last executing test programs: 4.208915784s ago: executing program 4 (id=4475): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000003c0)=@newtaction={0xe68, 0x30, 0x871a15abc695fa3d, 0x70bd2d, 0x1, {}, [{0xe54, 0x1, [@m_pedit={0xe50, 0x1, 0x0, 0x0, {{0xa}, {0xe24, 0x2, 0x0, 0x1, [@TCA_PEDIT_PARMS={0xe20, 0x2, {{{0x0, 0x300}, 0x93}, [{0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x3}, {0x0, 0x0, 0x0, 0x0, 0x3000000, 0x40000000}, {0x1, 0x0, 0x0, 0x4000000, 0x7, 0x80000}, {0x8000, 0x5, 0x0, 0xfffffffc, 0x5, 0x1}, {0x0, 0x8000000}, {0x0, 0x0, 0x800000, 0x0, 0x6, 0x80000001}, {0xffff4c74, 0xc3}, {0x0, 0x5, 0x0, 0x9}, {0x5}, {0x0, 0x0, 0x0, 0x8}, {0x0, 0x10, 0x0, 0xfffffffd}, {0x0, 0x470a, 0x0, 0x8000000}, {}, {0x2, 0x0, 0x0, 0x0, 0x6, 0x6}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, {0x0, 0x0, 0x0, 0x1, 0x0, 0xfff}, {0x0, 0x0, 0x0, 0x8000000}, {}, {0x0, 0x0, 0x0, 0x0, 0xd9f7}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000}, {0x0, 0x0, 0x0, 0xfffffffc}, {0x20000, 0x0, 0x0, 0x0, 0xfffffffe}, {}, {0x0, 0x7, 0x0, 0x0, 0xffffffff}, {0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x3}, {0x2, 0x0, 0x0, 0x0, 0x5, 0xfffffffc}, {0xffffffff, 0x0, 0x0, 0x0, 0xfffffffd, 0x60569add}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, {0xffffffff, 0x5, 0x0, 0x0, 0x4}, {0xffffffff, 0x0, 0x0, 0x0, 0xfffff800}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x400000}, {}, {0xffffffff, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, {0xfffffffd}, {0x0, 0x5}, {0x0, 0x9, 0x0, 0xffffffff, 0x0, 0x2}, {}, {0x80}, {0x80}, {0x0, 0x0, 0x0, 0x5, 0x5}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x2a}, {0x0, 0x0, 0x8}, {0x0, 0x2, 0x0, 0x0, 0x9}, {0x0, 0x0, 0x8, 0x0, 0x3}, {0x0, 0x9}, {0x0, 0xffffffff, 0x0, 0x0, 0x2}, {0x0, 0x0, 0x0, 0x8510}, {0xffff}, {0x2}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, {0x0, 0xfffefffd, 0x0, 0x0, 0x0, 0x2}, {0x0, 0x0, 0x0, 0x1, 0x0, 0xfffffffc}, {}, {0x5}, {0x0, 0x0, 0x2000, 0x0, 0x0, 0x8000000}, {0x0, 0x7, 0x0, 0x0, 0x2}, {}, {0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x9}, {0x0, 0xfffffffc, 0x200}, {0x0, 0xe3b6, 0x0, 0x200}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x40000}, {0x4, 0x0, 0xfa48}, {0x0, 0x0, 0x0, 0x0, 0xfffffffb}, {0x0, 0x0, 0x800}, {0xdb3, 0x300, 0x0, 0x0, 0x0, 0x1}, {0x0, 0x101, 0x0, 0x0, 0x0, 0x1}, {}, {0x3, 0xfffffffe}, {0x0, 0x0, 0x0, 0x4, 0x9}, {0x4, 0x0, 0xff}, {0x0, 0x0, 0x0, 0x0, 0x1, 0x7}, {0x0, 0xb}, {}, {0x0, 0x0, 0x2}, {0x0, 0x5, 0xe}, {0x2000, 0x0, 0x0, 0x0, 0x0, 0x56}, {0x0, 0x9797, 0x0, 0xec33, 0x0, 0x4}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x20000}, {0xb, 0x0, 0x0, 0x0, 0x0, 0xfe1}, {0x0, 0x0, 0x9, 0x0, 0x4}, {0x0, 0x0, 0xfffffffc}, {}, {0x0, 0xfffffffd, 0x0, 0x0, 0x8000}, {0x6, 0x0, 0x0, 0x0, 0x0, 0x1}, {0x7f}, {0x0, 0x0, 0x0, 0x8}, {0x0, 0x8, 0x0, 0x0, 0xfffffffe}, {0x4, 0x2, 0x6, 0x2, 0x0, 0xfffffffe}, {0x0, 0xfffffffd, 0x0, 0x0, 0xe9d, 0x58a}, {0x2}, {0x2, 0x9, 0x20000000}, {0xfffffffc}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x292}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x81, 0x0, 0x0, 0x2}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x101}, {0x0, 0x5, 0x0, 0x7, 0x1}, {0x0, 0x5}, {0x0, 0x0, 0x0, 0x0, 0x80, 0x2}, {0x10000008, 0x0, 0x0, 0x0, 0x4}, {0x0, 0x200000}, {0x0, 0x10000, 0xffffffff, 0x0, 0xfffffffd}, {0x3, 0x0, 0x0, 0x9}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x7fffffff}, {}, {0x0, 0x0, 0x0, 0x8, 0x0, 0xfffffffd}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x3}, {0xfffffffb, 0x0, 0x0, 0x0, 0x8000}, {0x6, 0x0, 0x0, 0x0, 0x0, 0x2}, {0x2d, 0x0, 0x10000, 0x1ff}, {0x0, 0x3, 0x8000}, {0x0, 0x8000}, {0x0, 0x0, 0x1010000}, {0x0, 0x80000000, 0x0, 0x7fff800, 0x87}, {0x0, 0x3}, {0xffffffff, 0x0, 0x0, 0x0, 0xd}, {0x0, 0x0, 0x800}], [{}, {}, {0x0, 0x1}, {0x1, 0x1}, {}, {0x3}, {}, {0x0, 0x1}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {}, {0x3, 0x1}, {0x0, 0x1}, {}, {0x5, 0x1}, {}, {0x4}, {0x3}, {}, {}, {}, {}, {}, {}, {}, {0x5}, {}, {0x4}, {}, {}, {0x1}, {}, {0x0, 0x1}, {0x0, 0x1}, {}, {}, {0x4}, {}, {}, {}, {}, {}, {0x4}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {}, {0x1}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {}, {}, {}, {0x0, 0x1}, {}, {0x5}, {0x3}, {0x4}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {}, {}, {}, {}, {}, {}, {0x5}, {}, {0x0, 0x1}, {}, {0x0, 0x1}, {}, {}, {0x1}, {}, {0x1}, {0x1}, {}, {0x5}, {}, {}, {}, {}, {}, {0x0, 0x1}, {}, {0x2, 0x1}, {}, {}, {0x1}, {}, {0x5, 0x1}, {}, {0x3}, {}, {0x2}, {}, {}, {0x4}, {0x3}, {}, {}, {}, {}, {0x0, 0x1}]}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xe68}}, 0x200c0) 3.617031699s ago: executing program 4 (id=4479): mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) socket$inet6(0xa, 0x3, 0x88) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000fc0)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00010000850000000d000000b7000000000000009500000000000000496cf2827fb43a431ca711fcc9cdfa146ec56175037958e271f60d25b7937f02c8695e5a1b2cdf41dc10d1e8bf076d83923dd29c034055b67dafe6c8dc3d5d78c07fa1f7e4d5b318e2ec0e0700897a74a0091ff110026e6d2ef831ab7ea0c34f17e3ad6ef3bb622003b538dfd8e012e79578e51bc53099e90fbdb2ca8eeb9c15ab3a14817ac61e4dd11183a13477bf7e060e3670ef0e789f93781965f1328d6704902cbe7bc0476619f28d99cd0aa7b73340cc2160a1fe3c184b751c51160fbce841f8a97be6148ba532e6ea09c346dfebd31a08b32808b80200000000009dd27080e71113610e10d859e8327ef03fb6c86adac12233f9a1fb9c2aec61ce63a3462fd50117b89a9ab759b4eeb8cb000067d42b4e54861d0227dbfd2ed8576a3f7f3deadd7130856f756436303767d2e24f29e5dad9796edb697a6ea0180aabc18cae2ed4b4390af9a9ceafd07ed0030000002cab154ad029a119ca3c972780870014605c83d7d11c3c975d5aec84222fff0d7216fdb0d3a0ec4bfae563112f4b391aafe234870072858dc06e7c337642d3e5a815212f5e16c1b30c3a2a71bc85018e5ff2c910496f18afc9ffc2cc788bee1b47683db01a46939868d75211bbae0e7313bff5d4c391ddece00fc772dd6b4d4d0a917b239fe12280fc92c88c5b8dcdcc22ee1747790a8992533ac2a9f5a699593f084419cae0b4183fb01c73f99857399537f5dc2acb72c7eae993fc9eb22d130665b6341da114f08cd0509d380578673fffffff7f23877a6b24db0e067345560942fa629fbef2461c96a08707671215c302fae29187d4f5c06a960fd37c10223fdae7ed04935c3c90d3add8eebc8619d73415e6adcda2130f5011e42e50adab988dd8e12baf5c768a40538be5f76e9c2977aab37d9a44cfc1c7b4000000000000fa47742f6c5b9c4b11e7d7262a1457c39495c826b956ba859adfe38f77b91bd7d5ca1664fe2f3ced8468911806e8916dc15e21644db60c2499d5d16d7d915836ab26c169482008ef069dc42749289f854797f2f900c2a12d8c38a967c1bbe09315c29877a331bcc87dc3addb08141bdee5d27874b2f663ddeef0005b3d96c7aae73835d5a3cda9e90d76c1993e0799d4894ee7f8249dc1e3428d2129369ee1b85afa1a5be5f6eb2eea0d0df414b315f65112412392191fa83ee830548ef8e1038debd64cbe359454a3f2239cfe35f81b7aded448859968ff0e90500d0b07c0dd00490f167e6d5c1109681739dc33f75b20428d6474a0a91ee90b8de802c6b538622e6bbcb80f87b415263c401e64ed69a2f75409000000000000001d695c4559b82cabac3cccadc1e1c19af4e03020abf5ff0433d660f20898d2a045d009a0ffb20a77c9af2b80c05184a66d30bbea2ca45a4d6d6d1e6e79aef42355a500587b603306a5af8d867d80a07f10d82eafb030621204d3ded6f260af62d91faae95196d5e3ff010000000000000be959096ea948cfa8e7194123e918914a71ad5a8521fb9553bc60f7d9719b55b3abb6bba3d113a680a8d46fe074c83fbe378a3889e8145b2eaceab05ef932c6e4f8ef0ed0d818a7b76d839cf3c63ebb4380b168c38fa32e49563cfee3a7f0fc18bfa32c418cef875fb49e2989177a30280bc586e79a5dd8076c248e7d6e97b3ce267dd4e27b6ef206660090bb2164474cef378f97ca33fc03000000000000001547053453d0c9aec91a24079b21d52fb5516bf0c28ef37aa76442f6083dc99cd61afaf6be45d7b00d3639f2f10ac2d5ffff000000000000c24411d415b6b085fb73a2c7c3852e0e658ffeb4e863428a792bee94f6cd895424360e0464f9d7ea425f2fa6aac029d15af607ad83532ff181c985f54b39370c06e63055b4d6a36fa98a44e379d28307c9912fb097601f3f88a2ca6fd1f9320cfe7fc8e9f7f15f02e177ce23f43a154b42e26f037e8a01377cbd3f509e6e540c9ba9c2a589ac5d8ad67a65e9a44c576dc24452eaa9d819e2b04bdd1c000000070000000000000000000000005333c6199c12dcd926891927a7267c47cf897853d160100b39b613faefe16bed1fc105dddd77ab929b837d54aa17eb9fbdc2bdc0e98ae2c3f23a6131e2879f04ff01000030b92dd493be66c2242f8184733b80ba28e8ffffff7f00000000bb2f89049c5f6d63d56995747639964217aacfe548bc869098aa8e07e51dbc9e2d4db3c5f79fd355222ec2a00cf7f2ccd6dd6d2dc2a815d8314221a5472f1318a9dfbec5a759579caf3262129b14e99040b5d91398e17df85c25ccae973eecc7d187168d5c9cd848d566cc17587641ed01889c927da38d83314480b15e23138c5b877a72bd4cf74a299df4fbfc8e6ea96939f15d254d9033c5a45706bda78ab60200000000000000000000000000000000000000706f78f0a2ea9667fb5b951808545a46830970c2dfae01adbda7d29bf1f7abdaf52e0de6f9d7150808ed086642e64ebf98762b34338b80e41b704c3eefaf0bb5f7d895de17a10b0a0ea15ccc0d7a830b6eb33b6b21675511d693ef5e3c44bbf71cabc5175d879e7499f8baae2a1a09cf38da73297764fbc0e723e1cc3abb12e3076982ed32c94a2ce3e6f37c47e983da4ca5c96187db5a2a2e1742bc93a65d7187126126b3a80f17dd2f7dbbe82d104ede9ba6925afc2ee6cb94f56f1363cad635abf8f983292c49c0ebf5005154c7b58a3a2a2e5a00d2f953a86d2fd92b8661264f781e3fb02d05a28f3f17b64d0258853d45cb5ebde10cd3d82eeed2f1ed925b7cf400304932c5ed0a362b235ce37e1f17700f7d1fecf8be8a2c5d25a9c60657560d05441387ff158a018d19a286c56d0886eb59d509ee89cc2df52881d005b2e5c27563ba54e4153c132d0366a9660000000000000009c1aaec93ec0f925921fb2e9eb202a29bef28224dbabe723de5c584bc398a8792e493048c87f60a51a391e959212181d4bf32ed89c96d421c8171698c49403558fd13c649f90b0911d57eeb298b590581eba1ce383b539ab80fd15445987b1bb4eb512545e1ab65fef310e10b1ee362b51c72f82edf2f502ddf52567775e34a56d1be892f1e62b08950d517fa6fb1b0ef2edf1b67f8644786116b037d4a36fdd30b000063e58c856ec44cbbc2d370553f832af9480215e09aaa3843fe360b1c293a14627f2cfbe278f31d0abc0f5aaa10926dbbfe8a4b131c13a73d4e6d065c2c0fed3ab8442520ce0e0ad7d2d177377ab197ace3ef8b1c24ceb0bdee84bd6e6317633938dd19dc42de7f8f860eca6d9c74525fcd3497526df4c13e3ba5f0d75365a4542ae9440d2fede416d618cdaaf7e038879c5d177b3876fda4121e15a00adb976064a93e8d000000000000903350932d3eef7fdada20c19807066e2c72d0d816eb9fa50be213bf6bbb7ccb9f2e8a153e6ced68f192ebed6e86af0f2cec7335fa8039fd6eb025440bc2a34d071f0a0e6774308a2c5986aa9200a1306ffa5a71ca69e89a6980612b35fc858f37c2c398515a910a35e22ab0573c10b85df4c2972a2fb8b9c080fbb41a753791df727fdeadc5cf218a6eda31312256191c620cce34d1e3bf40a4a207ab1575b399eb8155781bfc7cb5920b49c039935a888d77041814f60fbbcafa487ee96b368e8769da90b44190e569fe8b1d155d0765baaca5c5548b5a78bb43e5d9e47a1d5809bb178184b5672d08e29aecf1f572ac1e6cab7e820751beed5f79de29a67a579150bfb31232d296b9d2977ed027ca90af7088d6466f1501d96a32bfa3cf9ab0dcd626ac9341833e92685af6917ae05473ae4768341426e244159b3c3e002b6f8ee80cbe6e26c816ab92658d956d849cd3a21ebf4b143d338035cd91f087633aa668e0644b05dc5a7937cd5fb62bd08242a858aeeda8c0cbb4fc2478a8155b859e88493f322702277939832bd4a1d8109f98c5a187564c9eb80acc63ac57459593c81ce8998e38ea231b81ebaa6b242ebdf382d70232f1d8e516a8eaf39d09ea40198cf1b72eb5ce5327d3a3861470be47a9a9dbf569e6f6f474fd1448adfd70c4f4a4487edaf193a00a808389a110a4286905ba81309735f6ac5d2ba7ab2be01fa25c11dbb3170258e9d9fed944fd85c03336a49f7016517a1988bc84ee301e167d3cf88c46c4eba6e2bfd099acd2eec5c624679aa7ebab76061a9ca792bffe3d6df4dbe70b5cab6299a51e63826fd0bda4846d06e322ebd745e73da718ba0c93e7567df9ed7ea8d2fdbde44e65a4cd01748b"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2b, 0xffffffffffffffff, 0x8, 0x0, 0xff6c}, 0x48) socket(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x2000, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000400)='blkio.bfq.sectors_recursive\x00', 0x275a, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000f40)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)) socketpair(0x1, 0x2, 0x0, &(0x7f0000000000)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x1f, 0x10, &(0x7f0000000040)=ANY=[@ANYBLOB="1800000005000000000000008000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b702000003f80000850000008600000018010000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000050000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000200000085000000a600000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x11}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) r4 = socket$can_bcm(0x1d, 0x2, 0x2) setsockopt$SO_TIMESTAMPING(r4, 0x1, 0x41, &(0x7f0000000000)=0x4011, 0x4) connect$can_bcm(r4, &(0x7f00000005c0), 0x10) recvmmsg(r4, &(0x7f00000099c0)=[{{0x0, 0x0, &(0x7f0000007040)=[{&(0x7f0000006040)=""/4086, 0xff6}], 0x1}, 0x8000}], 0x1, 0x10002, 0x0) sendmsg$can_bcm(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000180)=ANY=[@ANYRES8=0x0, @ANYRES16=r0, @ANYRESHEX=r1], 0x48}, 0x1, 0x0, 0x0, 0x48000}, 0x24028800) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0xd, 0x20000000ec071, 0xffffffffffffffff, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) socket$nl_generic(0x10, 0x3, 0x10) 3.139775131s ago: executing program 3 (id=4487): sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000003c0)=ANY=[@ANYBLOB="84010000100013070000000000000000e0000001000000000000000000000000ac"], 0x184}}, 0x0) r0 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$inet6_int(r0, 0x29, 0x31, &(0x7f0000000100)=0x8, 0x4) bpf$MAP_CREATE(0x0, &(0x7f0000000bc0)=ANY=[@ANYBLOB="06000000", @ANYRES32, @ANYBLOB='\x00'/17, @ANYRES32=0x0], 0x50) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, 0x0, 0x0) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0x10, &(0x7f0000000080)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x8000}, {{0x18, 0x1, 0x1, 0x0, r1}}, {}, [@call={0x85, 0x0, 0x0, 0xe}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x8, '\x00', 0x0, @fallback=0x1e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000003f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x20}, 0x15) socketpair$tipc(0x1e, 0x1, 0x0, 0x0) recvmsg(0xffffffffffffffff, 0x0, 0x1f00) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r4, 0x6, 0xc, &(0x7f0000000180)=0xb, 0x4) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000180), r5) sendmsg$NLBL_MGMT_C_ADD(r3, &(0x7f0000000d80)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000c80)={0x34, r6, 0x1, 0x70bd25, 0x0, {}, [@NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @multicast2}, @NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @private=0xa010101}, @NLBL_MGMT_A_DOMAIN={0x5, 0x1, '\x00'}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000010}, 0x0) sendmsg$IEEE802154_SCAN_REQ(r3, &(0x7f00000002c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000300)=ANY=[@ANYBLOB="14000000", @ANYRES16=0x0, @ANYBLOB="000025db00"/14, @ANYRESDEC=r4, @ANYRESHEX=r4, @ANYRES16=r3], 0x14}, 0x1, 0x0, 0x0, 0xc004}, 0x8041) r7 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="030800de64bbcd5900000004000002bb04fdda5f615e5aa3460f00040000000a00000000000000", @ANYRES32=0x1, @ANYBLOB="000200"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="03000000030000000200"/28], 0x50) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2000006, 0x13, r7, 0x0) r8 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_int(r8, 0x29, 0x21, &(0x7f0000000000)=0x8, 0x4) sendmsg$inet6(r8, &(0x7f0000000280)={&(0x7f00000002c0)={0xa, 0x4e20, 0x0, @empty, 0x4}, 0x1c, 0x0}, 0x4004000) sendmmsg$inet6(r0, &(0x7f0000000380)=[{{&(0x7f0000000000)={0xa, 0x4e1e, 0x3, @empty, 0xfff}, 0x1c, 0x0}}], 0x1, 0x24000001) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="7bedcb5d07081196f37538e486dd6372ce22"], 0x66) r9 = bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x3, 0xc, &(0x7f00000005c0)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000610000001801000020786c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000110b0008850000000500000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0xd, '\x00', 0x0, @sched_cls=0x2f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000003c0)={r9, 0x0, 0xce0, 0x0, &(0x7f0000000000)="c1188e19b95d02ff4284860186dd", 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) recvmmsg(r0, &(0x7f00000003c0), 0x1, 0x40002142, 0x0) 3.130524395s ago: executing program 1 (id=4488): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) r2 = socket$netlink(0x10, 0x3, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e22, 0x40007f, @dev={0xfe, 0x80, '\x00', 0x20}, 0xc7}, 0x1c) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan1\x00'}) sendmsg$AUDIT_USER(r2, &(0x7f0000000400)={&(0x7f0000000200), 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x7c, 0x3ed, 0x300, 0x70bd2b, 0x25dfdbfd, "a762a7164cb00f3508ea69e97c9db65c5d028375f850d147c38b247384d04370e64b3bc620ed288e1f4be2e33f4b4a2379ce9851a7e036c067c3a48eafaf9ce1c3057914e214771caaee1050369d16b1145675bfb67eed6df63cb0f1550c1a8b5e5c9b0de764585a9b", ["", "", "", ""]}, 0x7c}, 0x1, 0x0, 0x0, 0x8000}, 0x4008000) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl(r3, 0x8b2c, &(0x7f0000000040)) r4 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x24}}, 0x0) getsockname$packet(r4, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507000000000000000016000000", @ANYRES32=r5, @ANYBLOB="0000000200000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}]}, 0x30}}, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000002c0)={&(0x7f0000000500)=ANY=[@ANYBLOB="9feb010018000000d40000000c0000000c000000060000000400000000003e6100"/42], 0x0, 0x2a, 0x0, 0x8, 0x1}, 0x28) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x4) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r7) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$batadv(&(0x7f0000000540), r7) sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(r8, &(0x7f0000000700)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000006c0)={&(0x7f0000000640)={0x64, r9, 0x300, 0x70bd28, 0x25dfdbff, {}, [@BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5, 0x2f, 0x1}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0xfffffff9}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x7}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0xffffffff}, @BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x3}]}, 0x64}, 0x1, 0x0, 0x0, 0x4080}, 0x40) getsockname$packet(r7, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route_sched(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000900)=@delchain={0x74, 0x2c, 0xf31, 0x0, 0x2000, {0x0, 0x0, 0x0, r10, {}, {0xfff2, 0xffff}, {0xffff, 0x1}}, [@filter_kind_options=@f_u32={{0x8}, {0x48, 0x2, [@TCA_U32_SEL={0x34, 0x5, {0xa, 0xb, 0x2, 0x6, 0x80, 0x7, 0x2, 0x2, [{0x7, 0x1, 0x9, 0x7}, {0xb, 0x2, 0x6, 0x8}]}}, @TCA_U32_LINK={0x8, 0x3, 0xff}, @TCA_U32_CLASSID={0x8, 0x1, {0xffff, 0x14}}]}}]}, 0x74}, 0x1, 0x0, 0x0, 0x4008844}, 0x4010) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r1, 0x84, 0x6, &(0x7f0000000440)={0x0, @in6={{0xa, 0x4e24, 0xb, @mcast1, 0x582e}}}, &(0x7f0000000500)=0x84) sendmsg$IPCTNL_MSG_CT_GET(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000001010102000000000000000002000000240002800c000280050081003a00000014000180080001000000000008000200000000000c0019800800020099"], 0x44}}, 0x0) r11 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r11, 0x84, 0x7d, 0x0, &(0x7f0000000280)) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000580)=@bpf_lsm={0xe, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="3eaa0000000000007910bd000000000095"], &(0x7f0000000000)='GPL\x00'}, 0x94) 2.839215764s ago: executing program 3 (id=4490): r0 = socket$qrtr(0x2a, 0x2, 0x0) connect$qrtr(r0, &(0x7f0000000040)={0x2a, 0x1, 0xfffffffe}, 0xc) r1 = socket$qrtr(0x2a, 0x2, 0x0) listen(r0, 0x9) recvmmsg(r0, &(0x7f0000000ac0)=[{{0x0, 0xff2c, 0x0}, 0x1}], 0x40, 0x2, 0x0) bind$qrtr(r0, &(0x7f0000000140)={0x2a, 0x1}, 0xc) connect$qrtr(r1, &(0x7f0000000040)={0x2a, 0x1, 0x4000}, 0xc) r2 = socket$inet_tcp(0x2, 0x1, 0x0) writev(r2, &(0x7f0000000000), 0x0) socket$qrtr(0x2a, 0x2, 0x0) (async) connect$qrtr(r0, &(0x7f0000000040)={0x2a, 0x1, 0xfffffffe}, 0xc) (async) socket$qrtr(0x2a, 0x2, 0x0) (async) listen(r0, 0x9) (async) recvmmsg(r0, &(0x7f0000000ac0)=[{{0x0, 0xff2c, 0x0}, 0x1}], 0x40, 0x2, 0x0) (async) bind$qrtr(r0, &(0x7f0000000140)={0x2a, 0x1}, 0xc) (async) connect$qrtr(r1, &(0x7f0000000040)={0x2a, 0x1, 0x4000}, 0xc) (async) socket$inet_tcp(0x2, 0x1, 0x0) (async) writev(r2, &(0x7f0000000000), 0x0) (async) 2.507871609s ago: executing program 2 (id=4493): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r4 = socket$inet(0x2, 0x3, 0xa) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000a80)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a6c000000060a0b04000000000000400002000000400004802800018011000100666c6f775f6f66666c6f616400000000100002800900010073797a300000000014000180"], 0xc8}, 0x1, 0x0, 0x0, 0x2000094}, 0x4000800) sendmmsg$inet(r4, &(0x7f0000000900)=[{{&(0x7f00000000c0)={0x2, 0x4e20, @empty}, 0x10, 0x0, 0x0, &(0x7f0000000ac0)=ANY=[@ANYBLOB="1c000000000000000000000007000000860a00000003"], 0x20}}], 0x1, 0x24000004) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0x6}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x24000084) socket$netlink(0x10, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) openat$6lowpan_control(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=@newqdisc={0x38, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r9, {0x9}, {0xffff, 0xffff}, {0x2, 0x1}}, [@qdisc_kind_options=@q_skbprio={{0xc}, {0x8, 0x2, 0x7}}]}, 0x38}, 0x1, 0x0, 0x0, 0x480d8}, 0x4000080) r10 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000140)=@newqdisc={0x30, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r11, {0x4}, {0xffff, 0xffff}, {0xffff, 0x6}}, [@qdisc_kind_options=@q_fq={{0x7}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x4005c}, 0x0) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x1, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000000)) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x48) connect$can_bcm(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r12 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r12, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)=ANY=[@ANYBLOB="000000100001000000f6ffffffffffffff0000", @ANYRES32=0x0, @ANYBLOB="000000002104020008001b0000000000"], 0x28}, 0x1, 0x0, 0x0, 0x4040000}, 0x8024) socket(0x80000000000000a, 0x2, 0x0) 2.498665402s ago: executing program 1 (id=4494): socket$inet6_sctp(0xa, 0x1, 0x84) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000140)={0xa, 0x4e20, 0xd4d, @loopback, 0xe}, 0x1c) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000300)={0xa, 0x4e23, 0xfffffffe, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x31}}}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000280)=@gcm_256={{0x303}, "1afc7c14d332bcc6", "a9ba0c85d68723369f51322151d9f41aaa2832bb07cc1e49ad714beac6f1ade8", "49960d8f", "bff2a81527ae4190"}, 0x38) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nbd(&(0x7f0000000200), r1) sendmsg$NBD_CMD_CONNECT(r1, &(0x7f00000027c0)={0x0, 0x0, &(0x7f0000002780)={&(0x7f00000002c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010029bd7000fbdbdf25010000000c00020000000000000000001c0007801800018008000100", @ANYBLOB="04"], 0x3c}, 0x1, 0x0, 0x0, 0x4000004}, 0x4000) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='freezer.state\x00', 0x275a, 0x0) write$cgroup_int(r3, &(0x7f0000000000), 0xffffff6a) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r3, 0x84, 0x1d, &(0x7f00000003c0), &(0x7f0000000340)=0x4) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) r5 = socket$inet6_sctp(0xa, 0x6, 0x84) setsockopt$MRT_DEL_VIF(r3, 0x0, 0xcb, &(0x7f0000000480)={0x0, 0x0, 0x7, 0x2b, @vifc_lcl_addr=@local, @broadcast}, 0x10) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) r7 = socket$nl_crypto(0x10, 0x3, 0x15) sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="e00000001300100000000000000000007374726565626f673531322d67656e657269"], 0xe0}}, 0x0) sendmsg$nl_crypto(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000005c0)=ANY=[@ANYRES8=0x0, @ANYRES32=0x0, @ANYBLOB="74d012fccf067084c8d439d50278f9d6b50d7353acae3f467c817c9b3ca37e66ec6a6147219530a9953612471d1f1c1001078ff4950235977927563a6e03f67faecac0977c63c3a879c153f29f5e452ad8c938bca366ac729484c2f81b491e1ad8f2999f52149125adbe31730e9645eec89e0e4a83a854862526713e33485fcf9a2844724daa483d24c45d3acd52099e826de071d3e289740b60a32af23c915f44bd4d68f9d67f5413845b58c323a52d6fc56b60fdc739327390b64c0fa486be691d9ec68eb55a46f8"], 0xf0}, 0x1, 0x0, 0x0, 0x4004080}, 0x4000000) sendmsg$NFT_MSG_GETCHAIN(r6, &(0x7f0000000440)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x800800}, 0xc, &(0x7f0000000400)={&(0x7f00000004c0)=ANY=[@ANYBLOB="20000000040a010100000000000000000a0000010900030073797a320000000083df0a63f183422e4215036c08a6377775327d731a22565a505990290b084f38d7af564b530c79f51a3b1c74ad86292d882cae"], 0x20}, 0x1, 0x0, 0x0, 0x40}, 0x80) r8 = socket$tipc(0x1e, 0x2, 0x0) bind$bt_hci(r8, &(0x7f0000000040), 0x6) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r5, 0x84, 0x64, &(0x7f0000000000)=[@in={0x2, 0x4e22, @empty}], 0x10) listen(r5, 0x3) sendmsg$inet6(r4, &(0x7f0000001dc0)={&(0x7f0000000840)={0xa, 0x4e22, 0x906, @loopback, 0x7}, 0x1c, &(0x7f0000001d40)=[{&(0x7f0000000880)="fa", 0x1}], 0x1}, 0x40085) socket$netlink(0x10, 0x3, 0x4) writev(r4, &(0x7f00000008c0)=[{&(0x7f0000000380)="d6", 0x1}], 0x1) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000540)="480000001400190d09004b87000000000000006080ffe00600004e22590000a2bc5603ca00000f7f89000000200000000101ff0000000309ff5bffff00c7e5ed5e000000000000001895a9eab28438823aba7f9b2dc4274390ccf715f256a710e20fe9c4a026e9c7b304238b7f73829772c86f85480cb58e78186648f9f583", 0xab}], 0x1) sendfile(r0, r3, 0x0, 0x20000000002) 2.497048581s ago: executing program 4 (id=4495): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r1) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000000)={@fallback=r0, 0xffffffffffffffff, 0x3a, 0x10, 0x4}, 0x20) ioctl$SIOCSIFMTU(r0, 0x8922, &(0x7f0000000440)={'syz_tun\x00', 0x101}) 2.450075915s ago: executing program 3 (id=4496): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000040)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_LEAVE_MESH(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x9}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, 0x0, 0x8, 0x70bd2b, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r2}, @void}}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000070}, 0x20004801) syz_genetlink_get_family_id$ethtool(&(0x7f0000000140), r1) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) setsockopt$bt_l2cap_L2CAP_CONNINFO(r3, 0x6, 0x2, &(0x7f0000000180)={0x96b9, "d56eb5"}, 0x6) socket$inet_sctp(0x2, 0x5, 0x84) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000200)={'wpan1\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000240)={'wpan1\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000280)={'wpan3\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000002c0)={'wpan4\x00', 0x0}) sendmsg$NL802154_CMD_DEL_SEC_DEVKEY(r4, &(0x7f0000000540)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000500)={&(0x7f0000000300)={0x1d8, 0x0, 0x20, 0x70bd25, 0x25dfdbfd, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r5}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r6}, @NL802154_ATTR_SEC_DEVKEY={0x80, 0x2f, 0x0, 0x1, [@NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc, 0x2, {0xaaaaaaaaaaaa0302}}, @NL802154_DEVKEY_ATTR_FRAME_COUNTER={0x8, 0x1, 0x8000}, @NL802154_DEVKEY_ATTR_ID={0x68, 0x3, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0x8}, @NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0x4}, @NL802154_KEY_ID_ATTR_SOURCE_EXTENDED={0xc, 0x5, 0x1}, @NL802154_KEY_ID_ATTR_IMPLICIT={0x34, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_PAN_ID={0x6, 0x1, 0x2}, @NL802154_DEV_ADDR_ATTR_PAN_ID={0x6, 0x1, 0x3}, @NL802154_DEV_ADDR_ATTR_MODE={0x8, 0x2, 0x1}, @NL802154_DEV_ADDR_ATTR_SHORT={0x6, 0x3, 0xfffd}, @NL802154_DEV_ADDR_ATTR_SHORT={0x6}, @NL802154_DEV_ADDR_ATTR_MODE={0x8, 0x2, 0x2}]}, @NL802154_KEY_ID_ATTR_INDEX={0x5, 0x2, 0x3}, @NL802154_KEY_ID_ATTR_SOURCE_EXTENDED={0xc, 0x5, 0x3}]}]}, @NL802154_ATTR_SEC_DEVKEY={0xbc, 0x2f, 0x0, 0x1, [@NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc, 0x2, {0xaaaaaaaaaaaa0202}}, @NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc, 0x2, {0xaaaaaaaaaaaa0202}}, @NL802154_DEVKEY_ATTR_FRAME_COUNTER={0x8, 0x1, 0x9}, @NL802154_DEVKEY_ATTR_ID={0x28, 0x3, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_IMPLICIT={0x1c, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_EXTENDED={0xc, 0x4, {0xaaaaaaaaaaaa0202}}, @NL802154_DEV_ADDR_ATTR_EXTENDED={0xc}]}, @NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0x6}]}, @NL802154_DEVKEY_ATTR_FRAME_COUNTER={0x8, 0x1, 0x80000000}, @NL802154_DEVKEY_ATTR_ID={0x5c, 0x3, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_IMPLICIT={0x24, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_PAN_ID={0x6}, @NL802154_DEV_ADDR_ATTR_MODE={0x8, 0x2, 0x2}, @NL802154_DEV_ADDR_ATTR_SHORT={0x6, 0x3, 0xaaa0}, @NL802154_DEV_ADDR_ATTR_MODE={0x8, 0x2, 0x3}]}, @NL802154_KEY_ID_ATTR_MODE={0x8}, @NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0x81}, @NL802154_KEY_ID_ATTR_INDEX={0x5, 0x2, 0x1}, @NL802154_KEY_ID_ATTR_SOURCE_EXTENDED={0xc, 0x5, 0x9000000000000}, @NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0x2}, @NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x3}]}, @NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc, 0x2, {0xaaaaaaaaaaaa0202}}]}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r7}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r8}, @NL802154_ATTR_SEC_DEVKEY={0x54, 0x2f, 0x0, 0x1, [@NL802154_DEVKEY_ATTR_ID={0x24, 0x3, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x3}, @NL802154_KEY_ID_ATTR_INDEX={0x5, 0x2, 0x2}, @NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x1}, @NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0x3}]}, @NL802154_DEVKEY_ATTR_ID={0x24, 0x3, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0x7}, @NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0x8001}, @NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0x2}, @NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0x3}]}, @NL802154_DEVKEY_ATTR_FRAME_COUNTER={0x8, 0x1, 0x4}]}]}, 0x1d8}, 0x1, 0x0, 0x0, 0x20044090}, 0x20000085) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r1, 0x8982, &(0x7f0000000580)={0x0, 'pimreg\x00', {}, 0x9}) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000600), r1) sendmsg$NL80211_CMD_GET_SCAN(r1, &(0x7f00000006c0)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000680)={&(0x7f0000000640)={0x20, r9, 0x300, 0x70bd26, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x1000, 0x19}}}}, ["", "", "", "", "", "", "", "", ""]}, 0x20}, 0x1, 0x0, 0x0, 0x80}, 0x40000) recvmsg(r1, &(0x7f0000002a80)={&(0x7f0000000700)=@vsock, 0x80, &(0x7f0000002940)=[{&(0x7f0000000780)=""/104, 0x68}, {&(0x7f0000000800)=""/4096, 0x1000}, {&(0x7f0000001800)=""/4096, 0x1000}, {&(0x7f0000002800)=""/93, 0x5d}, {&(0x7f0000002880)=""/164, 0xa4}], 0x5, &(0x7f00000029c0)=""/130, 0x82}, 0x12000) r10 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000002ac0)={0x1b, 0x0, 0x0, 0x2, 0x0, 0xffffffffffffffff, 0x7fff, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x3, 0x1}, 0x50) ioctl$BTRFS_IOC_SYNC(r10, 0x9408, 0x0) pread64(r3, &(0x7f0000002b40)=""/130, 0x82, 0x1) pipe(&(0x7f0000002c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000002cc0)={'syztnl1\x00', &(0x7f0000002c40)={'ip_vti0\x00', 0x0, 0x80, 0x7, 0xb8, 0x9, {{0xf, 0x4, 0x1, 0x7, 0x3c, 0x66, 0x0, 0x80, 0x29, 0x0, @loopback, @local, {[@cipso={0x86, 0x28, 0x3, [{0x2, 0xf, "c57cad09ce3f9fe753e25ac218"}, {0x7, 0x4, "825f"}, {0x2, 0x6, "898bca4f"}, {0x5, 0x9, "3e7152ee9588a9"}]}]}}}}}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r11, 0x89f3, &(0x7f0000002d80)={'ip6tnl0\x00', &(0x7f0000002d00)={'ip6tnl0\x00', r13, 0x2f, 0xff, 0x23, 0x1, 0x21, @local, @private0={0xfc, 0x0, '\x00', 0x1}, 0x700, 0x90, 0xb, 0x6}}) ioctl$SIOCGSTAMP(r12, 0x8906, &(0x7f0000002dc0)) syz_genetlink_get_family_id$tipc(&(0x7f0000002e00), r1) sendmsg$NL80211_CMD_SET_BSS(r1, &(0x7f0000002f00)={&(0x7f0000002e40)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000002ec0)={&(0x7f0000002e80)={0x1c, r9, 0x100, 0x70bd28, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_BSS_CTS_PROT={0x5, 0x1c, 0x2}]}, 0x1c}, 0x1, 0x0, 0x0, 0x400c2}, 0x0) socket$can_raw(0x1d, 0x3, 0x1) sendmsg$AUDIT_SIGNAL_INFO(r12, &(0x7f0000003000)={&(0x7f0000002f40)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000002fc0)={&(0x7f0000002f80)={0x10, 0x3f2, 0x200, 0x5, 0x25dfdbfe, "", ["", "", "", "", "", "", "", "", ""]}, 0x10}}, 0x20050811) ioctl$BTRFS_IOC_SCRUB(r0, 0xc400941b, &(0x7f0000003440)={0x0, 0x0, 0x6}) 2.264075652s ago: executing program 4 (id=4498): r0 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_GET_ASSOC_NUMBER(r0, 0x84, 0x1c, &(0x7f0000000000), &(0x7f0000000040)=0x4) r1 = openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$6lowpan_control(r1, &(0x7f00000000c0)='disconnect aa:aa:aa:aa:aa:10 2', 0x1e) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r2, 0x84, 0x6e, &(0x7f0000000100)=[@in6={0xa, 0x4e22, 0xf3, @mcast1, 0xf}, @in={0x2, 0x4e22, @remote}, @in={0x2, 0x4e23, @broadcast}, @in={0x2, 0x4e21, @multicast1}, @in={0x2, 0x4e21, @multicast2}], 0x5c) ioctl$XFS_IOC_READLINK_BY_HANDLE(r1, 0xc038586c, &(0x7f0000000280)={r0, &(0x7f0000000180)='\x00', 0x101000, &(0x7f00000001c0)={@align=0x800, {0x500, 0x7, 0x7, 0x5}}, 0x80000000, &(0x7f0000000200), &(0x7f0000000240)=0x3ff}) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_FRAGMENT_INTERLEAVE(r3, 0x84, 0x12, &(0x7f00000002c0), &(0x7f0000000300)=0x4) syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) r4 = accept4$tipc(0xffffffffffffffff, &(0x7f0000000340)=@id, &(0x7f0000000380)=0x10, 0x1000) setsockopt$TIPC_MCAST_BROADCAST(r4, 0x10f, 0x85) r5 = socket$xdp(0x2c, 0x3, 0x0) ioctl$sock_netdev_private(r4, 0x89f5, &(0x7f00000003c0)="8f660ceaf622033c2272cc29c9716b503f1d49d203e356c3105d894091") ioctl$sock_inet_SIOCGIFPFLAGS(r5, 0x8935, &(0x7f0000000400)={'vxcan1\x00'}) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000480)={'wlan0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r4, 0x8933, &(0x7f00000004c0)={'batadv_slave_1\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000580)={'syztnl2\x00', &(0x7f0000000500)={'syztnl1\x00', 0x0, 0x2f, 0x7f, 0xe4, 0xfffffff9, 0x40, @mcast2, @mcast2, 0x10, 0x40, 0x8, 0x5}}) sendmsg$nl_route(r6, &(0x7f00000006c0)={&(0x7f0000000440), 0xc, &(0x7f0000000680)={&(0x7f00000005c0)=@RTM_DELMDB={0x98, 0x55, 0x400, 0x70bd25, 0x25dfdbfd, {0x7, r7}, [@MDBA_SET_ENTRY={0x20, 0x1, {r8, 0x0, 0x1, 0x3, {@ip4=@empty, 0x400}}}, @MDBA_SET_ENTRY={0x20, 0x1, {0x0, 0x1, 0x1, 0x4, {@in6_addr=@remote, 0x800}}}, @MDBA_SET_ENTRY={0x20, 0x1, {0x0, 0x0, 0x1, 0x4, {@ip4=@empty}}}, @MDBA_SET_ENTRY={0x20, 0x1, {r9, 0x0, 0x2, 0x4, {@in6_addr=@mcast2, 0x800}}}]}, 0x98}}, 0x8000) ioctl$OCFS2_IOC_REFLINK(r6, 0x40186f04, &(0x7f0000000780)={&(0x7f0000000700)='\'\x00', &(0x7f0000000740)='\x00', 0x400}) setsockopt$inet_sctp6_SCTP_EVENTS(r3, 0x84, 0xb, &(0x7f00000007c0)={0x80, 0x9, 0x9, 0xa, 0x7, 0x4, 0x5, 0x1, 0x5, 0x4, 0x8, 0xff, 0x10, 0xfa}, 0xe) r10 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000840), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_ADD_DEVKEY(0xffffffffffffffff, &(0x7f0000000900)={&(0x7f0000000800)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000880)={0x1c, r10, 0x2, 0x70bd25, 0x25dfdbfd, {}, [@IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x8000) accept4$x25(0xffffffffffffffff, &(0x7f0000000940), &(0x7f0000000980)=0x12, 0x800) ioctl$XFS_IOC_FD_TO_HANDLE(r4, 0xc038586a, &(0x7f0000000ac0)={r2, &(0x7f00000009c0)='\'\x00', 0x2901, &(0x7f0000000a00)={@align, {0x9, 0x80, 0x4, 0x3}}, 0x3, &(0x7f0000000a40)={@_ha_fsid}, &(0x7f0000000a80)=0x6}) accept4$unix(r11, &(0x7f0000000b00)=@abs, &(0x7f0000000b80)=0x6e, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r11, 0x84, 0x72, &(0x7f0000000bc0)={0x0, 0x3178, 0x30}, &(0x7f0000000c00)=0xc) setsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r3, 0x84, 0x18, &(0x7f0000000c40)={r12}, 0x8) 1.997506337s ago: executing program 0 (id=4500): bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000000000)={0x3, 0x0}, 0x8) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000480)='cgroup.controllers\x00', 0x275a, 0x0) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(0xffffffffffffffff, 0x4048587b, &(0x7f0000001a40)={{0xffffffffffffffff, &(0x7f0000000000)='/proc/sys/net/ip]\x11tiox_control\x00'/42, 0x200, 0x0, 0x7ff, 0x0, 0x0}, 0x0, 0x0}) r2 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000080)={'wlan1\x00', 0x0}) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_CQM(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)={0x28, r5, 0x1, 0xffffffff, 0x0, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_CQM={0xc, 0x5e, 0x0, 0x1, [@NL80211_ATTR_CQM_TXE_RATE={0x8, 0x5, 0x1d}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x4008000}, 0x0) setsockopt$llc_int(r2, 0x10c, 0x4, &(0x7f0000001ec0)=0x7fff, 0x4) write$tun(r1, &(0x7f0000000000)=ANY=[], 0x38) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x10012, r1, 0x0) select(0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)={0x0, 0x2}) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000640)={0x6, 0x2, &(0x7f0000000200)=ANY=[@ANYRES64=r1], &(0x7f00000001c0)='syzkaller\x00', 0x5, 0x6d, &(0x7f0000000240)=""/109, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x90}, 0x94) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000100)=@bpf_lsm={0x3, 0x4, &(0x7f00000000c0)=ANY=[@ANYRES16=r0], &(0x7f0000000040)='syzkaller\x00', 0x2, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, r0}, 0x94) 1.973758244s ago: executing program 2 (id=4501): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000001240)=ANY=[@ANYBLOB="000086dd0000110000000000000060ec97000f982c00fe8000000000000000000000080000aaff02000000000000000000000000000111000000000000000100907809000000699951a503ff3c00fe8000000000000000000000000000bbfe0000000000000000000000000000bb2b00000f00000000a542e5fa78122afabe978693aab29d1466a08191331ab6a877ada0ba71547993040b10059bd34a8b75294b0923a60f1fb92185b6f684546c90065735ecd57d7d08c3b4f700b561a165be3b70f5708ad409f217ed6af01e38575352a8c2ea616803b11bf27a5a897a351022d0cbfbe26f30b3ab4e3a6f4253d5cf238632ba4115fbcacf020fd669b418bff577c51abf913317f857712c3d4734aa2f0dfdfd67c1de45cc09f7d560c395460a2a172b3c55cd9bcf7ebfd6763f961b5930f9280e156efdc6141ea07715d5af19c9ed06a53651a47aa5c52d8ff986c66d719c19088d4627ff684f19b24b6e6e9605c8a93df75154a96ee4db03442d71d423ae8c16b4106941048aaab26760c88cf9b2cddcd078641bfe5c645197c5ba125531be11df5a44801774c5539d136ba2032fbfcc52731f9713060fa4ad8f6b45b245da43d30117c2b132ed23eac46b5193978f893158020056a63a460d8204f02c26ea9dac9a739f166884691f551084b8ae09965499ddbf57f35eacf411d84b5213be8d953eedda4d32ad55543fd14d70809120f1ca942fb67d116642297cf78b6ca6f47089fb3ad10af09982551b6ab3c0f37a3e73e875220480c34b1746a98e551f4346706920c1f40dba48a6a3df76333178cd860232e4d52cbc9775fcb9785d5bd3df133756e4745e7e343bca8697fcf302178020df677a83b4473ecc42bfa8e6a50c8b79b315c1eb849fd713374d2b2dae2a60e1592baaf6ee9814c4b42e059094418d206392e9fb225922052995f932f454fd75cc7af9e13f28db47956289701273a411355f34f4677daa0d4fb8d87e2a49d3fc2d5670284c7cf2c622049eaafa2f743dfc7868d03505a409979adfc4ff044d1c04d2311f2ce1cdf5cbf50d289d9b5faae35b2b3de9211d5de16e1422dd47b6c4a4d0d28619e55a96063a46fe0f29b47e8c306cdfb3cb0064ecedfcf67bfe63a0e8a4c12929f0d6a7c32d9e225c7df08fdaf07d8dfbf85b3a167589378f74fa1bb75b3136619017c92a113075467498560442ba3fe1d5566b737e921dec06f60c8ec711b1a6b3df6ad7849564b4e05c4d29d73cda474a8e48f65aebe43c73a85af773eb382a1aba314430753a421d2827f677cc210cc4472e8ea235abc6e6e508c628bf78f5a9208f77c6ae02c03b7bfdde1b94ab2dad96714c5d0cc66763c74e7f1a3a373994ee7e30fd45ef323bb31400b701238fac457ec0d4d17b7b7393903b59dcba68fabfb65ec959f1a35948cd34799784bc3f4c6ff9fbb5da7a11bbf7bee96acfeb788d620f274858f6de5f7975d6bdf570de50ac2a9ecacf30672cb4d5326ab2ec36d0f09113d799a3167202b751292a497e015a6071373576f55bb0e6ce4f29820cd1a6a7293317ccce61d468e908868ba061653aaba351661008c70d825421810a524ef6df25878e750130dd99b8aa34fbce491e98770fa328c9d26f2d5800255e9037d74c7a2e2bacdcc81cec81a681d0be9aa77761ed07c91f5b0bcca388b881c001a6ecfd098ada1d3bed3b873ead6b79d930f544b2d3f3dd7b634105bfd710a825cb5c2bf41a931c0c3fabaef0bba470faadc56466bc0894f7222454ff138bffe94b58fb4d45a1cf14482d5bd7ac9887e2d2826bc74d1f22f056f2ded24c9586dd1be8a573a1c9da8dd0e5ff0a7263a473b1c948c4fea4a5282d3e039fb89140688b70d7d69ef13276d5e871550c1674cd506e9ad4d0d5a03e0b120c384b9f6ab315bc4c105f839206a53a6f226ce637689f81aab37a1b8f94f7796107ed826f3f3bf3d6a086f216ead59fc3e19a0aa39177bcbad38d94b7a4c3edbb53f88099a6ac618409a225c893244d22e236989ae9acd7eda7619f1f249dc60b855e0fec347f3909e90f80e6ac03feec2df18c9b4b2abcd96e90768e8433a133e69381b370341bd980257b4ed4ee4f7a2fda9142ed5540966d1142bb13840cccbab402d2ff9ce3702b4ca2115b20e29d4aa8341a77affa5abc88c09ead30ddd988844309d33fde48d32b156da20b912a17663b14b6db60d7d7af55dedb45d1088eb6b7e264478344c4389234e18209f86c9a77479f31e5617a30e6bf67f06c6c2d9558866dc9054814e58bcd5e2876e1f7b1d80279da5e1442eebffc07dc6330e000bd9361066950da1ba6cf64c7622c4e3ebd730152138d79b6f8f4cd3cfeca0c5f9c650303aef130c9e9449e7212163d60ca2741cfdf7951d804fa317d2cd4ae8397fed494502853b869672ca6f1e78d8fb05de313a4c0985f11b1c345bba92028bfd6b9e3a2cc7c975a48feb28ba1584523b88bbdaf4a052d01446ac06ff5fb00982ce965b72e9e37319ec7df2895843c750379eb99ecfa0569defe96a8204a7a1cda42eb69aa74fde31c0305d026ccf3fe1d3ac984901cc70890d0e3115001280f60e0130655f26bcb611e86f4c1c43327b18f2aace900cccc8a5606d7090cf7996093f72d32a71bfffb07954b4419c61c3a59ef35cd9533087c245106482d8d37b61d627fd1b60cc94ccceddb6da244a530442b4f2e4f7ec0cffca2cb02e4df7e25fe7229ea2b6be96ecab5ad54d623d369b5719d82c206692850b07e4a61dcca7d3cfd1bf0d8d46a0a9f6ced4f4094ba009e553f03a36e47fe5fa608f9d40fffef99d6e945468a75fc8663099c432bcb514d769e7559114ffe0beb6ddf9ad9dec965ec41b9ec2af69468b7e3512c949a82d8c1"], 0xfce) 1.801880244s ago: executing program 3 (id=4502): r0 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x50) (async) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000380)='memory.events\x00', 0x275a, 0x0) (async) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) pwritev(r2, &(0x7f0000000100)=[{&(0x7f0000000000)="8e", 0x1}], 0x1, 0x8001, 0x80) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000540)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) setsockopt$ALG_SET_AEAD_AUTHSIZE(r3, 0x117, 0x5, 0x0, 0x4005) close(r2) (async) sendfile(r2, r1, 0x0, 0xf03a0005) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0xffff}, 0x50) r5 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000100000c02000000000000000000000d0000000000005f"], 0x0, 0x34}, 0x20) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000100)=ANY=[@ANYBLOB="180000000100000000000000801800009500000000000000"], &(0x7f0000000000)='GPL\x00', 0xc, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r5, 0x8, &(0x7f00000000c0)={0x0, 0x1}, 0x1}, 0x94) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000500)=@bpf_ext={0x1a, 0xf, &(0x7f00000002c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8792}, {{0x18, 0x1, 0x1, 0x0, r4}, {}, {}, {0x85, 0x0, 0x0, 0xb8}}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000180)='GPL\x00', 0x7, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x3a, r5, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x1, r6, 0x0, 0x0, 0x0, 0x10, 0x4a6}, 0x94) (async) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000240)={{r0, 0xffffffffffffffff}, &(0x7f00000001c0), &(0x7f0000000200)=r2}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x28, &(0x7f00000003c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x400, 0x0, 0x0, 0x0, 0x9}, {{0x18, 0x1, 0x1, 0x0, r4}}, {}, [@generic={0xb0, 0x0, 0x3, 0x3, 0x1}, @printk={@x, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x1}}, @btf_id={0x18, 0x8, 0x3, 0x0, 0x5}, @map_fd={0x18, 0x0, 0x1, 0x0, r7}, @btf_id={0x18, 0x0, 0x3, 0x0, 0x2}, @printk={@u, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x400}}, @map_fd={0x18, 0x4, 0x1, 0x0, r0}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x21, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x8, &(0x7f0000000000)=@framed={{0x18, 0x6}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r0}}]}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) (async) epoll_create1(0x0) 1.742150989s ago: executing program 4 (id=4503): r0 = socket$nl_crypto(0x10, 0x3, 0x15) sendmsg$nl_crypto(r0, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000980)={&(0x7f0000000000)=ANY=[@ANYBLOB="100000001400e220b56d8bde7a0f962685840025"], 0x10}}, 0x40000) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_tx_ring(r1, 0x107, 0xd, &(0x7f00000002c0)=@req3={0x10000, 0x1, 0x100, 0x100, 0xe}, 0x1c) setsockopt$sock_linger(r1, 0x1, 0x3d, &(0x7f0000000000)={0x1}, 0x8) sendmmsg$sock(r1, &(0x7f0000003680)=[{{&(0x7f0000000500)=@ethernet={0x307, @multicast}, 0x80, 0x0, 0x0, &(0x7f0000000040)=[@txtime={{0x18, 0x1, 0x3d, 0x1000000000003}}], 0x18}}], 0x1, 0x8840) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000400)=ANY=[@ANYBLOB="140000001000010000000000000000000a00000a20000000000a05000000000000000000070000000900010073797a300000000078000000090a01040000000000000000070000000900010073797a30000000003c0011800c0001007061796c6f6164002c000280080001400000001408000340000000a20800024000000001080005400000000108000440000000d0080005400000000208000a40000000010900020073797a3100000000140000001000010000000000000000000084000ae34ac9bfe3cd87cb689b3c607a4195da6760e7568b3a22e11650bcf11f8e"], 0xc0}, 0x1, 0x0, 0x0, 0x20000080}, 0x0) r3 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=@newqdisc={0x7c, 0x24, 0x3fe3aa0262d8c783, 0x0, 0x100, {0x0, 0x0, 0x0, r4, {}, {0xffff, 0xffff}, {0x0, 0xfff2}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x4c, 0x2, [@TCA_GRED_MAX_P={0xfffc, 0x4, 0x4cc1}, @TCA_GRED_LIMIT={0x8, 0x5, 0x4}, @TCA_GRED_PARMS={0x38, 0x1, {0x6b5, 0x4, 0x3ff, 0x2, 0x6, 0xfffffca7, 0x8001, 0x9, 0x4, 0x4, 0xf, 0xe, 0x4, 0x99, 0x4, 0x5e}}]}}]}, 0x7c}, 0x1, 0x0, 0x0, 0x8040}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x3, 0x4, &(0x7f0000000180)=@framed={{}, [@ldst={0x3, 0x0, 0x3, 0x1, 0x0, 0x8}]}, &(0x7f0000000240)='GPL\x00', 0x1, 0x0, 0x0, 0x0, 0x21, '\x00', 0x0, @sched_cls=0x36, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000080)=0x14) r6 = socket$l2tp(0x2, 0x2, 0x73) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="1e000000000000007200100007"], 0x50) bpf$MAP_LOOKUP_ELEM(0x2, &(0x7f0000001740)={r7, 0x0, &(0x7f0000001700)=""/53}, 0x20) socket$unix(0x1, 0x1, 0x0) r8 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_INITMSG(r8, 0x84, 0x2, &(0x7f00000003c0)={0xfff9, 0xe38b, 0xffff, 0x40}, 0x8) r9 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYRES32=r5, @ANYRESOCT=r4, @ANYRESHEX=r7, @ANYRESHEX=r0, @ANYBLOB="9c400e8cfd7dc2261bf6c3b0d0aaaa4e53acd424b6be58591dee2c80d7f329c695ff90f6c5077fab491bd2d58fb7021bc67b68a75c061d8c6325a79b34d583d06093dba1298615976ea3f358257604046cb0a72b34c3198fb666", @ANYRESOCT=0x0, @ANYBLOB="44c8479d33745fa63991c2c81a1050702d69291250e8af2852f45f676deeefb2a69425bcbb02f336ae9b4edfffda694e58f8be2ab297e60a81e1fd78e94296f5dc808dd7c28f4f7dee41f3b1aecbf07476cce00f5456783cc5768b652038d5a9218e41111de3db9e68ce82bfb0b12729ca32ffd0f96f639c5f0a56ae3860c73c71b238053a28ce63eac9fbb9f523c30fb245ed9e083a915d4d39", @ANYRES32=r0], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r9, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r10 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r11 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000040)={{r11}, &(0x7f0000000280), &(0x7f0000000240)=r10}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x1, 0x10, &(0x7f0000000bc0)=ANY=[@ANYBLOB="18080000000000000000ffffffff000018120000", @ANYRES32=r11, @ANYBLOB="0000000000000000b703000000000000850000000c000000b7000000000000001801000000082c2500000000002120207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000700000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000200)={{r11}, &(0x7f0000000180), &(0x7f00000001c0)=r10}, 0x20) sendmsg$inet_sctp(r8, &(0x7f0000000140)={&(0x7f0000000340)=@in={0x2, 0x4e21, @local}, 0x10, &(0x7f0000000380)=[{&(0x7f00000001c0)='N', 0x1}], 0x1, 0x0, 0x0, 0xc005}, 0x4000890) setsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r8, 0x84, 0x13, 0x0, 0x0) getsockopt$inet_pktinfo(r6, 0x0, 0x8, &(0x7f0000000100)={0x0, @multicast2}, &(0x7f00000001c0)=0xc) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000140)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x4e, '\x00', r12, 0xffffffffffffffff, 0x3, 0x0, 0x2}, 0x50) 1.662281071s ago: executing program 0 (id=4504): r0 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x4000000000000, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x4001, 0x3, 0x200, 0x88, 0x0, 0x148, 0x0, 0x148, 0x1b8, 0x240, 0x240, 0x1b8, 0x240, 0x7fffffe, 0x0, {[{{@ip={@private=0xa010102, @private=0xa010101, 0x0, 0xff000000, 'ip6tnl0\x00', 'wlan1\x00', {}, {0xff}, 0x88, 0x3, 0x10}, 0x0, 0x70, 0xd0}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv4=@initdev={0xac, 0x1e, 0x1, 0x0}, [0xff000000, 0xffffff00, 0x0, 0xffffff00], 0x4e21, 0x4e23, 0x4e20, 0x4e23, 0x8, 0x4, 0x5f4a, 0x100, 0x6}}}, {{@ip={@empty, @empty, 0xff000000, 0xff000000, 'wlan0\x00', 'pimreg1\x00', {0xff}, {0xff}, 0xc, 0x0, 0x60}, 0x0, 0x70, 0x98}, @common=@unspec=@AUDIT={0x28, 'AUDIT\x00', 0x0, {0x2}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x260) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r2, 0x1, 0x3c, &(0x7f0000000040)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR(r2, 0x6, 0x13, &(0x7f00000000c0)=0x1, 0x4) connect$inet(r2, &(0x7f0000000080)={0x2, 0x0, @loopback}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r2, 0x6, 0x13, &(0x7f00000001c0)=0xffffffffffffffff, 0x4) sendmmsg$inet(r2, &(0x7f0000000a40)=[{{0x0, 0x0, &(0x7f0000000cc0)=[{&(0x7f0000000640)="dbcadafd9d8551fba25b67fcdd8fde86874291ea14b4447381d4a251eef0f6496b1f9a6f2178f114637544b1af1d786d42886fdc7d2a56371184ae47e2e3490711871de7d65eb12d843a1bbfc9a1be85dbb38bdf33e03dfa51bc75c426ea", 0x5e}, {&(0x7f0000000d40)="8297bfd985c530465c45e755ae5cab649b7abc3d9652a3c7026cdabeddd9c4f866a97dac88ede3fa11e13323ca387ac140e2b68ab392410864d5f0980d0879d444f2eafbefc8acd74488603d629ab56a4f36d2d2235aab3160745d6e147f17b352ef91a042333eaf03bde2f14efc7d07b366e23eb0b0c223d23d76449e4365c5c1c0231f573da1fb9cf9938753b2163e9cca77dd990267f0bcddfb3c0be33ab4178e40439f334ce8c75c418b04ca285c07584f4890778263b61402a21590f88b60eaa0231aa7393c5b8af566a332f3a77d2bea0b573e0ec8739f1f65ff8453110223def283661ef5566b27037c3d9735fd855326f27f22", 0xf7}, {&(0x7f0000000980)="59a3bf7ad623492102dd9852053a0f2baaaa2af67559a9a9c5a502bc85fcf1073185adbab8dad4efc722d77c0c8f5ac3f14c180599", 0x35}, {&(0x7f0000000300)="a3dad7face3b2b9b39bdde8d2d68463c3d39cb32b4d1313a14adcb7c3702e07eef3fd34b053d07cdef2759e1664f99382e1694645a80119ff441a2134ed9f7ca3bf88c17c2bd7758e63d47e74b61c78ae9c6b8c63d95fbe4502ea9ce729e9dee11eba76e3ceeb85f8ea66320be096195fe2302cc7205c1a24e34629f0fa3c9627a3d4aee30c31941a8fa0bff0a59", 0x8e}], 0x4}}], 0x1, 0x8000) sendmmsg(r2, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f00000014c0)='\t', 0x1}], 0x1, &(0x7f0000000000)=ANY=[], 0xa}}], 0x1, 0x4044805) sendmmsg$inet(r2, &(0x7f0000004800)=[{{0x0, 0x0, &(0x7f0000003040)=[{&(0x7f00000006c0)='1', 0x1}], 0x1}}], 0x1, 0x4) r3 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_bt_hidp_HIDPGETCONNINFO(r3, 0x800448d3, &(0x7f00000003c0)={@none, 0xfffffff7, 0x199, 0x81, 0x6, 0x5, "aa65f1f1482494ba15e2ad884a4677dea9f2d16f4ff334fe1c0b215e136479c7ed6bd54520d7311ff52069cab1b7669bfa683128c90a71668985b9cd70061bee717cd072e18341eda2afb953702d66dba190d9c93fd35471dcb495867c660dce2d84044b47d8a3913bfaa610e0127d8fe188124b09bd3e2dd08eab8757cb03c7"}) sendmsg$IPCTNL_MSG_EXP_NEW(r1, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000780)=ANY=[@ANYBLOB="980000000002010400000000000000000a00000504000180440003800c00028004000100000000002c00018014000300fe80000000000000000000000000001c14000400fe88000000000000000000000000000106000340000000003c0002800c00028005000100000000002c00018014000300ff01000000000000000000000000000114000400"], 0x98}}, 0x0) r4 = accept4$alg(0xffffffffffffffff, 0x0, 0x0, 0x80000) sendmsg$alg(r4, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000b80)=[{&(0x7f0000000540)="434dec911c59b0d9b64e23d82571712fffd0c26839b5486e1319abf46a98cf71f46e6cfa62c06cab5cae52a64c4fa976b23ce6306944d789d4e3b4e480c16de3b9cf2ea535e4b77715645690b09bd9f853d2fab5af53708c5f21f2f3229023f5c64e619cee8f7db4c1fdcda25c7e36619840054549c3226f6f17ce77e40d2dcf867595211606e50ff4163d8b", 0x8c}, {&(0x7f0000000700)="b103fbd48fbe0c2e7d10cefa2d2d04995ede2f8b77ccf94422ad09acfe55713898ddfac7e6444422a20af077cf305e940281a959400e1c4f44d794c40a379fe59c9654a81119c351c02983cb57045fd4ce7d5f5d769354beee506c7426433d1ad5e38b1720c845b7247a5d5aa1cda66222e5ea674851e2", 0x77}, {&(0x7f0000000840)="b62942d1b9c4a98ff1524a7993b2fe4e6a261bb88deb039e48ba40bba102409d6a9b4b95f71c139df86876548f627fe670c621ba2ff30a03a59a3045fc8085b937f2f59fe03fba31978efbfa3e51cdc7", 0x50}, {&(0x7f00000008c0)="92db88d07dce93c0a54173083796e47b68e047c86391acc9dadb2c2276d14350f1194d6b1699710f7d66c4abcf58050f3dbaf2d279c595702fda7ec691f746fbe263eec48afa33db84a771e7aeeb3067806b0e436cbba19d1d04e7c56309b412f047b95d2c9710a993cd8e681ae99a6aa09fae87367fc664616c30b3bd9e822fdf7cbfbccdb549c87be4750826c57d34882c28de3fe3e8e22f60c5c40a3eddf1f7b61e9d16d1", 0xa6}, {&(0x7f0000000a80)="1bb5e48b56ffeb7a97e6367757c71bddd85f57081ee4ad471d019d4c212d4cf18a73c47bdd4bae2d0397a842cb1848ec42f8cd4464ca4b4ed0c7e44765a98a39f064b7f0e7b087adc8eece6dc98084471b894a8ca17e39f5416d82081e29aa54ab17081beaa54618040b87a14037cd76eeaf8622e28a4e1437513c37d08b0e89468689d0c97790a09b8f00a7fdcada5455f0998e833d85d1aa9eaca1a76aca54e752932be787f697bc5b429685b0e32ff533d008a0de53f8a460d491ce578f2d9ab8a8c331ac119027a8529d31dd596cb63cfe80e9617e77cd6e", 0xda}], 0x5, 0x0, 0x0, 0x4004040}, 0x200040c0) r5 = socket(0x11, 0x6, 0x8) sendmsg$nl_route(r5, &(0x7f0000000340)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x80c00}, 0xc, &(0x7f0000000300)={&(0x7f0000000380)=ANY=[@ANYBLOB="1cee00001a001401d9569d2bffdbdf2502148009fd02000b00831100", @ANYRESDEC=r0], 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x20044844) 1.589157725s ago: executing program 3 (id=4505): bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000004c0)=ANY=[@ANYRES8=0x0], 0x50) bpf$MAP_CREATE(0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="07000000040000008000000001"], 0x50) socket$nl_netfilter(0x10, 0x3, 0xc) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket$l2tp6(0xa, 0x2, 0x73) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000300)}, &(0x7f0000000040)=0x10) setsockopt$inet_sctp_SCTP_RESET_STREAMS(r0, 0x84, 0x77, &(0x7f00000002c0)=ANY=[@ANYRES32=r1, @ANYBLOB="d89e0a4cb27399773f8aebdbc0a8a25cea11bdbdac7024e5af3cf07aa81b0052928d1216990a9a2b"], 0x8) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r3 = accept4(r2, 0x0, 0x0, 0x800) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) bind$qrtr(r3, &(0x7f0000000180)={0x2a, 0xffffffffffffffff, 0x7fff}, 0xc) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000480)={0xffffffffffffffff, 0x0, 0x0}, 0x20) sendmsg$IPSET_CMD_GET_BYINDEX(r3, &(0x7f0000001400)={0x0, 0x0, &(0x7f00000013c0)={&(0x7f0000001340)=ANY=[@ANYBLOB="240000000f060101000000000000000000000001050001000700000006000b0100000000"], 0x24}, 0x1, 0x0, 0x0, 0x20000015}, 0x4000000) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x7, 0x20000000000002a9, &(0x7f0000000c40)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r2, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r4, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r4, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r4, 0x6, 0x14, &(0x7f0000000400)=0x1, 0x4) syz_genetlink_get_family_id$ethtool(&(0x7f0000000200), r4) r5 = socket$inet_sctp(0x2, 0x1, 0x84) sendmmsg$inet_sctp(r5, &(0x7f0000003f40)=[{&(0x7f0000000000)=@in={0x2, 0x4e22, @remote}, 0x10, &(0x7f0000000140)=[{&(0x7f0000000040)="1c", 0x1}], 0x1, &(0x7f0000000200)=ANY=[@ANYBLOB="18000000d53ac0000500000000000000b2de657533e340b7"], 0x18, 0x48060}], 0x1, 0x200000d0) accept$inet(r5, 0x0, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r4, 0x6, 0x1d, &(0x7f0000000480)={0x7, 0x1, 0x836, 0x8, 0x7}, 0x14) setsockopt$sock_int(r4, 0x1, 0x12, &(0x7f0000000080)=0x10000008, 0x4) 1.405907991s ago: executing program 2 (id=4506): r0 = socket$nl_rdma(0x10, 0x3, 0x14) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x1f, 0x14, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000fcffffff00000000800000af18010000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000020000207b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000200000085000000a600000018010000646c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000a000000850000000600000095"], &(0x7f0000000740)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x11, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffe}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r1, 0x6c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) 1.360607612s ago: executing program 0 (id=4507): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r0, 0x84, 0x81, &(0x7f0000000280)="1a00000002000000", 0x8) (async) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=@ipv4_newrule={0x24, 0x20, 0x301, 0x70bd27, 0x25dfdbff, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1e}, [@FRA_GENERIC_POLICY=@FRA_SPORT_RANGE={0x8, 0x17, {0x4e20, 0x4e20}}]}, 0x24}, 0x1, 0x0, 0x0, 0x240480d4}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000021000100"], 0x28}}, 0x0) (async) setsockopt$inet_sctp6_SCTP_AUTH_KEY(r0, 0x84, 0x17, &(0x7f0000000000)=ANY=[], 0xffc9) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0xc, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000610000001801000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000001700000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000680)={r2, 0x18000000000002a0, 0x12, 0x0, &(0x7f0000000380)="b9fe030768045c8c989a14f088a8657986dd", 0x0, 0x9b, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000940)={0xffffffffffffffff, 0xe0, &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, &(0x7f0000000600)=[0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x3, 0x2, &(0x7f0000000640)=[0x0, 0x0, 0x0], &(0x7f0000000680)=[0x0, 0x0], 0x0, 0xad, &(0x7f00000006c0)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], 0x50, 0x10, &(0x7f0000000740), &(0x7f0000000780), 0x8, 0x1d, 0x8, 0x8, &(0x7f0000000800)}}, 0x10) sendmsg$inet(r0, &(0x7f00000009c0)={&(0x7f0000000000)={0x2, 0x4e20, @broadcast}, 0x10, &(0x7f0000000580)=[{&(0x7f0000000040)="93145a9e95d385c3b815111ecbc326339793ea185d6a8b2533c13f5fa8afd206c385ae6143764a935da88454def612a6844da8684b46b99f43f600464fc7b168edbd025916cda6cae8848d33b2fd878fd1705b2ab63954da18d72761a5dfe845ab743d725b5c4c7622e21d14c66777ac2231ea760f016f617653b09080", 0x7d}, {&(0x7f00000002c0)="4ee80bac21ebb86671db5c8d83add17df1de6e81942a08c32196cbdbdf56557ed89f14b6c75e1f015593330efde08f08fc94b3718d1809df6637dcd6909e2ddadef362c14fa53d41541daee53e5f5b553ba1b0e0274535feebd3bd4df05e6e5be2dcc702a08c9c08f823e6588c5e54a63eafa0c673c40fe6a8ac1fd4f8adfe167ce36c01df559f30523d91b779d2c29ba89da9974c511f34da9edb4bbc7d1eb063ad2e87b8e77157bbe71f585c475ba9507df18114fa2db6", 0xb8}, {&(0x7f0000000380)="882643112a612984cc0687d4a708f4944422b0481ff56fee684ee6fa560a0b6e9a1ce203c2cff6b6568948b9e0d9a250f8d9b3ceb7a2f1de95fdfdd7cf7d2e4145bc5b9699704e7f3413dce4272c1449b532f5e6f79e5075b4be352af28aaa94d91ec8dadd7aee0fdfe2a8b972fde7f494960d5f6b130eee591b61f3c12881abbcf27b9c60663f8bc373bcdaecd37d22c1e7a7c065b50a6e23bb0079d5cb08dfc7d8810fe03fb84f0aa53c6264dadc90afacbb1c8a7f793cc119899ffbffda0314e25961c5115b3ab6f6db2e6e01d6c373f3e57af17fd1523e06ecaeae8ae965be9fa0b0a79fb13e254b1bf48aa8fddfdacae55ab55f6ca07d9c5c6323", 0xfd}, {&(0x7f00000004c0)}, {&(0x7f0000000500)="cfea9829295221a2ac9cf13157dd40758b18216253d8db1b99064208eb6a81152ddc34500e833cd3a9b26c1c2a3a5d42159a56b90e14c1146eeda11802f9a7abba913d5153220b479034780282203cce011ae618b6ca7acc7c281e2d5a987ce45e", 0x61}], 0x5, &(0x7f0000000980)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r3, @private=0xa010101, @private=0xa010100}}}], 0x20}, 0x804) pipe(&(0x7f00000007c0)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r5, &(0x7f00000000c0)=[{&(0x7f0000000180)='w', 0x1}], 0x1, 0x2) close(r5) (async) r6 = socket$inet_udp(0x2, 0x2, 0x0) (async) r7 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r7, &(0x7f0000000040)={0x2, 0x4e21, @multicast2}, 0x10) (async) connect$inet(r7, &(0x7f0000000080)={0x2, 0x4e21, @empty}, 0x10) (async) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r7, 0x84, 0x75, &(0x7f00000000c0)={0x0, 0x40}, 0x0) r8 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_INITMSG(r8, 0x84, 0x2, &(0x7f0000000600)={0xfdf9, 0x8, 0x1f}, 0x8) (async) sendto$inet6(r8, &(0x7f0000000040)='\x00', 0x1, 0xc001, &(0x7f0000000280)={0xa, 0x0, 0x80, @private2={0xfc, 0x2, '\x00', 0x1}, 0x3355}, 0x1c) (async) recvmmsg(r8, &(0x7f0000002100)=[{{0x0, 0x0, 0x0}, 0x4}], 0x1, 0x40000140, 0x0) setsockopt$SO_TIMESTAMPING(r6, 0x1, 0x25, &(0x7f0000000200)=0x474c, 0x4) bind$inet(r6, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) (async) connect$inet(r6, &(0x7f0000000480)={0x2, 0x4e22, @multicast1}, 0x10) (async) splice(r4, 0x0, r5, 0x0, 0xfffd, 0x0) 1.239498895s ago: executing program 3 (id=4508): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, 0x0}, 0x0) r0 = socket$key(0xf, 0x3, 0x2) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) recvmmsg(r1, &(0x7f0000000480)=[{{0x0, 0x0, &(0x7f00000013c0)=[{&(0x7f0000000140)=""/79, 0x4f}], 0x1}}], 0x1, 0x0, 0x0) shutdown(r1, 0x2) socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(r2, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@dev, @in6=@mcast2, 0x0, 0x0, 0xffff, 0x0, 0x2}, {0x0, 0x28c, 0x1, 0x0, 0x0, 0x0, 0x2}, {0x7, 0x0, 0x0, 0x1}, 0x0, 0x0, 0x1}, {{@in=@rand_addr=0x64010102, 0x2000000, 0x33}, 0x0, @in6=@loopback, 0x0, 0x3, 0x3, 0xb7, 0x0, 0x8000000}}, 0xe8) syz_emit_ethernet(0x7e, &(0x7f00000006c0)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaabb86366f1200b000483a0000000000000000000000000000000000ff02000000000000bf165185f6ab475a935c26d1000000000000000104009078000000006000000000002c00fc010000000000000000000000000002200100000000000000000000000000012f01000000000000070822eb"], 0x0) sendmmsg(r2, &(0x7f0000007fc0), 0x800001d, 0x0) 1.138384861s ago: executing program 2 (id=4509): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000340)=ANY=[@ANYBLOB="9feb010018000000000000003c0000003c000000020000000000000002000004080000000000000003000000000000000000000002000000000000000000000020000002000000000000000000000004"], 0x0, 0x56}, 0x20) 1.062614332s ago: executing program 1 (id=4510): bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0x3, 0x4, &(0x7f0000000080)=ANY=[@ANYBLOB="660a0000070000ffd7114c000000000085000000cf00000095"], &(0x7f0000000040)='syzkaller\x00', 0x8, 0x0, 0x0, 0x41000}, 0x94) 1.017669058s ago: executing program 0 (id=4511): socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r0 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000380)={'veth0_virt_wifi\x00', 0x2}) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r1 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4050000d62b00006110600000000000c6000000000000009500000000000000"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000080)={@map, r1, 0x26}, 0x10) bpf$BPF_PROG_DETACH(0x8, &(0x7f00000000c0)={@map, r1, 0x5}, 0x10) unshare(0x20000400) r2 = socket(0x10, 0x803, 0x0) getsockname$packet(r2, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0b0000000d001900010001000900000001000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000080)={r4, &(0x7f0000000080), &(0x7f0000000200)=""/155}, 0x20) bpf$MAP_UPDATE_CONST_STR(0x4, &(0x7f0000001800)={{r4}, &(0x7f0000001780)=0x4, &(0x7f00000017c0)='%pS \x00'}, 0x20) sendmsg$nl_route(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000002440)=@newlink={0x48, 0x10, 0x437, 0x70bd2b, 0xffffffff, {0x0, 0x0, 0x0, r3, 0x51b0b}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @ip6gre={{0xb}, {0x18, 0x2, 0x0, 0x1, [@IFLA_GRE_LOCAL={0x14, 0x6, @mcast2}]}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x48800}, 0x4000010) getpeername$packet(r2, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r5, &(0x7f00000002c0)={0x0, 0x64, &(0x7f00000000c0)={&(0x7f0000000400)=ANY=[@ANYBLOB="600000000206050000000000000000000000000005000100070000000900020073797a3000000000140007800800124040000000080013400000000014000300686173683a69702c706f72742c6970000500050002000000050004"], 0x60}}, 0x4) socket$packet(0x11, 0x3, 0x300) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r6, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r7 = socket$inet6(0xa, 0x80003, 0x6) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x401, 0x0) connect$inet6(r7, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) r8 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r8, 0x107, 0x12, &(0x7f0000000000)={0x4, 0x3}, 0x4) r9 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000100)={0x6, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000002000000000000000008082295"], &(0x7f0000000240)='syzkaller\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r9, 0x5, 0xb68, 0xffffffffffffff6b, &(0x7f0000000000)="ff", 0x0, 0x149c, 0x503, 0x0, 0x0, 0x0, 0x0, 0x2, 0xffff80fe}, 0x48) 901.181249ms ago: executing program 2 (id=4512): getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000080)={0x0, 0x6, 0x20, 0x3bc, 0x8}, &(0x7f00000000c0)=0x18) setsockopt$inet_sctp_SCTP_MAXSEG(0xffffffffffffffff, 0x84, 0xd, &(0x7f0000000100)=@assoc_id=r0, 0x4) socket$tipc(0x1e, 0x5, 0x0) (async) bind$tipc(0xffffffffffffffff, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x0, {0x42}}, 0x10) r1 = epoll_create1(0x0) epoll_pwait(r1, &(0x7f0000000000), 0x0, 0x6e, &(0x7f0000000000)={[0x7f]}, 0x8) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) (async) openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) (async, rerun: 32) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (rerun: 32) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x50) (async) unshare(0x2a000000) (async) unshare(0x2c020400) (async) r2 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000180)={'vxcan0\x00', 0x0}) connect$can_bcm(r2, &(0x7f0000000140)={0x1d, r3}, 0x10) (async, rerun: 64) sendmsg$can_bcm(r2, 0x0, 0x20000000) (rerun: 64) socket$nl_route(0x10, 0x3, 0x0) r4 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r4, 0x8933, &(0x7f0000000100)={'vxcan0\x00'}) (async) r5 = socket$nl_route(0x10, 0x3, 0x0) (async) r6 = socket$nl_route(0x10, 0x3, 0x0) (async, rerun: 32) r7 = socket$netlink(0x10, 0x3, 0x0) (async, rerun: 32) r8 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x14}}, 0x0) (async) getsockname$packet(r8, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x7) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700000086d7c0d6c878f064eb", @ANYRES32=r9, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) (async, rerun: 32) sendmsg$nl_route_sched(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000900)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r9, {0x0, 0x8}, {0xfff1, 0xffff}, {0x6, 0xffe0}}, [@qdisc_kind_options=@q_clsact={0xb}]}, 0x30}}, 0x4000800) (async, rerun: 32) sendmsg$nl_route_sched(r6, &(0x7f0000000280)={0x0, 0xffffffffffffffba, &(0x7f0000000240)={&(0x7f0000000980)=@delchain={0x34, 0x64, 0xf31, 0xfffffffb, 0x0, {0x0, 0x0, 0x0, r9, {0x0, 0x9}, {0xfff3, 0xffff}, {0x0, 0x1b}}, [@filter_kind_options=@f_flower={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x10}, 0x800) (async, rerun: 32) sendmsg$nl_route_sched(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=@delchain={0x24, 0x11, 0x1, 0x1f, 0x0, {0x0, 0x0, 0x0, r9, {0xf}}}, 0x24}, 0x1, 0x0, 0x0, 0x4008000}, 0x0) (rerun: 32) 631.611698ms ago: executing program 1 (id=4513): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4081}, 0x2400c800) (async) sendmsg$nl_route_sched(r0, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4081}, 0x2400c800) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000003dc0)) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000004300)={'sit0\x00', &(0x7f0000004280)={'syztnl1\x00', 0x0, 0x20, 0x80, 0xe, 0x7, {{0xd, 0x4, 0x0, 0x32, 0x34, 0x67, 0x0, 0x10, 0x4, 0x0, @local, @loopback, {[@ssrr={0x89, 0x1b, 0x9, [@loopback, @empty, @dev={0xac, 0x14, 0x14, 0x22}, @loopback, @dev={0xac, 0x14, 0x14, 0x2a}, @rand_addr=0x64010101]}, @ra={0x94, 0x4}]}}}}}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000004340)={'ip6gre0\x00'}) (async) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000004340)={'ip6gre0\x00'}) r1 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x50) bpf$BPF_MAP_LOOKUP_AND_DELETE_ELEM(0x15, &(0x7f0000001d00)={r1, &(0x7f0000000080), 0x0}, 0x20) (async) bpf$BPF_MAP_LOOKUP_AND_DELETE_ELEM(0x15, &(0x7f0000001d00)={r1, &(0x7f0000000080), 0x0}, 0x20) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000007f40)={'syztnl1\x00', &(0x7f0000007ec0)={'ip6_vti0\x00', 0x0, 0x2b, 0x40, 0xc, 0x4d, 0x1a, @private2={0xfc, 0x2, '\x00', 0x1}, @dev={0xfe, 0x80, '\x00', 0x3d}, 0x8, 0x80, 0xe, 0x8bb}}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) r5 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r5, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000080)=@newlink={0x60, 0x10, 0x437, 0x70bd29, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, 0x20c89, 0x20}, [@IFLA_LINKINFO={0x40, 0x12, 0x0, 0x1, @ip6gre={{0xb}, {0x30, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}, @IFLA_GRE_REMOTE={0x14, 0x7, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @IFLA_GRE_LOCAL={0x14, 0x6, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}]}}}]}, 0x60}, 0x1, 0x0, 0x0, 0x20008000}, 0x20000000) ioctl$sock_kcm_SIOCKCMUNATTACH(r5, 0x89e1, &(0x7f00000000c0)={r3}) sendmsg$nl_route_sched(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0xffe0}, {0xffff, 0xffff}, {0x10}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0xe, 0x3, 0x1, 0x1}}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x51}, 0x40) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$batadv(&(0x7f0000000400), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r6, 0x8933, &(0x7f0000000440)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_SET_MESH(r6, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000300)={0x24, r7, 0x1, 0x4070bd28, 0x1, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r8}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x5}]}, 0x24}}, 0x18) (async) sendmsg$BATADV_CMD_SET_MESH(r6, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000300)={0x24, r7, 0x1, 0x4070bd28, 0x1, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r8}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x5}]}, 0x24}}, 0x18) socket$inet6_sctp(0xa, 0x1, 0x84) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r9, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@newtaction={0x64, 0x30, 0x1, 0x0, 0x0, {}, [{0x50, 0x1, [@m_vlan={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_VLAN_PARMS={0x1c, 0x2, {{0x5, 0x0, 0x0, 0x80000008}, 0x4}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x64}}, 0x0) pipe(&(0x7f0000000200)) (async) pipe(&(0x7f0000000200)) r10 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r10, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={0x0}, 0x9}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000680)=@newqdisc={0x3c, 0x24, 0xd0f, 0x200000, 0x0, {0x60, 0x0, 0x0, r4, {}, {0xffff, 0xffff}, {0x0, 0xb}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x4}}, @TCA_INGRESS_BLOCK={0x8, 0xd, 0x9}]}, 0x3c}}, 0x20000010) (async) sendmsg$nl_route_sched(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000680)=@newqdisc={0x3c, 0x24, 0xd0f, 0x200000, 0x0, {0x60, 0x0, 0x0, r4, {}, {0xffff, 0xffff}, {0x0, 0xb}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x4}}, @TCA_INGRESS_BLOCK={0x8, 0xd, 0x9}]}, 0x3c}}, 0x20000010) socket$inet_tcp(0x2, 0x1, 0x0) (async) socket$inet_tcp(0x2, 0x1, 0x0) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) (async) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) (async) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r11, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000680)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01080000000000000000070000000900010073797a300000000054000000090a010400000000000000000700000008000a40000000000900020073797a31000000000900010073797a3000000000080005400000000c080003400000000808000740000000310800064000000000780000000c0a01010000000000000000070000000900020073797a31000000000900010073797a30000000004c0003804800008008000340000000023c00028035000100299246c8790c329b9b21c709e5bde740667dacbfa315d9435694f397a882b3f08e609ceb866040a2100c9ec9eac4261c6200000014000000020a01"], 0x128}}, 0x0) (async) sendmsg$NFT_BATCH(r11, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000680)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01080000000000000000070000000900010073797a300000000054000000090a010400000000000000000700000008000a40000000000900020073797a31000000000900010073797a3000000000080005400000000c080003400000000808000740000000310800064000000000780000000c0a01010000000000000000070000000900020073797a31000000000900010073797a30000000004c0003804800008008000340000000023c00028035000100299246c8790c329b9b21c709e5bde740667dacbfa315d9435694f397a882b3f08e609ceb866040a2100c9ec9eac4261c6200000014000000020a01"], 0x128}}, 0x0) 523.0984ms ago: executing program 2 (id=4514): sendmsg$NL802154_CMD_NEW_SEC_KEY(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000002c0)={0x0, 0x7c}, 0x1, 0x0, 0x0, 0x4004}, 0x0) socket$key(0xf, 0x3, 0x2) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000004c0)=@newsa={0x128, 0x10, 0x7, 0x0, 0x0, {{@in6=@mcast2, @in=@multicast2, 0x4e20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xee00}, {@in6=@mcast1, 0x0, 0x2b}, @in6=@private0, {0x0, 0x0, 0x2, 0xfffffffffffffffd, 0x10000000, 0xffffffffffffffff}, {0x0, 0x200000, 0x7}, {0x40000, 0xfffffffd, 0xae8}, 0x0, 0x0, 0xa, 0x2, 0x0, 0x34}, [@coaddr={0x14, 0xe, @in6=@remote}, @lifetime_val={0x24, 0x9, {0x3, 0x8000000000000001, 0xb4, 0x5}}]}, 0x128}}, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000000c0)=@newsa={0x104, 0x1a, 0x7, 0x70bd2a, 0x0, {{@in6=@dev={0xfe, 0x80, '\x00', 0x1b}, @in=@multicast1, 0xffff, 0x0, 0x4e22, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xee00}, {@in6=@mcast1, 0x0, 0x2b}, @in6=@private0, {0x5a, 0xb400, 0x2, 0xfeffff7f00000001, 0x0, 0x60000}, {0x0, 0x200000, 0x7, 0xfffffffffffffffd}, {0x40000, 0x0, 0xae8}, 0x0, 0x0, 0xa, 0x2, 0x0, 0x70}, [@coaddr={0x14, 0xe, @in6=@remote}]}, 0x104}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000001000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a3c000000120a01080000000000000000020000000900020073797a2a0000000008000440000000000900010073797a3000000000080003400000000a14000000110001"], 0x64}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x3, 0x16, &(0x7f0000000f40)=ANY=[@ANYBLOB="61128c000000000061134c0000000000bf2000000000000007000000080000002d0301000000000095000000000000007126000000000000bf670000000000005601000000ff07ad6706000002000000070200000ee60000bf250000000000003d350000000000006507000002000000070700004c0000001f750000000000006154000000000000160400000400f9ffad3001000000000084000000000000004500000001f0ffff95000000000000006e8ad524a56600a5585b7351ca1136aef2e9407e5c2501d11900db85604036883647b1fb3f1403b816f511c8c56e56e40b01005505f8a89dae4293b10f3631b25fc9f189084c7fddccff01361d355f6cce8ec2abcdf1bc9040daef2cfa2046e2091e269f4734ffa55eb2d4e8de20b38c8808b365b46bd54c68cd30139a8c3827a7dd6d6e2b5fea3906f8456b0000000000ff07efffffff0047018ae79db613d2aec070f718ab629b4975320dd7a7da532281fd22c7b835005bf52715396669836db6000000005b4f0591ee7c8cd263dd172b28d01c4d8ddaf2cdad3d1a74a2f078aa6402483856a6e495408d0b33047f06aec2cc590df28efc7dbec6857db922195a271af103f03e1155197e067b2ebf4e2dae06e394c9639564f000fc3cdd05a157544d0200000000000000ee48f5287123a0d246c0c4c00fe979dbc09ed4db22d7172adc6ae8faa5f9ad188e07000000000000008d88a0b4684559d46cae41db1b914e93f1f88e80ef80c6ed3e1ff91ff111000000000000000000e33de432e488ad0e724c2d14a1e770e116984a5700afb8a1f3d47277ef0e33e7e00ec5f74e10937ba0e321346977b7d1b18013f509675b5b0f352e30dffda780e95c301f4fc7d5a76475ace6b128b02bfd71023daffdf748a6bd356fcbacec96373d1101000736ac0bbcb5f4836bddfe8bf46308000000ade9e59fcf271bb98bd0b8b5216b858b414c31682f9f3db2e4d8e5898e445fe55ac56c0ddd932d838ff651023853d42210642986f8bbc7340bc8393f774318c9fc9b05788de2c6e601b50777e8dff581de1d5ae3d801ead7eba31126e2172fa1eadf5f3bec81004d00000000c8e4692e051c731f9ac766b7fd66278d40f0760f23e8c7d1f47cd8e02504e85e152955ad8acd989c0b2eea71414f533f5685c3904bfe1d0011ffc1ba5398f3d68124674478186edd036f15bf847c33f79e1a0ad3d2b5080ecb01420c9f1b534e969fce97ffff07000009000000bfe0ed7c5853a665c0805752dca0e571d75cac5a5d8e4f6e05055b6dec5a9a5696f053a92d81fd9e5f2b9dbbe24f38e745b5a95d45003d0600e413dc623f3e6b096c8b0ad7438c6631388892c55b0671140afbfb83bba415f729fea4c8a8a86189dceedad84cdd17c46bdd847a1f4b0facd3744f5bbb06abb319204fca4bcd4297fe7b4cee75abf43e14fe861224799c0f12702964fc890a176fdafa2c9387280b5693c000c0304cece48642649375dae0b7979b229f708a97349e96e783af9a23cd3980a2c29d3d62875e5319cd51bdd224878a0b25edf0e83c930633bd9a823e28f359608ea326c77a1aa17318f392a0ec6c188916f4149c503027feccfd68ec826da90252693fb133c4615801077e1d75420017c03990b855fe481a20b4919bb11c6d737b6545ef140a0fc339bb53953662f1454f9852e7c4e17eb8e68f076c659f56d6c7f97a94d604f45cfe88b30c170000000001000000ef931f137967de563c29d81aacb3d48226a4e4b6670900000000000000fa68bff3693afc44db223f0400000000000000d23b48bb38b31a14ffcddd92ce4c4d353261260c9d7a6bd9f2c872c4172a3d2ac80dfb718cc159e6423065624f1300007d6072f0cf120ad2ba519afdd43a14000000000000000000000000007ef2f3c58d045f0700000094069acbe333aebd10f2118fbfeda3fa5500d52cd5241588d2b68a332edfef6d701c8936a25d68b841f982511392cc0d3a78616f8ce0f2877d099258bf85866d0ee7f803fa50fd41ef62b028d12028a7b497d92f544523290f520b0d000000000000000000007758b1267669ded883b5867c5916a74843b784955108f750c57744c76a09629dd0aaca5cb0f14f49db80a1aa2692c18fbb31cbdb3f2e138e6d5ba3491fc3617b511f24bad26466407e39000000000000d7a1bf4624d31c13a6840f45a7f4e01a50d790132abb36915e35b1ac35bf3921357f638684bba17b8fe1e2123153ecd6d1f76820d4f8fa0b96b50c457ae8d5f2351cdb7bc8170380557bc11cf6ee3395974e37018a2a7473312cb32affb8ff72a253e0d36099e460f13694b9891af526d9608271838e83d17103887f34210dd4c0cf60dec608b4ca5ba2f3037bf381e7b5d5b27820000000000000000000000b719bd34f3244730f708fdd532640edc6b82dd4ad72ecbaccafef806f5447aba2246d56a601bbd8c24ba1e16dda3296ce10de683000"/1782], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls}, 0x48) sendmsg$NFT_BATCH(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[], 0x74}, 0x1, 0x0, 0x0, 0x1}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r3, 0x1, 0x25, &(0x7f0000000200)=0x475c, 0x4) connect$inet(r3, &(0x7f0000000480)={0x2, 0x0, @multicast1}, 0x10) sendmmsg(r3, &(0x7f0000007fc0), 0x800001d, 0x0) recvmmsg(r3, &(0x7f0000000340)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=""/33, 0x21}, 0x4}], 0x3d5, 0x45833af92e4b38ff, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x88841, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r5 = socket$inet_sctp(0x2, 0x5, 0x84) mmap(&(0x7f0000abb000/0x1000)=nil, 0x1000, 0x0, 0x102000200032, 0xffffffffffffffff, 0x87f64000) setsockopt$sock_timeval(r5, 0x1, 0x14, &(0x7f0000abaff9)={0x0, 0xea60}, 0x10) write$cgroup_devices(r4, &(0x7f00000002c0)=ANY=[@ANYBLOB="0700a3fcf070d1ff"], 0xffdd) syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) r6 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r6, &(0x7f0000002140)={0xa, 0x4e24, 0x4, @empty, 0x8}, 0x1c) getsockopt$inet6_int(r6, 0x29, 0x18, 0x0, &(0x7f00000000c0)) ioctl$NILFS_IOCTL_CHANGE_CPMODE(r4, 0x40106e80, &(0x7f0000000000)={0x5, 0x1}) ioctl$NILFS_IOCTL_GET_CPSTAT(r5, 0x80186e83, &(0x7f0000000080)) 309.487264ms ago: executing program 0 (id=4515): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) bpf$OBJ_PIN_MAP(0x6, &(0x7f00000001c0)=@o_path={&(0x7f0000000bc0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', r1}, 0x18) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a3c000000120a09000000000000000000020000000900020073797a310000000008000440000000000900010073797a30000000000800034000000001340000001f0a03000000000000000000020000000900010073797a3000000000080003400000001e0c0006"], 0x98}}, 0x0) 256.641423ms ago: executing program 1 (id=4516): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x3, 0xc, &(0x7f0000000180)=@framed={{0x18, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x80000001}, [@ringbuf_output={{0x18, 0x5, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1ffb0}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x45}}]}, &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x42, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80}, 0x94) 170.637678ms ago: executing program 4 (id=4517): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) socket$inet_udp(0x2, 0x2, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000300)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70b923, 0x80000, {0x0, 0x0, 0x0, r6, {0x0, 0x9}, {0xfff1, 0xb}, {0xf, 0xb}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x0, 0x84000002, 0x7, 0x1, 0x80000000, 0x1ff, 0x8, 0x2, 0x2}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x2000c061}, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080), r7) sendmsg$TIPC_CMD_ENABLE_BEARER(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="010000000d0000000700010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) 1.677533ms ago: executing program 0 (id=4518): r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000080)=0x8, 0x4) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0xe22}, 0x1c) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000000240)=0x9, 0x4) bind$inet6(r1, &(0x7f0000000040)={0xa, 0xe22}, 0x1c) setsockopt$sock_int(r1, 0x1, 0x31, &(0x7f0000001600), 0x4) r2 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r2, &(0x7f0000000180)=[{&(0x7f00000001c0)="580000001500add427323b472545b4560a117fffffff81000e220e227f000008925aa80013007b00090080007f000001e809000000ff0000f03ac7100003ffffffffffffffffffffffe7ee000000deff0000000200000000", 0x58}], 0x1) sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000000c0)=ANY=[@ANYBLOB="3c0000001000010000000000000000002c0000000c000000ff0f00000000000008001c00c900000014003100fc010000000000000000000000000001ef948c95c530b78d405e13e70f8c004507df7200ccf002d2b87459afe968b1615070db6d58f2a45b89f70631a569c8aa967c896faea9929fecc4f188a871b2ca"], 0x3c}], 0x1, 0x0, 0x0, 0xb305e06d8ab48273}, 0x48800) unshare(0x22020600) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x42000, 0x0) vmsplice(r3, &(0x7f0000000800)=[{0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}], 0x9, 0xd) readv(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000000080)=""/115, 0x73}, {&(0x7f0000000100)=""/156, 0x9c}], 0x2) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r4, &(0x7f00000002c0)={0xa, 0x4e22, 0x0, @local, 0xb}, 0x1c) listen(r4, 0x2) r5 = socket$alg(0x26, 0x5, 0x0) bind$can_raw(0xffffffffffffffff, &(0x7f00000001c0), 0x10) bind$alg(r5, &(0x7f0000000940)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(blowfish)\x00'}, 0x58) r6 = bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000140)=@base={0xa, 0x16, 0xb3, 0x7f}, 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x12, &(0x7f0000000080)=@framed={{0x18, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, [@func={0x85, 0x0, 0x1, 0x0, 0x6}, @map_fd={0x18, 0x0, 0x1, 0x0, r6}, @generic={0x66}, @initr0, @exit, @printk={@x={0x18, 0x0}, {0x3, 0x3, 0x3, 0xa, 0x0}, {0x7, 0x1, 0xc, 0x1, 0x5}, {0x7, 0x0, 0x0, 0x1, 0x0, 0x0, 0xfffffe00}, {}, {}, {0x85, 0x0, 0x0, 0x2d}}]}, &(0x7f0000000000)='GPL\x00', 0x2}, 0x94) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r8 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r7, &(0x7f00000018c0)={@val={0x0, 0x86dd}, @val={0x0, 0x0, 0x11, 0x800}, @mpls={[], @ipv6=@icmpv6={0x0, 0x6, "ec9700", 0x40, 0x2c, 0x0, @local, @mcast2, {[@fragment={0x3a}], @pkt_toobig={0x2, 0x0, 0x0, 0x800, {0xf, 0x6, '*zc', 0x3ff, 0x6c, 0x1, @loopback, @loopback, [], "ab0924172f9c2a1d"}}}}}}, 0x76) accept4(r5, 0x0, 0x0, 0x800) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)) 0s ago: executing program 1 (id=4519): socketpair(0x1, 0x1, 0x9, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) connect$inet(r1, &(0x7f0000000080)={0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10) r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) ioctl$sock_ifreq(r3, 0x8910, &(0x7f0000000000)={'veth0_vlan\x00', @ifru_ivalue=0x4}) ioctl$sock_netdev_private(r3, 0x89f8, &(0x7f0000000000)) r4 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) r5 = socket$netlink(0x10, 0x3, 0x10) r6 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$bt_sco(r6, &(0x7f0000000000), 0x8) listen(r6, 0x312) setsockopt$bt_BT_VOICE(r6, 0x112, 0xb, 0x0, 0x0) r7 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000006800)={&(0x7f0000000100)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="15060000f2ff01000000010000003000018014000400ff010000000000000000000000000001060005004e220000060001000a000000080006000100"], 0x44}, 0x5}, 0x0) sendmsg$NBD_CMD_CONNECT(r2, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001600)=ANY=[@ANYBLOB='H\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="01002cbd700000100000010000000c00020009000000000000001c0007800c00018008000100", @ANYRES32=r0, @ANYBLOB="0500018008000100", @ANYRES32=r0, @ANYBLOB="0c0005002801000000000000"], 0x48}}, 0x4) kernel console output (not intermixed with test programs): tive [ 583.719292][T19064] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 583.730124][T19064] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 583.762943][T19064] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 584.217607][ T5632] Bluetooth: hci3: command tx timeout [ 586.846566][T19333] syzkaller0: entered promiscuous mode [ 586.852219][T19333] syzkaller0: entered allmulticast mode [ 590.214626][T19064] hsr_slave_0: entered promiscuous mode [ 590.238940][T19351] netlink: 'syz.0.3289': attribute type 58 has an invalid length. [ 590.250334][T19064] hsr_slave_1: entered promiscuous mode [ 590.270071][T19358] netlink: 'syz.3.3291': attribute type 9 has an invalid length. [ 590.283265][T19064] debugfs: 'hsr0' already exists in 'hsr' [ 590.289650][T19351] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3289'. [ 590.297722][T19064] Cannot create hsr debugfs directory [ 590.310367][T19358] netlink: 212400 bytes leftover after parsing attributes in process `syz.3.3291'. [ 590.320428][T19356] netlink: 'syz.1.3290': attribute type 8 has an invalid length. [ 590.351898][T19356] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3290'. [ 590.728160][T19381] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3293'. [ 591.288810][ T12] veth1_macvtap: left promiscuous mode [ 591.295786][ T12] veth0_macvtap: left promiscuous mode [ 591.700370][T19417] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 592.144627][ T5290] 8021q: adding VLAN 0 to HW filter on device eth3 [ 592.406125][T19431] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3302'. [ 592.442887][T19433] FAULT_INJECTION: forcing a failure. [ 592.442887][T19433] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 592.510486][T19433] CPU: 0 UID: 0 PID: 19433 Comm: syz.3.3303 Not tainted syzkaller #0 PREEMPT(full) [ 592.510512][T19433] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 592.510524][T19433] Call Trace: [ 592.510532][T19433] [ 592.510540][T19433] dump_stack_lvl+0xe8/0x150 [ 592.510578][T19433] should_fail_ex+0x412/0x560 [ 592.510607][T19433] _copy_from_user+0x2d/0xb0 [ 592.510636][T19433] __sys_bpf+0x229/0x950 [ 592.510667][T19433] ? __pfx___sys_bpf+0x10/0x10 [ 592.510708][T19433] ? ksys_write+0x242/0x270 [ 592.510737][T19433] ? __pfx_ksys_write+0x10/0x10 [ 592.510767][T19433] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 592.510786][T19433] __x64_sys_bpf+0x7c/0x90 [ 592.510812][T19433] do_syscall_64+0x15f/0xf80 [ 592.510829][T19433] ? trace_irq_disable+0x3b/0x140 [ 592.510856][T19433] ? clear_bhb_loop+0x40/0x90 [ 592.510878][T19433] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 592.510896][T19433] RIP: 0033:0x7f16dff9ce59 [ 592.510914][T19433] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 592.510928][T19433] RSP: 002b:00007f16e0e3c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 592.510947][T19433] RAX: ffffffffffffffda RBX: 00007f16e0215fa0 RCX: 00007f16dff9ce59 [ 592.510960][T19433] RDX: 0000000000000094 RSI: 0000200000000100 RDI: 0000000000000005 [ 592.510971][T19433] RBP: 00007f16e0e3c090 R08: 0000000000000000 R09: 0000000000000000 [ 592.510982][T19433] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 592.510991][T19433] R13: 00007f16e0216038 R14: 00007f16e0215fa0 R15: 00007ffc6079bef8 [ 592.511020][T19433] [ 592.892455][T19440] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3305'. [ 592.902274][T19441] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3304'. [ 593.073120][T19440] bridge1: port 1(gretap1) entered blocking state [ 593.096811][T19440] bridge1: port 1(gretap1) entered disabled state [ 593.109976][T19440] gretap1: entered allmulticast mode [ 593.140160][T19440] gretap1: entered promiscuous mode [ 593.483249][ T12] IPVS: stop unused estimator thread 0... [ 593.660155][T19464] netlink: 'syz.0.3309': attribute type 4 has an invalid length. [ 593.871828][T19483] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3312'. [ 594.092234][T19490] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 594.142915][T19490] mac80211_hwsim hwsim49 syzkaller0: entered promiscuous mode [ 594.169445][T19490] mac80211_hwsim hwsim49 syzkaller0: entered allmulticast mode [ 594.559001][T19064] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 594.616988][T19064] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 594.653306][T19064] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 594.658790][T19509] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3318'. [ 594.684211][T19505] netlink: 'syz.1.3316': attribute type 10 has an invalid length. [ 594.695163][T19064] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 594.710656][T19064] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 594.745548][T19064] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 594.761458][T19505] syz_tun: left allmulticast mode [ 594.803528][T19505] bridge0: port 3(syz_tun) entered disabled state [ 594.859395][T19505] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 594.895611][T19064] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 594.914460][T19064] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 594.957842][T19523] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3319'. [ 595.263307][T19534] pim6reg: entered allmulticast mode [ 595.480788][T19551] batman_adv: batadv0: Adding interface: macvtap1 [ 595.488288][T19551] batman_adv: batadv0: The MTU of interface macvtap1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 595.517369][T19551] batman_adv: batadv0: Not using interface macvtap1 (retrying later): interface not active [ 595.615832][T19557] tipc: Enabled bearer , priority 0 [ 595.669051][T19064] 8021q: adding VLAN 0 to HW filter on device bond0 [ 595.728125][T19064] 8021q: adding VLAN 0 to HW filter on device team0 [ 595.758324][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 595.765731][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 595.813230][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 595.820482][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 595.854102][T19563] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3328'. [ 596.732505][T10882] tipc: Node number set to 2369084699 [ 597.350569][T19064] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 597.430141][T19064] veth0_vlan: entered promiscuous mode [ 597.438569][T19628] batadv_slave_1: entered promiscuous mode [ 597.467710][T19064] veth1_vlan: entered promiscuous mode [ 597.511512][T19064] veth0_macvtap: entered promiscuous mode [ 597.524246][T19064] veth1_macvtap: entered promiscuous mode [ 597.555309][T19064] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 597.578390][T19064] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 597.601357][ T13] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 597.612306][ T13] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 597.625456][ T13] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 597.635730][ T13] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 598.188351][T19631] batadv_slave_1: left promiscuous mode [ 599.540677][T19591] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 599.714426][ T1165] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 599.754829][ T1165] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 599.832135][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 599.859558][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 599.930182][T19673] netlink: 36 bytes leftover after parsing attributes in process `syz.0.3341'. [ 600.119134][T19679] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3344'. [ 600.149789][T19684] RDS: rds_bind could not find a transport for ::ffff:100.1.1.0, load rds_tcp or rds_rdma? [ 600.206961][T19680] syzkaller0: entered promiscuous mode [ 600.224818][T19680] syzkaller0: entered allmulticast mode [ 600.423082][T19692] netlink: 'syz.3.3346': attribute type 5 has an invalid length. [ 600.480060][T19684] syzkaller0: entered promiscuous mode [ 600.499663][T19684] syzkaller0: entered allmulticast mode [ 601.094901][T16635] page_pool_release_retry() stalled pool shutdown: id 72, 1 inflight 241 sec [ 604.450150][T19698] batadv1: entered promiscuous mode [ 604.455765][T19698] batadv1: entered allmulticast mode [ 604.474804][T19706] workqueue: Failed to create a rescuer kthread for wq "bond3": -EINTR [ 604.475293][T19701] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3349'. [ 604.658822][T19711] gre2: entered allmulticast mode [ 604.950058][T19724] tipc: Enabling of bearer rejected, already enabled [ 605.257527][T19740] netlink: 'syz.4.3361': attribute type 1 has an invalid length. [ 605.265571][T19740] netlink: 224 bytes leftover after parsing attributes in process `syz.4.3361'. [ 605.424460][T19747] netlink: 'syz.4.3361': attribute type 10 has an invalid length. [ 605.479774][T19740] netlink: 'syz.4.3361': attribute type 10 has an invalid length. [ 605.532023][T19747] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 605.548881][T19747] team0: Port device netdevsim1 added [ 605.594898][T19740] team0: Port device netdevsim1 removed [ 605.612061][T19740] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 605.632224][T19740] bond0: (slave netdevsim1): Enslaving as an active interface with an up link [ 605.913311][T19774] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3367'. [ 606.063040][T19763] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3367'. [ 606.114740][T19781] netlink: 212368 bytes leftover after parsing attributes in process `syz.4.3368'. [ 606.348984][T19786] syzkaller0: entered promiscuous mode [ 606.374667][T19786] syzkaller0: entered allmulticast mode [ 606.478072][T19786] tipc: Enabled bearer , priority 0 [ 606.511043][T19784] tipc: Resetting bearer [ 606.591756][T19784] tipc: Disabling bearer [ 606.710803][T19807] tipc: New replicast peer: 255.255.255.255 [ 606.733947][T19807] tipc: Enabled bearer , priority 5 [ 606.837444][T19809] netlink: 14 bytes leftover after parsing attributes in process `syz.4.3378'. [ 607.385681][ T10] IPVS: starting estimator thread 0... [ 607.482476][T19833] IPVS: using max 31 ests per chain, 74400 per kthread [ 607.787755][T19838] vlan2: entered promiscuous mode [ 607.793466][T19838] bond_slave_1: entered promiscuous mode [ 607.800415][T19844] netlink: 80 bytes leftover after parsing attributes in process `syz.3.3387'. [ 607.849843][T19844] netlink: 76 bytes leftover after parsing attributes in process `syz.3.3387'. [ 607.872293][T19844] netlink: 76 bytes leftover after parsing attributes in process `syz.3.3387'. [ 607.891037][T19841] tipc: Enabling of bearer rejected, already enabled [ 608.175980][T19859] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3391'. [ 608.428329][T19859] bond0: (slave syz_tun): Releasing backup interface [ 608.888106][T19874] IPVS: Error connecting to the multicast addr [ 609.002172][T19879] netlink: 'syz.2.3399': attribute type 6 has an invalid length. [ 610.364489][T19934] __nla_validate_parse: 2 callbacks suppressed [ 610.364515][T19934] netlink: 6024 bytes leftover after parsing attributes in process `syz.4.3412'. [ 611.105136][T19964] netlink: 388 bytes leftover after parsing attributes in process `syz.0.3421'. [ 611.422895][T19972] netlink: 'syz.0.3423': attribute type 10 has an invalid length. [ 611.527117][T19976] netlink: 'syz.2.3424': attribute type 10 has an invalid length. [ 611.720656][T19972] syz_tun: entered promiscuous mode [ 611.750436][T19972] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 611.774662][T19976] syz_tun: entered promiscuous mode [ 611.810273][T19976] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 612.029200][T19986] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3428'. [ 612.307912][T20004] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3431'. [ 612.357818][T20004] netlink: 'syz.0.3431': attribute type 13 has an invalid length. [ 612.384568][T20004] netlink: 'syz.0.3431': attribute type 17 has an invalid length. [ 612.466912][T20004] syz_tun: left promiscuous mode [ 612.599795][T20021] netlink: 228 bytes leftover after parsing attributes in process `syz.4.3433'. [ 612.699873][T20023] netlink: 'syz.4.3433': attribute type 13 has an invalid length. [ 612.730428][T20023] netlink: 'syz.4.3433': attribute type 17 has an invalid length. [ 612.805288][T20031] netlink: 'syz.2.3436': attribute type 10 has an invalid length. [ 613.035401][T20004] bond1: left allmulticast mode [ 613.040452][T20004] bridge1: left allmulticast mode [ 613.049709][T20004] 8021q: adding VLAN 0 to HW filter on device bond1 [ 613.069149][T20004] 8021q: adding VLAN 0 to HW filter on device bond2 [ 613.079510][T20004] mac80211_hwsim hwsim49 syzkaller0: left promiscuous mode [ 613.087601][T20004] mac80211_hwsim hwsim49 syzkaller0: left allmulticast mode [ 613.095322][T20004] A link change request failed with some changes committed already. Interface syzkaller0 may have been left with an inconsistent configuration, please check. [ 613.218446][T20021] bridge0: port 2(bridge_slave_1) entered disabled state [ 613.226372][T20021] bridge0: port 1(bridge_slave_0) entered disabled state [ 613.320053][T20021] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 613.337921][T20021] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 613.526349][T20023] 8021q: adding VLAN 0 to HW filter on device bond0 [ 613.535912][T20023] 8021q: adding VLAN 0 to HW filter on device team0 [ 613.548767][T20023] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 613.574824][T20023] bridge0: port 1(bridge_slave_0) entered blocking state [ 613.582147][T20023] bridge0: port 1(bridge_slave_0) entered forwarding state [ 613.595928][T20023] bridge0: port 2(bridge_slave_1) entered blocking state [ 613.603156][T20023] bridge0: port 2(bridge_slave_1) entered forwarding state [ 613.628804][T20023] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 613.639410][T20023] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 613.673772][T20023] veth1_vlan: left promiscuous mode [ 613.680549][T20023] veth0_vlan: left promiscuous mode [ 613.687725][T20023] veth0_vlan: entered promiscuous mode [ 613.698545][T20023] veth1_vlan: entered promiscuous mode [ 613.710863][T20023] veth1_macvtap: left promiscuous mode [ 613.717891][T20023] veth0_macvtap: left promiscuous mode [ 613.725772][T20023] veth0_macvtap: entered promiscuous mode [ 613.747660][T20023] veth1_macvtap: entered promiscuous mode [ 613.762103][T20023] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 613.776918][T20023] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 613.791885][T20023] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 613.806497][T20023] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 613.831317][T20023] bridge1: port 1(gretap1) entered blocking state [ 613.838091][T20023] bridge1: port 1(gretap1) entered forwarding state [ 613.904668][T20023] vlan2: left promiscuous mode [ 613.909519][T20023] bond_slave_1: left promiscuous mode [ 613.930373][T20028] bridge0: port 2(bridge_slave_1) entered disabled state [ 614.020308][T20039] netlink: 108 bytes leftover after parsing attributes in process `syz.0.3438'. [ 614.411429][T20064] x_tables: arp_tables: NFQUEUE target: not valid for this family [ 614.494764][T20067] netlink: 388 bytes leftover after parsing attributes in process `syz.2.3445'. [ 614.571796][T20071] sctp: [Deprecated]: syz.4.3447 (pid 20071) Use of int in max_burst socket option. [ 614.571796][T20071] Use struct sctp_assoc_value instead [ 614.597303][T20072] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3447'. [ 614.664403][T20079] netlink: 'syz.3.3449': attribute type 1 has an invalid length. [ 614.686380][T20080] netlink: 'syz.0.3450': attribute type 10 has an invalid length. [ 614.698775][T20080] syz_tun: entered promiscuous mode [ 614.715180][T20079] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3449'. [ 615.028334][T20101] bridge0: port 1(bridge_slave_0) entered disabled state [ 615.061167][T20100] ip_tunnel: non-ECT from 172.20.20.187 with TOS=0x2 [ 615.070053][T20100] ip_tunnel: non-ECT from 172.20.20.187 with TOS=0x2 [ 615.077113][T20100] ip_tunnel: non-ECT from 172.20.20.187 with TOS=0x2 [ 615.084071][T20100] ip_tunnel: non-ECT from 172.20.20.187 with TOS=0x2 [ 615.090951][T20100] ip_tunnel: non-ECT from 172.20.20.187 with TOS=0x2 [ 615.097970][T20100] ip_tunnel: non-ECT from 172.20.20.187 with TOS=0x2 [ 615.104901][T20100] ip_tunnel: non-ECT from 172.20.20.187 with TOS=0x2 [ 615.111819][T20100] ip_tunnel: non-ECT from 172.20.20.187 with TOS=0x2 [ 615.118785][T20100] ip_tunnel: non-ECT from 172.20.20.187 with TOS=0x2 [ 615.182590][T20107] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3456'. [ 615.900436][T20128] __nla_validate_parse: 4 callbacks suppressed [ 615.900459][T20128] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3459'. [ 616.620366][T20155] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3465'. [ 616.753960][T20157] netlink: 'syz.0.3466': attribute type 10 has an invalid length. [ 616.989445][T20171] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3471'. [ 617.000832][T20170] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3471'. [ 617.033016][T20170] netlink: 'syz.0.3471': attribute type 30 has an invalid length. [ 617.068962][T11457] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 617.074990][T20171] netlink: 'syz.0.3471': attribute type 30 has an invalid length. [ 617.128184][T11457] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 617.210943][T11454] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 617.211279][T20171] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3471'. [ 617.229926][T11454] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 617.272774][T20171] netlink: 'syz.0.3471': attribute type 30 has an invalid length. [ 617.322209][T20171] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3471'. [ 617.345318][T20171] netlink: 'syz.0.3471': attribute type 30 has an invalid length. [ 617.369812][T20180] netlink: 52 bytes leftover after parsing attributes in process `syz.4.3474'. [ 617.411258][T20171] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3471'. [ 617.439639][T20171] netlink: 'syz.0.3471': attribute type 30 has an invalid length. [ 617.495219][T20171] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3471'. [ 617.527299][T20171] netlink: 'syz.0.3471': attribute type 30 has an invalid length. [ 617.612738][T20171] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3471'. [ 617.661098][T20171] netlink: 'syz.0.3471': attribute type 30 has an invalid length. [ 617.796793][T20171] netlink: 'syz.0.3471': attribute type 30 has an invalid length. [ 618.154721][T20205] bond0: (slave dummy0): Releasing backup interface [ 618.350864][T20213] tun0: tun_chr_ioctl cmd 1074025675 [ 618.374588][T20213] tun0: persist enabled [ 618.502866][T20220] netlink: 'syz.4.3481': attribute type 10 has an invalid length. [ 618.542474][T20220] syz_tun: entered promiscuous mode [ 618.568861][T20220] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 618.587955][T20222] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 618.595303][T20222] IPv6: NLM_F_CREATE should be set when creating new route [ 618.602657][T20222] IPv6: NLM_F_CREATE should be set when creating new route [ 618.874212][T20237] syzkaller0: entered promiscuous mode [ 618.888800][T20237] syzkaller0: entered allmulticast mode [ 619.028808][T20237] tipc: Enabled bearer , priority 0 [ 619.059812][T20235] tipc: Resetting bearer [ 619.115416][T20235] tipc: Disabling bearer [ 619.216605][T20241] xt_hashlimit: max too large, truncated to 1048576 [ 619.232145][T20241] xt_hashlimit: overflow, try lower: 2/0 [ 619.258303][T20241] IPVS: Error connecting to the multicast addr [ 619.563365][ T29] audit: type=1800 audit(1779555380.383:9): pid=20263 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.3493" name="memory.events" dev="tmpfs" ino=564 res=0 errno=0 [ 619.676358][ T29] audit: type=1800 audit(1779555380.423:10): pid=20262 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.3493" name="memory.events" dev="tmpfs" ino=564 res=0 errno=0 [ 620.368874][T20287] sctp: [Deprecated]: syz.2.3498 (pid 20287) Use of struct sctp_assoc_value in delayed_ack socket option. [ 620.368874][T20287] Use struct sctp_sack_info instead [ 620.576189][T20299] hsr0: entered promiscuous mode [ 620.597521][T20299] tipc: Failed to remove unknown binding: 66,1,1/0:2795563066/2795563068 [ 620.697370][T20298] hsr0: left promiscuous mode [ 621.181725][T20326] __nla_validate_parse: 4 callbacks suppressed [ 621.181747][T20326] netlink: 128 bytes leftover after parsing attributes in process `syz.0.3508'. [ 622.225684][T20370] tipc: Enabled bearer , priority 0 [ 622.239831][T20370] syzkaller0: entered promiscuous mode [ 622.264830][T20370] syzkaller0: entered allmulticast mode [ 622.289497][T20370] sch_tbf: burst 8 is lower than device syzkaller0 mtu (1514) ! [ 622.440283][T20375] tipc: Resetting bearer [ 622.468514][T20369] tipc: Resetting bearer [ 622.501104][T20369] tipc: Disabling bearer [ 622.841384][T20403] xt_physdev: --physdev-out and --physdev-is-out only supported in the FORWARD and POSTROUTING chains with bridged traffic [ 622.888189][T20403] x_tables: duplicate underflow at hook 1 [ 622.994553][T20391] bridge0: port 3(erspan0) entered blocking state [ 623.004366][T20391] bridge0: port 3(erspan0) entered disabled state [ 623.013560][T20391] erspan0: entered allmulticast mode [ 623.024779][T20391] erspan0: entered promiscuous mode [ 623.517353][T20428] netlink: 132 bytes leftover after parsing attributes in process `syz.0.3528'. [ 623.564715][T20431] netlink: 212368 bytes leftover after parsing attributes in process `syz.2.3533'. [ 623.584604][T20432] netlink: 212368 bytes leftover after parsing attributes in process `syz.2.3533'. [ 624.104510][T20442] syzkaller0: entered promiscuous mode [ 624.113464][T20442] syzkaller0: entered allmulticast mode [ 624.121800][T20440] validate_nla: 3 callbacks suppressed [ 624.121822][T20440] netlink: 'syz.2.3535': attribute type 1 has an invalid length. [ 624.237437][T20446] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3537'. [ 624.265282][T20446] ip6gre1: entered promiscuous mode [ 624.270596][T20446] ip6gre1: entered allmulticast mode [ 624.324164][T20440] veth3: entered allmulticast mode [ 624.385304][T20452] x_tables: ip_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 624.407653][T20440] bond1: (slave veth3): Enslaving as a backup interface with a down link [ 624.519211][T20457] netlink: 16150 bytes leftover after parsing attributes in process `syz.4.3541'. [ 624.705335][ T1316] net_ratelimit: 759 callbacks suppressed [ 624.705355][ T1316] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 624.745604][T20466] netlink: 'syz.0.3544': attribute type 25 has an invalid length. [ 624.774645][T20467] netlink: 'syz.2.3545': attribute type 10 has an invalid length. [ 624.782780][T20466] netlink: 'syz.0.3544': attribute type 3 has an invalid length. [ 624.793454][T20466] netlink: 132 bytes leftover after parsing attributes in process `syz.0.3544'. [ 624.863738][T20476] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3546'. [ 625.064845][T20476] bond1: option broadcast_neighbor: invalid value (30) [ 625.074560][T20476] bond1 (unregistering): Released all slaves [ 625.105730][T20482] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 625.132745][T20493] netlink: 'syz.2.3550': attribute type 10 has an invalid length. [ 625.382639][T20500] tipc: Enabling of bearer rejected, failed to enable media [ 625.643760][T20512] netlink: 212368 bytes leftover after parsing attributes in process `syz.2.3556'. [ 625.778668][T20519] batadv_slave_1: entered promiscuous mode [ 625.847886][T20518] batadv_slave_1: left promiscuous mode [ 626.036601][T20531] netlink: 80 bytes leftover after parsing attributes in process `syz.4.3560'. [ 626.194366][ T5774] IPVS: starting estimator thread 0... [ 626.312491][T20543] IPVS: using max 29 ests per chain, 69600 per kthread [ 626.347561][T20534] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3561'. [ 626.355179][T20549] netlink: 'syz.4.3563': attribute type 10 has an invalid length. [ 626.376643][T20550] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3562'. [ 626.903690][T20539] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 627.141429][T20568] netlink: 'syz.0.3567': attribute type 39 has an invalid length. [ 627.185868][T20568] netlink: 'syz.0.3567': attribute type 13 has an invalid length. [ 627.517396][T20589] netlink: 84 bytes leftover after parsing attributes in process `syz.1.3569'. [ 628.281624][T20568] bridge0: port 2(bridge_slave_1) entered disabled state [ 628.289479][T20568] bridge0: port 1(bridge_slave_0) entered disabled state [ 628.890116][T20568] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 628.912985][T20568] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 629.420918][T20570] netdevsim netdevsim1 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 629.485232][ T3272] netdevsim netdevsim0 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 629.519471][ T3272] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 629.558490][ T3272] netdevsim netdevsim0 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 629.590170][ T3272] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 629.674050][T20623] netlink: 'syz.4.3574': attribute type 10 has an invalid length. [ 629.749992][ T3272] netdevsim netdevsim0 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 629.762128][ T3272] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 629.780491][T20616] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3573'. [ 629.795193][ T3272] netdevsim netdevsim0 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 629.805894][ T3272] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 629.831876][T20625] netlink: 76 bytes leftover after parsing attributes in process `syz.0.3573'. [ 629.869499][T20624] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3575'. [ 629.906165][T20570] netdevsim netdevsim1 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 630.016214][T20616] 8021q: adding VLAN 0 to HW filter on device bond0 [ 630.027864][T20616] 8021q: adding VLAN 0 to HW filter on device team0 [ 630.039943][T20616] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 630.091227][T20616] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 630.102151][T20616] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 630.120450][T20616] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 630.149003][T20635] vlan2: entered promiscuous mode [ 630.154454][T20635] bond_slave_1: entered promiscuous mode [ 630.193907][T20621] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 630.232577][ T137] bridge0: port 1(bridge_slave_0) entered blocking state [ 630.239930][ T137] bridge0: port 1(bridge_slave_0) entered forwarding state [ 630.252278][ T137] bridge0: port 2(bridge_slave_1) entered blocking state [ 630.259680][ T137] bridge0: port 2(bridge_slave_1) entered forwarding state [ 630.342050][T20570] netdevsim netdevsim1 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 630.509109][T20570] netdevsim netdevsim1 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 630.546868][T20646] netlink: 124 bytes leftover after parsing attributes in process `syz.4.3581'. [ 630.637433][T20646] netlink: 40 bytes leftover after parsing attributes in process `syz.4.3581'. [ 630.730521][ T3272] netdevsim netdevsim1 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 630.805017][ T137] netdevsim netdevsim1 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 630.896461][ T3272] netdevsim netdevsim1 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 631.014104][T11441] netdevsim netdevsim1 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 631.254375][T20673] netlink: 'syz.0.3587': attribute type 10 has an invalid length. [ 631.382874][T20677] vlan3: entered promiscuous mode [ 631.388233][T20677] bond_slave_1: entered promiscuous mode [ 631.608239][T20686] netlink: 'syz.0.3591': attribute type 1 has an invalid length. [ 631.835155][T20693] IPVS: Scheduler module ip_vs_sip not found [ 631.886787][T20693] netlink: 'syz.0.3591': attribute type 10 has an invalid length. [ 631.907550][T20693] netlink: 40 bytes leftover after parsing attributes in process `syz.0.3591'. [ 632.027115][T20700] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 632.130804][T20693] dummy0: entered promiscuous mode [ 632.572803][T20700] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 632.780282][T20700] bond0: (slave netdevsim1): Releasing backup interface [ 632.828859][T20700] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 632.895153][T20739] netlink: 'syz.2.3604': attribute type 1 has an invalid length. [ 632.970021][T20744] netlink: 48 bytes leftover after parsing attributes in process `syz.2.3604'. [ 632.985433][T20700] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 633.024021][T20749] netlink: 48 bytes leftover after parsing attributes in process `syz.2.3604'. [ 633.097710][T20739] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3604'. [ 633.131235][T20739] 8021q: adding VLAN 0 to HW filter on device bond2 [ 633.200053][T20756] netlink: 64 bytes leftover after parsing attributes in process `syz.3.3609'. [ 633.343673][T20756] ip6gre1: entered promiscuous mode [ 633.361996][T20756] ip6gre1: entered allmulticast mode [ 633.378615][ T137] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 633.427475][ T137] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 633.464834][ T137] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 633.513247][ T784] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 633.652129][T20773] siw: device registration error -23 [ 633.704972][T20778] x_tables: duplicate underflow at hook 2 [ 633.754053][T20779] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3614'. [ 634.391175][T20766] netlink: 16402 bytes leftover after parsing attributes in process `syz.1.3611'. [ 634.517439][T20796] x_tables: ip_tables: ah match: only valid for protocol 51 [ 634.525572][T20796] openvswitch: netlink: nsh attr 14384 is out of range max 3 [ 634.541064][T20789] syz_tun: left promiscuous mode [ 634.546287][T20796] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 634.610136][T20801] netlink: 144 bytes leftover after parsing attributes in process `syz.1.3618'. [ 634.663841][T20789] dummy0: left promiscuous mode [ 634.760967][T20789] veth1_vlan: left promiscuous mode [ 634.777344][T20789] veth0_vlan: left promiscuous mode [ 634.785559][T20789] veth0_vlan: entered promiscuous mode [ 634.797766][T20789] veth1_vlan: entered promiscuous mode [ 634.819776][T20789] veth1_macvtap: left promiscuous mode [ 634.828538][T20789] veth0_macvtap: left promiscuous mode [ 634.841298][T20789] veth0_macvtap: entered promiscuous mode [ 634.849099][T20809] netlink: 14 bytes leftover after parsing attributes in process `syz.2.3621'. [ 634.870221][T20789] veth1_macvtap: entered promiscuous mode [ 634.886005][T20789] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 634.898486][T20789] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 634.916378][T20789] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 634.928921][T20789] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 634.984838][T20789] 8021q: adding VLAN 0 to HW filter on device bond1 [ 634.998998][T20789] 8021q: adding VLAN 0 to HW filter on device bond2 [ 635.009810][T20789] A link change request failed with some changes committed already. Interface syzkaller0 may have been left with an inconsistent configuration, please check. [ 635.100640][ T784] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 635.149393][ T784] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 635.180940][ T784] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 635.207834][ T784] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 635.324380][T20815] TC_ACT_REPEAT abuse ? [ 636.180155][T20855] tap0: tun_chr_ioctl cmd 2148553947 [ 636.339176][T20855] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3630'. [ 637.014173][ T50] Bluetooth: hci5: command 0x0419 tx timeout [ 637.664829][T15331] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 637.712715][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 637.852523][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 637.978564][T20926] netlink: 'syz.3.3656': attribute type 8 has an invalid length. [ 637.997018][T20926] sch_fq: defrate 0 ignored. [ 638.007410][T20927] __nla_validate_parse: 1 callbacks suppressed [ 638.007425][T20927] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3658'. [ 638.028435][T20927] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3658'. [ 638.071368][T20927] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3658'. [ 638.084327][T20927] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3658'. [ 638.110758][ T33] netdevsim netdevsim4 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 638.122947][ T33] netdevsim netdevsim4 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 638.174501][ T33] netdevsim netdevsim4 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 638.206984][T20933] syzkaller0: entered promiscuous mode [ 638.216415][T20933] syzkaller0: entered allmulticast mode [ 638.224131][ T33] netdevsim netdevsim4 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 638.392644][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 638.566827][T20945] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 638.577406][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 638.822567][T20963] netlink: 'syz.4.3666': attribute type 1 has an invalid length. [ 638.984273][T20963] 8021q: adding VLAN 0 to HW filter on device bond1 [ 639.037025][T20971] bond1: option lacp_rate: mode dependency failed, not supported in mode balance-alb(6) [ 639.741207][ T5632] block nbd0: Receive control failed (result -32) [ 639.748467][ T50] block nbd0: Receive control failed (result -32) [ 639.763959][T15331] net_ratelimit: 10 callbacks suppressed [ 639.763980][T15331] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 639.870902][T20985] syzkaller0: entered promiscuous mode [ 639.881816][T20973] infiniband syz0: set active [ 639.886980][T20973] infiniband syz0: added bond_slave_1 [ 639.891218][T20985] syzkaller0: entered allmulticast mode [ 639.898731][T20973] workqueue: Failed to create a rescuer kthread for wq "ib_mad1": -EINTR [ 639.902873][T20973] infiniband syz0: Couldn't open port 1 [ 639.953047][T20973] smbdirect: ib_dev[syz0]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000 [ 639.998191][T20973] smbdirect: ib_dev[syz0]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32 [ 640.018175][T20973] smbdirect: ib_dev[syz0]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005 [ 640.061066][T20973] RDS/IB: syz0: added [ 640.065826][T20973] smc: adding ib device syz0 with port count 1 [ 640.072150][T20973] smc: ib device syz0 port 1 has no pnetid [ 640.777412][T15334] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 641.818279][T15334] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 642.236405][ T5762] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 642.857417][T15330] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 643.581211][T21006] netlink: 56 bytes leftover after parsing attributes in process `syz.1.3674'. [ 643.617638][T21007] tipc: Enabled bearer , priority 0 [ 643.635744][T21009] mac80211_hwsim hwsim49 syzkaller0: entered promiscuous mode [ 643.643578][T21009] mac80211_hwsim hwsim49 syzkaller0: entered allmulticast mode [ 643.652068][T21007] syzkaller0: entered promiscuous mode [ 643.659452][T21007] syzkaller0: entered allmulticast mode [ 643.715622][T21009] tipc: Enabling of bearer rejected, already enabled [ 643.729865][T21007] tipc: Resetting bearer [ 643.767121][T21004] tipc: Resetting bearer [ 643.864717][T21004] tipc: Disabling bearer [ 643.915397][T15330] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 643.950186][T21014] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3679'. [ 644.821734][T21059] netlink: 'syz.2.3686': attribute type 13 has an invalid length. [ 644.948990][T15330] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 645.124157][T21069] netlink: 64 bytes leftover after parsing attributes in process `syz.2.3690'. [ 645.153640][T21067] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3689'. [ 645.168804][T21069] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3690'. [ 645.170798][T21067] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3689'. [ 645.196084][T21070] IPVS: set_ctl: invalid protocol: 8 127.0.0.1:20004 [ 645.203419][T21069] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3690'. [ 645.212850][T21070] IPVS: set_ctl: invalid protocol: 8 127.0.0.1:20004 [ 645.220061][T21069] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3690'. [ 645.229438][T21070] IPVS: set_ctl: invalid protocol: 8 127.0.0.1:20004 [ 645.237643][T21069] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3690'. [ 645.247126][T21070] IPVS: set_ctl: invalid protocol: 8 127.0.0.1:20004 [ 645.254645][ T5734] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 645.265059][T21070] IPVS: set_ctl: invalid protocol: 8 127.0.0.1:20004 [ 645.279229][T21070] IPVS: set_ctl: invalid protocol: 8 127.0.0.1:20004 [ 645.290383][ T33] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 645.290791][T21069] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3690'. [ 645.309688][T21070] IPVS: set_ctl: invalid protocol: 8 127.0.0.1:20004 [ 645.317308][T21070] IPVS: set_ctl: invalid protocol: 8 127.0.0.1:20004 [ 645.321038][ T33] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 645.334165][T21070] IPVS: set_ctl: invalid protocol: 8 127.0.0.1:20004 [ 645.349064][ T33] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 645.349782][T21070] IPVS: set_ctl: invalid protocol: 8 127.0.0.1:20004 [ 645.374699][ T33] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 645.384954][T21070] IPVS: set_ctl: invalid protocol: 8 127.0.0.1:20004 [ 645.395092][T21070] IPVS: set_ctl: invalid protocol: 8 127.0.0.1:20004 [ 645.426847][T21070] IPVS: set_ctl: invalid protocol: 8 127.0.0.1:20004 [ 645.472502][T21070] IPVS: set_ctl: invalid protocol: 8 127.0.0.1:20004 [ 645.494141][T21070] IPVS: set_ctl: invalid protocol: 8 127.0.0.1:20004 [ 645.514195][T21070] IPVS: set_ctl: invalid protocol: 8 127.0.0.1:20004 [ 645.532783][T21070] IPVS: set_ctl: invalid protocol: 8 127.0.0.1:20004 [ 645.552555][T21070] IPVS: set_ctl: invalid protocol: 8 127.0.0.1:20004 [ 645.569745][T21070] IPVS: set_ctl: invalid protocol: 8 127.0.0.1:20004 [ 645.603087][T21070] IPVS: set_ctl: invalid protocol: 8 127.0.0.1:20004 [ 645.610322][T21070] IPVS: set_ctl: invalid protocol: 8 127.0.0.1:20004 [ 645.618596][T21070] IPVS: set_ctl: invalid protocol: 8 127.0.0.1:20004 [ 645.626942][T21070] IPVS: set_ctl: invalid protocol: 8 127.0.0.1:20004 [ 645.640766][T21070] IPVS: set_ctl: invalid protocol: 8 127.0.0.1:20004 [ 645.648411][T21070] IPVS: set_ctl: invalid protocol: 8 127.0.0.1:20004 [ 645.655650][T21070] IPVS: set_ctl: invalid protocol: 8 127.0.0.1:20004 [ 645.663099][T21070] IPVS: set_ctl: invalid protocol: 8 127.0.0.1:20004 [ 645.670673][T21070] IPVS: set_ctl: invalid protocol: 8 127.0.0.1:20004 [ 645.678083][T21070] IPVS: set_ctl: invalid protocol: 8 127.0.0.1:20004 [ 645.687607][T21070] IPVS: set_ctl: invalid protocol: 8 127.0.0.1:20004 [ 645.699213][T21070] IPVS: set_ctl: invalid protocol: 8 127.0.0.1:20004 [ 645.718248][T21070] IPVS: set_ctl: invalid protocol: 8 127.0.0.1:20004 [ 645.733074][T21070] IPVS: set_ctl: invalid protocol: 8 127.0.0.1:20004 [ 645.921935][T21081] syzkaller0: entered promiscuous mode [ 645.927800][T21081] syzkaller0: entered allmulticast mode [ 645.978044][T15331] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 646.453439][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 646.492750][T21096] netlink: 'syz.2.3698': attribute type 1 has an invalid length. [ 646.552840][T21096] 8021q: adding VLAN 0 to HW filter on device bond3 [ 646.865005][T21116] Bluetooth: MGMT ver 1.23 [ 647.027000][T15330] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 648.057352][T15330] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 648.310487][ T5762] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 648.376731][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 649.023088][T16632] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 649.107206][T15330] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 649.778883][T21135] ip6tnl1: entered allmulticast mode [ 650.146148][T15330] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 650.195316][T21156] syzkaller0: entered promiscuous mode [ 650.212982][T21156] syzkaller0: entered allmulticast mode [ 650.396084][T21164] netlink: 'syz.4.3715': attribute type 3 has an invalid length. [ 650.514406][T21161] vlan2: entered promiscuous mode [ 650.524201][T21161] bond_slave_1: entered promiscuous mode [ 650.677796][T21167] kÿ: entered promiscuous mode [ 651.023225][T21193] netlink: 'syz.3.3724': attribute type 1 has an invalid length. [ 651.063185][T21193] bond2: entered promiscuous mode [ 651.068584][T21193] bond2: entered allmulticast mode [ 651.074424][T21193] 8021q: adding VLAN 0 to HW filter on device bond2 [ 651.189867][T15330] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 651.294329][T21204] __nla_validate_parse: 196 callbacks suppressed [ 651.294350][T21204] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3726'. [ 651.333485][ T5734] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 651.488809][T21214] FAULT_INJECTION: forcing a failure. [ 651.488809][T21214] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 651.513499][T21214] CPU: 0 UID: 0 PID: 21214 Comm: syz.3.3727 Not tainted syzkaller #0 PREEMPT(full) [ 651.513529][T21214] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 651.513543][T21214] Call Trace: [ 651.513553][T21214] [ 651.513561][T21214] dump_stack_lvl+0xe8/0x150 [ 651.513593][T21214] should_fail_ex+0x412/0x560 [ 651.513630][T21214] _copy_to_user+0x31/0xb0 [ 651.513665][T21214] simple_read_from_buffer+0xe1/0x170 [ 651.513699][T21214] proc_fail_nth_read+0x1bb/0x230 [ 651.513731][T21214] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 651.513761][T21214] ? rw_verify_area+0x2a6/0x4d0 [ 651.513789][T21214] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 651.513817][T21214] vfs_read+0x20c/0xa70 [ 651.513862][T21214] ? __pfx___mutex_lock+0x10/0x10 [ 651.513891][T21214] ? __pfx_vfs_read+0x10/0x10 [ 651.513922][T21214] ? __fget_files+0x2a/0x420 [ 651.513952][T21214] ? __fget_files+0x3a0/0x420 [ 651.513976][T21214] ? __fget_files+0x2a/0x420 [ 651.514011][T21214] ksys_read+0x150/0x270 [ 651.514044][T21214] ? __pfx_ksys_read+0x10/0x10 [ 651.514084][T21214] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 651.514108][T21214] do_syscall_64+0x15f/0xf80 [ 651.514128][T21214] ? trace_irq_disable+0x3b/0x140 [ 651.514161][T21214] ? clear_bhb_loop+0x40/0x90 [ 651.514188][T21214] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 651.514209][T21214] RIP: 0033:0x7f16dff5d68e [ 651.514230][T21214] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 651.514248][T21214] RSP: 002b:00007f16e0e1afe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 651.514271][T21214] RAX: ffffffffffffffda RBX: 00007f16e0e1b6c0 RCX: 00007f16dff5d68e [ 651.514287][T21214] RDX: 000000000000000f RSI: 00007f16e0e1b0a0 RDI: 0000000000000006 [ 651.514301][T21214] RBP: 00007f16e0e1b090 R08: 0000000000000000 R09: 0000000000000000 [ 651.514314][T21214] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 651.514327][T21214] R13: 00007f16e0216128 R14: 00007f16e0216090 R15: 00007ffc6079bef8 [ 651.514362][T21214] [ 651.915469][T21217] vlan2: entered promiscuous mode [ 652.164553][T21222] netlink: 160 bytes leftover after parsing attributes in process `syz.3.3730'. [ 652.219410][T15330] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 652.516320][T21240] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3733'. [ 653.274769][T15331] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 654.085353][T21317] netlink: 'syz.3.3751': attribute type 1 has an invalid length. [ 654.192602][T21328] netlink: 76 bytes leftover after parsing attributes in process `syz.1.3753'. [ 654.202616][T21328] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3753'. [ 654.228469][T21317] workqueue: Failed to create a rescuer kthread for wq "bond3": -EINTR [ 654.316745][T15331] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 654.378860][T15347] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 654.438213][T21331] syzkaller0: entered promiscuous mode [ 654.446100][T21331] syzkaller0: entered allmulticast mode [ 654.465819][T21337] netlink: 'syz.1.3756': attribute type 1 has an invalid length. [ 654.707902][T21337] bond1: entered promiscuous mode [ 654.751774][T21337] 8021q: adding VLAN 0 to HW filter on device bond1 [ 654.798481][T21333] tipc: Enabling of bearer rejected, failed to enable media [ 654.878247][T21342] netlink: 1047 bytes leftover after parsing attributes in process `syz.0.3758'. [ 655.269382][T21377] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3760'. [ 655.284075][T21377] netlink: 7 bytes leftover after parsing attributes in process `syz.3.3760'. [ 655.338675][T15330] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 655.529263][T21383] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 655.772971][T21389] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3765'. [ 656.386408][T15331] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 656.611887][T21413] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3774'. [ 656.652760][T21409] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3770'. [ 656.663435][T21413] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3774'. [ 656.710568][T21410] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3773'. [ 656.951096][T21422] netlink: 'syz.4.3775': attribute type 1 has an invalid length. [ 657.165936][T21424] bond2: (slave dummy0): making interface the new active one [ 657.189965][T21424] bond2: (slave dummy0): Enslaving as an active interface with an up link [ 657.213059][T21429] bond2: entered promiscuous mode [ 657.218201][T21429] dummy0: entered promiscuous mode [ 657.417998][T15334] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 657.438839][T15347] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 657.635655][T21422] bond0: (slave syz_tun): Releasing backup interface [ 657.663621][T21422] bridge0: port 1(bridge_slave_0) entered disabled state [ 657.759616][T21422] bond2: (slave dummy0): Releasing active interface [ 657.773235][T21422] dummy0: left promiscuous mode [ 657.879017][T21422] bridge_slave_0: left allmulticast mode [ 657.892659][T21422] bridge_slave_0: left promiscuous mode [ 657.898739][T21422] bridge0: port 1(bridge_slave_0) entered disabled state [ 657.917480][T21422] bridge_slave_1: left promiscuous mode [ 657.927463][T21422] bridge0: port 2(bridge_slave_1) entered disabled state [ 657.956604][T21422] bond0: (slave bond_slave_0): Releasing backup interface [ 657.999954][T21422] bond0: (slave bond_slave_1): Releasing backup interface [ 658.042895][T21422] team0: Port device team_slave_0 removed [ 658.073493][T21422] team0: Port device team_slave_1 removed [ 658.083987][T21422] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 658.111155][T21422] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 658.129644][T21422] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 658.148253][T21422] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 658.208286][T21422] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 658.244220][T21418] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3773'. [ 658.264741][T21419] bond2: left promiscuous mode [ 658.461511][T15334] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 658.614133][ T5762] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 658.871494][T21459] netlink: 40 bytes leftover after parsing attributes in process `syz.4.3785'. [ 658.920441][T21459] nbd: must specify at least one socket [ 659.015103][T21462] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3785'. [ 659.234155][T21459] bond3: option miimon: invalid value (18446744073709551607) [ 659.258881][T21459] bond3: option miimon: allowed values 0 - 2147483647 [ 659.297243][T21459] bond3 (unregistering): Released all slaves [ 659.393267][T21486] netlink: 212340 bytes leftover after parsing attributes in process `syz.3.3784'. [ 659.414338][T21486] openvswitch: netlink: Port 167772160 exceeds max allowable 65535 [ 659.497138][T15330] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 660.452726][ T943] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 660.552835][T15334] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 661.413155][ T943] page_pool_release_retry() stalled pool shutdown: id 72, 1 inflight 302 sec [ 661.578088][T15334] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 661.813185][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 662.145562][T21507] syzkaller0: entered promiscuous mode [ 662.152897][T21507] syzkaller0: entered allmulticast mode [ 662.297291][T21507] tipc: Enabled bearer , priority 0 [ 662.321585][T21506] tipc: Resetting bearer [ 662.398565][T21519] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3797'. [ 662.424392][T21506] tipc: Disabling bearer [ 662.622522][ T50] Bluetooth: hci4: command 0x0406 tx timeout [ 662.633707][T15334] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 662.735209][T21533] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3801'. [ 662.786995][T21533] veth0_macvtap: left promiscuous mode [ 662.963263][T21541] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci3/hci3:200/input9 [ 663.498274][T15347] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 663.660495][T15330] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 663.988204][T21589] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3816'. [ 663.999646][T21591] netlink: 76 bytes leftover after parsing attributes in process `syz.2.3815'. [ 664.019527][T21593] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3814'. [ 664.029745][T21586] netlink: 32 bytes leftover after parsing attributes in process `syz.2.3815'. [ 664.433017][T21606] netlink: 'syz.0.3820': attribute type 49 has an invalid length. [ 664.555708][T21609] netlink: 48 bytes leftover after parsing attributes in process `syz.4.3821'. [ 664.592117][T21609] netlink: 212340 bytes leftover after parsing attributes in process `syz.4.3821'. [ 664.650622][T21609] openvswitch: netlink: Key 0 has unexpected len 4 expected 0 [ 664.698011][T15330] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 664.724079][T21603] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3820'. [ 664.780745][T21606] ip6gretap0: entered promiscuous mode [ 664.794998][T21606] ip6gretap0: entered allmulticast mode [ 665.267023][T21629] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3827'. [ 665.652927][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 665.740340][T15330] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 665.867954][T21647] xt_l2tp: unknown flags: 51 [ 665.925982][T21650] xt_hashlimit: size too large, truncated to 1048576 [ 666.097414][T21647] tipc: Enabled bearer , priority 0 [ 666.129985][T21647] syzkaller0: entered promiscuous mode [ 666.165945][T21647] syzkaller0: entered allmulticast mode [ 666.532621][T15347] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 666.647761][T21644] tipc: Resetting bearer [ 666.758683][T21644] tipc: Disabling bearer [ 666.780850][T10882] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 666.903213][T21680] syzkaller0: entered promiscuous mode [ 666.924735][T21680] syzkaller0: entered allmulticast mode [ 666.957162][T21675] tipc: Enabled bearer , priority 0 [ 667.044090][T21684] netlink: 'syz.2.3839': attribute type 12 has an invalid length. [ 667.557434][T21674] tipc: Resetting bearer [ 667.639998][T21674] tipc: Disabling bearer [ 667.737066][T21723] __nla_validate_parse: 4 callbacks suppressed [ 667.737092][T21723] netlink: 7 bytes leftover after parsing attributes in process `syz.2.3848'. [ 667.818533][T15330] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 667.884584][T21727] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3851'. [ 667.911476][T21727] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3851'. [ 667.979834][T21733] netlink: 388 bytes leftover after parsing attributes in process `syz.1.3854'. [ 668.201622][T21741] smbdirect: ib_dev[syz2]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 668.245148][T21741] smbdirect: ib_dev[syz2]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 668.284859][T21741] smbdirect: ib_dev[syz2]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 668.373123][T21741] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98 [ 668.678556][T21761] tipc: Enabling of bearer rejected, already enabled [ 668.779359][T21761] tipc: Resetting bearer [ 668.860342][T15330] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 668.904498][T11448] nci: nci_rsp_packet: unknown rsp opcode 0x8 [ 668.939799][T21771] IPVS: set_ctl: invalid protocol: 0 224.0.0.1:20001 [ 668.970808][ T1181] smbdirect: ib_dev[syz2] removed [ 668.984487][T21772] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3865'. [ 669.594473][T15347] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 669.666221][T21789] netlink: 388 bytes leftover after parsing attributes in process `syz.2.3867'. [ 669.905071][T15330] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 670.188276][T21811] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3873'. [ 670.418989][T21817] hsr0: entered promiscuous mode [ 670.484635][T21818] netlink: 44 bytes leftover after parsing attributes in process `syz.0.3875'. [ 670.937048][T15330] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 671.764673][T21763] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 671.986414][T21821] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3876'. [ 672.003244][T15330] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 672.066476][T21822] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3876'. [ 672.281630][T21843] xt_hashlimit: overflow, try lower: 6/0 [ 672.476434][T21862] ip6t_srh: unknown srh invflags 4000 [ 672.612644][ T5762] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 672.783039][T21886] __nla_validate_parse: 2 callbacks suppressed [ 672.783063][T21886] netlink: 388 bytes leftover after parsing attributes in process `syz.3.3892'. [ 672.958178][T21896] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3895'. [ 673.027980][T15330] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 673.166262][T21909] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3899'. [ 673.180908][T21911] netlink: 68 bytes leftover after parsing attributes in process `syz.1.3900'. [ 673.274081][T21909] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3899'. [ 673.546447][T21918] netlink: 'syz.1.3901': attribute type 39 has an invalid length. [ 673.606238][T21918] netlink: 'syz.1.3901': attribute type 1 has an invalid length. [ 673.620056][T21924] syz.2.3903: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 673.645382][T21918] netlink: 88 bytes leftover after parsing attributes in process `syz.1.3901'. [ 673.660676][T21918] netlink: 658 bytes leftover after parsing attributes in process `syz.1.3901'. [ 673.670435][T21924] CPU: 1 UID: 0 PID: 21924 Comm: syz.2.3903 Not tainted syzkaller #0 PREEMPT(full) [ 673.670473][T21924] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 673.670505][T21924] Call Trace: [ 673.670513][T21924] [ 673.670522][T21924] dump_stack_lvl+0xe8/0x150 [ 673.670553][T21924] warn_alloc+0x249/0x340 [ 673.670583][T21924] ? stack_trace_save+0xa9/0x100 [ 673.670620][T21924] ? __pfx_warn_alloc+0x10/0x10 [ 673.670658][T21924] ? kasan_save_track+0x4f/0x80 [ 673.670684][T21924] ? kasan_save_track+0x3e/0x80 [ 673.670708][T21924] ? __kasan_kmalloc+0x93/0xb0 [ 673.670732][T21924] ? __kmalloc_cache_noprof+0x31c/0x660 [ 673.670756][T21924] ? xskq_create+0x56/0x170 [ 673.670781][T21924] ? xsk_setsockopt+0x54c/0x990 [ 673.670805][T21924] ? do_sock_setsockopt+0x17c/0x1b0 [ 673.670823][T21924] ? __x64_sys_setsockopt+0x13d/0x1b0 [ 673.670842][T21924] ? do_syscall_64+0x15f/0xf80 [ 673.670862][T21924] __vmalloc_node_range_noprof+0x132/0x1750 [ 673.670925][T21924] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 673.670959][T21924] ? __kasan_kmalloc+0x93/0xb0 [ 673.670995][T21924] vmalloc_user_noprof+0xad/0xe0 [ 673.671024][T21924] ? xskq_create+0xbf/0x170 [ 673.671054][T21924] xskq_create+0xbf/0x170 [ 673.671087][T21924] xsk_init_queue+0x8a/0xe0 [ 673.671119][T21924] xsk_setsockopt+0x54c/0x990 [ 673.671149][T21924] ? __pfx_xsk_setsockopt+0x10/0x10 [ 673.671176][T21924] ? __pfx_aa_sk_perm+0x10/0x10 [ 673.671207][T21924] ? aa_sock_opt_perm+0xff/0x1a0 [ 673.671238][T21924] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 673.671267][T21924] ? __pfx_xsk_setsockopt+0x10/0x10 [ 673.671295][T21924] do_sock_setsockopt+0x17c/0x1b0 [ 673.671320][T21924] __x64_sys_setsockopt+0x13d/0x1b0 [ 673.671345][T21924] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 673.671366][T21924] do_syscall_64+0x15f/0xf80 [ 673.671385][T21924] ? trace_irq_disable+0x3b/0x140 [ 673.671416][T21924] ? clear_bhb_loop+0x40/0x90 [ 673.671447][T21924] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 673.671473][T21924] RIP: 0033:0x7fd206b9ce59 [ 673.671493][T21924] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 673.671509][T21924] RSP: 002b:00007fd207b3d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 673.671529][T21924] RAX: ffffffffffffffda RBX: 00007fd206e15fa0 RCX: 00007fd206b9ce59 [ 673.671543][T21924] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000007 [ 673.671555][T21924] RBP: 00007fd206c32d6f R08: 0000000000000004 R09: 0000000000000000 [ 673.671566][T21924] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 673.671578][T21924] R13: 00007fd206e16038 R14: 00007fd206e15fa0 R15: 00007ffe81d88538 [ 673.671610][T21924] [ 673.671647][T21924] Mem-Info: [ 673.983251][T21924] active_anon:5819 inactive_anon:0 isolated_anon:0 [ 673.983251][T21924] active_file:3445 inactive_file:40278 isolated_file:0 [ 673.983251][T21924] unevictable:768 dirty:210 writeback:0 [ 673.983251][T21924] slab_reclaimable:11514 slab_unreclaimable:161358 [ 673.983251][T21924] mapped:29935 shmem:1288 pagetables:1325 [ 673.983251][T21924] sec_pagetables:0 bounce:0 [ 673.983251][T21924] kernel_misc_reclaimable:0 [ 673.983251][T21924] free:1242858 free_pcp:25940 free_cma:0 [ 674.036664][T21933] x_tables: duplicate underflow at hook 1 [ 674.044393][T21924] Node 0 active_anon:23176kB inactive_anon:0kB active_file:13780kB inactive_file:160912kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:111548kB dirty:840kB writeback:0kB shmem:3616kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:13848kB pagetables:5040kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 674.081094][T15330] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 674.162020][T21924] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:8192kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:32kB pagetables:160kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 674.195799][T21935] xt_l2tp: unknown flags: 51 [ 674.253526][T21924] Node 0 DMA free:15336kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:24kB local_pcp:16kB free_cma:0kB [ 674.255156][T21935] xt_hashlimit: size too large, truncated to 1048576 [ 674.318358][T21924] lowmem_reserve[]: 0 2492 2493 2493 2493 [ 674.334181][T21924] Node 0 DMA32 free:1308064kB boost:0kB min:34184kB low:42728kB high:51272kB reserved_highatomic:0KB free_highatomic:0KB active_anon:23236kB inactive_anon:0kB active_file:13780kB inactive_file:160912kB unevictable:1536kB writepending:876kB zspages:0kB present:3129332kB managed:2552360kB mlocked:0kB bounce:0kB free_pcp:35740kB local_pcp:20928kB free_cma:0kB [ 674.392040][T21942] tipc: Enabled bearer , priority 0 [ 674.398993][T21924] lowmem_reserve[]: 0 0 0 0 0 [ 674.404726][T21942] syzkaller0: entered promiscuous mode [ 674.412514][T21924] Node 0 Normal free:0kB boost:0kB min:8kB low:8kB high:8kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:660kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 674.449877][T21947] netlink: 280 bytes leftover after parsing attributes in process `syz.0.3912'. [ 674.465995][T21942] syzkaller0: entered allmulticast mode [ 674.476797][T21924] lowmem_reserve[]: 0 0 0 0 0 [ 674.486939][T21924] Node 1 Normal free:3643368kB boost:0kB min:55704kB low:69628kB high:83552kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB writepending:0kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:63600kB local_pcp:30152kB free_cma:0kB [ 674.530570][T21924] lowmem_reserve[]: 0 0 0 0 0 [ 674.535720][T21924] Node 0 DMA: 0*4kB 1*8kB (U) 2*16kB (U) 2*32kB (U) 2*64kB (U) 2*128kB (U) 2*256kB (U) 2*512kB (U) 3*1024kB (U) 3*2048kB (UM) 0*4096kB = 11240kB [ 674.569241][T21924] Node 0 DMA32: 7582*4kB (UM) 5903*8kB (UME) 3585*16kB (UME) 317*32kB (UME) 1048*64kB (UME) 938*128kB (UME) 700*256kB (UM) 490*512kB (UME) 299*1024kB (UE) 115*2048kB (UME) 0*4096kB = 1303968kB [ 674.626050][T21924] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 674.639152][T21924] Node 1 Normal: 4*4kB (UM) 5*8kB (UM) 11*16kB (UM) 8*32kB (UM) 6*64kB (UM) 5*128kB (UM) 6*256kB (UM) 6*512kB (UM) 4*1024kB (UM) 4*2048kB (U) 885*4096kB (UM) = 3643368kB [ 674.662870][T21924] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 674.697606][T21924] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 674.707625][T21924] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 674.717361][T21924] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 674.726924][T21924] 45007 total pagecache pages [ 674.731746][T21924] 0 pages in swap cache [ 674.736148][T21924] Free swap = 124996kB [ 674.740435][T21924] Total swap = 124996kB [ 674.744806][T21924] 2097051 pages RAM [ 674.761369][T21924] 0 pages HighMem/MovableOnly [ 674.784487][T21954] 8021q: adding VLAN 0 to HW filter on device ipvlan2 [ 674.791419][T21924] 427181 pages reserved [ 674.798648][T21924] 0 pages cma reserved [ 674.803663][T21954] bond0: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 675.018695][T21934] tipc: Resetting bearer [ 675.092604][T10882] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 675.157908][T21934] tipc: Disabling bearer [ 675.467145][T21995] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 675.611150][T21995] sctp: [Deprecated]: syz.2.3924 (pid 21995) Use of struct sctp_assoc_value in delayed_ack socket option. [ 675.611150][T21995] Use struct sctp_sack_info instead [ 675.652807][ T5762] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 675.674588][T22000] syzkaller1: entered promiscuous mode [ 675.680601][T22000] syzkaller1: entered allmulticast mode [ 676.132711][T15330] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 676.604473][T22022] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3930'. [ 676.694193][T22025] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3930'. [ 676.914052][T22037] syzkaller0: entered promiscuous mode [ 676.929927][T22037] syzkaller0: entered allmulticast mode [ 676.969049][T22039] netlink: 'syz.1.3935': attribute type 1 has an invalid length. [ 677.042974][T22039] bond2: option lacp_rate: mode dependency failed, not supported in mode balance-rr(0) [ 677.056828][T22039] bond2 (unregistering): Released all slaves [ 677.056865][T22042] rdma_rxe: rxe_newlink: failed to add bond_slave_1 [ 677.122651][T22041] tipc: Enabled bearer , priority 0 [ 677.164365][T22036] tipc: Resetting bearer [ 677.173131][T15330] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 677.260093][T22036] tipc: Disabling bearer [ 677.510623][T22049] bond4 (unregistering): Released all slaves [ 677.634443][T22054] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 677.654062][T22058] openvswitch: netlink: Flow actions attr not present in new flow. [ 678.212759][T10882] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 678.693579][ T5762] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 679.254433][T15330] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 680.292820][T15330] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 681.332768][T15330] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 681.732961][ T943] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 682.373013][T10882] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 683.412857][T10882] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 684.452766][T15330] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 684.772910][ T5762] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 685.493085][T10882] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 686.134425][ T1316] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 686.532986][T10882] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 687.573004][T15330] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 687.822763][ T943] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 688.212724][ T5632] Bluetooth: hci1: command 0x0406 tx timeout [ 688.612753][T10882] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 689.652823][T10882] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 690.692696][T15334] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 690.852968][ T5762] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 691.732725][T15334] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 692.772810][T15334] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 693.813078][T15334] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 693.892946][ T943] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 694.852744][T15330] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 695.125789][T22101] netlink: 'syz.4.3945': attribute type 1 has an invalid length. [ 695.138002][T22104] __nla_validate_parse: 3 callbacks suppressed [ 695.138023][T22104] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3941'. [ 695.144302][T22101] netlink: 244 bytes leftover after parsing attributes in process `syz.4.3945'. [ 695.144358][T22101] NCSI netlink: No device for ifindex 0 [ 695.382152][T22115] netlink: 'syz.2.3948': attribute type 1 has an invalid length. [ 695.450684][T22115] 8021q: adding VLAN 0 to HW filter on device bond4 [ 695.499440][T22115] rdma_rxe: rxe_newlink: failed to add bond_slave_1 [ 695.513663][T22123] bond5: option lacp_rate: mode dependency failed, not supported in mode balance-rr(0) [ 695.530388][T22123] bond5 (unregistering): Released all slaves [ 695.565695][T22126] tipc: Enabling of bearer rejected, already enabled [ 695.590809][T22131] netlink: 'syz.1.3952': attribute type 14 has an invalid length. [ 695.796111][T22138] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3955'. [ 695.858736][T22139] tipc: Started in network mode [ 695.863949][T22139] tipc: Node identity 9eb0a7be9cb5, cluster identity 4711 [ 695.871579][T22139] tipc: Enabled bearer , priority 0 [ 695.892893][T15334] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 695.912879][T22136] tipc: Disabling bearer [ 695.976163][T22149] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3959'. [ 696.367834][T22172] netlink: 'syz.0.3964': attribute type 1 has an invalid length. [ 696.465398][T22172] 8021q: adding VLAN 0 to HW filter on device bond4 [ 696.572541][T22180] rdma_rxe: rxe_newlink: failed to add bond_slave_1 [ 696.683840][T22177] bond5: option lacp_rate: mode dependency failed, not supported in mode balance-rr(0) [ 696.696693][T22177] bond5 (unregistering): Released all slaves [ 696.728168][T22190] netlink: 40 bytes leftover after parsing attributes in process `syz.2.3967'. [ 696.758278][T22191] tipc: Enabled bearer , priority 0 [ 696.842608][T22181] syzkaller0: entered promiscuous mode [ 696.850990][T22181] syzkaller0: entered allmulticast mode [ 696.877472][T22173] tipc: Resetting bearer [ 696.943092][ T943] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 696.956468][T15334] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 696.970371][T22173] tipc: Disabling bearer [ 697.206963][T22208] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3973'. [ 697.253224][T22208] bond5: entered promiscuous mode [ 697.259345][T22208] 8021q: adding VLAN 0 to HW filter on device bond5 [ 697.880994][T22231] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3977'. [ 697.972765][T15330] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 698.275908][T22244] xt_l2tp: unknown flags: 51 [ 698.309514][T22244] xt_hashlimit: size too large, truncated to 1048576 [ 698.321452][T22247] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3982'. [ 698.361753][T22247] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3982'. [ 698.378047][T22247] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3982'. [ 698.411100][T22247] tls_set_device_offload: netdev not found [ 698.432692][T22251] netlink: 'syz.0.3984': attribute type 1 has an invalid length. [ 698.454427][T22248] tipc: Enabled bearer , priority 0 [ 698.473774][T22248] syzkaller0: entered promiscuous mode [ 698.489551][T22248] syzkaller0: entered allmulticast mode [ 698.767430][T22264] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_tx_wq": -EINTR [ 698.808143][T22243] tipc: Resetting bearer [ 698.890668][T22243] tipc: Disabling bearer [ 699.023678][T15330] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 699.350341][T22288] netlink: 'syz.0.3991': attribute type 7 has an invalid length. [ 699.678335][T22293] 8021q: adding VLAN 0 to HW filter on device bond6 [ 699.766414][T22297] bond6: (slave veth13): Enslaving as an active interface with an up link [ 699.931761][T22312] openvswitch: netlink: nsh attr 14384 is out of range max 3 [ 699.957446][T22312] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 699.974107][ T5762] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 699.992134][T22312] netlink: 'syz.1.3995': attribute type 9 has an invalid length. [ 700.045455][T22314] sctp: [Deprecated]: syz.4.3996 (pid 22314) Use of struct sctp_assoc_value in delayed_ack socket option. [ 700.045455][T22314] Use struct sctp_sack_info instead [ 700.065710][T15334] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 700.188146][T22303] bond6: (slave bridge3): Enslaving as an active interface with an up link [ 700.266858][T22320] __nla_validate_parse: 8 callbacks suppressed [ 700.266878][T22320] netlink: 388 bytes leftover after parsing attributes in process `syz.4.3998'. [ 700.420569][T22324] xt_l2tp: unknown flags: 51 [ 700.468271][T22324] xt_hashlimit: size too large, truncated to 1048576 [ 700.510257][T22327] tipc: Enabling of bearer rejected, already enabled [ 700.574353][T22330] syzkaller0: entered promiscuous mode [ 700.586845][T22330] syzkaller0: entered allmulticast mode [ 700.926464][T22349] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4007'. [ 701.095603][T15330] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 701.427899][T22369] netlink: 388 bytes leftover after parsing attributes in process `syz.0.4011'. [ 701.493780][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 701.594564][T22376] netlink: 120 bytes leftover after parsing attributes in process `syz.2.4012'. [ 701.689747][T22376] netlink: 'syz.2.4012': attribute type 1 has an invalid length. [ 701.702533][T22376] netlink: 64 bytes leftover after parsing attributes in process `syz.2.4012'. [ 702.120342][T22383] netlink: 'syz.3.4015': attribute type 1 has an invalid length. [ 702.154358][T22385] netlink: 'syz.0.4016': attribute type 4 has an invalid length. [ 702.163743][T15334] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 702.222703][T22385] netlink: 240 bytes leftover after parsing attributes in process `syz.0.4016'. [ 702.284363][T22383] bond3: entered promiscuous mode [ 702.311573][T22383] 8021q: adding VLAN 0 to HW filter on device bond3 [ 702.331145][T22388] xt_CT: No such helper "syz0" [ 702.408206][T22387] 8021q: adding VLAN 0 to HW filter on device bond3 [ 702.463588][T22387] bond3: (slave ip6gre2): The slave device specified does not support setting the MAC address [ 702.493068][T22387] bond3: (slave ip6gre2): Setting fail_over_mac to active for active-backup mode [ 702.503977][T22399] xt_l2tp: unknown flags: 51 [ 702.530233][T22387] bond3: (slave ip6gre2): making interface the new active one [ 702.553513][T22399] xt_hashlimit: size too large, truncated to 1048576 [ 702.567905][T22387] ip6gre2: entered promiscuous mode [ 702.604457][T22387] bond3: (slave ip6gre2): Enslaving as an active interface with an up link [ 702.656756][T22404] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4020'. [ 702.699222][T22404] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4020'. [ 702.716490][T22403] tipc: Enabling of bearer rejected, already enabled [ 703.016734][ T5762] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 703.049374][T22416] netlink: 388 bytes leftover after parsing attributes in process `syz.4.4023'. [ 703.172922][T15334] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 703.591403][T22435] netlink: 48 bytes leftover after parsing attributes in process `syz.0.4029'. [ 703.695237][T22439] netdevsim netdevsim4 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 703.706172][T22439] netdevsim netdevsim4 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 703.861479][T22439] netdevsim netdevsim4 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 703.887466][T22439] netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 704.015375][T22439] netdevsim netdevsim4 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 704.033961][T22439] netdevsim netdevsim4 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 704.124847][T22439] netdevsim netdevsim4 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 704.148922][T22439] netdevsim netdevsim4 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 704.215473][T15330] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 705.023979][T11451] netdevsim netdevsim4 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 705.033767][T11451] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 705.090424][T11451] netdevsim netdevsim4 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 705.104046][T11451] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 705.187222][T22479] netlink: 'syz.0.4039': attribute type 4 has an invalid length. [ 705.199479][T11451] netdevsim netdevsim4 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 705.216936][T11451] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 705.262838][T15330] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 705.348771][T11457] netdevsim netdevsim4 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 705.358620][T22476] __nla_validate_parse: 3 callbacks suppressed [ 705.358644][T22476] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4038'. [ 705.374472][T11457] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 705.695344][T22491] netlink: 'syz.2.4042': attribute type 6 has an invalid length. [ 705.726348][T22491] IPv6: NLM_F_CREATE should be specified when creating new route [ 706.056272][T15347] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 706.294099][T15330] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 706.407473][T22509] openvswitch: netlink: VXLAN extension message has 12 unknown bytes. [ 706.519502][T22510] netlink: 'syz.0.4048': attribute type 3 has an invalid length. [ 706.534248][T22510] netlink: 666 bytes leftover after parsing attributes in process `syz.0.4048'. [ 706.700454][T22523] IPv6: Can't replace route, no match found [ 707.334175][T15334] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 707.800639][T22553] xt_hashlimit: size too large, truncated to 1048576 [ 707.951895][T22561] netlink: 'syz.0.4062': attribute type 1 has an invalid length. [ 708.062226][T22567] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4062'. [ 708.122730][T22564] bond7: (slave vxcan3): The slave device specified does not support setting the MAC address [ 708.155943][T22564] bond7: (slave vxcan3): Error -95 calling set_mac_address [ 708.183955][T22566] syzkaller0: entered promiscuous mode [ 708.201859][T22566] syzkaller0: entered allmulticast mode [ 708.305285][T22567] bond7: (slave bridge4): Enslaving as an active interface with a down link [ 708.372664][T15330] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 708.394242][T22561] macvlan2: entered promiscuous mode [ 708.400072][T22561] macvlan2: entered allmulticast mode [ 708.407699][T22561] bond7: entered promiscuous mode [ 708.414286][T22561] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 708.425737][T22561] bond7: left promiscuous mode [ 708.460571][T22566] tipc: Enabled bearer , priority 0 [ 708.498931][T22556] tipc: Resetting bearer [ 708.581968][T22556] tipc: Disabling bearer [ 709.094740][ T943] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 709.103394][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 709.187134][T22602] netlink: 16 bytes leftover after parsing attributes in process `syz.4.4072'. [ 709.413330][T15334] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 709.793396][T22618] syzkaller0: entered promiscuous mode [ 709.815465][T22618] syzkaller0: entered allmulticast mode [ 709.865525][T22621] netlink: 92 bytes leftover after parsing attributes in process `syz.1.4079'. [ 709.945875][T22618] tipc: Enabled bearer , priority 0 [ 710.024627][T22617] tipc: Resetting bearer [ 710.143527][T22617] tipc: Disabling bearer [ 710.158569][T22629] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4081'. [ 710.179033][T22629] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4081'. [ 710.200850][T22629] netlink: 'syz.1.4081': attribute type 18 has an invalid length. [ 710.221129][T22632] netlink: 228 bytes leftover after parsing attributes in process `syz.1.4081'. [ 710.343487][ T29] audit: type=1804 audit(1779555471.173:11): pid=22636 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.4.4083" name="/newroot/172/cgroup.controllers" dev="tmpfs" ino=896 res=1 errno=0 [ 710.427055][ T29] audit: type=1800 audit(1779555471.193:12): pid=22636 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.4083" name="cgroup.controllers" dev="tmpfs" ino=896 res=0 errno=0 [ 710.452691][T15330] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 710.615640][T22642] netlink: 'syz.0.4085': attribute type 1 has an invalid length. [ 710.638641][T22648] Cannot find set identified by id 65534 to match [ 710.650698][T22642] netlink: 28 bytes leftover after parsing attributes in process `syz.0.4085'. [ 710.865920][T22654] netlink: 'syz.4.4088': attribute type 1 has an invalid length. [ 711.054591][T22654] 8021q: adding VLAN 0 to HW filter on device bond3 [ 711.182401][T22657] bond3: (slave veth3): Enslaving as an active interface with a down link [ 711.210752][T22659] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 711.230949][T22659] bond3: (slave batadv1): dev_set_mac_address on slave failed! ALB mode requires that the base driver support setting the hw address also when the network device's interface is open [ 711.322097][T22661] netlink: 'syz.2.4089': attribute type 1 has an invalid length. [ 711.452574][T22663] netlink: 72 bytes leftover after parsing attributes in process `syz.0.4090'. [ 711.502525][T15330] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 711.638939][T22670] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 711.682063][T22670] netlink: 148 bytes leftover after parsing attributes in process `syz.2.4092'. [ 711.875876][T22676] sctp: [Deprecated]: syz.0.4093 (pid 22676) Use of struct sctp_assoc_value in delayed_ack socket option. [ 711.875876][T22676] Use struct sctp_sack_info instead [ 711.956722][T22680] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4094'. [ 712.015491][T22680] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4094'. [ 712.133220][ T943] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 712.141828][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 712.307877][T22684] tipc: Enabling of bearer rejected, already enabled [ 712.515759][T22694] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4098'. [ 712.544342][T15334] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 712.792094][T22702] netlink: 'syz.2.4100': attribute type 1 has an invalid length. [ 712.919291][T22708] SET target dimension over the limit! [ 713.132768][T22706] bond5: (slave bridge4): making interface the new active one [ 713.154121][T22706] bond5: (slave bridge4): Enslaving as an active interface with an up link [ 713.278866][T22708] bond5: (slave vlan3): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 713.576687][T10882] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 713.763489][T22722] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4106'. [ 714.102101][T22731] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4107'. [ 714.203338][T22734] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4107'. [ 714.575691][T22748] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 714.583048][T22748] IPv6: NLM_F_CREATE should be set when creating new route [ 714.590375][T22748] IPv6: NLM_F_CREATE should be set when creating new route [ 714.597758][T22748] IPv6: NLM_F_CREATE should be set when creating new route [ 714.615164][T10882] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 714.693837][T22751] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4115'. [ 714.764715][T22751] netlink: 'syz.1.4115': attribute type 1 has an invalid length. [ 714.821796][T22751] gretap1: entered allmulticast mode [ 715.174122][ T943] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 715.182639][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 715.489591][T22775] bridge7: entered promiscuous mode [ 715.519085][T22775] bridge7: entered allmulticast mode [ 715.560185][T22775] team0: Port device bridge7 added [ 715.655262][T15334] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 716.187473][T22806] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4129'. [ 716.214191][T11448] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 716.227957][T22806] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4129'. [ 716.693035][T10882] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 716.797906][T22825] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4135'. [ 716.837091][T22825] netlink: 44 bytes leftover after parsing attributes in process `syz.1.4135'. [ 716.859243][T22828] tunl0: entered allmulticast mode [ 716.927644][T22833] netlink: 'syz.0.4138': attribute type 15 has an invalid length. [ 716.957098][T22833] netlink: 24 bytes leftover after parsing attributes in process `syz.0.4138'. [ 717.315490][T22850] netlink: 210640 bytes leftover after parsing attributes in process `syz.0.4142'. [ 717.474736][T22844] bond8: (slave bond_slave_1): Device is not our slave [ 717.481907][T22844] bond8: option active_slave: invalid value (bond_slave_1) [ 717.535422][T22844] bond8 (unregistering): Released all slaves [ 717.734067][T10882] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 717.780972][T22868] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4148'. [ 717.928651][T22876] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4152'. [ 718.157804][T22890] ip6t_srh: unknown srh match flags 4000 [ 718.223659][ T5762] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 718.232167][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 718.432082][T22902] mac80211_hwsim hwsim46 ªªªªª;: renamed from wlan0 [ 718.671705][T22908] netlink: 388 bytes leftover after parsing attributes in process `syz.1.4158'. [ 718.989915][T22919] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4163'. [ 719.553972][T22948] bond4: (slave bridge8): Enslaving as an active interface with an up link [ 719.569762][T22953] netlink: 'syz.2.4175': attribute type 3 has an invalid length. [ 719.675806][T22958] sctp: [Deprecated]: syz.1.4176 (pid 22958) Use of int in maxseg socket option. [ 719.675806][T22958] Use struct sctp_assoc_value instead [ 719.920624][T22968] netlink: 'syz.4.4181': attribute type 1 has an invalid length. [ 719.999381][T22968] 8021q: adding VLAN 0 to HW filter on device bond4 [ 720.126910][T22968] netlink: 'syz.4.4181': attribute type 1 has an invalid length. [ 720.150615][T22983] x_tables: duplicate underflow at hook 3 [ 720.293896][T22990] openvswitch: netlink: Missing key (keys=40, expected=2000) [ 720.314376][T22992] openvswitch: netlink: Missing key (keys=40, expected=2000) [ 720.542179][T22993] sctp: [Deprecated]: syz.3.4190 (pid 22993) Use of struct sctp_assoc_value in delayed_ack socket option. [ 720.542179][T22993] Use struct sctp_sack_info instead [ 720.559680][T22993] netlink: 'syz.3.4190': attribute type 1 has an invalid length. [ 720.703143][T23007] netlink: 'syz.4.4195': attribute type 20 has an invalid length. [ 721.033604][T23014] A link change request failed with some changes committed already. Interface bridge0 may have been left with an inconsistent configuration, please check. [ 721.047864][T23018] sctp: [Deprecated]: syz.4.4196 (pid 23018) Use of int in maxseg socket option. [ 721.047864][T23018] Use struct sctp_assoc_value instead [ 721.100619][T23017] netlink: 'syz.1.4197': attribute type 3 has an invalid length. [ 721.197813][T23021] FAULT_INJECTION: forcing a failure. [ 721.197813][T23021] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 721.226332][T23022] __nla_validate_parse: 17 callbacks suppressed [ 721.226355][T23022] netlink: 212344 bytes leftover after parsing attributes in process `syz.1.4197'. [ 721.255442][T23021] CPU: 1 UID: 0 PID: 23021 Comm: syz.2.4198 Not tainted syzkaller #0 PREEMPT(full) [ 721.255473][T23021] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 721.255487][T23021] Call Trace: [ 721.255496][T23021] [ 721.255505][T23021] dump_stack_lvl+0xe8/0x150 [ 721.255537][T23021] should_fail_ex+0x412/0x560 [ 721.255572][T23021] _copy_from_user+0x2d/0xb0 [ 721.255607][T23021] ___sys_sendmsg+0x1c6/0x360 [ 721.255631][T23021] ? __lock_acquire+0x6b5/0x2cf0 [ 721.255660][T23021] ? __pfx____sys_sendmsg+0x10/0x10 [ 721.255727][T23021] ? __fget_files+0x2a/0x420 [ 721.255753][T23021] ? __fget_files+0x3a0/0x420 [ 721.255790][T23021] __x64_sys_sendmsg+0x1bd/0x2a0 [ 721.255818][T23021] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 721.255852][T23021] ? __pfx_ksys_write+0x10/0x10 [ 721.255893][T23021] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 721.255917][T23021] do_syscall_64+0x15f/0xf80 [ 721.255937][T23021] ? trace_irq_disable+0x3b/0x140 [ 721.255970][T23021] ? clear_bhb_loop+0x40/0x90 [ 721.255997][T23021] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 721.256017][T23021] RIP: 0033:0x7fd206b9ce59 [ 721.256038][T23021] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 721.256056][T23021] RSP: 002b:00007fd207b3d028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 721.256087][T23021] RAX: ffffffffffffffda RBX: 00007fd206e15fa0 RCX: 00007fd206b9ce59 [ 721.256103][T23021] RDX: 0000000000000810 RSI: 00002000000000c0 RDI: 0000000000000003 [ 721.256117][T23021] RBP: 00007fd207b3d090 R08: 0000000000000000 R09: 0000000000000000 [ 721.256130][T23021] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 721.256143][T23021] R13: 00007fd206e16038 R14: 00007fd206e15fa0 R15: 00007ffe81d88538 [ 721.256178][T23021] [ 721.732796][ T5762] page_pool_release_retry() stalled pool shutdown: id 72, 1 inflight 362 sec [ 721.785616][T23036] netlink: 'syz.0.4201': attribute type 8 has an invalid length. [ 721.888104][T23041] netlink: 68 bytes leftover after parsing attributes in process `syz.2.4203'. [ 721.976981][ T33] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 721.985396][ T33] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 721.993643][ T33] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 722.001948][ T33] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 722.138872][T23047] ip6tnl1: entered allmulticast mode [ 722.232189][T23048] erspan0: left allmulticast mode [ 722.245038][T23048] erspan0: left promiscuous mode [ 722.259037][T23048] bridge0: port 3(erspan0) entered disabled state [ 722.269083][T23055] netlink: 'syz.0.4208': attribute type 1 has an invalid length. [ 722.288752][T23055] netlink: 'syz.0.4208': attribute type 4 has an invalid length. [ 722.308188][T23056] netlink: 40 bytes leftover after parsing attributes in process `syz.2.4207'. [ 722.309169][T23055] netlink: 9462 bytes leftover after parsing attributes in process `syz.0.4208'. [ 722.520985][T23067] netlink: 56 bytes leftover after parsing attributes in process `syz.0.4210'. [ 722.550794][T23067] netlink: 24 bytes leftover after parsing attributes in process `syz.0.4210'. [ 722.713901][T23076] FAULT_INJECTION: forcing a failure. [ 722.713901][T23076] name failslab, interval 1, probability 0, space 0, times 0 [ 722.743176][T23076] CPU: 1 UID: 0 PID: 23076 Comm: syz.3.4213 Not tainted syzkaller #0 PREEMPT(full) [ 722.743211][T23076] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 722.743224][T23076] Call Trace: [ 722.743232][T23076] [ 722.743242][T23076] dump_stack_lvl+0xe8/0x150 [ 722.743272][T23076] should_fail_ex+0x412/0x560 [ 722.743307][T23076] should_failslab+0xa8/0x100 [ 722.743343][T23076] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 722.743372][T23076] ? __alloc_skb+0x186/0x7d0 [ 722.743392][T23076] ? __alloc_skb+0x1d0/0x7d0 [ 722.743409][T23076] ? __local_bh_enable_ip+0xd0/0x130 [ 722.743437][T23076] __alloc_skb+0x1d0/0x7d0 [ 722.743462][T23076] netlink_sendmsg+0x5d4/0xb40 [ 722.743498][T23076] ? __pfx_netlink_sendmsg+0x10/0x10 [ 722.743526][T23076] ? aa_sock_msg_perm+0xf1/0x1b0 [ 722.743558][T23076] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 722.743591][T23076] ____sys_sendmsg+0x972/0x9f0 [ 722.743614][T23076] ? __might_fault+0xaf/0x130 [ 722.743648][T23076] ? __pfx_____sys_sendmsg+0x10/0x10 [ 722.743681][T23076] ? import_iovec+0x73/0xa0 [ 722.743717][T23076] ___sys_sendmsg+0x2a5/0x360 [ 722.743739][T23076] ? __lock_acquire+0x6b5/0x2cf0 [ 722.743769][T23076] ? __pfx____sys_sendmsg+0x10/0x10 [ 722.743832][T23076] ? __fget_files+0x2a/0x420 [ 722.743856][T23076] ? __fget_files+0x3a0/0x420 [ 722.743893][T23076] __x64_sys_sendmsg+0x1bd/0x2a0 [ 722.743919][T23076] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 722.743953][T23076] ? __pfx_ksys_write+0x10/0x10 [ 722.744003][T23076] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 722.744026][T23076] do_syscall_64+0x15f/0xf80 [ 722.744046][T23076] ? trace_irq_disable+0x3b/0x140 [ 722.744077][T23076] ? clear_bhb_loop+0x40/0x90 [ 722.744103][T23076] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 722.744124][T23076] RIP: 0033:0x7f16dff9ce59 [ 722.744144][T23076] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 722.744163][T23076] RSP: 002b:00007f16e0e3c028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 722.744184][T23076] RAX: ffffffffffffffda RBX: 00007f16e0215fa0 RCX: 00007f16dff9ce59 [ 722.744199][T23076] RDX: 0000000000000810 RSI: 00002000000000c0 RDI: 0000000000000003 [ 722.744213][T23076] RBP: 00007f16e0e3c090 R08: 0000000000000000 R09: 0000000000000000 [ 722.744227][T23076] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 722.744239][T23076] R13: 00007f16e0216038 R14: 00007f16e0215fa0 R15: 00007ffc6079bef8 [ 722.744274][T23076] [ 723.135334][T23085] FAULT_INJECTION: forcing a failure. [ 723.135334][T23085] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 723.148694][T23085] CPU: 1 UID: 0 PID: 23085 Comm: syz.1.4217 Not tainted syzkaller #0 PREEMPT(full) [ 723.148724][T23085] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 723.148738][T23085] Call Trace: [ 723.148747][T23085] [ 723.148756][T23085] dump_stack_lvl+0xe8/0x150 [ 723.148787][T23085] should_fail_ex+0x412/0x560 [ 723.148821][T23085] _copy_from_user+0x2d/0xb0 [ 723.148855][T23085] __sys_bpf+0x229/0x950 [ 723.148898][T23085] ? __pfx___sys_bpf+0x10/0x10 [ 723.148947][T23085] ? ksys_write+0x242/0x270 [ 723.148981][T23085] ? __pfx_ksys_write+0x10/0x10 [ 723.149017][T23085] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 723.149040][T23085] __x64_sys_bpf+0x7c/0x90 [ 723.149072][T23085] do_syscall_64+0x15f/0xf80 [ 723.149094][T23085] ? trace_irq_disable+0x3b/0x140 [ 723.149126][T23085] ? clear_bhb_loop+0x40/0x90 [ 723.149153][T23085] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 723.149174][T23085] RIP: 0033:0x7f8d6619ce59 [ 723.149193][T23085] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 723.149211][T23085] RSP: 002b:00007f8d670c7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 723.149234][T23085] RAX: ffffffffffffffda RBX: 00007f8d66415fa0 RCX: 00007f8d6619ce59 [ 723.149250][T23085] RDX: 0000000000000094 RSI: 0000200000000300 RDI: 0000000000000005 [ 723.149263][T23085] RBP: 00007f8d670c7090 R08: 0000000000000000 R09: 0000000000000000 [ 723.149277][T23085] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 723.149290][T23085] R13: 00007f8d66416038 R14: 00007f8d66415fa0 R15: 00007fffea7fcfd8 [ 723.149324][T23085] [ 723.450075][T23090] net_ratelimit: 1 callbacks suppressed [ 723.450096][T23090] openvswitch: netlink: Geneve option length err (len 256, max 255). [ 723.535009][ T5762] IPVS: starting estimator thread 0... [ 723.622441][T23105] IPVS: using max 28 ests per chain, 67200 per kthread [ 723.754177][T23114] veth0: entered promiscuous mode [ 723.761143][T23114] bond0: entered promiscuous mode [ 723.773508][T23114] bond_slave_0: entered promiscuous mode [ 723.794733][T23114] bond_slave_1: entered promiscuous mode [ 723.821033][T23114] syz_tun: entered promiscuous mode [ 723.855072][T23113] bond0: left promiscuous mode [ 723.869649][T23113] bond_slave_0: left promiscuous mode [ 723.891865][T23113] bond_slave_1: left promiscuous mode [ 723.915498][T23113] syz_tun: left promiscuous mode [ 723.939405][T23113] veth0: left promiscuous mode [ 724.160697][T23138] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4232'. [ 724.193083][T23138] IPVS: set_ctl: invalid protocol: 33 100.1.1.2:20000 [ 724.204993][T23141] netlink: 'syz.4.4227': attribute type 10 has an invalid length. [ 724.213631][T23138] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4232'. [ 724.225252][T23143] netlink: 'syz.2.4233': attribute type 1 has an invalid length. [ 724.324084][T23147] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4233'. [ 724.368132][T23146] bond8: entered allmulticast mode [ 724.474192][T23146] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 724.486037][T23146] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 724.494725][T23146] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 724.605295][T23158] netlink: 44 bytes leftover after parsing attributes in process `syz.1.4237'. [ 724.707229][T23160] macsec1: entered promiscuous mode [ 724.811199][T23165] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth0_to_bond, syncid = 0, id = 0 [ 724.901972][ T29] audit: type=1800 audit(1779555485.723:13): pid=23172 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.4242" name="blkio.bfq.time_recursive" dev="tmpfs" ino=1291 res=0 errno=0 [ 725.866598][T23215] gre1: entered allmulticast mode [ 726.240764][T23237] __nla_validate_parse: 7 callbacks suppressed [ 726.240788][T23237] netlink: 16 bytes leftover after parsing attributes in process `syz.4.4261'. [ 726.821829][T23267] netlink: 56 bytes leftover after parsing attributes in process `syz.1.4264'. [ 727.137701][T23275] netlink: 'syz.2.4265': attribute type 1 has an invalid length. [ 727.150035][T23275] netlink: 'syz.2.4265': attribute type 1 has an invalid length. [ 727.159114][T23275] netlink: 264 bytes leftover after parsing attributes in process `syz.2.4265'. [ 727.170371][T23275] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4265'. [ 727.472848][T23292] syzkaller0: entered promiscuous mode [ 727.503716][T23292] syzkaller0: entered allmulticast mode [ 727.599081][T23292] tipc: Enabled bearer , priority 0 [ 727.644578][T23291] tipc: Resetting bearer [ 727.666574][T23301] netlink: 24 bytes leftover after parsing attributes in process `syz.0.4273'. [ 727.736478][ T1181] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 727.744818][ T1181] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 727.753098][ T1181] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 727.761325][ T1181] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 727.776772][T23291] tipc: Disabling bearer [ 728.218049][T23331] netlink: 'syz.3.4281': attribute type 1 has an invalid length. [ 728.263412][T23331] bond5: entered promiscuous mode [ 728.269561][T23331] 8021q: adding VLAN 0 to HW filter on device bond5 [ 728.387935][T23327] 8021q: adding VLAN 0 to HW filter on device bond6 [ 728.411715][T23327] bond5: (slave bond6): making interface the new active one [ 728.419841][T23327] bond6: entered promiscuous mode [ 728.426877][T23327] bond5: (slave bond6): Enslaving as an active interface with an up link [ 728.753605][T23345] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 728.786588][T23345] netlink: 296 bytes leftover after parsing attributes in process `syz.3.4286'. [ 728.806893][T23347] FAULT_INJECTION: forcing a failure. [ 728.806893][T23347] name failslab, interval 1, probability 0, space 0, times 0 [ 728.866593][T23347] CPU: 1 UID: 0 PID: 23347 Comm: syz.1.4287 Not tainted syzkaller #0 PREEMPT(full) [ 728.866625][T23347] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 728.866639][T23347] Call Trace: [ 728.866648][T23347] [ 728.866657][T23347] dump_stack_lvl+0xe8/0x150 [ 728.866688][T23347] should_fail_ex+0x412/0x560 [ 728.866724][T23347] should_failslab+0xa8/0x100 [ 728.866760][T23347] __kmalloc_cache_noprof+0x88/0x660 [ 728.866792][T23347] ? nfnetlink_rcv+0xfdf/0x27b0 [ 728.866820][T23347] nfnetlink_rcv+0xfdf/0x27b0 [ 728.866882][T23347] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 728.866963][T23347] ? netlink_deliver_tap+0x2e/0x1b0 [ 728.867001][T23347] ? netlink_deliver_tap+0x2e/0x1b0 [ 728.867024][T23347] ? netlink_deliver_tap+0x2e/0x1b0 [ 728.867055][T23347] netlink_unicast+0x75c/0x8e0 [ 728.867090][T23347] netlink_sendmsg+0x813/0xb40 [ 728.867132][T23347] ? __pfx_netlink_sendmsg+0x10/0x10 [ 728.867166][T23347] ? aa_sock_msg_perm+0xf1/0x1b0 [ 728.867198][T23347] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 728.867232][T23347] ____sys_sendmsg+0x972/0x9f0 [ 728.867256][T23347] ? __might_fault+0xaf/0x130 [ 728.867291][T23347] ? __pfx_____sys_sendmsg+0x10/0x10 [ 728.867326][T23347] ? import_iovec+0x73/0xa0 [ 728.867363][T23347] ___sys_sendmsg+0x2a5/0x360 [ 728.867386][T23347] ? __lock_acquire+0x6b5/0x2cf0 [ 728.867415][T23347] ? __pfx____sys_sendmsg+0x10/0x10 [ 728.867479][T23347] ? __fget_files+0x2a/0x420 [ 728.867504][T23347] ? __fget_files+0x3a0/0x420 [ 728.867542][T23347] __x64_sys_sendmsg+0x1bd/0x2a0 [ 728.867569][T23347] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 728.867604][T23347] ? __pfx_ksys_write+0x10/0x10 [ 728.867644][T23347] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 728.867668][T23347] do_syscall_64+0x15f/0xf80 [ 728.867688][T23347] ? trace_irq_disable+0x3b/0x140 [ 728.867720][T23347] ? clear_bhb_loop+0x40/0x90 [ 728.867747][T23347] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 728.867768][T23347] RIP: 0033:0x7f8d6619ce59 [ 728.867789][T23347] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 728.867807][T23347] RSP: 002b:00007f8d670c7028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 728.867830][T23347] RAX: ffffffffffffffda RBX: 00007f8d66415fa0 RCX: 00007f8d6619ce59 [ 728.867845][T23347] RDX: 0000000000000810 RSI: 00002000000000c0 RDI: 0000000000000003 [ 728.867859][T23347] RBP: 00007f8d670c7090 R08: 0000000000000000 R09: 0000000000000000 [ 728.867872][T23347] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 728.867885][T23347] R13: 00007f8d66416038 R14: 00007f8d66415fa0 R15: 00007fffea7fcfd8 [ 728.867921][T23347] [ 729.167199][T23354] syzkaller0: entered promiscuous mode [ 729.172949][T23354] syzkaller0: entered allmulticast mode [ 729.273064][T23354] tipc: Enabled bearer , priority 0 [ 729.304919][T23353] tipc: Resetting bearer [ 729.339820][T23360] netlink: 277 bytes leftover after parsing attributes in process `syz.1.4290'. [ 729.466707][T23353] tipc: Disabling bearer [ 729.567837][T23363] syzkaller0: entered promiscuous mode [ 729.592584][T23363] syzkaller0: entered allmulticast mode [ 729.637330][T23370] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4293'. [ 729.746038][T23370] bond9: Invalid ad_actor_system MAC address. [ 729.752615][T23370] bond9: option ad_actor_system: invalid value (7) [ 729.765407][T23370] bond9 (unregistering): Released all slaves [ 729.871098][T23381] netlink: 40 bytes leftover after parsing attributes in process `syz.2.4294'. [ 730.096609][T23394] netlink: 'syz.2.4298': attribute type 1 has an invalid length. [ 730.100670][T23395] veth1_to_bond: entered allmulticast mode [ 730.114815][T23395] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4299'. [ 730.129292][T23395] veth1_to_bond (unregistering): left allmulticast mode [ 730.235073][T23400] rdma_rxe: rxe_newlink: failed to add bond_slave_1 [ 730.265634][T23394] 8021q: adding VLAN 0 to HW filter on device bond6 [ 730.385846][T23396] bond7: option lacp_rate: mode dependency failed, not supported in mode balance-rr(0) [ 730.398349][T23396] bond7 (unregistering): Released all slaves [ 730.875610][T23423] macsec2: entered promiscuous mode [ 730.987505][T23427] netlink: 'syz.1.4309': attribute type 1 has an invalid length. [ 731.008367][T23427] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 731.146984][T23434] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 731.316198][T23445] netlink: 'syz.1.4316': attribute type 10 has an invalid length. [ 731.346802][T23445] team0: Port device veth1_to_hsr added [ 731.375307][T23445] __nla_validate_parse: 1 callbacks suppressed [ 731.375329][T23445] netlink: 224 bytes leftover after parsing attributes in process `syz.1.4316'. [ 731.467381][T23449] netlink: 'syz.3.4318': attribute type 8 has an invalid length. [ 731.581061][T23448] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4317'. [ 732.172689][T23492] netlink: 24 bytes leftover after parsing attributes in process `syz.4.4331'. [ 732.220325][T23484] netlink: 'syz.2.4328': attribute type 39 has an invalid length. [ 732.287283][T23497] mac80211_hwsim hwsim48 ªªªªª;: renamed from wlan0 (while UP) [ 732.310676][T23500] openvswitch: netlink: VXLAN extension 1 has unexpected len 8 expected 4 [ 732.757175][T23524] netlink: 36 bytes leftover after parsing attributes in process `syz.1.4342'. [ 732.790953][T23524] netlink: 24 bytes leftover after parsing attributes in process `syz.1.4342'. [ 732.997994][T23533] netlink: 'syz.1.4344': attribute type 1 has an invalid length. [ 733.052107][T23533] bond2: option lacp_rate: mode dependency failed, not supported in mode balance-rr(0) [ 733.065828][T23533] bond2 (unregistering): Released all slaves [ 733.080348][T23539] rdma_rxe: rxe_newlink: failed to add bond_slave_1 [ 733.493010][ T1181] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 733.501885][ T1181] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 733.510257][ T1181] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 733.518486][ T1181] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 733.858432][T23563] bridge0: port 1(ipvlan2) entered blocking state [ 733.869908][T23563] bridge0: port 1(ipvlan2) entered disabled state [ 733.877473][T23563] ipvlan2: entered allmulticast mode [ 733.885289][T23563] bridge0: entered allmulticast mode [ 733.905969][T23563] ipvlan2: left allmulticast mode [ 733.912689][T23563] bridge0: left allmulticast mode [ 734.194968][T23572] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4357'. [ 734.424542][T23578] netlink: 'syz.1.4359': attribute type 1 has an invalid length. [ 734.478221][T23578] bond2: option lacp_rate: mode dependency failed, not supported in mode balance-rr(0) [ 734.490890][T23580] rdma_rxe: rxe_newlink: failed to add bond_slave_1 [ 734.491085][T23578] bond2 (unregistering): Released all slaves [ 734.752033][T23590] netlink: 60 bytes leftover after parsing attributes in process `syz.1.4362'. [ 734.779755][T23590] netlink: 60 bytes leftover after parsing attributes in process `syz.1.4362'. [ 734.838755][T23586] netlink: 'syz.4.4360': attribute type 13 has an invalid length. [ 739.253256][T11457] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 739.261492][T11457] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 739.269858][T11457] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 739.278074][T11457] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 745.013106][T11457] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 745.021500][T11457] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 745.029755][T11457] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 745.037947][T11457] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 747.573852][ T1316] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 749.678559][T23625] bridge0: port 1(bridge_slave_0) entered blocking state [ 749.686016][T23625] bridge0: port 1(bridge_slave_0) entered forwarding state [ 749.725646][T23639] netlink: 'syz.1.4364': attribute type 1 has an invalid length. [ 749.844096][T23625] 8021q: adding VLAN 0 to HW filter on device bond1 [ 749.896303][T23625] 8021q: adding VLAN 0 to HW filter on device bond5 [ 749.952528][T11457] bond1: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 750.037028][T23658] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 750.125737][T23639] 8021q: adding VLAN 0 to HW filter on device bond2 [ 750.206518][ T1181] bond1: (slave veth3): link status definitely up, 10000 Mbps full duplex [ 750.258193][ T1181] bond1: active interface up! [ 750.417250][T23676] netlink: 'syz.2.4373': attribute type 1 has an invalid length. [ 750.445567][T23641] bond2: (slave veth11): Enslaving as an active interface with a down link [ 750.459281][T23643] netlink: 'syz.3.4368': attribute type 1 has an invalid length. [ 750.469758][T23643] netlink: 244 bytes leftover after parsing attributes in process `syz.3.4368'. [ 750.507304][T23652] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 750.526159][T23678] rdma_rxe: rxe_newlink: failed to add bond_slave_1 [ 750.693731][T23677] bond7: option lacp_rate: mode dependency failed, not supported in mode balance-rr(0) [ 750.708164][T23677] bond7 (unregistering): Released all slaves [ 750.783460][T11451] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 750.792026][T11451] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 750.800338][T11451] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 750.808566][T11451] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 751.256033][T23703] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci3/hci3:200/input10 [ 751.305217][T23706] netlink: 32 bytes leftover after parsing attributes in process `syz.4.4379'. [ 751.804263][T23725] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4385'. [ 752.283186][T23734] rdma_rxe: rxe_newlink: failed to add bond_slave_1 [ 752.370972][T23732] bond3: option lacp_rate: mode dependency failed, not supported in mode balance-rr(0) [ 752.430742][T23732] bond3 (unregistering): Released all slaves [ 752.742812][T23742] netlink: 24 bytes leftover after parsing attributes in process `syz.4.4390'. [ 753.247412][T23766] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 753.281030][T23769] netlink: 'syz.0.4399': attribute type 1 has an invalid length. [ 753.295537][T23766] netlink: 'syz.4.4398': attribute type 1 has an invalid length. [ 753.450922][T23770] bond9: (slave dummy0): making interface the new active one [ 753.463400][T23770] bond9: (slave dummy0): Enslaving as an active interface with an up link [ 753.472206][T23771] bond9: entered promiscuous mode [ 753.478271][T23771] dummy0: entered promiscuous mode [ 753.490610][T23781] rdma_rxe: rxe_newlink: failed to add bond_slave_1 [ 753.564140][T23780] bond3: option lacp_rate: mode dependency failed, not supported in mode balance-rr(0) [ 753.602920][T23780] bond3 (unregistering): Released all slaves [ 753.627287][T23784] netlink: 68 bytes leftover after parsing attributes in process `syz.2.4402'. [ 753.648434][T23771] bond9: left promiscuous mode [ 753.656866][T23785] netlink: 68 bytes leftover after parsing attributes in process `syz.2.4402'. [ 753.656884][T23771] dummy0: left promiscuous mode [ 753.907528][T23797] macvtap2: entered promiscuous mode [ 753.940994][T23797] macvtap2: entered allmulticast mode [ 753.960455][T23797] veth1_vlan: entered allmulticast mode [ 754.005824][T23799] macvtap3: entered promiscuous mode [ 754.025033][T23799] macvtap3: entered allmulticast mode [ 754.058799][T23809] IPVS: set_ctl: invalid protocol: 12 10.1.5.1:20000 [ 755.387803][T23827] dvmrp0: entered allmulticast mode [ 755.421885][T23873] netlink: 'syz.3.4430': attribute type 7 has an invalid length. [ 755.444949][T23873] netlink: 'syz.3.4430': attribute type 8 has an invalid length. [ 755.460115][T23873] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4430'. [ 755.469592][T23868] geneve3: entered promiscuous mode [ 755.476347][T23872] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4429'. [ 755.526462][T23872] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4429'. [ 755.665697][T23882] rdma_rxe: rxe_newlink: failed to add bond_slave_1 [ 755.761976][T23876] bond10: option lacp_rate: mode dependency failed, not supported in mode balance-rr(0) [ 755.793433][T23876] bond10 (unregistering): Released all slaves [ 755.838757][T23888] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4435'. [ 756.010170][T23890] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4436'. [ 756.143959][T23895] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4438'. [ 756.263004][T23902] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4440'. [ 756.307625][T23902] netlink: 40 bytes leftover after parsing attributes in process `syz.3.4440'. [ 756.325894][T23902] netlink: 28 bytes leftover after parsing attributes in process `syz.3.4440'. [ 756.348768][T23902] netlink: 28 bytes leftover after parsing attributes in process `syz.3.4440'. [ 756.693728][T23922] netlink: 40 bytes leftover after parsing attributes in process `syz.3.4443'. [ 757.173590][T23929] netdevsim netdevsim2 €Â: renamed from netdevsim0 (while UP) [ 757.256411][T23937] rdma_rxe: rxe_newlink: failed to add bond_slave_1 [ 757.323254][T23932] bond10: option lacp_rate: mode dependency failed, not supported in mode balance-rr(0) [ 757.355282][T23932] bond10 (unregistering): Released all slaves [ 757.397378][T23941] netlink: 'syz.2.4446': attribute type 3 has an invalid length. [ 757.415492][T23941] netlink: 'syz.2.4446': attribute type 3 has an invalid length. [ 757.710135][T23961] ip6tnl1: entered allmulticast mode [ 757.754375][T23961] netlink: 'syz.2.4454': attribute type 1 has an invalid length. [ 757.909063][T23962] bridge0: port 2(bridge_slave_1) entered disabled state [ 757.916875][T23962] bridge0: port 1(bridge_slave_0) entered disabled state [ 758.032090][T23933] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 758.056875][T23962] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 758.099791][T23962] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 759.285253][T23979] tipc: Enabling of bearer rejected, failed to enable media [ 759.307107][T11451] netdevsim netdevsim2 €Â: unset [0, 0] type 1 family 0 port 8472 - 0 [ 759.330305][T11451] netdevsim netdevsim2 €Â: unset [1, 0] type 2 family 0 port 6081 - 0 [ 759.344799][T11451] netdevsim netdevsim2 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 759.371685][T11451] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 759.425988][T11451] netdevsim netdevsim2 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 759.458274][T11451] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 759.497941][T11451] netdevsim netdevsim2 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 759.524051][T11451] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 759.587876][T23999] rdma_rxe: rxe_newlink: failed to add bond_slave_1 [ 759.655995][T23995] bond7: option lacp_rate: mode dependency failed, not supported in mode balance-rr(0) [ 759.676561][T23995] bond7 (unregistering): Released all slaves [ 760.158186][T24027] tipc: Enabling of bearer rejected, failed to enable media [ 760.227791][T24027] syz_tun: left promiscuous mode [ 760.250843][T24027] 8021q: adding VLAN 0 to HW filter on device bond0 [ 760.274052][T24027] 8021q: adding VLAN 0 to HW filter on device team0 [ 760.314871][T24027] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 760.501365][T24027] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 760.533688][T24027] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 760.573081][T24027] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 760.596009][T24027] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 760.654586][T24027] veth1_vlan: left promiscuous mode [ 760.666072][T24027] veth0_vlan: left promiscuous mode [ 760.679440][T24027] veth0_vlan: entered promiscuous mode [ 760.690196][T24027] veth1_vlan: entered promiscuous mode [ 760.702579][T24027] veth1_macvtap: left promiscuous mode [ 760.709887][T24027] veth0_macvtap: left promiscuous mode [ 760.718105][T24027] veth0_macvtap: entered promiscuous mode [ 760.725890][T24027] veth1_macvtap: entered promiscuous mode [ 760.744104][T24027] 8021q: adding VLAN 0 to HW filter on device €Â [ 760.753030][T24027] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 760.763374][T24027] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 760.775535][T24027] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 760.793525][T24027] 8021q: adding VLAN 0 to HW filter on device bond1 [ 760.812046][T24027] vlan2: left promiscuous mode [ 760.817720][T24027] bond_slave_1: left promiscuous mode [ 760.831541][T24027] 8021q: adding VLAN 0 to HW filter on device bond2 [ 760.845992][T24027] 8021q: adding VLAN 0 to HW filter on device bond3 [ 760.858869][T24027] 8021q: adding VLAN 0 to HW filter on device bond4 [ 760.875401][T24027] 8021q: adding VLAN 0 to HW filter on device bond5 [ 760.894109][T24027] macsec1: left promiscuous mode [ 760.905501][T24027] 8021q: adding VLAN 0 to HW filter on device bond6 [ 760.941246][T11457] bridge0: port 1(bridge_slave_0) entered blocking state [ 760.949121][T11457] bridge0: port 1(bridge_slave_0) entered forwarding state [ 760.984856][T11457] bridge0: port 2(bridge_slave_1) entered blocking state [ 760.992347][T11457] bridge0: port 2(bridge_slave_1) entered forwarding state [ 761.109265][T11448] netdevsim netdevsim2 €Â: set [0, 0] type 1 family 0 port 8472 - 0 [ 761.132840][T11448] netdevsim netdevsim2 €Â: set [1, 0] type 2 family 0 port 6081 - 0 [ 761.164118][T11448] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 761.209465][T11448] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 761.229265][T11448] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 761.240861][T11448] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 761.264760][T11448] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 761.298595][T11448] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 761.724810][T24080] __nla_validate_parse: 8 callbacks suppressed [ 761.724837][T24080] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4485'. [ 761.766787][T24082] netlink: 'syz.0.4486': attribute type 4 has an invalid length. [ 761.847872][T24090] netlink: 'syz.0.4486': attribute type 4 has an invalid length. [ 761.890269][T24092] netlink: 24 bytes leftover after parsing attributes in process `syz.1.4488'. [ 761.900554][ T50] Bluetooth: hci3: command 0x0405 tx timeout [ 762.452534][T24117] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4494'. [ 762.493112][T24119] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4493'. [ 762.672916][T24130] netlink: 212408 bytes leftover after parsing attributes in process `syz.0.4499'. [ 762.769497][ T50] block nbd1: Receive control failed (result -1) [ 763.221553][T24148] netlink: 72 bytes leftover after parsing attributes in process `syz.4.4503'. [ 763.300907][T24151] netlink: 'syz.0.4504': attribute type 1 has an invalid length. [ 763.558231][T24162] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4507'. [ 764.086048][T24182] workqueue: Failed to create a rescuer kthread for wq "nfc3_nci_tx_wq": -EINTR [ 764.168970][T24178] ip6gre2: entered promiscuous mode [ 764.242154][T24178] ip6gre2: entered allmulticast mode [ 764.476093][T24205] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4514'. [ 764.533658][T24205] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4514'. [ 764.613507][T24209] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4515'. [ 764.751850][T24215] syzkaller0: entered promiscuous mode [ 764.769974][T24215] syzkaller0: entered allmulticast mode [ 764.841655][T24215] tipc: Enabled bearer , priority 0 [ 764.879470][T24214] tipc: Resetting bearer [ 764.953446][T24214] tipc: Disabling bearer [ 765.028277][T24221] [ 765.030789][T24221] ====================================================== [ 765.037852][T24221] WARNING: possible circular locking dependency detected [ 765.045053][T24221] syzkaller #0 Not tainted [ 765.049504][T24221] ------------------------------------------------------ [ 765.056553][T24221] syz.1.4519/24221 is trying to acquire lock: [ 765.062642][T24221] ffffffff8ea85460 (fs_reclaim){+.+.}-{0:0}, at: __kmalloc_cache_noprof+0x40/0x660 [ 765.071991][T24221] [ 765.071991][T24221] but task is already holding lock: [ 765.079372][T24221] ffff8880584d8260 (k-sk_lock-AF_INET6/1){+.+.}-{0:0}, at: mptcp_subflow_create_socket+0x142/0x800 [ 765.090114][T24221] [ 765.090114][T24221] which lock already depends on the new lock. [ 765.090114][T24221] [ 765.100733][T24221] [ 765.100733][T24221] the existing dependency chain (in reverse order) is: [ 765.109884][T24221] [ 765.109884][T24221] -> #7 (k-sk_lock-AF_INET6/1){+.+.}-{0:0}: [ 765.118028][T24221] lock_sock_nested+0x41/0x100 [ 765.123369][T24221] mptcp_subflow_create_socket+0x142/0x800 [ 765.129819][T24221] __mptcp_nmpc_sk+0x155/0x790 [ 765.135139][T24221] mptcp_bind+0xab/0x1d0 [ 765.140107][T24221] __sys_bind+0x2e3/0x410 [ 765.145093][T24221] __x64_sys_bind+0x7a/0x90 [ 765.150176][T24221] do_syscall_64+0x15f/0xf80 [ 765.155336][T24221] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 765.161802][T24221] [ 765.161802][T24221] -> #6 (sk_lock-AF_INET6){+.+.}-{0:0}: [ 765.169585][T24221] lock_sock_nested+0x41/0x100 [ 765.174911][T24221] inet_shutdown+0x6a/0x390 [ 765.179988][T24221] nbd_mark_nsock_dead+0x2e9/0x560 [ 765.185844][T24221] recv_work+0x1c2e/0x1d40 [ 765.190875][T24221] process_scheduled_works+0xb5d/0x1860 [ 765.196990][T24221] worker_thread+0xa53/0xfc0 [ 765.202157][T24221] kthread+0x389/0x470 [ 765.206891][T24221] ret_from_fork+0x514/0xb70 [ 765.212050][T24221] ret_from_fork_asm+0x1a/0x30 [ 765.217485][T24221] [ 765.217485][T24221] -> #5 (&nsock->tx_lock){+.+.}-{4:4}: [ 765.225180][T24221] __mutex_lock+0x1a3/0x1550 [ 765.230333][T24221] nbd_queue_rq+0x37b/0x1100 [ 765.235554][T24221] blk_mq_dispatch_rq_list+0xa70/0x1910 [ 765.241745][T24221] __blk_mq_sched_dispatch_requests+0xdcc/0x1600 [ 765.248713][T24221] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 765.255241][T24221] blk_mq_run_hw_queue+0x348/0x4f0 [ 765.260911][T24221] blk_mq_dispatch_list+0xd16/0xe10 [ 765.266706][T24221] blk_mq_flush_plug_list+0x48d/0x570 [ 765.272643][T24221] __blk_flush_plug+0x3ed/0x4d0 [ 765.278144][T24221] __submit_bio+0x28d/0x580 [ 765.283216][T24221] submit_bio_noacct_nocheck+0x2f4/0xa40 [ 765.289427][T24221] block_read_full_folio+0x599/0x830 [ 765.295373][T24221] filemap_read_folio+0x137/0x3b0 [ 765.300961][T24221] do_read_cache_folio+0x358/0x590 [ 765.306634][T24221] read_part_sector+0xb6/0x2b0 [ 765.311957][T24221] adfspart_check_ICS+0xb1/0x960 [ 765.317475][T24221] bdev_disk_changed+0x817/0x1770 [ 765.323064][T24221] blkdev_get_whole+0x380/0x510 [ 765.328457][T24221] bdev_open+0x31e/0xd30 [ 765.333338][T24221] blkdev_open+0x470/0x610 [ 765.338304][T24221] do_dentry_open+0x785/0x14e0 [ 765.343626][T24221] vfs_open+0x3b/0x340 [ 765.348240][T24221] path_openat+0x2e08/0x3860 [ 765.353380][T24221] do_file_open+0x23e/0x4a0 [ 765.358440][T24221] do_sys_openat2+0x113/0x200 [ 765.363728][T24221] __x64_sys_openat+0x138/0x170 [ 765.369129][T24221] do_syscall_64+0x15f/0xf80 [ 765.374270][T24221] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 765.380800][T24221] [ 765.380800][T24221] -> #4 (&cmd->lock){+.+.}-{4:4}: [ 765.388048][T24221] __mutex_lock+0x1a3/0x1550 [ 765.393281][T24221] nbd_queue_rq+0xc6/0x1100 [ 765.398339][T24221] blk_mq_dispatch_rq_list+0xa70/0x1910 [ 765.404542][T24221] __blk_mq_sched_dispatch_requests+0xdcc/0x1600 [ 765.411502][T24221] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 765.418035][T24221] blk_mq_run_hw_queue+0x348/0x4f0 [ 765.423712][T24221] blk_mq_dispatch_list+0xd16/0xe10 [ 765.429475][T24221] blk_mq_flush_plug_list+0x48d/0x570 [ 765.435407][T24221] __blk_flush_plug+0x3ed/0x4d0 [ 765.440818][T24221] __submit_bio+0x28d/0x580 [ 765.445867][T24221] submit_bio_noacct_nocheck+0x2f4/0xa40 [ 765.452055][T24221] block_read_full_folio+0x599/0x830 [ 765.457903][T24221] filemap_read_folio+0x137/0x3b0 [ 765.463484][T24221] do_read_cache_folio+0x358/0x590 [ 765.469163][T24221] read_part_sector+0xb6/0x2b0 [ 765.474496][T24221] adfspart_check_ICS+0xb1/0x960 [ 765.479977][T24221] bdev_disk_changed+0x817/0x1770 [ 765.485551][T24221] blkdev_get_whole+0x380/0x510 [ 765.490966][T24221] bdev_open+0x31e/0xd30 [ 765.495771][T24221] blkdev_open+0x470/0x610 [ 765.500929][T24221] do_dentry_open+0x785/0x14e0 [ 765.506244][T24221] vfs_open+0x3b/0x340 [ 765.510877][T24221] path_openat+0x2e08/0x3860 [ 765.516032][T24221] do_file_open+0x23e/0x4a0 [ 765.521097][T24221] do_sys_openat2+0x113/0x200 [ 765.526358][T24221] __x64_sys_openat+0x138/0x170 [ 765.531792][T24221] do_syscall_64+0x15f/0xf80 [ 765.537022][T24221] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 765.543484][T24221] [ 765.543484][T24221] -> #3 (set->srcu){.+.+}-{0:0}: [ 765.550789][T24221] __synchronize_srcu+0xca/0x300 [ 765.556335][T24221] elevator_switch+0x1e8/0x7a0 [ 765.561743][T24221] elevator_change+0x2cc/0x450 [ 765.567065][T24221] elevator_set_default+0x36c/0x430 [ 765.572818][T24221] blk_register_queue+0x3e9/0x4e0 [ 765.578386][T24221] __add_disk+0x677/0xd50 [ 765.583302][T24221] add_disk_fwnode+0xfb/0x480 [ 765.588538][T24221] nbd_dev_add+0x72c/0xb50 [ 765.593730][T24221] nbd_init+0x168/0x1f0 [ 765.598452][T24221] do_one_initcall+0x250/0x870 [ 765.603769][T24221] do_initcall_level+0x104/0x190 [ 765.609265][T24221] do_initcalls+0x59/0xa0 [ 765.614144][T24221] kernel_init_freeable+0x2a6/0x3e0 [ 765.619889][T24221] kernel_init+0x1d/0x1d0 [ 765.624772][T24221] ret_from_fork+0x514/0xb70 [ 765.629918][T24221] ret_from_fork_asm+0x1a/0x30 [ 765.635235][T24221] [ 765.635235][T24221] -> #2 (&q->elevator_lock){+.+.}-{4:4}: [ 765.643117][T24221] __mutex_lock+0x1a3/0x1550 [ 765.648261][T24221] elevator_change+0x1b3/0x450 [ 765.653583][T24221] elevator_set_none+0xb5/0x140 [ 765.659165][T24221] blk_mq_update_nr_hw_queues+0x5e7/0x1a60 [ 765.665530][T24221] nbd_start_device+0x17f/0xb10 [ 765.670942][T24221] nbd_genl_connect+0x165b/0x1cf0 [ 765.676513][T24221] genl_family_rcv_msg_doit+0x22a/0x330 [ 765.682809][T24221] genl_rcv_msg+0x61c/0x7a0 [ 765.687881][T24221] netlink_rcv_skb+0x232/0x4b0 [ 765.693201][T24221] genl_rcv+0x28/0x40 [ 765.697832][T24221] netlink_unicast+0x75c/0x8e0 [ 765.703158][T24221] netlink_sendmsg+0x813/0xb40 [ 765.708493][T24221] ____sys_sendmsg+0x972/0x9f0 [ 765.713806][T24221] ___sys_sendmsg+0x2a5/0x360 [ 765.719044][T24221] __x64_sys_sendmsg+0x1bd/0x2a0 [ 765.724554][T24221] do_syscall_64+0x15f/0xf80 [ 765.729717][T24221] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 765.736187][T24221] [ 765.736187][T24221] -> #1 (&q->q_usage_counter(io)#49){++++}-{0:0}: [ 765.745333][T24221] blk_alloc_queue+0x546/0x680 [ 765.750780][T24221] __blk_mq_alloc_disk+0x197/0x390 [ 765.756856][T24221] nbd_dev_add+0x499/0xb50 [ 765.762016][T24221] nbd_init+0x168/0x1f0 [ 765.766719][T24221] do_one_initcall+0x250/0x870 [ 765.772027][T24221] do_initcall_level+0x104/0x190 [ 765.777651][T24221] do_initcalls+0x59/0xa0 [ 765.782536][T24221] kernel_init_freeable+0x2a6/0x3e0 [ 765.788409][T24221] kernel_init+0x1d/0x1d0 [ 765.793381][T24221] ret_from_fork+0x514/0xb70 [ 765.798528][T24221] ret_from_fork_asm+0x1a/0x30 [ 765.803840][T24221] [ 765.803840][T24221] -> #0 (fs_reclaim){+.+.}-{0:0}: [ 765.811093][T24221] __lock_acquire+0x15a5/0x2cf0 [ 765.816491][T24221] lock_acquire+0x106/0x350 [ 765.821554][T24221] fs_reclaim_acquire+0x71/0x100 [ 765.827044][T24221] __kmalloc_cache_noprof+0x40/0x660 [ 765.832885][T24221] ref_tracker_alloc+0x15a/0x4c0 [ 765.838384][T24221] get_net_track+0x16e/0x230 [ 765.843523][T24221] sk_net_refcnt_upgrade+0xb2/0x130 [ 765.849268][T24221] mptcp_subflow_create_socket+0x32b/0x800 [ 765.855630][T24221] __mptcp_nmpc_sk+0x155/0x790 [ 765.860956][T24221] mptcp_pm_nl_add_addr_doit+0xe25/0x1420 [ 765.867327][T24221] genl_family_rcv_msg_doit+0x22a/0x330 [ 765.873432][T24221] genl_rcv_msg+0x61c/0x7a0 [ 765.878579][T24221] netlink_rcv_skb+0x232/0x4b0 [ 765.883890][T24221] genl_rcv+0x28/0x40 [ 765.888442][T24221] netlink_unicast+0x75c/0x8e0 [ 765.893747][T24221] netlink_sendmsg+0x813/0xb40 [ 765.899055][T24221] ____sys_sendmsg+0x972/0x9f0 [ 765.904378][T24221] ___sys_sendmsg+0x2a5/0x360 [ 765.909689][T24221] __x64_sys_sendmsg+0x1bd/0x2a0 [ 765.915208][T24221] do_syscall_64+0x15f/0xf80 [ 765.920345][T24221] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 765.926789][T24221] [ 765.926789][T24221] other info that might help us debug this: [ 765.926789][T24221] [ 765.937031][T24221] Chain exists of: [ 765.937031][T24221] fs_reclaim --> sk_lock-AF_INET6 --> k-sk_lock-AF_INET6/1 [ 765.937031][T24221] [ 765.950281][T24221] Possible unsafe locking scenario: [ 765.950281][T24221] [ 765.957752][T24221] CPU0 CPU1 [ 765.963591][T24221] ---- ---- [ 765.969070][T24221] lock(k-sk_lock-AF_INET6/1); [ 765.973970][T24221] lock(sk_lock-AF_INET6); [ 765.981015][T24221] lock(k-sk_lock-AF_INET6/1); [ 765.988417][T24221] lock(fs_reclaim); [ 765.992425][T24221] [ 765.992425][T24221] *** DEADLOCK *** [ 765.992425][T24221] [ 766.000717][T24221] 4 locks held by syz.1.4519/24221: [ 766.005987][T24221] #0: ffffffff8fe42848 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 766.014249][T24221] #1: ffffffff8fe42680 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10b/0x7a0 [ 766.023301][T24221] #2: ffff88807699b560 (msk_lock-AF_INET6){+.+.}-{0:0}, at: mptcp_pm_nl_add_addr_doit+0xdc7/0x1420 [ 766.034173][T24221] #3: ffff8880584d8260 (k-sk_lock-AF_INET6/1){+.+.}-{0:0}, at: mptcp_subflow_create_socket+0x142/0x800 [ 766.045376][T24221] [ 766.045376][T24221] stack backtrace: [ 766.051295][T24221] CPU: 0 UID: 0 PID: 24221 Comm: syz.1.4519 Not tainted syzkaller #0 PREEMPT(full) [ 766.051318][T24221] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 766.051330][T24221] Call Trace: [ 766.051340][T24221] [ 766.051350][T24221] dump_stack_lvl+0xe8/0x150 [ 766.051374][T24221] print_circular_bug+0x2e1/0x300 [ 766.051402][T24221] check_noncircular+0x12e/0x150 [ 766.051429][T24221] __lock_acquire+0x15a5/0x2cf0 [ 766.051450][T24221] ? check_noncircular+0xda/0x150 [ 766.051476][T24221] ? lockdep_unlock+0x5d/0xd0 [ 766.051493][T24221] ? __lock_acquire+0x146e/0x2cf0 [ 766.051515][T24221] ? __kmalloc_cache_noprof+0x40/0x660 [ 766.051541][T24221] lock_acquire+0x106/0x350 [ 766.051559][T24221] ? __kmalloc_cache_noprof+0x40/0x660 [ 766.051590][T24221] fs_reclaim_acquire+0x71/0x100 [ 766.051616][T24221] ? __kmalloc_cache_noprof+0x40/0x660 [ 766.051641][T24221] __kmalloc_cache_noprof+0x40/0x660 [ 766.051666][T24221] ? ref_tracker_alloc+0x15a/0x4c0 [ 766.051692][T24221] ? rcu_is_watching+0x15/0xb0 [ 766.051715][T24221] ref_tracker_alloc+0x15a/0x4c0 [ 766.051748][T24221] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 766.051773][T24221] ? ref_tracker_free+0x522/0x840 [ 766.051799][T24221] ? __pfx_ref_tracker_free+0x10/0x10 [ 766.051824][T24221] ? sk_net_refcnt_upgrade+0x8c/0x130 [ 766.051844][T24221] ? mptcp_subflow_create_socket+0x32b/0x800 [ 766.051864][T24221] ? __mptcp_nmpc_sk+0x155/0x790 [ 766.051883][T24221] ? mptcp_pm_nl_add_addr_doit+0xe25/0x1420 [ 766.051912][T24221] ? genl_family_rcv_msg_doit+0x22a/0x330 [ 766.051940][T24221] ? net_passive_dec+0x177/0x250 [ 766.051965][T24221] ? __pfx_net_passive_dec+0x10/0x10 [ 766.051994][T24221] get_net_track+0x16e/0x230 [ 766.052013][T24221] sk_net_refcnt_upgrade+0xb2/0x130 [ 766.052034][T24221] mptcp_subflow_create_socket+0x32b/0x800 [ 766.052057][T24221] ? __pfx_mptcp_subflow_create_socket+0x10/0x10 [ 766.052079][T24221] ? do_raw_spin_lock+0x12b/0x2f0 [ 766.052104][T24221] ? lock_sock_nested+0x6a/0x100 [ 766.052129][T24221] __mptcp_nmpc_sk+0x155/0x790 [ 766.052151][T24221] ? __pfx___mptcp_nmpc_sk+0x10/0x10 [ 766.052170][T24221] ? mptcp_pm_nl_add_addr_doit+0xdc7/0x1420 [ 766.052198][T24221] ? __local_bh_enable_ip+0xd0/0x130 [ 766.052219][T24221] mptcp_pm_nl_add_addr_doit+0xe25/0x1420 [ 766.052255][T24221] ? __pfx_mptcp_pm_nl_add_addr_doit+0x10/0x10 [ 766.052303][T24221] ? genl_family_rcv_msg_attrs_parse+0x20b/0x2f0 [ 766.052329][T24221] ? genl_family_rcv_msg_attrs_parse+0x265/0x2f0 [ 766.052359][T24221] genl_family_rcv_msg_doit+0x22a/0x330 [ 766.052386][T24221] ? __asan_memcpy+0x40/0x70 [ 766.052410][T24221] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 766.052441][T24221] ? bpf_lsm_capable+0x9/0x20 [ 766.052460][T24221] ? security_capable+0x7e/0x2c0 [ 766.052485][T24221] genl_rcv_msg+0x61c/0x7a0 [ 766.052514][T24221] ? __pfx_genl_rcv_msg+0x10/0x10 [ 766.052538][T24221] ? __pfx_mptcp_pm_nl_add_addr_doit+0x10/0x10 [ 766.052572][T24221] netlink_rcv_skb+0x232/0x4b0 [ 766.052591][T24221] ? __pfx_genl_rcv_msg+0x10/0x10 [ 766.052616][T24221] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 766.052642][T24221] ? down_read+0x270/0x2e0 [ 766.052660][T24221] ? genl_rcv+0xd/0x40 [ 766.052684][T24221] genl_rcv+0x28/0x40 [ 766.052707][T24221] netlink_unicast+0x75c/0x8e0 [ 766.052728][T24221] netlink_sendmsg+0x813/0xb40 [ 766.052759][T24221] ? __pfx_netlink_sendmsg+0x10/0x10 [ 766.052780][T24221] ? aa_sock_msg_perm+0xf1/0x1b0 [ 766.052806][T24221] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 766.052833][T24221] ____sys_sendmsg+0x972/0x9f0 [ 766.052853][T24221] ? __might_fault+0xaf/0x130 [ 766.052878][T24221] ? __pfx_____sys_sendmsg+0x10/0x10 [ 766.052901][T24221] ? import_iovec+0x73/0xa0 [ 766.052930][T24221] ___sys_sendmsg+0x2a5/0x360 [ 766.052948][T24221] ? __lock_acquire+0x6b5/0x2cf0 [ 766.052969][T24221] ? __pfx____sys_sendmsg+0x10/0x10 [ 766.052991][T24221] ? futex_wake+0x4ac/0x580 [ 766.053028][T24221] ? __fget_files+0x2a/0x420 [ 766.053049][T24221] ? __fget_files+0x3a0/0x420 [ 766.053074][T24221] __x64_sys_sendmsg+0x1bd/0x2a0 [ 766.053094][T24221] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 766.053117][T24221] ? rcu_is_watching+0x15/0xb0 [ 766.053142][T24221] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 766.053161][T24221] do_syscall_64+0x15f/0xf80 [ 766.053178][T24221] ? trace_irq_disable+0x3b/0x140 [ 766.053205][T24221] ? clear_bhb_loop+0x40/0x90 [ 766.053225][T24221] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 766.053243][T24221] RIP: 0033:0x7f8d6619ce59 [ 766.053260][T24221] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 766.053277][T24221] RSP: 002b:00007f8d670c7028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 766.053297][T24221] RAX: ffffffffffffffda RBX: 00007f8d66415fa0 RCX: 00007f8d6619ce59 [ 766.053311][T24221] RDX: 0000000000000000 RSI: 0000200000000240 RDI: 0000000000000003 [ 766.053322][T24221] RBP: 00007f8d66232d6f R08: 0000000000000000 R09: 0000000000000000 [ 766.053334][T24221] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 766.053346][T24221] R13: 00007f8d66416038 R14: 00007f8d66415fa0 R15: 00007fffea7fcfd8 [ 766.053368][T24221]