713] ? __x64_sys_sendmsg+0x19b/0x260 [ 602.429134][T25713] ? do_syscall_64+0xec/0xf80 [ 602.433811][T25713] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 602.439871][T25713] ? cfg802154_switch_netns+0x3c7/0x3d0 [ 602.445427][T25713] ? __pfx___report_bug+0x10/0x10 [ 602.450476][T25713] ? cfg802154_switch_netns+0x3c7/0x3d0 [ 602.456035][T25713] report_bug+0x16a/0x220 [ 602.460362][T25713] ? cfg802154_switch_netns+0x3c7/0x3d0 [ 602.465918][T25713] ? cfg802154_switch_netns+0x3c9/0x3d0 [ 602.471475][T25713] handle_bug+0x98/0x200 [ 602.475738][T25713] exc_invalid_op+0x1a/0x50 [ 602.480267][T25713] asm_exc_invalid_op+0x1a/0x20 [ 602.485124][T25713] RIP: 0010:cfg802154_switch_netns+0x3c7/0x3d0 [ 602.491288][T25713] Code: e1 07 38 c1 7c 8d 4c 89 e7 e8 55 35 17 f7 eb 83 e8 ae 15 b1 f6 e9 62 fe ff ff e8 a4 15 b1 f6 e9 58 fe ff ff e8 9a 15 b1 f6 90 <0f> 0b 90 e9 4a fe ff ff 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 602.510901][T25713] RSP: 0018:ffffc9000e95f340 EFLAGS: 00010293 [ 602.517110][T25713] RAX: ffffffff8b0fe226 RBX: 00000000fffffff4 RCX: ffff8880589dbd00 [ 602.525094][T25713] RDX: 0000000000000000 RSI: 00000000fffffff4 RDI: 0000000000000000 [ 602.533788][T25713] RBP: 0000000000000000 R08: ffffffff8f822c77 R09: 1ffffffff1f0458e [ 602.541778][T25713] R10: dffffc0000000000 R11: fffffbfff1f0458f R12: ffff8880275a4198 [ 602.549756][T25713] R13: dffffc0000000000 R14: dffffc0000000000 R15: ffff888031634b80 [ 602.557745][T25713] ? cfg802154_switch_netns+0x3c6/0x3d0 [ 602.563426][T25713] nl802154_wpan_phy_netns+0x13e/0x3d0 [ 602.568907][T25713] genl_family_rcv_msg_doit+0x215/0x300 [ 602.574472][T25713] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 602.580554][T25713] ? bpf_lsm_capable+0x9/0x20 [ 602.585241][T25713] ? security_capable+0x7e/0x2e0 [ 602.590191][T25713] genl_rcv_msg+0x60e/0x790 [ 602.594709][T25713] ? __pfx_genl_rcv_msg+0x10/0x10 [ 602.599826][T25713] ? __pfx_nl802154_pre_doit+0x10/0x10 [ 602.605290][T25713] ? __pfx_nl802154_wpan_phy_netns+0x10/0x10 [ 602.611274][T25713] ? __pfx_nl802154_post_doit+0x10/0x10 [ 602.616841][T25713] netlink_rcv_skb+0x208/0x470 [ 602.621607][T25713] ? __pfx_genl_rcv_msg+0x10/0x10 [ 602.626644][T25713] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 602.631939][T25713] ? genl_rcv+0x19/0x40 [ 602.636113][T25713] ? down_read+0x274/0x2e0 [ 602.640529][T25713] ? genl_rcv+0xd/0x40 [ 602.644607][T25713] genl_rcv+0x28/0x40 [ 602.648638][T25713] netlink_unicast+0x82f/0x9e0 [ 602.653413][T25713] ? __pfx_netlink_unicast+0x10/0x10 [ 602.658695][T25713] ? __alloc_skb+0x198/0x3a0 [ 602.663285][T25713] ? netlink_sendmsg+0x642/0xb30 [ 602.668223][T25713] ? skb_put+0x11b/0x210 [ 602.672475][T25713] netlink_sendmsg+0x805/0xb30 [ 602.677247][T25713] ? __pfx_netlink_sendmsg+0x10/0x10 [ 602.683108][T25713] ? aa_sock_msg_perm+0xf1/0x1b0 [ 602.688066][T25713] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 602.693363][T25713] ? __pfx_netlink_sendmsg+0x10/0x10 [ 602.698661][T25713] __sock_sendmsg+0x21c/0x270 [ 602.703359][T25713] ____sys_sendmsg+0x505/0x820 [ 602.708127][T25713] ? __pfx_____sys_sendmsg+0x10/0x10 [ 602.713446][T25713] ? import_iovec+0x74/0xa0 [ 602.718170][T25713] ___sys_sendmsg+0x21f/0x2a0 [ 602.722865][T25713] ? __pfx____sys_sendmsg+0x10/0x10 [ 602.728095][T25713] ? __fget_files+0x2a/0x420 [ 602.732693][T25713] ? __fget_files+0x3a0/0x420 [ 602.737390][T25713] __x64_sys_sendmsg+0x19b/0x260 [ 602.742341][T25713] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 602.747817][T25713] ? __pfx_ksys_write+0x10/0x10 [ 602.752864][T25713] do_syscall_64+0xec/0xf80 [ 602.757455][T25713] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 602.763541][T25713] ? trace_irq_disable+0x37/0x100 [ 602.768588][T25713] ? clear_bhb_loop+0x60/0xb0 [ 602.773293][T25713] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 602.779297][T25713] RIP: 0033:0x7f961eb8f749 [ 602.783734][T25713] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 602.803361][T25713] RSP: 002b:00007f961f95b038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 602.811787][T25713] RAX: ffffffffffffffda RBX: 00007f961ede6090 RCX: 00007f961eb8f749 [ 602.819766][T25713] RDX: 0000000004000000 RSI: 0000200000000280 RDI: 0000000000000007 [ 602.827739][T25713] RBP: 00007f961f95b090 R08: 0000000000000000 R09: 0000000000000000 [ 602.835714][T25713] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 602.843779][T25713] R13: 00007f961ede6128 R14: 00007f961ede6090 R15: 00007ffefba4d128 [ 602.851772][T25713] [ 602.855155][T25713] Kernel Offset: disabled [ 602.859476][T25713] Rebooting in 86400 seconds..