last executing test programs: 6.54786392s ago: executing program 2 (id=3882): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000180)={0x26, 'aead\x00', 0x0, 0x0, 'authencesn(wp512-generic,cbc-camellia-aesni-avx2)\x00'}, 0x58) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)={0x1c, 0x46, 0x107, 0x70bd28, 0x0, {0x1, 0x7c}, [@nested={0x7, 0x4, 0x0, 0x1, [@generic='6dy']}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) r2 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_TTY_GET(r2, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x10, 0x3f8, 0x1, 0x70bd27, 0x25dfdbfc, "", ["", "", "", "", "", "", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x50}, 0x4000) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ad56b6c582", 0x56ad) 6.176408684s ago: executing program 1 (id=3885): sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)={0x20, 0x1e, 0x1, 0x70bd2b, 0x0, {0x17}, [@typed={0x5, 0x2a, 0x0, 0x0, @str='\x00'}, @nested={0x4, 0xf}]}, 0x20}, 0x1, 0x0, 0x0, 0x2008800}, 0x0) (async, rerun: 64) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) (rerun: 64) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) (async) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000750000001801000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb70200000800"], 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) write$tun(r0, &(0x7f0000000440)={@val, @void, @eth={@broadcast, @remote, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x452c, 0x0, 0x0, 0x0, 0x2f, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @multicast1}, {0x0, 0x6558, 0x18, 0x0, @wg=@data={0x4, 0x0, 0x5865}}}}}}}, 0xfdef) 5.940170689s ago: executing program 1 (id=3888): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_NEW_STATION(r1, &(0x7f0000000340)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x50, r2, 0x800, 0x70bd25, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_STA_TX_POWER={0x6, 0x114, 0x4}, @NL80211_ATTR_STA_SUPPORTED_RATES={0x1e, 0x13, [{0x1b}, {0xc}, {0x1}, {0x5}, {0x48}, {0x16}, {0x4}, {0x7}, {0x48}, {0x48, 0x1}, {0x48, 0x1}, {0xb}, {0x5, 0x1}, {0x24}, {0x6}, {0x24, 0x1}, {0xc}, {0x1}, {0x1b}, {0x12}, {0x1, 0x1}, {0xc, 0x1}, {0x1b}, {0x5, 0x1}, {0x16}, {0x6, 0x1}]}, @NL80211_ATTR_STA_FLAGS2={0xc, 0x43, {0x2, 0x6}}, @NL80211_ATTR_PEER_AID={0x6, 0xb5, 0x430}]}, 0x50}, 0x1, 0x0, 0x0, 0x20040804}, 0x4000) r3 = syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) r4 = epoll_create1(0x80000) r5 = socket$inet6_sctp(0xa, 0x801, 0x84) sendto$inet6(r5, &(0x7f0000000280)="f9", 0x1, 0x20000040, &(0x7f0000000040)={0xa, 0x0, 0x2, @private2}, 0x1c) shutdown(r5, 0x1) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r5, 0x84, 0x7b, &(0x7f0000000100)={0x0, 0x2}, 0x8) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r3, &(0x7f0000000080)={0x20000001}) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_NEWRULE={0x50, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x24, 0x4, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @log={{0x8}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_LOG_LEVEL={0x8, 0x5, 0x1, 0x0, 0x40}, @NFTA_LOG_GROUP={0x6, 0x1, 0x1, 0x0, 0x1}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x78}, 0x1, 0x0, 0x0, 0x4008891}, 0x10) 3.947863953s ago: executing program 1 (id=3897): bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x2, 0x16, &(0x7f0000000180)=ANY=[@ANYBLOB="611230000000000061134c0000000000bf2000000000000016000200071b48013c030000000000009500000000000000bc26000000000000bf67000000000000150200000fff07006702000003000000360600000ee600f0bf050000000000000f650000000000006507f4ff02000000070700004c0040001f75000000000000bf54000000000000070500000300f9ffad430100000000009500000000000000050800000000000095000000000000004d9bd591d568253e9988431ec068e3a83683d58719d72183f2cb7f43dd55788be820b236dcb695dbfd737cbf5fe7030586"], &(0x7f0000000100)='GPL\x00'}, 0x48) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="580000001000010027bd7200fedbdf25000891c2", @ANYRES32=0x0, @ANYBLOB="0c040100000000001400030076657468315f746f5f626f6e64000000180016801400018010000200feffffff"], 0x58}, 0x1, 0x0, 0x0, 0x4000840}, 0x60000080) r1 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_PORT_GET(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000a80)=ANY=[@ANYBLOB="2000000005140100"], 0x20}, 0x1, 0x0, 0x0, 0x4}, 0x4000010) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f0000000080)={0x0, @in={{0x2, 0x4e20, @loopback}}}, &(0x7f0000000140)=0x84) pipe(&(0x7f00000007c0)={0xffffffffffffffff, 0xffffffffffffffff}) close(r4) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) unshare(0x2c020400) splice(r3, 0x0, r4, 0x0, 0xfffd, 0xa) pipe(&(0x7f0000000340)={0xffffffffffffffff}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r5, 0x89f8, &(0x7f0000000480)={'syztnl0\x00', &(0x7f00000003c0)={'ip_vti0\x00', 0x0, 0x40, 0x1, 0x9, 0x2, {{0x26, 0x4, 0x0, 0x0, 0x98, 0x68, 0x0, 0x7a, 0x2f, 0x0, @rand_addr=0x64010102, @multicast1, {[@timestamp={0x44, 0x14, 0x1b, 0x0, 0x7, [0x6, 0x10000, 0x9, 0x5]}, @lsrr={0x83, 0xb, 0xa4, [@multicast2, @rand_addr=0x64010100]}, @rr={0x7, 0x1f, 0x13, [@private=0xa010101, @remote, @rand_addr=0x64010100, @dev={0xac, 0x14, 0x14, 0x22}, @remote, @loopback, @private=0xa010102]}, @rr={0x7, 0x17, 0x9f, [@rand_addr=0x64010100, @rand_addr=0x64010101, @remote, @dev={0xac, 0x14, 0x14, 0x36}, @dev={0xac, 0x14, 0x14, 0x23}]}, @timestamp_prespec={0x44, 0x2c, 0x5, 0x3, 0x4, [{@initdev={0xac, 0x1e, 0x1, 0x0}, 0x1}, {@private=0xa010101, 0x401}, {@remote, 0x1ff}, {@local, 0x9}, {@loopback, 0x762c}]}, @generic={0x56, 0x3, "87"}]}}}}}) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xc, &(0x7f0000000580)=ANY=[@ANYRESHEX=r0, @ANYRES16=r5, @ANYBLOB="44e7e40930691066c717a583d8f740337ab1652dd3bd8d0ad1a85d190e23032a4d472e0a1738f0791b422f936a66a6a9908647085b065357e5bebbe73a3b801a8c2c6fa1d1193812e2d91ebe07a54e7013f6fbdf8412b6042a8ff79428", @ANYRESHEX=r0, @ANYRESOCT=r2, @ANYRES16=r0, @ANYRES32=0x0], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x13, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_GET_PROG_INFO(0xa, &(0x7f0000000740)={r6, 0x0, 0x0}, 0x10) write(r6, &(0x7f0000000240)="82360f492d214a8839799ed0749f759319fb9f762d5b9107b693b1f513bf24f6e43b43206154eb770176e25e9c30e93a4f11063063740e956a7eec90585476ec81c303ea0cf9c92c38823b6dbaca0f2671b149fa7032ea29b2bf3d31357fba27ddcdb7e8739864fd5179e1a9a0f32b510c367e8546e88c6bf10c477f07cd06fb2d0b71596feaa20c7217b210e61bc1beef73e64ac14499e5f66a1dc6a7b936718c77292debc1f27ddbf7775f5017eed311a13f7e169720945aea718ebaf094ffe12eb01d40c66eb07d318d71dcf6addb418d3e7489", 0xd5) setsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(0xffffffffffffffff, 0x84, 0x76, &(0x7f0000000180)={r2, 0x401}, 0x8) 3.861632401s ago: executing program 2 (id=3898): syz_emit_ethernet(0x46, &(0x7f00000000c0)={@multicast, @remote, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "120008", 0x10, 0x3a, 0xff, @ipv4={'\x00', '\xff\xff', @loopback}, @dev={0xfe, 0x80, '\x00', 0xc}, {[], @ndisc_ra={0x86, 0x0, 0x0, 0xff, 0x0, 0x200, 0x0, 0x7}}}}}}, 0x0) r0 = accept4$inet6(0xffffffffffffffff, &(0x7f0000000140)={0xa, 0x0, 0x0, @loopback}, &(0x7f0000000240)=0x1c, 0x80000) getsockname$packet(0xffffffffffffffff, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000300)={@empty, @rand_addr=' \x01\x00', @mcast2, 0x3, 0xff, 0x5, 0x200, 0x7fff, 0x0, r1}) (async) r2 = accept$ax25(0xffffffffffffffff, &(0x7f0000000000)={{0x3, @default}, [@null, @null, @remote, @null, @bcast, @rose, @rose, @bcast]}, &(0x7f0000000080)=0x48) sendto(r2, &(0x7f0000000200)="05cb8e535fc16abacdac557cbd35973d982ea11ad9bb17d0e0e93c5019a38695743faa72c29eadf5ec3694bb04c03be271e480b5a4", 0x35, 0x40080, &(0x7f0000000180)=@caif=@rfm={0x25, 0x4, "46d5b9be00efe9b537df1bc8dab15368"}, 0x80) 3.860901016s ago: executing program 4 (id=3899): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000480)=ANY=[@ANYBLOB="700000000206010100000000000000000000000005000500000000002c000780080012400000000005001400cd0000000800064000000002050014000600000008000b4000000000100003006269746d61703a706f727400050004000200000005000100070000f50400040000000000"], 0x70}, 0x1, 0x0, 0x0, 0x4000000}, 0x480d4) (async) socket$nl_route(0x10, 0x3, 0x0) (async) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=ANY=[@ANYBLOB="14000000100001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) (async) r1 = socket$nl_route(0x10, 0x3, 0x0) (async) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r2, 0x0) (async) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x1c, &(0x7f0000000280)=[@in6={0xa, 0x4e21, 0x0, @private2={0xfc, 0x2, '\x00', 0xff}}]}, &(0x7f0000000180)=0x10) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r2, 0x84, 0x7c, &(0x7f0000000100)={r3, 0x9, 0x2}, &(0x7f0000000140)=0x8) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="8400000010000504000783007b00000000000000", @ANYRES32=0x0, @ANYBLOB="0200000000000200240012800b00010065727370616e000014000280"], 0x84}}, 0x20000010) (async) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000001c6a000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) (async) sendmsg$NFT_BATCH(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWRULE={0x6c, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_EXPRESSIONS={0x40, 0x4, 0x0, 0x1, [{0x3c, 0x1, 0x0, 0x1, @payload={{0xc}, @val={0x2c, 0x2, 0x0, 0x1, [@NFTA_PAYLOAD_LEN={0x8}, @NFTA_PAYLOAD_BASE={0x8}, @NFTA_PAYLOAD_SREG={0x8}, @NFTA_PAYLOAD_OFFSET={0x8}, @NFTA_PAYLOAD_CSUM_TYPE={0x8, 0x6, 0x1, 0x0, 0x2}]}}}]}]}], {0x14}}, 0x94}}, 0x0) (async) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_SET(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="010028bd7000fddbdf2505000000280001800d0001007564703a73797a3257"], 0x3c}, 0x1, 0x0, 0x0, 0x4c445}, 0x4040940) (async) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="180000000000000000000000fbffffff9540000000000000971fb206712757893994bc8b9637786fdeceb022f48e8e7b5d9f5c68c7a3815be478"], &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, 0x94) r8 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r8, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0xfffffffd}}, 0x10) (async) r9 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r9, &(0x7f0000000180)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x2, 0x4}}, 0x10) (async) bind$tipc(r8, &(0x7f0000000400)=@name={0x1e, 0x2, 0x2, {{0x42, 0x2}, 0x3}}, 0x10) (async) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0xc, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000070000000000000013d38000911172000000000095"], &(0x7f0000000c40)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffff9}, 0x94) bind$tipc(r9, &(0x7f0000000440)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x2, 0x3}}, 0x10) (async) bind$tipc(r9, &(0x7f00000001c0)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x3, 0x4}}, 0x10) bind$tipc(r8, 0x0, 0x0) (async) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000080)={r7, 0xffffffffffffffff, 0x31, 0x0, @val=@kprobe_multi=@syms={0x1, 0x6, &(0x7f0000000640)=[&(0x7f0000000340)='GPL\x00', &(0x7f0000000380)='^{\x00', &(0x7f0000000500)=':$(\\\x10%\x00', &(0x7f0000000540)='\x9b#]\x00', &(0x7f0000000580)='}(/[\x8e!-\'\x00', &(0x7f00000005c0)='^}\x00'], 0x0, 0xb29}}, 0x30) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x16, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000000000000911092000000000095000000000000"], &(0x7f0000000600)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async, rerun: 32) r10 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000000140)='GPL\x00'}, 0x80) (rerun: 32) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000240)={r10, 0x8, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) 3.85938431s ago: executing program 0 (id=3900): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x6, 0x10, &(0x7f0000000880)=ANY=[@ANYBLOB="1800f300000100000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r0, @ANYBLOB="0000000000000000b705000008000000850000008500000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp=0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 3.756920501s ago: executing program 2 (id=3902): r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) r1 = socket(0x6, 0x0, 0x7) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$L2TP_CMD_NOOP(r1, &(0x7f0000000440)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000400)={&(0x7f0000000380)={0x68, r2, 0x800, 0x70bd2a, 0x25dfdbfc, {}, [@L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x4}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0xb2}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @dev={0xac, 0x14, 0x14, 0x31}}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x4}, @L2TP_ATTR_COOKIE={0xc, 0xf, 0x7}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x9}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0x3}, @L2TP_ATTR_MTU={0x6, 0x1c, 0x3}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x8}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x8e}]}, 0x68}, 0x1, 0x0, 0x0, 0x4040}, 0x40040c1) ioctl$XFS_IOC_INUMBERS(r0, 0x80405880, &(0x7f00000000c0)={{0x654af4b7, 0x4, 0x400, 0x7, 0xfffff63c}, [{0x1000, 0xffffffffffffffff, 0x2}, {0x1, 0x4, 0xf3, 0xf7}, {0x4, 0x1000, 0x2, 0x5}, {0x9, 0x3ff, 0xd, 0x7}]}) unshare(0x6a040000) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000200000a98000000060a010400000000000000000a0022050900010073797a31000000006c000480680001800a000100696e6e6572000000580002800800044000000017340005800c0001007061796c6f616400240002800800034000000092030002400000000408000440000000e908000140000000110800034000000002080002400000008408000140000000eb0800020073797a32"], 0xc0}, 0x1, 0x0, 0x0, 0x8890}, 0x24000000) sendmsg$nl_generic(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000002700090025bd7000ffd3008001000000080001"], 0x1c}, 0x1, 0x0, 0x0, 0x4000811}, 0x4000) r5 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) getsockopt$bt_BT_SECURITY(r5, 0x112, 0x4, &(0x7f0000000180), 0x2) 3.733812897s ago: executing program 4 (id=3903): bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000000)={0x1, 0xffffffffffffffff}, 0x4) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'team0\x00', 0x0}) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0x8, 0x0, 0x1, 0x2202, r0, 0x2, '\x00', r1, 0xffffffffffffffff, 0x4, 0x0, 0x1, 0xd}, 0x50) ioctl$BTRFS_IOC_QUOTA_RESCAN(r2, 0x4040942c, &(0x7f0000000100)={0x0, 0x3, [0x2, 0x8, 0x6c, 0x1, 0x1092, 0x3]}) ioctl$FS_IOC_GETVERSION(r0, 0x80087601, &(0x7f0000000140)) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r3, &(0x7f0000000300)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000200)={0x8c, r4, 0x800, 0x70bd27, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0x2}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}, @MPTCP_PM_ATTR_ADDR_REMOTE={0x60, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e21}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private1}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast1}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private1}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e24}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r1}]}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x8}]}, 0x8c}, 0x1, 0x0, 0x0, 0x404c084}, 0x20040000) socket$inet_udp(0x2, 0x2, 0x0) r5 = syz_genetlink_get_family_id$tipc(&(0x7f0000000380), r3) sendmsg$TIPC_CMD_GET_REMOTE_MNG(r3, &(0x7f0000000440)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x1c, r5, 0x1, 0x70bd28, 0x25dfdbfd, {}, ["", "", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x20004001}, 0x40000000) pread64(r0, &(0x7f0000000480)=""/206, 0xce, 0xd) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r3, 0xc400941d, &(0x7f0000000580)={0x0, 0x4, 0x8, 0x1}) ioctl$BTRFS_IOC_DEV_INFO(r6, 0xd000941e, &(0x7f0000000980)={r7, "70dedd42b2e43b02cdfbb14ace97fa09"}) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f00000019c0), r3) sendmsg$NL80211_CMD_FRAME(r8, &(0x7f0000001ac0)={&(0x7f0000001980)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000001a80)={&(0x7f0000001a00)={0x48, r9, 0x200, 0xf45f, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0x6, 0x5f}}}}, [@NL80211_ATTR_OFFCHANNEL_TX_OK={0x4}, @NL80211_ATTR_CSA_C_OFFSETS_TX={0xa, 0xcd, [0x3ff, 0x6, 0x6]}, @NL80211_ATTR_CSA_C_OFFSETS_TX={0x12, 0xcd, [0x7ff, 0x93, 0x2, 0x2, 0x4, 0x8, 0x8]}, @NL80211_ATTR_OFFCHANNEL_TX_OK={0x4}]}, 0x48}, 0x1, 0x0, 0x0, 0x4}, 0x4) r10 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001b40), r3) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000001c00)={'syztnl1\x00', &(0x7f0000001b80)={'syztnl2\x00', r1, 0x4, 0x0, 0x6, 0x8001, 0xa, @mcast2, @mcast2, 0x8, 0x7, 0x4, 0x41}}) sendmsg$ETHTOOL_MSG_EEE_SET(r3, &(0x7f0000002300)={&(0x7f0000001b00)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000022c0)={&(0x7f0000001c40)={0x65c, r10, 0x20, 0x70bd29, 0x25dfdbfd, {}, [@ETHTOOL_A_EEE_TX_LPI_TIMER={0x8, 0x7, 0x9}, @ETHTOOL_A_EEE_ENABLED={0x5, 0x5, 0x1}, @ETHTOOL_A_EEE_TX_LPI_ENABLED={0x5, 0x6, 0x1}, @ETHTOOL_A_EEE_MODES_OURS={0x2f8, 0x2, 0x0, 0x1, [@ETHTOOL_A_BITSET_VALUE={0x6, 0x4, "e1b9"}, @ETHTOOL_A_BITSET_NOMASK={0x4}, @ETHTOOL_A_BITSET_SIZE={0x8, 0x2, 0x9}, @ETHTOOL_A_BITSET_VALUE={0xc2, 0x4, "99be5d54055716a9e56f07098234fe09b0ed6dce91ebad37fb1a4f278c2aa44e078a3d1a4b577df8ae20a022dc23d2054b4b2106955e3573afbe60d89f2cb780115793208d19db1ce904940bb903b7fb67ddf3977ed724d382dc87a69a2a94a2c2f1a21056932ebccca43f87e5789f432414a93ec33be83f78c8cc937b0fbc9dccdf0a2cb087b4c05ea0f79588e55466e0ec7d44cadad10213453c806527be6987a1a5728d6f549febd56e9e06eb5dfa611c012f863d25ec025367f65ae8"}, @ETHTOOL_A_BITSET_MASK={0x61, 0x5, "3522793c1be225a90b7f18b3129c431969396dfccc2a63ed2e15eff4b5cd8a75d7f462af7de1a87cca592110db45a1d567422ef81e2f24e1cb35c46a1e0125a5ab87888991eb415617276009eaf618dd669d09c2ac9fb24417669d6fe7"}, @ETHTOOL_A_BITSET_BITS={0x1a4, 0x3, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_NAME={0x6, 0x2, '.\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0x5, 0x2, '\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0xd, 0x2, 'mptcp_pm\x00'}]}, {0x1c, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x8}, @ETHTOOL_A_BITSET_BIT_NAME={0xd, 0x2, '(]/*,\'*#\x00'}]}, {0x5c, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x8}, @ETHTOOL_A_BITSET_BIT_NAME={0xd, 0x2, 'mptcp_pm\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x8}, @ETHTOOL_A_BITSET_BIT_NAME={0xc, 0x2, 'nl80211\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0x9, 0x2, 'TIPC\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0x6, 0x2, '%\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0x9, 0x2, 'TIPC\x00'}]}, {0x40, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0x9, 0x2, 'TIPC\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x8}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x2}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x40}]}, {0x40, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0xfffffff7}, @ETHTOOL_A_BITSET_BIT_NAME={0x5, 0x2, '\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0xb9}, @ETHTOOL_A_BITSET_BIT_NAME={0xf, 0x2, '*(,\r($\xfa})@\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0x7, 0x2, '%*\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}]}, {0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x1ff}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x4}]}, {0x34, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0xa, 0x2, '^\'}:#\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0x5, 0x2, '\x00'}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x357}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x2}]}, {0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x1}]}, {0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0xa, 0x2, 'team0\x00'}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x103}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0xd, 0x2, 'mptcp_pm\x00'}]}]}, @ETHTOOL_A_BITSET_VALUE={0x8, 0x4, "5c053132"}, @ETHTOOL_A_BITSET_NOMASK={0x4}, @ETHTOOL_A_BITSET_SIZE={0x8, 0x2, 0x8}]}, @ETHTOOL_A_EEE_ENABLED={0x5}, @ETHTOOL_A_EEE_HEADER={0x34, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}]}, @ETHTOOL_A_EEE_TX_LPI_TIMER={0x8, 0x7, 0xfffffff9}, @ETHTOOL_A_EEE_MODES_OURS={0x4c, 0x2, 0x0, 0x1, [@ETHTOOL_A_BITSET_BITS={0x34, 0x3, 0x0, 0x1, [{0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0xc}]}, {0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0xfc44}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0xea67}]}]}, @ETHTOOL_A_BITSET_NOMASK={0x4}, @ETHTOOL_A_BITSET_MASK={0xe, 0x5, "dab5abd2017e008dcec5"}]}, @ETHTOOL_A_EEE_HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r11}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_virt_wifi\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_batadv\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}, @ETHTOOL_A_EEE_MODES_OURS={0x26c, 0x2, 0x0, 0x1, [@ETHTOOL_A_BITSET_NOMASK={0x4}, @ETHTOOL_A_BITSET_NOMASK={0x4}, @ETHTOOL_A_BITSET_BITS={0x2c, 0x3, 0x0, 0x1, [{0x8, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_VALUE={0x4}]}, {0x20, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_NAME={0xd, 0x2, 'mptcp_pm\x00'}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x7}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}]}]}, @ETHTOOL_A_BITSET_BITS={0x38, 0x3, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x100}, @ETHTOOL_A_BITSET_BIT_NAME={0xa, 0x2, 'team0\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x5}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8}, @ETHTOOL_A_BITSET_BIT_NAME={0x6, 0x2, '*\x00'}]}]}, @ETHTOOL_A_BITSET_BITS={0x84, 0x3, 0x0, 0x1, [{0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0xc, 0x2, 'nl80211\x00'}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0xfffffffd}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x100}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}]}, {0x28, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x2}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x9f}, @ETHTOOL_A_BITSET_BIT_NAME={0x7, 0x2, ']*\x00'}]}, {0x28, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x2}, @ETHTOOL_A_BITSET_BIT_NAME={0x9, 0x2, 'TIPC\x00'}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0xff}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x3d4}]}]}, @ETHTOOL_A_BITSET_VALUE={0xdf, 0x4, "95d72ef594981f6dcdc4fbf82c33601d9efa46415aa24b35ccb3f2a9b85c1a00fea6fdf7cd301b5a38674c9177e25eb9543ff68c208c3d0edfb41f3bc5c85ee3e983a25786981142ab6b6433951691e8c6f67b0a1c970dd51625ae1f2e04b31ef6f18ffc8ae6a275caae17477ca6a6afc03855fe57ab5c17c511d0fdfe07524e38b0060aeab7c3cf8807c58e31311da4a9377158bbb435a14584b2d6df2ebe64a6b992974958e59a482f3339331be92b32bcdd84595dee95cb3013b54d3a41eac39a72943e5e707d7e66b056c8c11be44f2b9ce55122618c0d0287"}, @ETHTOOL_A_BITSET_MASK={0x97, 0x5, "ae972b5c6e34e13df15cbbd40911a65c7bd109d5e1b02f650d83ed8d0d696892074b87a58131f77911cdb40e142f2b127bf1e7b2d1ea53ed24310e47e01e4f56c7f3cd23013d0706cc4bd4483c41463f6a7e9a5216602bc848f30b4a7bd5209d8ccfa108bec5cad8a397174892ff843e905860e894f139a975e7346b51cd68184bd04c2d8aca6d4303e2eaa0fd8b8b7e36e915"}]}]}, 0x65c}, 0x1, 0x0, 0x0, 0x4000c}, 0x8000) ioctl$BTRFS_IOC_RESIZE(r3, 0x50009403, &(0x7f0000002340)={{r2}, {@void, @actul_num={@void, 0x8001, 0x47}}}) r12 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000002500)={&(0x7f0000002440)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x4, [@volatile={0x3}]}, {0x0, [0x0, 0x61]}}, &(0x7f0000002480)=""/80, 0x28, 0x50, 0x0, 0x4}, 0x28) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000002580)={0x9, 0x0}, 0x8) r14 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002780)={0x0, 0x7, &(0x7f00000025c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x4a23e67e, 0x0, 0x0, 0x0, 0x14}, [@exit, @exit, @call={0x85, 0x0, 0x0, 0x29}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x1}]}, &(0x7f0000002600)='syzkaller\x00', 0xf8f, 0x0, 0x0, 0x41100, 0x9, '\x00', r11, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000002640)={0x8, 0x4}, 0x8, 0x10, &(0x7f0000002680)={0x2, 0x1, 0x6, 0x9226}, 0x10, 0x0, 0x0, 0x7, &(0x7f00000026c0)=[r2], &(0x7f0000002700)=[{0x1, 0x1, 0x0, 0xc}, {0x3, 0x2, 0x2, 0x6}, {0x4, 0x2, 0x7, 0x8}, {0x5, 0x2, 0x1, 0x7}, {0x1, 0x3, 0xa, 0xc}, {0x2, 0x3, 0xc}, {0x2, 0x5, 0xd, 0xc}], 0x10, 0x32}, 0x94) r15 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000002840)={0x3, 0x4, 0x4, 0xa, 0x0, r0, 0x9, '\x00', r11, 0xffffffffffffffff, 0x2, 0x3, 0x3}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000002900)={0xb, 0x6, &(0x7f0000002380)=@raw=[@tail_call={{0x18, 0x2, 0x1, 0x0, r2}}, @jmp={0x5, 0x1, 0x6, 0x4, 0x7, 0x80, 0xffffffffffffffff}], &(0x7f00000023c0)='syzkaller\x00', 0x8, 0xd, &(0x7f0000002400)=""/13, 0x41000, 0x11, '\x00', 0x0, @fallback=0xe, r12, 0x8, 0x0, 0x0, 0x10, &(0x7f0000002540)={0x3, 0xa, 0x1, 0x7}, 0x10, r13, r14, 0x0, &(0x7f00000028c0)=[r15, r2, r0, r0, r2, r2], 0x0, 0x10, 0xfffff801}, 0x94) recvmmsg(r6, &(0x7f0000003300)=[{{0x0, 0x0, &(0x7f0000002c40)=[{&(0x7f00000029c0)=""/90, 0x5a}, {&(0x7f0000002a40)=""/54, 0x36}, {&(0x7f0000002a80)=""/43, 0x2b}, {&(0x7f0000002ac0)=""/244, 0xf4}, {&(0x7f0000002bc0)=""/116, 0x74}], 0x5, &(0x7f0000002cc0)=""/67, 0x43}, 0x8}, {{&(0x7f0000002d40)=@pptp={0x18, 0x2, {0x0, @local}}, 0x80, &(0x7f0000002f80)=[{&(0x7f0000002dc0)=""/244, 0xf4}, {&(0x7f0000002ec0)=""/163, 0xa3}], 0x2, &(0x7f0000002fc0)=""/120, 0x78}, 0x7d}, {{0x0, 0x0, &(0x7f0000003240)=[{&(0x7f0000003040)=""/153, 0x99}, {&(0x7f0000003100)=""/89, 0x59}, {&(0x7f0000003180)=""/180, 0xb4}], 0x3, &(0x7f0000003280)=""/113, 0x71}, 0xaa}], 0x3, 0xc0002140, &(0x7f00000033c0)={0x0, 0x989680}) socket$nl_rdma(0x10, 0x3, 0x14) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(0xffffffffffffffff, 0x84, 0x75, &(0x7f0000003480)={0x0, 0x8}, &(0x7f00000034c0)=0x8) 3.656598691s ago: executing program 1 (id=3904): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@remote, @in=@broadcast, 0x4e23, 0x0, 0x0, 0x0, 0x2}, {0x0, 0x0, 0x4000000000, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, {0x0, 0x0, 0x8000, 0x9}, 0x0, 0x0, 0x1}, {{@in6=@remote, 0x0, 0x32}, 0x0, @in=@private=0xa010100, 0x0, 0x0, 0x3, 0xb7, 0xc4, 0xfffffffe}}, 0xe8) socket$netlink(0x10, 0x3, 0x0) poll(&(0x7f0000000040)=[{}], 0x20000000000002d6, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000000080)={{{@in6=@mcast1, @in6=@ipv4={'\x00', '\xff\xff', @multicast2}, 0x0, 0x1, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee00}}, {{@in=@dev, 0x0, 0x32}, 0x0, @in=@remote, 0x0, 0x4}}, 0xe8) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r3, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x6}, 0x4) setsockopt$packet_fanout_data(r3, 0x107, 0x16, &(0x7f0000000100)={0x3, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff034}, {0x48}, {0x6, 0x37, 0x0, 0x9}]}, 0x10) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r5 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000280)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) writev(r4, &(0x7f0000000480)=[{&(0x7f0000000080)="2e9b5b0007e03dd65193dfb6c575963f86dd", 0x12}, {&(0x7f00000004c0)="b70000000180", 0x6}, {&(0x7f00000003c0)="06000000750d08c4daf10a7742e39e31ceefb1fcd2e5bc3fc84150da0d1787cc10d211447da94cb715e462e27318612235a604082c42", 0x36}], 0x3) r6 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r6, &(0x7f0000514ff4)={0x10, 0x0, 0x25dfdbff, 0x2ffffffff}, 0xc) r7 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r7, &(0x7f0000514ff4)={0x10, 0x0, 0x25dfdbff, 0x2ffffffff}, 0xc) bpf$BPF_PROG_TEST_RUN(0x12, &(0x7f0000000600)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x4}, 0x50) sendmsg$nl_route(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="30000000200081dc010000000300000002000000000000031f00000004001500"], 0x30}, 0x1, 0x0, 0x0, 0x81}, 0x40084) socket$nl_netfilter(0x10, 0x3, 0xc) r8 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f0000000180)={'wlan1\x00'}) sendmsg$NL80211_CMD_JOIN_MESH(r8, 0x0, 0x4040810) socket$inet6(0xa, 0x2, 0x0) r9 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), r9) getsockname$packet(r3, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0xfffffffffffffdb2) 3.656116403s ago: executing program 0 (id=3905): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0xa, &(0x7f0000000080)=@framed={{0x18, 0x8, 0x0, 0x0, 0xffd0, 0x0, 0x0, 0x0, 0xd0ff}, [@func={0x85, 0x0, 0x1, 0x0, 0x6}, @map_fd={0x18, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0xffffffd0}, @generic={0x66, 0x8, 0x0, 0x0, 0xffffffd0}, @initr0={0x18, 0x0, 0x0, 0x0, 0x600}, @exit], {0x95, 0x0, 0x0, 0x85ffffff}}, &(0x7f0000000000)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x8}, 0x94) 3.567654333s ago: executing program 4 (id=3906): bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000006080)={0x6, 0xc, &(0x7f00000001c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$inet_tcp(0x2, 0x1, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) socket$xdp(0x2c, 0x3, 0x0) (async) r1 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r1, 0x11b, 0x3, &(0x7f0000000140)=0x40, 0x4) (async) setsockopt$XDP_TX_RING(r1, 0x11b, 0x3, &(0x7f0000000140)=0x40, 0x4) r2 = socket$xdp(0x2c, 0x3, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x7, 0x4, 0x8, 0x8000}, 0x50) (async) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x7, 0x4, 0x8, 0x8000}, 0x50) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000240)={r3, &(0x7f0000000140)="f78b", 0x0}, 0x20) setsockopt$XDP_UMEM_REG(r2, 0x11b, 0x4, &(0x7f0000000340)={&(0x7f0000000000)=""/62, 0x328000, 0x800, 0x9, 0x3}, 0x20) setsockopt$XDP_UMEM_COMPLETION_RING(r2, 0x11b, 0x6, &(0x7f0000000080)=0x1, 0x4) setsockopt$XDP_RX_RING(r2, 0x11b, 0x2, &(0x7f0000001980)=0x100, 0x4) (async) setsockopt$XDP_RX_RING(r2, 0x11b, 0x2, &(0x7f0000001980)=0x100, 0x4) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000580)={'batadv_slave_1\x00', 0x0}) setsockopt$XDP_UMEM_FILL_RING(r2, 0x11b, 0x5, &(0x7f0000000300)=0x2, 0x4) bind$xdp(r2, &(0x7f0000000100)={0x2c, 0x0, r4}, 0x10) (async) bind$xdp(r2, &(0x7f0000000100)={0x2c, 0x0, r4}, 0x10) bind$xdp(r1, &(0x7f0000000240)={0x2c, 0x1, r4, 0x0, r2}, 0x10) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$packet(0x11, 0x2, 0x300) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r6, 0x8933, &(0x7f00000001c0)={'batadv_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)=@getchain={0x24, 0x11, 0x43d, 0x0, 0x25dfdbff, {0x0, 0x0, 0x0, r7, {0x3, 0xfff1}, {0x4, 0xa}, {0x0, 0xffe0}}}, 0x24}, 0x1, 0x0, 0x0, 0x4048080}, 0x0) (async) sendmsg$nl_route_sched(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)=@getchain={0x24, 0x11, 0x43d, 0x0, 0x25dfdbff, {0x0, 0x0, 0x0, r7, {0x3, 0xfff1}, {0x4, 0xa}, {0x0, 0xffe0}}}, 0x24}, 0x1, 0x0, 0x0, 0x4048080}, 0x0) 3.546128685s ago: executing program 0 (id=3907): r0 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r0, &(0x7f0000000100)={0x18, 0x0, {0x2, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xa}, 'lo\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x20001000) bpf$ENABLE_STATS(0x20, 0x0, 0x0) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x18, 0xc, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000170000001801000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000009b00000095"], 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x5e}, 0x94) (async) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0xc, &(0x7f0000000000)=ANY=[], &(0x7f0000000080)='syzkaller\x00'}, 0x27) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r1, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) (async) socket$inet_icmp_raw(0x2, 0x3, 0x1) (async) sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000a00)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000740)={&(0x7f0000000680)={0x9c, 0x0, 0x300, 0x70bd27, 0x25dfdbff, {{}, {@val={0x8, 0x1, 0x45}, @val={0x8}, @val={0xc, 0x99, {0xa77, 0xd}}}}, [@NL80211_ATTR_IFNAME={0x14, 0x4, 'macvtap0\x00'}, @mon_options=[@NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa}], @NL80211_ATTR_SOCKET_OWNER={0x4}, @NL80211_ATTR_SOCKET_OWNER={0x4}, @NL80211_ATTR_IFNAME={0x14, 0x4, 'batadv_slave_1\x00'}, @NL80211_ATTR_4ADDR={0x5, 0x53, 0x1}, @NL80211_ATTR_SOCKET_OWNER={0x4}, @mon_options=[@NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "91c0f664cd304a1db7982a706a0653f1991e250120aa85bc"}], @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x4}]}, 0x9c}, 0x1, 0x0, 0x0, 0x80}, 0x24004004) socket$inet_icmp_raw(0x2, 0x3, 0x1) (async) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000380)='memory.events\x00', 0x275a, 0x0) (async) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) pwritev(r3, &(0x7f0000000640)=[{&(0x7f0000000280)="95", 0x1}], 0x1, 0x3, 0x80000080) close(r3) socket(0x1d, 0x2, 0x6) (async, rerun: 32) sendfile(r3, r2, 0x0, 0xf03a0005) (async, rerun: 32) syz_genetlink_get_family_id$devlink(&(0x7f0000000380), r0) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x1, 0x8, &(0x7f0000000780)=ANY=[@ANYBLOB="7a0af8ff75257000bfa100000000000007010000f8ffffffb702000005000000bf130000000000008500000006000000b700000000000000950000ff00000000b25952850a84a70002b2ab3d6ffaa6ead0169191d54f8196217fc563e2fc91f6da4dad4fdc2eb1b5986fc44bc25fb591cf77b9dfb379a3f611dbc2a364916f098dab10b1a297cf528666d1ddd73f30f2382f6cda4bfdd45be583823c0f092248a57d48621f3c1c65ee19ee875daf45006a4c4ea5e15b2f9618d547244a22000000000800db583620ce7243d1aebdb638d91dbef6619358399aa9c2acd068c03efefd8bc77edf2d34b12cd48a1b20fb7dd843267e0331759f4ec6b5b0af58e604f494eff289026d5045ef08000000000000007718a09f4886afc26abba34635d0e8b598a51bc742135a6e1d33fe226c944bc76be40d435aa8b5202db761014b1b999a12df6bee431a6681000000263b6233e1c0fe30e384c3cb07b74a72291a1a2b523dd81b6651b1ee48e999bb004823ebcd8c65743f31f84b263ab9b3426692d01ad194f302d7a658e9e54687d3c56d7bedb6b2f25ddb8c640bb321a402058c9221b6870814cf4ee23ddb79fff5eb156e0a000000000000f2bd1d4a178d86d6935eb8b75bc4eb680d10e8b6a54c6c8674caf63ff76622939a20d4aadf85db40179c2cf83ee07e30a279d8f9f3bc282deb43a03409f8e6972f3f720d045923702cede0f3e91411f3f1b16f065624f280a7dcce8db910f93c49b9e0b6dd7356aa79d5fabb5c0d0da6d719d7e0efb2bb713d18242cd5df6ca53307a4cdd91be4587f90e317c8de5e5c3933fd5d5bf38f6b9fc39fc829dcfe4af8ac5fbb7314a7a433e0182767d1786eda2b20"], &(0x7f0000000100)='GPL\x00'}, 0x48) (async) r5 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="840100001900010000000000000000001d0109005000128049002100c9a7befe6f6d645a1a11b81b2c4b101c7510e19feecb90ee6bb49f6cc7a2c50fd57c06db1a75df432aa833928a0772ff8f5e9ed32d3b477d35b296674f1fe35663c0d236fd00000020010680d353"], 0x184}, 0x1, 0x0, 0x0, 0x5}, 0x0) (async) r6 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000001d40)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000280)={{r6, 0xffffffffffffffff}, &(0x7f0000000200), &(0x7f0000000380)=r4}, 0x20) (async) r8 = socket$inet_smc(0x2b, 0x1, 0x0) accept4$inet(r8, 0x0, &(0x7f0000000180), 0x0) (async) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000640)={0xffffffffffffffff, 0x20, &(0x7f0000000600)={&(0x7f0000000440)=""/238, 0xee, 0x0, &(0x7f0000000540)=""/133, 0x85}}, 0x10) (async) r10 = bpf$PROG_LOAD(0x5, &(0x7f0000000900)={0x4, 0x21, &(0x7f0000001100)=ANY=[@ANYBLOB="1800000000010000000000000400000018110000", @ANYRES32, @ANYBLOB="00000000000000000100010014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000085100000080000001f84fcff04000000950000000000000018110000", @ANYRES32=0x1, @ANYBLOB="0000000000000000b7080000080000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000010000008500000082000000850000000200000018120000", @ANYRES32=0x1, @ANYBLOB="0000000000000000b703000000000000850000000c000000b700000000000000bf91000000000000b7020000000000008500000084000000b7000000000000009500000000000000"], &(0x7f00000007c0)='GPL\x00', 0x7ff, 0x0, 0x0, 0x41000, 0x1, '\x00', 0x0, @fallback=0x11, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000840)={0x1, 0xc, 0x1, 0xfffffff5}, 0x10, 0xffffffffffffffff, 0xffffffffffffffff, 0x2, &(0x7f0000000880)=[0xffffffffffffffff, 0x1], &(0x7f00000008c0)=[{0x1, 0x4, 0x0, 0xb}, {0x0, 0x2, 0xe, 0xa62296b9d1e0688e}], 0x10, 0x10001}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000140)=ANY=[@ANYBLOB="180000000300000000000000feffff10850000000700000095"], 0x0, 0x80000, 0x0, 0x0, 0x100, 0x74, '\x00', 0x0, @fallback=0x26, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r9, r10, 0x0, 0x0, 0x0, 0x0, 0x10000}, 0x94) (async) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0xc, 0xc, &(0x7f0000000080)=ANY=[@ANYBLOB="380000000008000000000000808d00008500000018000000180100002020732500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008b00000b70300000900000085000000060000009500000000000000"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xb, '\x00', 0x0, @fallback=0x37, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r9, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async, rerun: 32) r11 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1a, 0x5, &(0x7f0000000ec0)=ANY=[@ANYRES8=0x0], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x22, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, r9}, 0x94) (rerun: 32) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000340)={{r7}, &(0x7f00000002c0), &(0x7f0000000300)=r11}, 0x20) 3.374515597s ago: executing program 2 (id=3909): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) setsockopt$inet6_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000300)={@in6={{0xa, 0x4e24, 0x2, @ipv4={'\x00', '\xff\xff', @multicast1}, 0xcac2d78a}}, 0x0, 0x0, 0x43, 0x0, "eead00000000000000f46d7fb980e989db9e8bf9b93129488f651a8de213eb94cd46e19d9c65a018444a131f4da55a02ddbe2665dca1add0a80939a8ebf07cb417308a3d40aa1c788df600"}, 0xd8) setsockopt$sock_int(r0, 0x1, 0x7, &(0x7f0000000400)=0x3, 0x4) connect$inet6(r0, &(0x7f0000000540)={0xa, 0x0, 0x1, @ipv4={'\x00', '\xff\xff', @local}, 0x100}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000040)=0x2, 0x4) setsockopt$inet6_IPV6_ADDRFORM(r0, 0x29, 0x1, 0x0, 0x0) listen(0xffffffffffffffff, 0x8) sendmsg$inet_sctp(0xffffffffffffffff, &(0x7f0000001640)={0x0, 0x0, &(0x7f0000000280), 0x0, &(0x7f00000007c0)=ANY=[], 0x18}, 0x280400d5) r1 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(r1) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000300)='ns/net\x00') r2 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000640)=@bpf_lsm={0x1e, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB="188000000000000d000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000005c0)={r2, 0x0, 0x24, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xa) r3 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r3, &(0x7f0000000080)=[{&(0x7f0000000200)="a10100001400add427323b470c45b45602067fffffff81004e22000d00ff0028925aa80020007b00090080000efffeffe809000000ff0000f03ac7100003ffffffffffffffffffffffe7ee00000000000000000200000000", 0x1a1}], 0x1) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x16, 0x0, 0x0, 0x0, 0x2, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @flow_dissector}, 0x94) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) r4 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r4, 0x107, 0xa, &(0x7f0000000080)=0x400002, 0x4) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_NEW_SEC_DEV(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x811}, 0x20040084) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/pid\x00') unshare(0x6a040000) r5 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r5, 0x11, 0xa, &(0x7f0000000040)=0x8, 0x4) epoll_create1(0x80000) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="580000001000030429bd70003d00000000000000", @ANYRES32=0x0, @ANYBLOB="a5fdad8800000000380012800b00010067656e657665000028000280140007000000000000000000000000000000000108000b4000010001060001004e200000"], 0x58}, 0x1, 0x0, 0x0, 0x4004}, 0x4804) 3.374028209s ago: executing program 0 (id=3910): socket$packet(0x11, 0x2, 0x300) bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)) epoll_create1(0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$xdp(0x2c, 0x3, 0x0) sendmsg$ETHTOOL_MSG_LINKMODES_GET(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)={0x14, 0x0, 0x321, 0x70bd25, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x80}, 0x404c010) r0 = socket$nl_route(0x10, 0x3, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff}) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x3, &(0x7f0000000000)=@framed, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x20, r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = socket(0x1, 0x803, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000b80)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x101, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x54, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x8}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x8}, @NFTA_SET_DATA_LEN={0x8, 0x7, 0x1, 0x0, 0x29}, @NFTA_SET_DATA_TYPE={0x8}]}, @NFT_MSG_NEWSETELEM={0x48, 0xc, 0xa, 0x101, 0x0, 0x0, {0x7, 0x0, 0x4004}, [@NFTA_SET_ELEM_LIST_ELEMENTS={0x1c, 0x3, 0x0, 0x1, [{0x18, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_DATA={0xc, 0x2, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, "d0f9"}]}]}]}, @NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0xe4}, 0x1, 0x0, 0x0, 0x8000}, 0x0) socket$xdp(0x2c, 0x3, 0x0) getsockname$packet(r2, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) socket(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=@newtfilter={0x34, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x74, r4, {}, {0xf, 0x1}, {0xa, 0x1}}, [@filter_kind_options=@f_route={{0xa}, {0x4}}]}, 0x34}, 0x1, 0xf0ffffffffffff, 0x0, 0x60001d0}, 0xc8c4) 3.302111286s ago: executing program 1 (id=3911): r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000500)=ANY=[@ANYBLOB="3c0000001000010800"/20, @ANYRES32=r2, @ANYBLOB="312000000000000014002b8008000100", @ANYRES32, @ANYBLOB="08000300030004"], 0x3c}, 0x1, 0x0, 0x0, 0x80}, 0x48000) r3 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r1) r4 = socket$inet(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r4, 0x0, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x8, 0x3, 0x290, 0x0, 0xb, 0xd0e0011, 0x120, 0xc6, 0x1f8, 0x1d8, 0x190, 0x1f8, 0x1d8, 0x3, 0x0, {[{{@ip={@rand_addr, @broadcast, 0x0, 0x0, 'nr0\x00', '\x00', {}, {}, 0x1}, 0x0, 0xd8, 0x120, 0x7000000, {}, [@common=@icmp={{0x28}, {0xd, "0010"}}, @common=@unspec=@connlimit={{0x40}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x33f}}}, {{@ip={@remote, @multicast1, 0x0, 0x0, 'bridge_slave_1\x00', 'virt_wifi0\x00'}, 0x0, 0x70, 0xd8}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x9, 0x0, 0x0, 0x20000, 'syz1\x00', 'syz1\x00'}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x2f0) syz_genetlink_get_family_id$nl802154(&(0x7f0000000280), r1) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r3, @ANYBLOB="010026bd7000fcdbdf250200000008000100", @ANYRES32=r5], 0x1c}}, 0x840) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0xe, &(0x7f0000000880)=ANY=[@ANYBLOB="b702000000000000bfa300000000000007030000f0ffffff7a0af0ff0200000079a4f0ff00000000b706000000000081ad64020000000000450404000100ff0f1704000001130a00b7050000010000006a0af2fe000000008500000044000000b700000000000000950000000000000000e154cd8445974b26c933f7ffffffffe4fbffffff55bb2007ee51050512b5b42128aa090a79507df79f298129daa7a6b2f91af50342115e17392ac627c87881c000006146001e04aeacea799a22a2fa798b5adc43eb27d53319d0ad229e5752548300000000dbc2777df150b7cdd77b85b941092314fd085f028f2ed1a4535550614e09d6378198a6097a670838337af2abd55a87ac0394b2f92ffab7d153d62058d0a413b2173619ccf55520f22c9ca8b6712f3024b7041b1df65b3e1b9bf115646d14ce53d13d0ccacda1ef0900094fa737c28b99938512c816fdcceaede3faedc51d29a47fc813a2ec00f4c7a53ac271d6d7f4ea6bf97f2f33e2ea2e534300bcb3fdc4b4861004eefbda7f54f82a804da4f85db47a4a69bf9bc5fa96ee293fbd165a5a68488e40b030166565a097b1b44b451de736bb6d43db8db03d4b7745fef1d04ec633dee254a6d491b849a5a787e814c4fd21a18986252a70f8f92eb6f0e8c7db4bf23242a1f2c28159f09943b1b0452d1b72183aacf4a84f9130b775dd4e9e3070756f97ad791fa99dac06b57479321a0574fb30ff0000001989328c8ddc20ea011bf5742e0e0d4334db8b20ce3f9f16cb7fc20fb4791ec85823d0c48fb657c29b309c73f0977e7cde65a82b94c461d7962b0d2277a84af326f37f3e2c25a61ec45c3af97a8f17da954aff3fc8c108755f75ca13fb7c8bbd8b6e7dac1aba4b20dc7de058a4dfa7e85a8bdf1d41a2d8bda74d66f47cc180f82c5f573c6d294d3665016ac59dda0fde4745db06753a7ac74a2d32f7528751313694bf5700b20ef0c248ddd3da32396a614cacad4aff2066bb5d4045c958559b7dcb98a6273b8c651e24d9f679e4fbe948dfb4cc4a389469608241730459f0123fd39206000000000000eb55dad46de56ef907b059b90b8aa49afb9a79ae5498f6589880ed6eea7f9c670012be05e7de0940313c5870786554df26236ebced9390cb6941b8375d936a7d2120eca291963eb2d537d8ee4de5c183c960119451c31539b22809e1d7f0cda06a9fa87d64cb77872a2cd8a104e16bb1a2ba9c29faa38c409d32b6b7d6cf13464ca03aff14a9aa4bd9539f5096412b92012e095b84c20243ff98df3347f0e399d1b9f27e3c33269c0e153b28b2d4410572bc45b9d3fa02208d304d455c36300000000022320178b00cc6ed7966130b547dbf8b497af002000000cd1d00000020000000ef19349ee7f31abc11c800000000000000000000000928ee53595a779d243a48cea769470424d28804c04b2c4324ab7f4a5c81921f0128dfd70b438af60b060000000000000056642b49b745f3bf2cf7908b6d7d748308eea09fc361b4735efbf3411718d6ee7aebf9ef679dbfae9fb4a79f8a836804ed3a1079b0282a12043408cd60b687dcff91af19010000000000000000456f7d2a42bd13da202274f20675eb781925441578e93046aaddea8ec4ca37f71c2710a7ea8ae0dc214e1cc275b26adfa892e6de92000000000000000000ddff004cff9ec7ffff35e62f4eeee50e5bafecea4d4134f9d006c8d6883eca5c9c58c9e933119c5009c68c73de2f04f15d005387577f480000ea65559eb00e76e9d0ada201bcbb5c252b28a60ca770663da451790cc36000906d5a9fad98c308e39bd5ffb6151d79c1cee1cd102e3c8e63e9fba05e3633be3f00000015762e5f5a3a0bc33fdbe28a5ffc83f2b485185cc92fe7f791e8f6429309d6adab4b7e508e5bf024ed8f8a005f2bbf96c89739f5cf1e750d50517a59a3ad09e8802e8f4f535447cc0fc9d5f99a73145dfcedad69da9cd4375c624600e78f4458542b14f29611f95d4a31838eeb20c20bb82aa31771cd379ec83554cea5e6539db7384e1f58d81f2f2653c4d9818708e27c89b552d7fcd116bce9c764c714c9402c21d181aac59efb28d4f91652f6750b6ec962802c0320f8059195729d60c534ee8e8ff0755b67fe4c25edb85bcff24c757aa8090000000000008c420eb4304f66e3a37aaf000000c42a570f0e9dd5fd545470f862f8c3c14fa9ecd1e877b0d8ca84c044859e85e6158f9184bc61a9a284db80e4636c25b96174327d82761c26e329555f9290af4100000000000000749efd3763655500344bae34137f5ab0d534b8d63e4ca3b671f2de1cdf519192c6b59a601fd419adc16e2055b85058f793484305d7a1759782e4c571ee855a47bc00edf5e9020c09ab004321610b857e8717764b633b21cb32f0e03280e09758bd445ab91d20baca005452b79d7b574a247fa62fe45b3c4e93da3d51de647c10dd49944dc87c92332af00f191b66b6a6f732a91f0e2e9120bed64069dcf82d3e5e0361e58c79d497247d278888901d442ad7f8536605a644e9e3d769db497c3960dfde12182334caee994adc38a436367a54b9e182b78e9a0ceb9a2c4f63902c1ad1a7c5a08d0920a23c2a86abbdf357849a651733e57f31019876026888c8ccb85c86b4f8ffffff7f000000002c331fca0e541b7ca211c28ed61c525708a13d115b43f8b1894c8fa8a1000000002100000000000000000001000027c9a46157a3609b6fd9843ee19ec647249a9375de5858818f3c4a4fa6ce46f4d42b07199de8b99231ace58c77819ee214e49666c464d35ca9b5143ed3b3dc8c17a23692759ccf5a205311b7ab22532697b861dfb54609fd88e6043bd52ae84c1bb0c8a6c769f952283a1f4e3842edb3d42c68a27ef6a1296dfff4a979369b0e8ebc62887aa46e824d86869ec4ab392b0a74f91381dcc198e353047db70686d147357024eb3cb94f1e89cb5ba0a56aa046b4dc521a3d9356b4b8b5917c4c860495b240e80063bde261fd00000000007271e28ef6806bc8e139c49b91c76bea3858f78fbd8d31330d89069f9648a2ff93060ff073b3a113e47edf76f7d116d2b0976cf2ec447c030931651dd315003b7a6a5433a2bb3c035fc6846abe389b25c988f0bbb889560ae99ec4b227eda2e63a1c31a2c2bd48a822cbe92b6524e0cd8020ecaa34e19e7141d5e221509342bfe7d294d1eb3de6a50ca0301f89c2ee627e949c68b3a4a412a9b7d503a26e9a714ee5f72d8805dd1bfbd081f6a5d1f1289dfe14cb9194e26a44fac273461fc5c0e0a33db7f2d43ea8086cf059f40fa2640b6bfb74dd35f5a31059c01517cf4b6641fce9a24b96767b837ca037a1199735c375c705c798e0e208e4a5259d0bfa526b462af45a6eab34000000000000000000000000c4426344ec1a3366515dee221e747f55d7dd02534bc503b9b28277c253e410986bef2111a99cc448d652929f8a67a6a1d3f00dcad91aff428aade3f85714a1d3ef29acd4d49b62339c10c2ec0daca8d4c1090000000000000084d8223edbccbf9258b7374e79a1f8bf3fb73c8c6dbb7bbdfc399847a11921f97eba0ea14c4fed9a71eedb97c02461792e3a49dac16c60c3fcaab222025d78963c3ac899fa8b63f58a30212c9b2d7fe751e2046b78f86e22861b6504c667350244dd6d9189a8b9c45f8aaff9db694811ca86ed978f23eed7459c0382074170cf1e25b0e9ba3d1cc309353eea4cd8ab96bafda393276bdd8d32ead8db9e1b54d2d3d50e2815268fc1a6ec566981bc8ca2a4583f3d40e817433d0f4f25cfe6cc1897449ba5f26a9d66ac73e6f5c401376f23a314e0b9ff997d22f3e34b7524642c248aa813edaa626f0000000000000000004f9e02a3b51a97c4b1c1b411cc6bee2a56f29c55a6aac46a0cfc318fae02922a403431d4e5a4396cad2c8dd34037bc041a2ba1505ba2c4889122ca04e85881aad5f8bfc12e6741872aad21bf5301cd4c607ef50a991c410f7c60e45b5c193f813a36d841165b91b5e170f6ba24558df57145eb8142a6ed87c6d5cbae3e52d569996604669a6e9ca1a3689c795970b4bcd00881faff52a6766fafa07ed7d4a49f47d34fd76a394adcb33a270b6a14e74bca7c2ea92dd845d3f774fde1bbea911c1ea76d52f7912e2597e6a33380647ed44956730b5b84662b8e659124379c0d86b1d28fdfa3cd2013103e3048c4ad4f5a4dcd133b2fc8fae3b51e4433cee7c08e67c7d7ed4432045e10f8718e5c163b1704fa2c707b61a1a9f63edfceff1a0cd7baf4a15b2fd607a09d398d73243bdcc664fbd5f582e48af2a18b02f0184a7bdd95ac78241e6749e74b152702333c56588375f806f10578eaae329c4f8dfb83e5524e2c9aa59ce7828bd1f146b2a4150fb2a8ced08e2ffac81e921e8a6f0071361a0acdbd125fb5f5e9ffe98e38508582a496afd30ca460dbfca77915a18b7b9ef6c1d6e13bc12fe43063cfecfafb05bf2339ad61533fbf3e410b403182742fa2d40c402cb83c2fef46a36f17c1abf97b0e2d114bd1472ab4207aa060f9e5d91c4a4911b1a1df47b858be141ab3386f26f561df35678489dc1b9f10eee1b2ab3dfdaedd7e06ff8a127f1743fcb32d7f80d40aebc1ea72edc348f5f9ba4bace97db948c24c679c74cd4336a7233d836082bb0e8b013bd1ee3612cd43cd2a3cb83754bb3408"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xc, 0xffffffffffffffff, 0x8, &(0x7f00000001c0)={0x8, 0x1000000}, 0xfffffedf, 0x10, &(0x7f0000000040), 0xeafcf7e0, 0x0, 0xffffffffffffffff, 0xd}, 0x48) write$nci(r0, &(0x7f00000009c0)=ANY=[@ANYBLOB="710509400205000a04e1078b6b93fec2a515"], 0x14f) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) sendmsg$RDMA_NLDEV_CMD_STAT_GET(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="10006d383e32a500"/22], 0x10}, 0x1, 0x0, 0x0, 0x20000414}, 0x2404c190) r6 = socket(0x2, 0x80805, 0x0) sendmmsg$inet(r6, &(0x7f0000000480)=[{{&(0x7f0000000000)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000200)="b1", 0x1}], 0x1}}], 0x1, 0x24040800) r7 = socket$inet_sctp(0x2, 0x4, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r7, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r6, 0x84, 0x22, &(0x7f0000000580)={0x2, 0x201, 0xca25, 0x5, r8}, 0x10) setsockopt$ALG_SET_KEY(r6, 0x117, 0x1, &(0x7f0000000300)="9bb3383014c2f8b02d1bb8ae239cbfccd2c21d5b6a59f6a69a46feaad95702af8f34c3541d892300afdcb7defe38b51407f6e970888fc608ff2fe75e4a0355e482998fe1913c27e02e88affc1997b108c22939f981ac9d4d47149a6379ceeef55f3cdd6f05d1d7feb8874d1c6bc2011a03feb766134cb8068c05e7cb8449813c9d0c3b842ba689dd4aa4cb01247761b556d1fdb9c183287705b7f1349a9269aa75dde3", 0xa3) 2.838539474s ago: executing program 4 (id=3912): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001a000100000000000700ebff80"], 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'veth0_to_bridge\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000a40)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000a00)={&(0x7f0000000980)=@ipv6_getaddr={0x78, 0x16, 0x200, 0x70bd2a, 0x25dfdbfd, {0xa, 0x40, 0x0, 0xff, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x1ff, 0x3, 0x10000, 0xeca4}}, @IFA_RT_PRIORITY={0x8}, @IFA_LOCAL={0x14, 0x2, @local}, @IFA_LOCAL={0x14, 0x2, @loopback}, @IFA_ADDRESS={0x14, 0x1, @dev={0xfe, 0x80, '\x00', 0x40}}, @IFA_RT_PRIORITY={0x8}]}, 0x78}, 0x1, 0x0, 0x0, 0x4001}, 0x4040000) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) ppoll(&(0x7f0000000040)=[{r3, 0xe264}], 0x1, 0x0, &(0x7f0000000100)={[0x8000000000000001]}, 0x8) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0xd, 0x4, &(0x7f0000001300)=@framed={{}, [@ldst={0x1, 0x3, 0x3, 0x2, 0x1, 0xa8}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xe}, 0x90) socket$nl_rdma(0x10, 0x3, 0x14) r4 = bpf$OBJ_GET_PROG(0x7, &(0x7f0000000280)=@o_path={&(0x7f0000000180)='./file0\x00', 0x0, 0x6008, r0}, 0x18) bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0xf, 0x10, &(0x7f0000000380)=ANY=[@ANYRESDEC=r4, @ANYRES32=r0, @ANYBLOB="0000000000000000b70500000800489685000000ff0f0000953861359ee761f5cf02c01824352a429f06436851886a745bc06b0b5b0fe2136bae332517908a1012b56f81a88d417e1157a3c54e446220e25075809e225b673941a2f0a027d973a830b608b3cb575492af69094a63d2ce096ba7745715606462900ac4935947c5fc84c5c0b20e8a22546381f2e41c79b71f2f6476d1d50fe6ca6835f417fa3ceb8d132549f12cb88ff2ce9466f133a03200fca6ed8862dbcab4941406bb77e558bb1cec8ed959ff15e105f7e1736298440b95e13d15cbc5f31bd30f720e83456769e2f35e78676fe36d6fc2c7666050cf11064dd8792c7e06344c53ffd9dd3f379a301b5606f95c50d7d520"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x11, '\x00', 0x0, @fallback=0x1c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r4, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11000000040000000400000002"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xd, &(0x7f0000000180)=@framed={{}, [@call={0x85, 0x0, 0x0, 0x7d}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {}, {}, {0x4}, {0x6, 0x0, 0xa}, {}, {}, {0x85, 0x0, 0x0, 0x33}}]}, &(0x7f00000004c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000080)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x24, 0x24, 0x2, [@struct={0x0, 0x1, 0x0, 0x4, 0x1, 0xffffffff, [{0x0, 0x2}]}, @ptr={0x0, 0x0, 0x0, 0x9, 0x1}]}}, 0x0, 0x3e}, 0x28) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000600)={'ip6_vti0\x00', &(0x7f0000000580)={'ip6tnl0\x00', 0x0, 0x2f, 0x9, 0x2, 0x800, 0x54, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x1, 0x80, 0x5, 0x101}}) r7 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000007c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="9feb010018000000000000001c0100001c0100000c0000001000000009000084b50400000400000004000000050000000a00000002000000080000000100000005000000060000000a000000020000000200000001000000010000000bfd00000100000001000000000800000000000000000000070000000b00000003000000feffffff0c00000004000000070000000700000008000093040000001000000023cb000035030000010000000d0000003a66000004000000820900000f000000030000000e000000060000000300000002000000000100000a000000000000005200000001000000c1860000987600000d00000000000000040000000d000000040000060400000002005d49869f00000e0000000100010002000000020000000f00000004000000050000000000000801000000000000612e305f005f003000"], &(0x7f0000000780)=""/53, 0x140, 0x35, 0x0, 0x4}, 0x28) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000008c0)={0x18, 0x14, &(0x7f0000000080)=ANY=[@ANYBLOB="00000200003d718b7500", @ANYRES32=r5, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018000000e77b000000000000010000005015fefffcffffff185600000a0000000000000000000000bf91000000000000b7020000020000008500000085000000b7000000000000009500000000000000"], &(0x7f0000000140)='syzkaller\x00', 0x8, 0xa7, &(0x7f00000004c0)=""/167, 0x41100, 0x40, '\x00', r6, 0x0, r7, 0x8, &(0x7f0000000800)={0x8, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000840)=[r0, r0], &(0x7f0000000880)=[{0x0, 0x0, 0x6, 0x6}, {0x0, 0x1, 0x9, 0x8}, {0x3, 0x2, 0xc}, {0x1, 0x5, 0xc, 0x6}], 0x10, 0xb}, 0x94) 2.802129288s ago: executing program 4 (id=3913): r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCSIFVLAN_SET_VLAN_INGRESS_PRIORITY_CMD(r0, 0x8983, &(0x7f0000000140)={0x2, 'tunl0\x00', {0x8}, 0x4}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) r1 = socket$inet6(0xa, 0x400000000001, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000880)=@raw={'raw\x00', 0x3c1, 0x3, 0x5f8, 0x3c0, 0xffffff80, 0x178, 0x0, 0x178, 0x528, 0x22b, 0x258, 0x528, 0x258, 0x2034, 0x0, {[{{@uncond, 0x1d, 0x398, 0x3c0, 0x340, {0x1e0002a8, 0x7203000000000000}, [@common=@unspec=@bpf1={{0x230}, @bytecode={0x0, 0x1a, 0x64, [{}, {0x0, 0x0, 0x1}, {}, {}, {}, {}, {0x0, 0x0, 0xfd}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {}, {}, {}, {}, {}, {}, {0x6}, {}, {0x9}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x80000000}, {0x870}, {}, {}, {}, {0x2, 0xfe}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x1}, {}, {0x8, 0x0, 0x0, 0xfffffffc}, {}, {0x0, 0xfc}, {}, {}, {0x3}, {}, {0x0, 0x0, 0x0, 0x10}, {}, {}, {0x0, 0x0, 0x0, 0xffffffff}, {}, {0x0, 0x8a}]}}, @common=@unspec=@string={{0xc0}, {0x0, 0x0, 'kmp\x00', "e22e50439abb066265e088a63e13552b8b2fec412753ac647d17d2ebca69d17a9722bd2f5be411676d5993fb4cc74168209fb9f43b63bab2a88206d7dd8158d916b865d0f713f772c59ad6e6b572e9a6c498fb6459888a281e8c071a9a7229f9fe02cb8e9ba7637a2591a5367c770c87034734be6eda195ce135517efa85da52", 0x59}}]}, @common=@unspec=@CLASSIFY={0x28, 'CLASSIFY\x00', 0x0, {0x9}}}, {{@uncond, 0x0, 0x100, 0x168, 0x0, {}, [@common=@ah={{0x30}}, @inet=@rpfilter={{0x28}, {0x4}}]}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x8, 0x0, 0x0, 0x0, '\x00', 'syz0\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x67a) syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/pid_for_children\x00') unshare(0x6a040000) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$gtp(&(0x7f0000000000), r2) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_SET(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x28, 0x3, 0x8, 0x201, 0x0, 0x0, {0x0, 0x0, 0x9}, [@CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x6}, @CTA_TIMEOUT_DATA={0xc, 0x4, 0x0, 0x1, @tcp=[@CTA_TIMEOUT_TCP_SYN_SENT2={0x8, 0x9, 0x1, 0x0, 0x4914}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x48010}, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) getsockname$packet(0xffffffffffffffff, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=@newlink={0x2c, 0x10, 0x437, 0x800000, 0x0, {0x0, 0x0, 0x0, r5, 0x504c3}, [@IFLA_ADDRESS={0xa, 0x1, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x19}}]}, 0x2c}, 0x1, 0x0, 0x0, 0x2000c014}, 0x0) sendmsg$GTP_CMD_DELPDP(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000080)={0x24, r3, 0x1, 0x70bd28, 0xe, {}, [@GTPA_LINK={0x8, 0x1, r5}, @GTPA_VERSION={0x8, 0x2, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x44800}, 0x20000000) socket$inet_icmp_raw(0x2, 0x3, 0x1) (async) ioctl$sock_SIOCSIFVLAN_SET_VLAN_INGRESS_PRIORITY_CMD(r0, 0x8983, &(0x7f0000000140)={0x2, 'tunl0\x00', {0x8}, 0x4}) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) (async) close(0x4) (async) socket$inet6(0xa, 0x400000000001, 0x0) (async) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000880)=@raw={'raw\x00', 0x3c1, 0x3, 0x5f8, 0x3c0, 0xffffff80, 0x178, 0x0, 0x178, 0x528, 0x22b, 0x258, 0x528, 0x258, 0x2034, 0x0, {[{{@uncond, 0x1d, 0x398, 0x3c0, 0x340, {0x1e0002a8, 0x7203000000000000}, [@common=@unspec=@bpf1={{0x230}, @bytecode={0x0, 0x1a, 0x64, [{}, {0x0, 0x0, 0x1}, {}, {}, {}, {}, {0x0, 0x0, 0xfd}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {}, {}, {}, {}, {}, {}, {0x6}, {}, {0x9}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x80000000}, {0x870}, {}, {}, {}, {0x2, 0xfe}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x1}, {}, {0x8, 0x0, 0x0, 0xfffffffc}, {}, {0x0, 0xfc}, {}, {}, {0x3}, {}, {0x0, 0x0, 0x0, 0x10}, {}, {}, {0x0, 0x0, 0x0, 0xffffffff}, {}, {0x0, 0x8a}]}}, @common=@unspec=@string={{0xc0}, {0x0, 0x0, 'kmp\x00', "e22e50439abb066265e088a63e13552b8b2fec412753ac647d17d2ebca69d17a9722bd2f5be411676d5993fb4cc74168209fb9f43b63bab2a88206d7dd8158d916b865d0f713f772c59ad6e6b572e9a6c498fb6459888a281e8c071a9a7229f9fe02cb8e9ba7637a2591a5367c770c87034734be6eda195ce135517efa85da52", 0x59}}]}, @common=@unspec=@CLASSIFY={0x28, 'CLASSIFY\x00', 0x0, {0x9}}}, {{@uncond, 0x0, 0x100, 0x168, 0x0, {}, [@common=@ah={{0x30}}, @inet=@rpfilter={{0x28}, {0x4}}]}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x8, 0x0, 0x0, 0x0, '\x00', 'syz0\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x67a) (async) syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/pid_for_children\x00') (async) unshare(0x6a040000) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$gtp(&(0x7f0000000000), r2) (async) socket$nl_netfilter(0x10, 0x3, 0xc) (async) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_SET(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x28, 0x3, 0x8, 0x201, 0x0, 0x0, {0x0, 0x0, 0x9}, [@CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x6}, @CTA_TIMEOUT_DATA={0xc, 0x4, 0x0, 0x1, @tcp=[@CTA_TIMEOUT_TCP_SYN_SENT2={0x8, 0x9, 0x1, 0x0, 0x4914}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x48010}, 0x0) (async) syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) (async) getsockname$packet(0xffffffffffffffff, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) (async) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=@newlink={0x2c, 0x10, 0x437, 0x800000, 0x0, {0x0, 0x0, 0x0, r5, 0x504c3}, [@IFLA_ADDRESS={0xa, 0x1, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x19}}]}, 0x2c}, 0x1, 0x0, 0x0, 0x2000c014}, 0x0) (async) sendmsg$GTP_CMD_DELPDP(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000080)={0x24, r3, 0x1, 0x70bd28, 0xe, {}, [@GTPA_LINK={0x8, 0x1, r5}, @GTPA_VERSION={0x8, 0x2, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x44800}, 0x20000000) (async) 994.317988ms ago: executing program 0 (id=3914): r0 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) connect$802154_dgram(r0, &(0x7f0000000200)={0x2, @none={0x0, 0xffff}}, 0x14) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f00000008c0), r1) (async) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x10, 0x4, &(0x7f0000000380)=ANY=[@ANYBLOB="18020000000000000000000000000000850000003d00000095"], &(0x7f00000000c0)='GPL\x00', 0x1}, 0x94) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000023c0)=@base={0x12, 0x4, 0x8, 0xb}, 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f00000001c0)={@map=r4, r3, 0x7}, 0x10) close(r4) sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000003c0)=ANY=[@ANYBLOB="929d3f38", @ANYRES16=0x0, @ANYBLOB="00012cbd7000fedbdf250100000004000300b40002800c000180080001000500000014000180080001000500000008000100040000001c0001800800010002000000080001000700000008000100050000002c00018008000100050000000800010006000000080001000000000008000100070000000800010002000000340001800800010002000000080001000100000008000100070000000800010008000000080001000100000008000100020000001400018008000100030000000800010001000000980002801c0001800800010008000000080001000500000008000100020000003c00018008000100040000000800010006000000080001000700000008000100070000000800010004000000080001000500000008000100060000003c0001800800010007000000080001000300000008000100020000000800010002000000080001000700000008000100010000000800010002000000ec0002805400018008000100010000000800010004000000080001000000000008000100080000000800010004000000080001000700000008000100050000000800010005000000080001000200000008000100030000000c00018008000100040000001c000180080001000a000000080001000100000008000100040000000c00018008000100070000003c0001800800010006000000080001000200000008000100010000000800010002000000080001000400000008000100010000000800010005000000240001800800010001000000080001000500000008000100060000000800010004000000"], 0x250}, 0x1, 0x0, 0x0, 0x24000085}, 0x20000001) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$NL80211_CMD_SET_CQM(r1, &(0x7f0000000f80)={0x0, 0x0, &(0x7f0000000f40)={&(0x7f00000005c0)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010069bd7000fedbdf253f00000008000300", @ANYRES32=r3, @ANYBLOB="3c005e80080009000800001008000600c7f20000080005004d0000000800050022000000080007"], 0x58}, 0x1, 0x0, 0x0, 0x80c0}, 0x4) 874.25565ms ago: executing program 3 (id=3916): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x6, 0x10, &(0x7f0000000880)=ANY=[@ANYBLOB="18000201000100000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r0, @ANYBLOB="0000000000000000b705000008000000850000008500000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp=0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 818.541577ms ago: executing program 3 (id=3917): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0xa, &(0x7f0000000080)=@framed={{0x18, 0x8, 0x0, 0x0, 0xffd0, 0x0, 0x0, 0x0, 0xd0ff}, [@func={0x85, 0x0, 0x1, 0x0, 0x6}, @map_fd={0x18, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0xffffffd0}, @generic={0x66, 0x8, 0x0, 0x0, 0xffffffd0}, @initr0={0x18, 0x0, 0x0, 0x0, 0x600}, @exit], {0x95, 0x0, 0x0, 0xa2ffffff}}, &(0x7f0000000000)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x8}, 0x94) 719.821554ms ago: executing program 3 (id=3918): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x5, &(0x7f0000000900)=ANY=[@ANYBLOB="18020000faffffff0000000000003e7c8500000005000000850000002a00000095"], &(0x7f0000000200)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000000c0)={r2, 0x27, 0xe, 0x0, &(0x7f0000000700)="f9ad0000d238928a43cba9fc99d41a08320a9c99568ec20d2038cce05bf42abdf78093954ff37b7c9edbfdd361a9be17f939ba891a1a2d10c22488df3c7bcf0042ca57bffacc5f7d4f1bf95f3eb9b17188d729db8851cb8c2404039ecc43cd296fe5690d29df88d0bf4785b340a3fa17197cdb099a552a383553206f4fd874dda6cee161d6fa490870c9265632ece8820e06e306db78e92ee98f6c355294434c9d4ff8f75e866bf1dcc2b7fbd85be14fa473132271943270d4ddd125448ad8b9cd09a0b301411de6da08e1e89e62e4bda5b67e754054b2db296bbc5cb96fb485f5d1dcde056e831b1059de965ff7accedc58bbb8f18b89a2b03405e0406b2fb1f3b1578dca59b298f9f0cffd9374ff5eb8281c2903af4a131df6b12d8894f37f3d4b2f0f78", 0x0, 0x13fd, 0xf2ffffff, 0x0, 0x43, 0x0, 0x0, 0x4, 0x0, 0x5}, 0x50) sendmsg$nl_route(r1, &(0x7f0000004380)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000600)=ANY=[@ANYBLOB="2c0000001800090400000001fedbdf250a0000000000000000000b8008001e0001000000080008"], 0x2c}}, 0x0) r3 = socket(0x10, 0x80002, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x5) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x48, 0x10, 0xffffff1f, 0x0, 0x80, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @veth={{0x9}, {0x18, 0x2, 0x0, 0x1, @val=@VETH_INFO_PEER={0x14, 0x1, {{0x0, 0x0, 0x0, 0x0, 0x10440}}}}}}]}, 0x48}}, 0x0) sendmmsg$alg(r3, &(0x7f00000000c0), 0x492492492492627, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r5, 0x8933, &(0x7f0000000000)={'team0\x00', 0x0}) r7 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000480)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x4000000}, 0x50) r8 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000340)={0x1b, 0x0, 0x0, 0x40000, 0x0, r7, 0xfff}, 0x50) syz_init_net_socket$bt_l2cap(0x1f, 0x6, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000b40)={0x15, 0x1c, &(0x7f0000000100)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x80000000}, {{0x18, 0x1, 0x1, 0x0, r8}, {}, {0x7, 0x0, 0xb, 0x6}, {0x85, 0x0, 0x0, 0x5}}, {{0x5, 0x0, 0x3}}, [@snprintf={{0x7, 0x0, 0xb, 0x2}, {0x3, 0x3, 0x3, 0xa, 0x9}, {0x5, 0x0, 0xb, 0x9, 0x0, 0x0, 0x2}, {0x3, 0x3, 0x3, 0xa, 0xa}, {0x6, 0x1, 0xa, 0x9, 0x8}, {0x7, 0x0, 0x0, 0x8}, {0x7, 0x1, 0xb, 0x4, 0x8}, {}, {0x7, 0x0, 0xc}, {0x18, 0x6, 0x2, 0x0, r7}, {}, {0x46, 0x8, 0xfff0, 0x76}}], {{0x7, 0x1, 0xb, 0x8, 0x9, 0x20}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xd, '\x00', 0x0, @sk_reuseport=0x27, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$nl_route(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000001280)=@newlink={0x58, 0x10, 0xffffffffffffffff, 0x70bd25, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x2017, 0x2021}, [@IFLA_LINKINFO={0x30, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x20, 0x2, 0x0, 0x1, [@IFLA_MACVLAN_MACADDR_MODE={0x8}, @IFLA_MACVLAN_MODE={0x8, 0x1, 0x10}, @IFLA_MACVLAN_MACADDR={0xa, 0x4, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x42}}]}}}, @IFLA_LINK={0x8, 0x5, r6}]}, 0x58}, 0x1, 0x0, 0x0, 0x1}, 0x8000002) r9 = socket$netlink(0x10, 0x3, 0x0) recvmmsg(r9, 0x0, 0x0, 0x2040, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) r10 = socket$packet(0x11, 0x2, 0x300) r11 = socket$l2tp(0x2, 0x2, 0x73) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r3, 0x84, 0x1b, &(0x7f00000003c0)={0x0, 0x68, "cd985de532b5f5f2faa3249a2e5d6c8edc45daa4976e6d72d35c64f455092cd09fe3b88d40725e6cde1df05f46bf51b6052aae4431df200f3c9dae20841d36d26f6e4d4200dfaf87081cb0c542a6a5d9aed3974d00c4f23fc7e15493ab0d317e1493f98d84ed5c6d"}, &(0x7f0000000440)=0x70) r13 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r13, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r13, 0x84, 0x72, &(0x7f0000000200)={r14, 0x1, 0x30}, &(0x7f0000000240)=0xc) getsockopt$inet_sctp6_SCTP_STATUS(r3, 0x84, 0xe, &(0x7f0000000500)={r12, 0x1, 0xf, 0x8, 0x9, 0x0, 0x1, 0x1, {r14, @in={{0x2, 0x4e21, @local}}, 0x2, 0x2, 0xb4db, 0x80000000, 0x2}}, &(0x7f00000005c0)=0xb0) connect$qrtr(r11, &(0x7f0000004d80)={0x2a, 0xffffffffffffffff, 0x3ffe}, 0xc) sendmmsg(r10, 0x0, 0x0, 0x6080) 443.947601ms ago: executing program 3 (id=3919): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000001000010000000000000000000700000a28000000000a010300000000000000000100000008000240000000010900010073797a310000000040000000030a01020000000000000000010000000900030073797a320000000014000480080002400000000008000140000000050900010073797a310000000030000000050a01020000000000000000010020000c00024000000000000000010900010073797a31000000000400048014000000110001"], 0xc0}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f0000000000)={r0, 0x4, 0xfffffffffffffe01}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000140)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r1, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x30, r2, 0x400, 0x70bd25, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_CSA_C_OFFSETS_TX={0xa, 0xcd, [0xb, 0xffff, 0x9]}, @NL80211_ATTR_DONT_WAIT_FOR_ACK={0x4}, @NL80211_ATTR_OFFCHANNEL_TX_OK={0x4}]}, 0x30}, 0x1, 0x0, 0x0, 0x24008004}, 0x20081) 441.3458ms ago: executing program 2 (id=3920): bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) (async) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x11, 0x3, &(0x7f0000000980)=@framed={{0x18, 0x0, 0x0, 0x0, 0x7}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x34, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) socketpair(0xf, 0x3, 0x2, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) (async) syz_genetlink_get_family_id$ethtool(&(0x7f00000001c0), 0xffffffffffffffff) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x8, 0x13, &(0x7f00000002c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, '\x00', 0x0, @cgroup_skb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd}, 0x94) (async) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x6, 0xe, &(0x7f00000008c0)=ANY=[@ANYBLOB="b702000000200000bfa30000000000000703000000feffff7a0af0fff8ffff1971a4f0ff00000000b7060000080000006f6400000000000045040400010000001704000001000a00b7040000ff0100006a0a00fe0000000085000000bd000000b70000000000000095000000000000009e17f199a68b06d83298a8cdc21ce784909b849d5550ad857d0454d8877a6db61d69f2ffcaa10350e11cb97c8adf1bc9a0c4eeceb9971e43405d621ffbc9ce000000d8ca56b50d0c010d631f6dde53a9a53608c10556e5734eb84049761451ce540c772e2d9f8004e26f7fcc059c062234d5595f6fbaa187b81d1106000000000fd60000fd9ac3d09e29a9d542ca9d85a5c9c88474895d679838def0a83a733dc6a39b63a5ed69d32394c53361d7e43c5cbd80450f859ce8122a79c3e40000b59b0fc46d6cec3c0802882add4e3179bd4a44f231b6d753a7be428ba953df4aece69311687f4122073a236c3a32efa04137d4524847d2638da3261c8162bb7c7824be6195a66d2e17e122040e1100000000928612a29fc691e4f1f7bd053abb885f39381f1759410b1059f05684261f332d606834669b49ec99320ca7712d7e79bd5bf5ed818ecc7640917f6a559a47db608fcf9f6c131b84e41c354c66838f72b9e12d36e996f316f0812ca83efb30c7f6c6d57c4a64590401eec22523dd712c680013e87f649a1ede7142ca9d5d8a8c9f9b440fe4331ad5532c74d9a31a5d737537f7a2caa30581253d14dd3e92af7dc836686365ae01bdec561c0402b67801267a8df97d2f85426a5963d4fa3e26cc05972c162f223f000000d999e80de00fcbcc02d0aed7bb8f7ba337d59c14f39dcd4aad4139ef6425a9367f1bd1467fc6b95a4df7669839771ce9d5788029901e5a79d8b9990ace8f74087f25ad50c46088000000008000"/686], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x3a, 0x10, &(0x7f0000000340), 0xd58495bc, 0x0, 0xffffffffffffffff, 0xffffffffffffff5b}, 0x42) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000c80)={r2, 0x2000000, 0xfe7f, 0x0, &(0x7f0000000c40)="63eced8e46dc3f2ddf33c9e9b986", 0x0, 0x7ffe, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) (async) getsockname$packet(r1, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000000c0)=0x14) bpf$BPF_GET_PROG_INFO(0xa, &(0x7f0000000400)={r0, 0x0, 0x0}, 0x10) 204.433151ms ago: executing program 3 (id=3921): r0 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'hsr0\x00', 0x0}) setsockopt$packet_add_memb(r0, 0x107, 0x1, &(0x7f0000000080)={r1, 0x3, 0x6, @random="7c6a97bead69"}, 0x10) (async, rerun: 64) r2 = socket$nl_route(0x10, 0x3, 0x0) (async, rerun: 64) r3 = socket(0x10, 0x3, 0x0) (async) r4 = syz_init_net_socket$ax25(0x3, 0x2, 0xc5) (async) setsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000080)="109f1fe3e5d24fb7", 0x8) (async) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x64, 0x0, 0x1, 0x401, 0x0, 0x0, {0x2}, [@CTA_TUPLE_ORIG={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast2=0xe0000001}, {0x8, 0x2, @multicast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x24, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @multicast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TIMEOUT={0x8, 0x7, 0x1, 0x0, 0x7}]}, 0x64}}, 0x0) (async, rerun: 32) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) (rerun: 32) sendmsg$IPCTNL_MSG_CT_NEW(r6, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)={0x64, 0x0, 0x1, 0x401, 0x0, 0x1a14, {0x2}, [@CTA_TUPLE_ORIG={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @multicast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x2c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8}, {0x8, 0x2, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}]}]}, 0x64}}, 0x0) ioctl$SIOCAX25ADDUID(r4, 0x89e1, &(0x7f0000000240)={0x3, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0xee01}) (async, rerun: 32) ioctl$SIOCAX25DELUID(r4, 0x89e2, &(0x7f0000000080)={0x3, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}}) (async, rerun: 32) sendmsg$nl_generic(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="280000001e00010a030000000000009b2d"], 0x28}}, 0x4040) (async, rerun: 64) r7 = socket$netlink(0x10, 0x3, 0x0) (async, rerun: 64) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000000)={0x0, 0x0, 0x0, &(0x7f0000010040), 0x2, 0xffffffffffffffff, 0x4}, 0x38) r8 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) close(r8) socket$kcm(0x10, 0x2, 0x0) (async) close(0x3) (async) r9 = socket(0x10, 0x803, 0x0) write(r9, &(0x7f0000000040)="2600000022004701050007108980e8ff06006d20002b1ffec0e90101c7bb0000b00000000000", 0x26) (async, rerun: 32) setsockopt$sock_int(r9, 0x1, 0x8, &(0x7f0000d9bffc), 0x4) (async, rerun: 32) r10 = socket(0x2a, 0x2, 0x0) getsockname$packet(r10, 0x0, 0x0) (async) socket$key(0xf, 0x3, 0x2) (async) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000080), 0xc) sendmsg$nl_route_sched(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=@newtaction={0x70, 0x30, 0x871a15abc695f20d, 0x0, 0x25dfdbfc, {}, [{0x5c, 0x1, [@m_sample={0x58, 0x1, 0x0, 0x0, {{0xb}, {0x2c, 0x2, 0x0, 0x1, [@TCA_SAMPLE_PARMS={0x18, 0x2, {0x9, 0x4000000, 0xffffffffffffffff, 0x0, 0x1}}, @TCA_SAMPLE_PSAMPLE_GROUP={0x8}, @TCA_SAMPLE_RATE={0x8, 0x3, 0x7}]}, {0x4}, {0xfffffffffffffd80}, {0xc, 0x8, {0x2, 0x3}}}}]}]}, 0x70}, 0x1, 0x0, 0x0, 0x4}, 0x0) bind$packet(r0, &(0x7f0000000040)={0x11, 0x1, r1, 0x1, 0x9}, 0x14) sendmsg$nl_route_sched(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)=@getchain={0x24, 0x11, 0x1, 0xfffffffe, 0x2000001, {0x0, 0x0, 0x0, r1, {0x7, 0xa}, {0xd, 0x9}, {0x8}}}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x20048054) 160.600488ms ago: executing program 4 (id=3922): bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000006080)={0x6, 0xc, &(0x7f00000001c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000380)={'gre0\x00', &(0x7f0000000280)={'syztnl2\x00', 0x0, 0x8, 0x8, 0x27a, 0x7, {{0x16, 0x4, 0x0, 0xb, 0x58, 0x68, 0x0, 0x1, 0x4, 0x0, @rand_addr=0x64010102, @broadcast, {[@ssrr={0x89, 0x1b, 0x77, [@local, @broadcast, @rand_addr=0x64010100, @dev={0xac, 0x14, 0x14, 0x1a}, @multicast2, @empty]}, @ra={0x94, 0x4, 0x1}, @end, @generic={0x88, 0xf, "8eb322b19908e93405ed75ef08"}, @rr={0x7, 0x13, 0x43, [@multicast2, @rand_addr=0x64010100, @initdev={0xac, 0x1e, 0x0, 0x0}, @initdev={0xac, 0x1e, 0x0, 0x0}]}]}}}}}) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x10, 0x4, &(0x7f0000001300)=ANY=[@ANYBLOB="180000000300000071141100000000009500"/32], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xe, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffe}, 0x94) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f00000003c0)={r2, @multicast2, @loopback}, 0xc) r3 = socket$xdp(0x2c, 0x3, 0x0) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r4, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) write$bt_hci(r4, &(0x7f0000000580)=ANY=[@ANYBLOB="3500000002"], 0x8) setsockopt$XDP_TX_RING(r3, 0x11b, 0x3, &(0x7f0000000140)=0x40, 0x4) r5 = bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000040)=ANY=[@ANYBLOB="1600000000000000b40000007f00000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000100000000002000"/28], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x2, 0xa, &(0x7f0000000700)=ANY=[@ANYBLOB="1808000000000000000000000000000085100000060000001810000004d060dae9ab388cfaad20ec35a8349ba0258719acff4ac31c5a37c8ad83a6c832b07cc0d7789a60dade662057a5dfc62fd0638a68a01860b6f337d26a984d0fea0514076ea1c68f67a6ecc709b7347c5323e52dd8e42286b1cc3ee9eb0e02703ed9ea2aa90121f7901d93e5c7185252d6e8", @ANYRES32=r5, @ANYBLOB="000000000000000079005101000000001800000002000000000000000000000095000000000000009500000000000000"], &(0x7f0000000200)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x5c}, 0x94) r6 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r6, 0x11b, 0x4, &(0x7f0000000340)={&(0x7f0000000000)=""/62, 0x328000, 0x800, 0x9, 0x3}, 0x20) setsockopt$XDP_UMEM_COMPLETION_RING(r6, 0x11b, 0x6, &(0x7f0000000080)=0x1, 0x4) setsockopt$XDP_RX_RING(r6, 0x11b, 0x2, &(0x7f0000001980)=0x100, 0x4) r7 = socket$pppl2tp(0x18, 0x1, 0x1) r8 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="5c00000013006bec9e3be35c6e17aa31076b876c0d000000ba090000160af3653c001ac00400020208000400030001002c000000eab556a705251e618294ff0051f60a84c9f4d4938037e786a6d0000300000000000000ffffc6c953", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x4a046) sendto(r7, 0x0, 0x0, 0x20050, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000580)={'batadv_slave_1\x00', 0x0}) setsockopt$XDP_UMEM_FILL_RING(r6, 0x11b, 0x5, &(0x7f0000000300)=0x2, 0x4) bind$xdp(r6, &(0x7f0000000100)={0x2c, 0x0, r9}, 0x10) bind$xdp(r3, &(0x7f0000000240)={0x2c, 0x1, r9, 0x0, r6}, 0x10) r10 = socket$nl_route(0x10, 0x3, 0x0) r11 = socket$packet(0x11, 0x2, 0x300) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r11, 0x8933, &(0x7f00000001c0)={'batadv_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r10, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)=@getchain={0x24, 0x11, 0x43d, 0x0, 0x25dfdbff, {0x0, 0x0, 0x0, r12, {0x3, 0xfff1}, {0x4, 0xa}, {0x0, 0xffe0}}}, 0x24}, 0x1, 0x0, 0x0, 0x4048080}, 0x0) 160.104599ms ago: executing program 2 (id=3923): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x208240, 0x0) socket$netlink(0x10, 0x3, 0x6) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000440)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfb, {0x0, 0x0, 0x0, r2, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x7fffe, {0x0, 0x0, 0x0, r2, {0x0, 0xfff3}, {0xb, 0xb}, {0x2, 0xb}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0x6, 0x808, 0xa4b6, 0x1, 0xc}, 0xb, 0x4, 0x32, 0x5, 0xb, 0x7, 0x9, 0x1a, 0x1, 0xffffff5c, {0xffff1c72, 0x23, 0x4, 0x6, 0xfffffffe, 0x7583}}}}]}, 0x78}, 0x1, 0x0, 0x0, 0x404c800}, 0x44000) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r4) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r5) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x22, 0xffffffffffffffff, 0x0) sendmsg$TIPC_CMD_ENABLE_BEARER(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x44081}, 0x40000) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) r8 = socket(0x10, 0x3, 0x0) close(r7) r9 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000440)=@newqdisc={0x54, 0x24, 0x4ee4e6a52ff56541, 0x70bd2b, 0x0, {0x0, 0x0, 0x0, r10, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x24, 0x2, {{0x3, 0x7, 0x9, 0x8, 0xffffffff, 0x10000}, [@TCA_NETEM_ECN={0x8}]}}}]}, 0x54}, 0x1, 0x0, 0x0, 0x24008041}, 0x4008810) ioctl$SIOCSIFHWADDR(r7, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) 159.692549ms ago: executing program 0 (id=3924): socket$inet(0x2, 0x3, 0x6) socket(0x15, 0x80005, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f00000700000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000d00)={0x3, 0x3, &(0x7f0000000480)=ANY=[@ANYBLOB="189f8b5e72d4ad859f109d15acdb000095001000fe000000"], &(0x7f0000000b40)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=[r2, r2]}, 0x94) getsockopt$bt_hci(r1, 0x84, 0xd, &(0x7f0000003140)=""/4111, &(0x7f0000000080)=0x100f) socket$netlink(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) r4 = socket$tipc(0x1e, 0x5, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0b00000007000000010001000900000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r7, 0x2000002, 0xe, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) sendmsg$nl_generic(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000001080)=ANY=[@ANYBLOB="3000000040000701feffffff00000000047c0000040042801400018006000600800a000008001c00", @ANYRES16=r5, @ANYRES8=r4], 0x30}, 0x1, 0x0, 0x0, 0x48815}, 0xc000) syz_genetlink_get_family_id$devlink(&(0x7f00000001c0), r3) getsockname$packet(r3, &(0x7f0000000240)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendto$packet(r0, &(0x7f00000005c0)="10bdc4f5f910d4c5fbc75d99a314bb56d706d9be589f29641de6746b4c6ff575a1c111fc96aacbc9a1920708a1002441b001f1ed93ae7e68cfe19993e176125fdf8f8078db0f461be9928b2e7d83f40d97b35848e637366c2e5920856f0757c8174c99e438f7558bbd00b7d8db5a1cbeb9d00738ca36a88266369489132ce4dea3b14cadc657fc0e6bfaf0545162aace6bcc61bb63f1664baef6bf5e53d53ed9c30968f53de1cc4abd046f1476c329d9ccc89d51661d45e733f5690a1552f7a7ca0c0b646de18d20c13eba631f54b9f3dbc8f5880075f7f039c2820fc1301338622b63459e57", 0xe6, 0x40800, 0x0, 0x0) r8 = socket$kcm(0x2a, 0x2, 0x0) sendmsg$kcm(r8, &(0x7f00000000c0)={&(0x7f0000000040)=@qipcrtr, 0x80, 0x0}, 0x0) r9 = socket$inet_sctp(0x2, 0x1, 0x84) r10 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r10, 0x0, 0x482, &(0x7f00000000c0)={0x84, @loopback, 0x4e20, 0x3, 'none\x00', 0x30, 0x0, 0x3f}, 0x2c) r11 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000340)={'dvmrp0\x00'}) sendmsg$nl_route(r11, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000300)=ANY=[], 0x2c}}, 0x40080) setsockopt$IP_VS_SO_SET_ADDDEST(r10, 0x0, 0x487, &(0x7f0000000000)={{0x84, @broadcast, 0x4e21, 0x3, 'fo\x00', 0x11, 0x3240, 0x37}, {@loopback, 0x4e23, 0x4, 0xc3, 0x12d5c, 0x12d5c}}, 0x44) setsockopt$IP_VS_SO_SET_DELDEST(r9, 0x0, 0x488, &(0x7f0000000280)={{0x84, @rand_addr=0x64010102, 0x4e20, 0x3, 'nq\x00', 0x1d, 0x2, 0x2a}, {@loopback, 0x4e23, 0x2000, 0xc24, 0x9, 0xfffffff9}}, 0x44) 64.596763ms ago: executing program 1 (id=3925): socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/ipc\x00') unshare(0x6a040000) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f00000001c0)={'syztnl0\x00', &(0x7f0000000140)={'ip6_vti0\x00', 0x0, 0x29, 0xf, 0x95, 0xeb, 0x4, @local, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x1, 0x7, 0xfffffffd, 0x9}}) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="040100001000010400000000000000000000ffff", @ANYRES32=0x0, @ANYBLOB="0000000000000000240012800b0001006272696467650000140002800800050001200000080001"], 0x104}}, 0x0) 0s ago: executing program 3 (id=3926): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)={0x60, 0x2, 0x6, 0x101, 0x0, 0x300, {0x5}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8, 0x8, 0x1, 0x0, 0xd1}, @IPSET_ATTR_MARKMASK={0x8, 0xb, 0x1, 0x0, 0x3}]}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x3}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:ip,mark\x00'}]}, 0x60}, 0x1, 0x0, 0x0, 0x10}, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000280)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x78, r2, 0x1, 0x70bd29, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_ADDR={0x34, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x7}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0xff}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0xd}]}, @MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0x7}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x3}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x4}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x8}, @MPTCP_PM_ATTR_SUBFLOWS={0x8}, @MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0x5}]}, 0x78}, 0x1, 0x0, 0x0, 0x20040000}, 0x24000080) kernel console output (not intermixed with test programs): ctio) comm="syz.2.2699" name="r" dev="tmpfs" ino=2649 res=0 errno=0 [ 329.651921][T16047] lo speed is unknown, defaulting to 1000 [ 329.890608][T16040] bond6 (unregistering): Released all slaves [ 329.954626][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5150 ms [ 329.964377][ C0] lec:lec_tx_timeout: lec0 [ 329.969438][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 329.980327][T16060] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2702'. [ 330.243282][T16066] validate_nla: 5 callbacks suppressed [ 330.243301][T16066] netlink: 'syz.0.2704': attribute type 3 has an invalid length. [ 330.542740][T16078] bond11: up delay (2) is not a multiple of miimon (80), value rounded to 0 ms [ 330.564220][T16078] bond11: entered promiscuous mode [ 330.593801][T16078] 8021q: adding VLAN 0 to HW filter on device bond11 [ 330.883708][T16085] syzkaller1: entered promiscuous mode [ 330.894718][T16085] syzkaller1: entered allmulticast mode [ 331.647172][T16128] bond10: entered allmulticast mode [ 331.669709][T16128] 8021q: adding VLAN 0 to HW filter on device bond10 [ 331.836317][T16128] bond0: (slave vlan2): Opening slave failed [ 331.916178][T16141] netlink: 'syz.2.2724': attribute type 21 has an invalid length. [ 331.935471][T16130] lo speed is unknown, defaulting to 1000 [ 332.628330][T16173] __nla_validate_parse: 7 callbacks suppressed [ 332.628355][T16173] netlink: 160 bytes leftover after parsing attributes in process `syz.3.2730'. [ 332.701357][T16167] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2731'. [ 332.710493][ T5894] IPVS: starting estimator thread 0... [ 332.813214][T16175] IPVS: using max 31 ests per chain, 74400 per kthread [ 332.916677][T16171] lo speed is unknown, defaulting to 1000 [ 332.938131][T16170] lo speed is unknown, defaulting to 1000 [ 333.068871][T16190] syzkaller1: entered promiscuous mode [ 333.076858][T16190] syzkaller1: entered allmulticast mode [ 333.627510][T16202] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2737'. [ 333.681941][T16202] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2737'. [ 333.695212][T16202] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2737'. [ 333.730897][T16212] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2738'. [ 333.755157][T16203] netlink: 'syz.1.2737': attribute type 1 has an invalid length. [ 333.763675][T16213] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2740'. [ 333.769920][T16212] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2738'. [ 333.822010][T16213] nbd: couldn't find a device at index 65546 [ 333.907840][T16203] workqueue: Failed to create a rescuer kthread for wq "bond11": -EINTR [ 334.246976][T16227] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2743'. [ 334.264850][T16227] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2743'. [ 334.641757][T16257] IPVS: set_ctl: invalid protocol: 3 172.20.20.45:20000 [ 334.839332][T16278] xt_NFQUEUE: number of queues (16) out of range (got 65549) [ 334.970453][T16274] bond11: invalid ARP target 0.0.0.0 specified for addition [ 334.980177][T16274] bond11: option arp_ip_target: invalid value (0) [ 334.986703][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 334.986771][ C0] lec:lec_tx_timeout: lec0 [ 334.995504][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 335.009028][T16274] bond11 (unregistering): Released all slaves [ 335.086642][T16286] netlink: 'syz.2.2761': attribute type 1 has an invalid length. [ 335.112693][T16287] lo speed is unknown, defaulting to 1000 [ 335.113985][T16286] NCSI netlink: No device for ifindex 0 [ 335.508470][T16309] lo speed is unknown, defaulting to 1000 [ 335.820571][T16315] syzkaller1: entered promiscuous mode [ 335.827009][T16315] syzkaller1: entered allmulticast mode [ 336.081407][T16339] netlink: 'syz.3.2774': attribute type 1 has an invalid length. [ 336.210946][T16339] bond11: entered promiscuous mode [ 336.217563][T16339] 8021q: adding VLAN 0 to HW filter on device bond11 [ 336.233102][T16347] ipvlan5: entered allmulticast mode [ 336.238675][T16347] bond11: entered allmulticast mode [ 336.290446][T16352] bond11: (slave bridge17): making interface the new active one [ 336.298834][T16352] bridge17: entered promiscuous mode [ 336.307203][T16352] bridge17: entered allmulticast mode [ 336.314454][T16352] bond11: (slave bridge17): Enslaving as an active interface with an up link [ 338.639954][T16321] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 338.993022][T16419] ip6gre3: entered promiscuous mode [ 338.998764][T16419] ip6gre3: entered allmulticast mode [ 339.014978][T16425] __nla_validate_parse: 17 callbacks suppressed [ 339.014996][T16425] netlink: 192 bytes leftover after parsing attributes in process `syz.4.2788'. [ 339.061090][T16421] lo speed is unknown, defaulting to 1000 [ 339.170443][T16429] netlink: 120 bytes leftover after parsing attributes in process `syz.2.2791'. [ 339.186135][T16429] netlink: 120 bytes leftover after parsing attributes in process `syz.2.2791'. [ 339.786902][T16458] TC_ACT_REPEAT abuse ? [ 339.982952][T16466] bond13: option miimon: invalid value (18446744073709551607) [ 340.001860][T16466] bond13: option miimon: allowed values 0 - 2147483647 [ 340.014478][T16466] bond13 (unregistering): Released all slaves [ 340.014658][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 340.029443][ C0] lec:lec_tx_timeout: lec0 [ 340.034554][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 340.426973][T16487] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2809'. [ 340.857525][T16496] hsr0: entered promiscuous mode [ 340.876248][T16496] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2814'. [ 340.925611][T16498] syzkaller0: entered promiscuous mode [ 340.936540][T16498] syzkaller0: entered allmulticast mode [ 340.945271][T16498] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2812'. [ 340.955256][T16496] hsr_slave_0: left promiscuous mode [ 340.961810][T16496] hsr_slave_1: left promiscuous mode [ 340.969105][T16498] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2812'. [ 340.992479][T16496] hsr0 (unregistering): left promiscuous mode [ 341.214493][T16517] netlink: 'syz.2.2820': attribute type 4 has an invalid length. [ 341.236213][T16517] netlink: 156 bytes leftover after parsing attributes in process `syz.2.2820'. [ 341.273946][T16517] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 341.327508][T16524] x_tables: duplicate underflow at hook 2 [ 341.633094][T16542] netlink: 'syz.4.2826': attribute type 10 has an invalid length. [ 341.720050][T16544] lo speed is unknown, defaulting to 1000 [ 341.743103][T16546] netlink: 192 bytes leftover after parsing attributes in process `syz.0.2828'. [ 342.400487][T16562] Bluetooth: hci0: Opcode 0x0401 failed: -22 [ 342.430908][T16562] netlink: 76 bytes leftover after parsing attributes in process `syz.2.2832'. [ 342.446179][T16562] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 342.541364][T16567] syzkaller0: entered promiscuous mode [ 342.558720][T16567] syzkaller0: entered allmulticast mode [ 344.449192][T16519] Set syz1 is full, maxelem 65536 reached [ 345.048449][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 345.056492][ C0] lec:lec_tx_timeout: lec0 [ 345.061213][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 345.593533][T16599] vlan4: entered promiscuous mode [ 345.613424][T16599] team0: entered promiscuous mode [ 345.627763][T16599] team_slave_0: entered promiscuous mode [ 345.650854][ T29] audit: type=1804 audit(1776511752.236:12): pid=16608 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.2.2841" name="/newroot/552/cgroup.controllers" dev="tmpfs" ino=2839 res=1 errno=0 [ 345.675047][T16599] team_slave_1: entered promiscuous mode [ 345.682954][T16599] bridge1: entered promiscuous mode [ 345.722173][ T29] audit: type=1800 audit(1776511752.256:13): pid=16608 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.2841" name="cgroup.controllers" dev="tmpfs" ino=2839 res=0 errno=0 [ 345.785399][T16611] __nla_validate_parse: 3 callbacks suppressed [ 345.785417][T16611] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2846'. [ 345.887990][T16621] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2850'. [ 345.966699][T16631] netlink: 52 bytes leftover after parsing attributes in process `syz.0.2850'. [ 345.993305][T16615] bond12: invalid ARP target 0.0.0.0 specified for addition [ 346.015643][T16615] bond12: option arp_ip_target: invalid value (0) [ 346.025619][T16615] bond12 (unregistering): Released all slaves [ 346.072736][T16621] ip6gre2: entered promiscuous mode [ 346.084519][T16640] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2850'. [ 346.090263][T16621] ip6gre2: entered allmulticast mode [ 346.162826][T16624] bond2: entered allmulticast mode [ 346.246287][T16648] netlink: 'syz.3.2853': attribute type 39 has an invalid length. [ 346.262411][T16623] bond2: left allmulticast mode [ 346.436009][T11665] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 346.469902][ T7498] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 346.471334][T16657] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2857'. [ 346.478923][T11665] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 346.605641][ T1333] nci: nci_extract_activation_params_iso_dep: unsupported activation_rf_tech_and_mode 0x2 [ 346.704795][ T7497] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 346.876712][T16681] syzkaller1: entered promiscuous mode [ 346.884427][T16681] syzkaller1: entered allmulticast mode [ 347.000127][T16685] netlink: 332 bytes leftover after parsing attributes in process `syz.1.2863'. [ 347.014447][T16685] netlink: 'syz.1.2863': attribute type 9 has an invalid length. [ 347.023770][T16685] netlink: 108 bytes leftover after parsing attributes in process `syz.1.2863'. [ 347.033195][T16685] netlink: 32 bytes leftover after parsing attributes in process `syz.1.2863'. [ 347.074129][T16692] netlink: 192 bytes leftover after parsing attributes in process `syz.2.2864'. [ 347.124935][ T7497] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 347.166267][T16687] lo speed is unknown, defaulting to 1000 [ 347.351209][T16709] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2869'. [ 347.379938][T16707] syz_tun: entered allmulticast mode [ 347.437963][T16698] syz_tun: left allmulticast mode [ 347.647313][T16724] netlink: 'syz.3.2873': attribute type 1 has an invalid length. [ 347.704954][ T5894] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 347.769030][T16720] No such timeout policy "syz0" [ 347.779155][T16724] bond12: entered promiscuous mode [ 347.800505][T16724] 8021q: adding VLAN 0 to HW filter on device bond12 [ 347.928576][T16724] bond12: (slave bridge19): making interface the new active one [ 347.955457][T16724] bridge19: entered promiscuous mode [ 347.981151][T16724] bond12: (slave bridge19): Enslaving as an active interface with an up link [ 348.009150][T16736] syzkaller1: entered promiscuous mode [ 348.023619][T16736] syzkaller1: entered allmulticast mode [ 348.164883][ T5894] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 348.281289][T16741] lo speed is unknown, defaulting to 1000 [ 348.622781][T16760] lo speed is unknown, defaulting to 1000 [ 348.626373][T16772] Cannot find del_set index 4 as target [ 348.945057][T16776] lo speed is unknown, defaulting to 1000 [ 349.460412][ T5824] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 349.480854][ T5824] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 349.489765][ T5824] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 349.502725][ T5824] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 349.510493][ T5824] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 349.946582][T16811] dvmrp1: entered allmulticast mode [ 349.952255][T16823] syz_tun: entered allmulticast mode [ 350.084636][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5020 ms [ 350.092704][ C0] lec:lec_tx_timeout: lec0 [ 350.097645][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 350.139483][T16802] lo speed is unknown, defaulting to 1000 [ 350.602834][T16858] netlink: 'syz.1.2907': attribute type 2 has an invalid length. [ 350.829205][T16876] __nla_validate_parse: 6 callbacks suppressed [ 350.829225][T16876] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2911'. [ 350.892170][T16802] chnl_net:caif_netlink_parms(): no params data found [ 350.914872][ C0] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 351.390924][T16911] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2917'. [ 351.401841][T16802] bridge0: port 1(bridge_slave_0) entered blocking state [ 351.412480][T16802] bridge0: port 1(bridge_slave_0) entered disabled state [ 351.419993][T16802] bridge_slave_0: entered allmulticast mode [ 351.428427][T16802] bridge_slave_0: entered promiscuous mode [ 351.510821][T16912] delete_channel: no stack [ 351.521131][T16802] bridge0: port 2(bridge_slave_1) entered blocking state [ 351.527039][T16912] delete_channel: no stack [ 351.537857][T16802] bridge0: port 2(bridge_slave_1) entered disabled state [ 351.555174][ T5824] Bluetooth: hci5: command tx timeout [ 351.573411][T16802] bridge_slave_1: entered allmulticast mode [ 351.604961][T16802] bridge_slave_1: entered promiscuous mode [ 351.638626][T16923] netlink: 'syz.4.2919': attribute type 1 has an invalid length. [ 351.753071][T16923] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2919'. [ 351.784248][T16802] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 351.808927][T16802] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 351.934301][T16802] team0: Port device team_slave_0 added [ 351.960185][T11664] macvlan3: left allmulticast mode [ 351.970919][T11664] macvlan3: left promiscuous mode [ 351.985939][T11664] bridge0: port 4(macvlan3) entered disabled state [ 352.019392][T11664] hsr0: left allmulticast mode [ 352.030054][T11664] hsr_slave_0: left allmulticast mode [ 352.037445][T11664] hsr_slave_1: left allmulticast mode [ 352.043102][T11664] hsr0: left promiscuous mode [ 352.048602][T11664] bridge0: port 3(hsr0) entered disabled state [ 352.210467][T16954] netlink: 'syz.1.2928': attribute type 9 has an invalid length. [ 352.219220][T16954] netlink: 'syz.1.2928': attribute type 6 has an invalid length. [ 352.270464][T11664] bond9 (unregistering): (slave ip6gre2): Releasing backup interface [ 352.278723][T11664] ip6gre2 (unregistering): left promiscuous mode [ 352.568195][T11664] bond3 (unregistering): (slave bridge3): Releasing backup interface [ 353.198264][T11664] bond11 (unregistering): (slave bridge17): Releasing backup interface [ 353.206781][T11664] bridge17 (unregistering): left promiscuous mode [ 353.213228][T11664] bridge17 (unregistering): left allmulticast mode [ 353.278538][T11664] bond12 (unregistering): (slave bridge19): Releasing backup interface [ 353.286896][T11664] bridge19 (unregistering): left promiscuous mode [ 353.320584][T11664] bond0 (unregistering): (slave dummy0): Releasing backup interface [ 353.332105][T11664] bond0 (unregistering): Released all slaves [ 353.342270][T11664] bond1 (unregistering): Released all slaves [ 353.355663][T11664] bond2 (unregistering): Released all slaves [ 353.376765][T11664] bond3 (unregistering): Released all slaves [ 353.391339][T11664] bond4 (unregistering): Released all slaves [ 353.408824][T11664] bond5 (unregistering): Released all slaves [ 353.432846][T11664] bond6 (unregistering): Released all slaves [ 353.447441][T11664] bond7 (unregistering): Released all slaves [ 353.460897][T11664] bond8 (unregistering): Released all slaves [ 353.474388][T11664] bond9 (unregistering): Released all slaves [ 353.491672][T11664] bond10 (unregistering): Released all slaves [ 353.514463][T11664] bond11 (unregistering): Released all slaves [ 353.529441][T11664] bond12 (unregistering): Released all slaves [ 353.543274][T16802] team0: Port device team_slave_1 added [ 353.635038][ T5824] Bluetooth: hci5: command tx timeout [ 353.651044][T16802] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 353.698073][T16802] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 353.746133][T16802] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 353.797255][T16802] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 353.826368][T16802] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 353.874202][T16970] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 353.898879][T16802] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 353.950559][T11664] : left promiscuous mode [ 354.205545][T16994] FAULT_INJECTION: forcing a failure. [ 354.205545][T16994] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 354.261539][T16994] CPU: 1 UID: 0 PID: 16994 Comm: syz.4.2937 Not tainted syzkaller #0 PREEMPT(full) [ 354.261564][T16994] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 354.261576][T16994] Call Trace: [ 354.261582][T16994] [ 354.261590][T16994] dump_stack_lvl+0xe8/0x150 [ 354.261620][T16994] should_fail_ex+0x412/0x560 [ 354.261649][T16994] _copy_from_user+0x2d/0xb0 [ 354.261669][T16994] do_ipv6_setsockopt+0x25c/0x3150 [ 354.261704][T16994] ? __pfx_do_ipv6_setsockopt+0x10/0x10 [ 354.261735][T16994] ? __mutex_trylock_common+0x158/0x260 [ 354.261762][T16994] ? __pfx___mutex_trylock_common+0x10/0x10 [ 354.261789][T16994] ? rcu_is_watching+0x15/0xb0 [ 354.261812][T16994] ? trace_contention_end+0x3d/0x140 [ 354.261831][T16994] ? __mutex_lock+0x319/0x1550 [ 354.261862][T16994] ? __lock_acquire+0x6b5/0x2cf0 [ 354.261885][T16994] ? smc_setsockopt+0x18e/0xac0 [ 354.261906][T16994] ? __pfx___mutex_lock+0x10/0x10 [ 354.261940][T16994] ipv6_setsockopt+0x59/0x170 [ 354.261963][T16994] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 354.261986][T16994] smc_setsockopt+0x249/0xac0 [ 354.262009][T16994] ? __pfx_smc_setsockopt+0x10/0x10 [ 354.262025][T16994] ? aa_sock_opt_perm+0xff/0x1a0 [ 354.262052][T16994] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 354.262076][T16994] ? __pfx_smc_setsockopt+0x10/0x10 [ 354.262094][T16994] do_sock_setsockopt+0x17c/0x1b0 [ 354.262122][T16994] __x64_sys_setsockopt+0x13d/0x1b0 [ 354.262148][T16994] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 354.262166][T16994] do_syscall_64+0x15f/0xf80 [ 354.262186][T16994] ? trace_irq_disable+0x3b/0x140 [ 354.262203][T16994] ? clear_bhb_loop+0x40/0x90 [ 354.262223][T16994] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 354.262241][T16994] RIP: 0033:0x7efd5a19c819 [ 354.262258][T16994] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 354.262273][T16994] RSP: 002b:00007efd5af82028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 354.262293][T16994] RAX: ffffffffffffffda RBX: 00007efd5a415fa0 RCX: 00007efd5a19c819 [ 354.262306][T16994] RDX: 0000000000000030 RSI: 0000000000000029 RDI: 0000000000000003 [ 354.262316][T16994] RBP: 00007efd5af82090 R08: 0000000000020000 R09: 0000000000000000 [ 354.262326][T16994] R10: 0000200000000080 R11: 0000000000000246 R12: 0000000000000001 [ 354.262337][T16994] R13: 00007efd5a416038 R14: 00007efd5a415fa0 R15: 00007ffc6cedacf8 [ 354.262367][T16994] [ 354.533471][T11664] tipc: Disabling bearer [ 354.544147][T11664] tipc: Left network mode [ 354.642490][T16802] hsr_slave_0: entered promiscuous mode [ 354.660829][T16802] hsr_slave_1: entered promiscuous mode [ 354.671650][T16802] debugfs: 'hsr0' already exists in 'hsr' [ 354.677551][T16802] Cannot create hsr debugfs directory [ 354.893757][T11664] IPVS: stopping master sync thread 9377 ... [ 355.020062][T17020] bond9: (slave lo): Releasing backup interface [ 355.090028][T17023] netlink: 68 bytes leftover after parsing attributes in process `syz.1.2944'. [ 355.105060][T17030] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2946'. [ 355.157205][T17034] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2946'. [ 355.200754][T17020] bond9: (slave lo): last VLAN challenged slave left bond - VLAN blocking is removed [ 355.232873][T17020] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 355.502200][T17026] veth1: renamed from macsec0 [ 355.714844][ T5824] Bluetooth: hci5: command tx timeout [ 355.948244][ T5490] 8021q: adding VLAN 0 to HW filter on device eth1 [ 356.150524][T17057] 8021q: adding VLAN 0 to HW filter on device macvlan3 [ 356.169599][ T29] audit: type=1800 audit(1776511762.756:14): pid=17064 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.2952" name="cpu.stat" dev="tmpfs" ino=3105 res=0 errno=0 [ 356.194601][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 6100 ms [ 356.202657][ C0] lec:lec_tx_timeout: lec0 [ 356.207685][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 356.234781][T17071] netlink: 220 bytes leftover after parsing attributes in process `syz.0.2954'. [ 356.329139][T17060] 8021q: adding VLAN 0 to HW filter on device macvlan4 [ 356.666432][T17088] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2958'. [ 356.757948][T17092] FAULT_INJECTION: forcing a failure. [ 356.757948][T17092] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 356.772665][T17093] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2958'. [ 356.788032][T17092] CPU: 0 UID: 0 PID: 17092 Comm: syz.0.2959 Not tainted syzkaller #0 PREEMPT(full) [ 356.788057][T17092] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 356.788067][T17092] Call Trace: [ 356.788074][T17092] [ 356.788081][T17092] dump_stack_lvl+0xe8/0x150 [ 356.788112][T17092] should_fail_ex+0x412/0x560 [ 356.788141][T17092] _copy_from_user+0x2d/0xb0 [ 356.788160][T17092] ipv6_set_mcast_msfilter+0x148/0x310 [ 356.788190][T17092] do_ipv6_setsockopt+0x12ee/0x3150 [ 356.788224][T17092] ? __pfx_do_ipv6_setsockopt+0x10/0x10 [ 356.788255][T17092] ? __mutex_trylock_common+0x158/0x260 [ 356.788284][T17092] ? __pfx___mutex_trylock_common+0x10/0x10 [ 356.788312][T17092] ? rcu_is_watching+0x15/0xb0 [ 356.788336][T17092] ? trace_contention_end+0x3d/0x140 [ 356.788355][T17092] ? __mutex_lock+0x319/0x1550 [ 356.788387][T17092] ? __lock_acquire+0x6b5/0x2cf0 [ 356.788411][T17092] ? smc_setsockopt+0x18e/0xac0 [ 356.788431][T17092] ? __pfx___mutex_lock+0x10/0x10 [ 356.788466][T17092] ipv6_setsockopt+0x59/0x170 [ 356.788490][T17092] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 356.788513][T17092] smc_setsockopt+0x249/0xac0 [ 356.788538][T17092] ? __pfx_smc_setsockopt+0x10/0x10 [ 356.788553][T17092] ? aa_sock_opt_perm+0xff/0x1a0 [ 356.788578][T17092] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 356.788602][T17092] ? __pfx_smc_setsockopt+0x10/0x10 [ 356.788621][T17092] do_sock_setsockopt+0x17c/0x1b0 [ 356.788649][T17092] __x64_sys_setsockopt+0x13d/0x1b0 [ 356.788675][T17092] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 356.788694][T17092] do_syscall_64+0x15f/0xf80 [ 356.788713][T17092] ? trace_irq_disable+0x3b/0x140 [ 356.788731][T17092] ? clear_bhb_loop+0x40/0x90 [ 356.788752][T17092] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 356.788769][T17092] RIP: 0033:0x7f69c2b9c819 [ 356.788786][T17092] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 356.788801][T17092] RSP: 002b:00007f69c39d5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 356.788821][T17092] RAX: ffffffffffffffda RBX: 00007f69c2e15fa0 RCX: 00007f69c2b9c819 [ 356.788833][T17092] RDX: 0000000000000030 RSI: 0000000000000029 RDI: 0000000000000003 [ 356.788843][T17092] RBP: 00007f69c39d5090 R08: 0000000000020000 R09: 0000000000000000 [ 356.788853][T17092] R10: 0000200000000080 R11: 0000000000000246 R12: 0000000000000001 [ 356.788863][T17092] R13: 00007f69c2e16038 R14: 00007f69c2e15fa0 R15: 00007fff4552cad8 [ 356.788891][T17092] [ 357.171387][T17101] lo speed is unknown, defaulting to 1000 [ 357.204557][T17103] netlink: 'syz.0.2961': attribute type 12 has an invalid length. [ 357.791938][T11664] hsr_slave_0: left promiscuous mode [ 357.804712][ T5824] Bluetooth: hci5: command tx timeout [ 357.836979][T11664] hsr_slave_1: left promiscuous mode [ 357.929556][T17138] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2969'. [ 357.938754][T17138] netlink: 48 bytes leftover after parsing attributes in process `syz.2.2969'. [ 358.150571][T11664] team0 (unregistering): Port device vxcan1 removed [ 358.257920][T17138] vlan4: entered allmulticast mode [ 358.270695][T17138] macvtap0: entered allmulticast mode [ 358.345120][T17150] netlink: 'syz.4.2971': attribute type 9 has an invalid length. [ 358.360612][T17150] netlink: 'syz.4.2971': attribute type 6 has an invalid length. [ 358.897351][T17170] netlink: 44 bytes leftover after parsing attributes in process `syz.2.2976'. [ 358.940706][T17170] netlink: 35 bytes leftover after parsing attributes in process `syz.2.2976'. [ 358.962340][T16802] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 358.988261][T16802] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 358.998674][T17170] netlink: 'syz.2.2976': attribute type 5 has an invalid length. [ 359.003602][T16802] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 359.029197][T17170] netlink: 'syz.2.2976': attribute type 6 has an invalid length. [ 359.053053][T17177] xt_hashlimit: size too large, truncated to 1048576 [ 359.079148][T17170] netlink: 35 bytes leftover after parsing attributes in process `syz.2.2976'. [ 359.108153][T17188] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2976'. [ 359.130791][T17179] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2979'. [ 359.132186][T16802] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 359.205341][T16802] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 359.221782][T16802] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 359.246796][T16802] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 359.249761][T11664] IPVS: stop unused estimator thread 0... [ 359.266627][T16802] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 359.498136][T17207] netlink: 'syz.4.2981': attribute type 1 has an invalid length. [ 359.552582][T17211] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 359.586011][T17207] 8021q: adding VLAN 0 to HW filter on device bond6 [ 359.623028][T17208] bond6: (slave geneve0): making interface the new active one [ 359.643872][T17208] bond6: (slave geneve0): Enslaving as an active interface with an up link [ 359.699507][ T147] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 20000 - 0 [ 359.742378][ T147] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 20000 - 0 [ 359.775008][ T147] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 20000 - 0 [ 359.798530][ T147] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 20000 - 0 [ 359.800122][T17223] netlink: 'syz.1.2985': attribute type 20 has an invalid length. [ 359.831774][T16802] 8021q: adding VLAN 0 to HW filter on device bond0 [ 359.886292][T16802] 8021q: adding VLAN 0 to HW filter on device team0 [ 359.950820][ T147] netdevsim netdevsim1 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 359.964285][ T147] netdevsim netdevsim1 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 359.974437][ T147] netdevsim netdevsim1 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 359.991066][ T147] netdevsim netdevsim1 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 360.014469][T11659] bridge0: port 1(bridge_slave_0) entered blocking state [ 360.021643][T11659] bridge0: port 1(bridge_slave_0) entered forwarding state [ 360.034791][ C0] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 360.109477][ T1333] bridge0: port 2(bridge_slave_1) entered blocking state [ 360.116695][ T1333] bridge0: port 2(bridge_slave_1) entered forwarding state [ 360.261498][T17231] lo speed is unknown, defaulting to 1000 [ 360.539302][T17251] bond2: entered allmulticast mode [ 360.823628][T17256] tipc: Enabling of bearer rejected, media not registered [ 360.865356][T17260] geneve2: entered promiscuous mode [ 360.923278][T17245] bond2: left allmulticast mode [ 361.088318][T16802] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 361.287078][T16802] veth0_vlan: entered promiscuous mode [ 361.311195][T16802] veth1_vlan: entered promiscuous mode [ 361.317376][T17288] xt_hashlimit: size too large, truncated to 1048576 [ 361.367664][T17292] __nla_validate_parse: 3 callbacks suppressed [ 361.367681][T17292] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2998'. [ 361.426675][T17291] netlink: 14 bytes leftover after parsing attributes in process `syz.0.2999'. [ 361.471815][T16802] veth0_macvtap: entered promiscuous mode [ 361.571208][T17291] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 361.609356][T17291] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 361.647781][T17303] netlink: 'syz.1.3001': attribute type 2 has an invalid length. [ 361.648548][T17291] bond0 (unregistering): Released all slaves [ 361.679268][T17303] netlink: 119 bytes leftover after parsing attributes in process `syz.1.3001'. [ 361.706611][T17307] netlink: 'syz.2.3000': attribute type 3 has an invalid length. [ 361.730768][T17304] netlink: 'syz.1.3001': attribute type 11 has an invalid length. [ 361.766677][T16802] veth1_macvtap: entered promiscuous mode [ 361.823567][T16802] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 361.897679][T16802] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 361.954597][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5750 ms [ 361.962659][ C0] lec:lec_tx_timeout: lec0 [ 361.967718][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 362.014471][ T35] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 362.034376][ T35] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 362.062204][T17322] RDS: rds_bind could not find a transport for fe80::1a, load rds_tcp or rds_rdma? [ 362.105080][ T35] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 362.143962][ T35] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 362.258537][T17320] lo speed is unknown, defaulting to 1000 [ 362.399777][ T35] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 362.429313][ T35] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 362.543138][T17339] delete_channel: no stack [ 362.575532][ T1333] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 362.599312][ T1333] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 363.314888][ T5824] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 363.486049][T17372] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3013'. [ 363.659081][T17374] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3013'. [ 363.830652][T17379] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3015'. [ 364.070940][ T5826] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 364.091922][ T5826] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 364.103516][ T5826] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 364.114452][ T5826] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 364.117967][ T5820] syz_tun (unregistering): left allmulticast mode [ 364.134364][ T5826] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 364.267335][T17394] bond2: entered allmulticast mode [ 364.269266][T17390] netlink: 76 bytes leftover after parsing attributes in process `syz.1.3017'. [ 364.403433][T17384] lo speed is unknown, defaulting to 1000 [ 364.415808][T17387] bond2: left allmulticast mode [ 364.954247][ T48] netdevsim netdevsim4 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 364.982216][ T48] netdevsim netdevsim4 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 365.005250][ T48] netdevsim netdevsim4 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 365.033609][T17433] batadv_slave_0: Caught tx_queue_len zero misconfig [ 365.088432][ T48] netdevsim netdevsim4 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 365.116341][T17384] chnl_net:caif_netlink_parms(): no params data found [ 365.423851][T17453] syzkaller1: entered promiscuous mode [ 365.455757][T17453] syzkaller1: entered allmulticast mode [ 365.595924][T17458] bond14: option active_slave: mode dependency failed, not supported in mode balance-xor(2) [ 365.617461][T17458] bond14 (unregistering): Released all slaves [ 365.711882][T17384] bridge0: port 1(bridge_slave_0) entered blocking state [ 365.731895][T17384] bridge0: port 1(bridge_slave_0) entered disabled state [ 365.740370][T17384] bridge_slave_0: entered allmulticast mode [ 365.767419][T17384] bridge_slave_0: entered promiscuous mode [ 365.789980][T17472] syzkaller1: entered promiscuous mode [ 365.803534][T17472] syzkaller1: entered allmulticast mode [ 365.817079][T17483] netlink: 76 bytes leftover after parsing attributes in process `syz.2.3032'. [ 365.826561][T17483] netlink: 76 bytes leftover after parsing attributes in process `syz.2.3032'. [ 365.835880][T17384] bridge0: port 2(bridge_slave_1) entered blocking state [ 365.845290][T17384] bridge0: port 2(bridge_slave_1) entered disabled state [ 365.852661][T17384] bridge_slave_1: entered allmulticast mode [ 365.861368][T17384] bridge_slave_1: entered promiscuous mode [ 365.916111][T17384] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 365.931705][T17384] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 366.011843][T17489] FAULT_INJECTION: forcing a failure. [ 366.011843][T17489] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 366.025267][T17489] CPU: 0 UID: 0 PID: 17489 Comm: syz.2.3034 Not tainted syzkaller #0 PREEMPT(full) [ 366.025290][T17489] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 366.025304][T17489] Call Trace: [ 366.025311][T17489] [ 366.025319][T17489] dump_stack_lvl+0xe8/0x150 [ 366.025348][T17489] should_fail_ex+0x412/0x560 [ 366.025376][T17489] _copy_from_iter+0x1d3/0x1670 [ 366.025398][T17489] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 366.025420][T17489] ? __pfx_policy_nodemask+0x10/0x10 [ 366.025441][T17489] ? __pfx__copy_from_iter+0x10/0x10 [ 366.025469][T17489] ? set_page_refcounted+0xa0/0x1e0 [ 366.025485][T17489] ? page_copy_sane+0x4e/0x270 [ 366.025508][T17489] copy_page_from_iter+0xdd/0x170 [ 366.025534][T17489] tun_get_user+0x1db3/0x3ed0 [ 366.025550][T17489] ? tun_get_user+0x6ff/0x3ed0 [ 366.025581][T17489] ? aa_file_perm+0x50e/0x15e0 [ 366.025604][T17489] ? __pfx_tun_get_user+0x10/0x10 [ 366.025625][T17489] ? __lock_acquire+0x6b5/0x2cf0 [ 366.025661][T17489] ? ref_tracker_alloc+0x35c/0x4c0 [ 366.025686][T17489] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 366.025711][T17489] ? tun_get+0x1c/0x2f0 [ 366.025727][T17489] ? tun_get+0x1c/0x2f0 [ 366.025751][T17489] ? tun_get+0x1c/0x2f0 [ 366.025768][T17489] ? tun_get+0x1c/0x2f0 [ 366.025791][T17489] tun_chr_write_iter+0x113/0x200 [ 366.025813][T17489] vfs_write+0x61d/0xb90 [ 366.025844][T17489] ? __pfx_vfs_write+0x10/0x10 [ 366.025875][T17489] ? __fget_files+0x2a/0x420 [ 366.025904][T17489] ksys_write+0x150/0x270 [ 366.025930][T17489] ? __pfx_ksys_write+0x10/0x10 [ 366.025961][T17489] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 366.025989][T17489] do_syscall_64+0x15f/0xf80 [ 366.026008][T17489] ? trace_irq_disable+0x3b/0x140 [ 366.026025][T17489] ? clear_bhb_loop+0x40/0x90 [ 366.026045][T17489] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 366.026065][T17489] RIP: 0033:0x7f5ef6f5d04e [ 366.026081][T17489] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 366.026096][T17489] RSP: 002b:00007f5ef7f0bfb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 366.026115][T17489] RAX: ffffffffffffffda RBX: 00007f5ef7f0c6c0 RCX: 00007f5ef6f5d04e [ 366.026128][T17489] RDX: 000000000000004a RSI: 00002000000000c0 RDI: 00000000000000c8 [ 366.026139][T17489] RBP: 00007f5ef7f0c090 R08: 0000000000000000 R09: 0000000000000000 [ 366.026150][T17489] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 366.026160][T17489] R13: 00007f5ef7216038 R14: 00007f5ef7215fa0 R15: 00007ffd7a013c48 [ 366.026187][T17489] [ 366.027354][T17384] team0: Port device team_slave_0 added [ 366.214765][ T5824] Bluetooth: hci0: command tx timeout [ 366.387014][T17384] team0: Port device team_slave_1 added [ 366.501590][T17384] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 366.524306][T17384] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 366.569226][T17384] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 366.585599][T17384] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 366.596631][T17384] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 366.627277][T17384] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 366.707006][T17384] hsr_slave_0: entered promiscuous mode [ 366.733721][T17384] hsr_slave_1: entered promiscuous mode [ 366.762371][T17384] debugfs: 'hsr0' already exists in 'hsr' [ 366.786166][T17384] Cannot create hsr debugfs directory [ 366.959122][T17530] bond2: entered allmulticast mode [ 366.974624][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 366.982687][ C0] lec:lec_tx_timeout: lec0 [ 366.987348][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 367.013693][T17522] bond2: left allmulticast mode [ 367.595503][T17555] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3052'. [ 367.707035][T17555] 8021q: adding VLAN 0 to HW filter on device bond11 [ 367.780748][T17558] bond11: (slave veth13): Enslaving as an active interface with an up link [ 367.872111][T17568] syz_tun: entered allmulticast mode [ 367.957314][T17555] validate_nla: 1 callbacks suppressed [ 367.957333][T17555] netlink: 'syz.1.3052': attribute type 1 has an invalid length. [ 368.014422][T17564] syz_tun: left allmulticast mode [ 368.078928][T17555] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 368.119049][T17555] bond11: (slave batadv1): Enslaving as an active interface with an up link [ 368.206530][T17582] netlink: 'syz.2.3059': attribute type 2 has an invalid length. [ 368.263784][T17585] xt_TCPMSS: Only works on TCP SYN packets [ 368.316564][T17580] RDS: rds_bind could not find a transport for fe80::1a, load rds_tcp or rds_rdma? [ 368.335317][T17582] : entered promiscuous mode [ 368.357515][T17588] FAULT_INJECTION: forcing a failure. [ 368.357515][T17588] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 368.371322][ T5824] Bluetooth: hci0: command tx timeout [ 368.379796][T17588] CPU: 0 UID: 0 PID: 17588 Comm: syz.4.3060 Not tainted syzkaller #0 PREEMPT(full) [ 368.379818][T17588] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 368.379829][T17588] Call Trace: [ 368.379836][T17588] [ 368.379844][T17588] dump_stack_lvl+0xe8/0x150 [ 368.379875][T17588] should_fail_ex+0x412/0x560 [ 368.379905][T17588] _copy_to_user+0x31/0xb0 [ 368.379926][T17588] simple_read_from_buffer+0xe1/0x170 [ 368.379952][T17588] proc_fail_nth_read+0x1bb/0x230 [ 368.379986][T17588] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 368.380012][T17588] ? rw_verify_area+0x2a6/0x4d0 [ 368.380035][T17588] ? tun_chr_write_iter+0x18a/0x200 [ 368.380053][T17588] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 368.380076][T17588] vfs_read+0x20c/0xa70 [ 368.380104][T17588] ? __pfx___mutex_lock+0x10/0x10 [ 368.380126][T17588] ? __pfx_vfs_read+0x10/0x10 [ 368.380150][T17588] ? __fget_files+0x2a/0x420 [ 368.380174][T17588] ? __fget_files+0x3a0/0x420 [ 368.380193][T17588] ? __fget_files+0x2a/0x420 [ 368.380222][T17588] ksys_read+0x150/0x270 [ 368.380249][T17588] ? __pfx_ksys_read+0x10/0x10 [ 368.380281][T17588] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 368.380300][T17588] do_syscall_64+0x15f/0xf80 [ 368.380320][T17588] ? trace_irq_disable+0x3b/0x140 [ 368.380338][T17588] ? clear_bhb_loop+0x40/0x90 [ 368.380358][T17588] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 368.380376][T17588] RIP: 0033:0x7efd5a15d04e [ 368.380393][T17588] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 368.380407][T17588] RSP: 002b:00007efd583f5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 368.380426][T17588] RAX: ffffffffffffffda RBX: 00007efd583f66c0 RCX: 00007efd5a15d04e [ 368.380439][T17588] RDX: 000000000000000f RSI: 00007efd583f60a0 RDI: 0000000000000006 [ 368.380450][T17588] RBP: 00007efd583f6090 R08: 0000000000000000 R09: 0000000000000000 [ 368.380460][T17588] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 368.380471][T17588] R13: 00007efd5a416128 R14: 00007efd5a416090 R15: 00007ffc6cedacf8 [ 368.380500][T17588] [ 368.649832][T17584] lo speed is unknown, defaulting to 1000 [ 369.052328][T17608] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 369.239144][T17614] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3069'. [ 369.299284][T17624] netlink: 14 bytes leftover after parsing attributes in process `syz.1.3072'. [ 369.317765][T17624] dvmrp1: entered allmulticast mode [ 369.334010][T17624] syz_tun: left allmulticast mode [ 369.339395][T17624] dvmrp1: left allmulticast mode [ 369.378792][T17384] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 369.393622][T17384] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 369.426528][T17384] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 369.470122][T17384] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 369.510018][T17384] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 369.539423][T17384] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 369.559081][T17384] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 369.586620][T17384] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 369.761480][T17645] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3076'. [ 369.775262][T17384] 8021q: adding VLAN 0 to HW filter on device bond0 [ 369.789864][T17645] vlan2: entered promiscuous mode [ 369.796465][T17645] bond0: entered promiscuous mode [ 369.802287][T17645] bond_slave_0: entered promiscuous mode [ 369.808271][T17645] bond_slave_1: entered promiscuous mode [ 369.845696][T17384] 8021q: adding VLAN 0 to HW filter on device team0 [ 369.874414][ T138] bridge0: port 1(bridge_slave_0) entered blocking state [ 369.881575][ T138] bridge0: port 1(bridge_slave_0) entered forwarding state [ 369.934057][ T35] bridge0: port 2(bridge_slave_1) entered blocking state [ 369.941260][ T35] bridge0: port 2(bridge_slave_1) entered forwarding state [ 369.962260][T17651] netlink: 196 bytes leftover after parsing attributes in process `syz.1.3078'. [ 370.068819][T17384] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 370.162351][T17656] xt_hashlimit: Unknown mode mask C4, kernel too old? [ 370.258804][T17664] syz_tun: entered allmulticast mode [ 370.340092][T17657] syz_tun: left allmulticast mode [ 370.408607][T17384] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 370.436067][ T5824] Bluetooth: hci0: command tx timeout [ 370.535170][T17384] veth0_vlan: entered promiscuous mode [ 370.559048][T17384] veth1_vlan: entered promiscuous mode [ 370.633127][T17384] veth0_macvtap: entered promiscuous mode [ 370.656765][T17384] veth1_macvtap: entered promiscuous mode [ 370.721523][T17384] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 370.751905][T17384] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 370.797259][T11659] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 370.835608][T17680] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3087'. [ 370.838773][T11659] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 370.876869][T17680] netlink: 144 bytes leftover after parsing attributes in process `syz.3.3087'. [ 370.901628][T11659] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 370.923922][T11659] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 371.115974][ T138] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 371.144973][ T138] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 371.219576][T11664] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 371.250662][T11664] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 371.418787][T17695] netlink: 60 bytes leftover after parsing attributes in process `syz.0.3012'. [ 371.455460][T17695] netlink: 60 bytes leftover after parsing attributes in process `syz.0.3012'. [ 371.764463][T17706] syz_tun: entered allmulticast mode [ 371.903887][ T5826] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 371.917537][ T5826] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 371.931984][ T5826] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 371.941054][ T5826] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 371.949048][ T5826] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 371.980055][T17699] syz_tun: left allmulticast mode [ 371.994700][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 372.002780][ C0] lec:lec_tx_timeout: lec0 [ 372.007680][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 372.066861][T17708] lo speed is unknown, defaulting to 1000 [ 372.298994][T17717] netlink: 'syz.0.3097': attribute type 1 has an invalid length. [ 372.362050][T17714] syzkaller1: entered promiscuous mode [ 372.384664][T17714] syzkaller1: entered allmulticast mode [ 372.415416][T17719] bond1 (unregistering): Released all slaves [ 372.524826][ T5824] Bluetooth: hci0: command tx timeout [ 372.551837][T17719] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3097'. [ 372.900414][T17708] chnl_net:caif_netlink_parms(): no params data found [ 373.261153][T17757] syz_tun: entered allmulticast mode [ 373.287026][T17708] bridge0: port 1(bridge_slave_0) entered blocking state [ 373.302588][T17708] bridge0: port 1(bridge_slave_0) entered disabled state [ 373.319303][T17708] bridge_slave_0: entered allmulticast mode [ 373.341239][T17708] bridge_slave_0: entered promiscuous mode [ 373.362127][T17753] syz_tun: left allmulticast mode [ 373.379852][T17708] bridge0: port 2(bridge_slave_1) entered blocking state [ 373.393097][T17708] bridge0: port 2(bridge_slave_1) entered disabled state [ 373.402769][T17708] bridge_slave_1: entered allmulticast mode [ 373.411177][T17708] bridge_slave_1: entered promiscuous mode [ 373.500716][T17708] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 373.522766][T17764] syzkaller1: entered promiscuous mode [ 373.529750][T17764] syzkaller1: entered allmulticast mode [ 373.542329][T17708] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 373.683876][T17708] team0: Port device team_slave_0 added [ 373.711975][T17708] team0: Port device team_slave_1 added [ 373.864392][T17708] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 373.893398][T17708] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 373.978568][T17708] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 374.006622][T17708] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 374.013580][T17708] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 374.046851][ T5824] Bluetooth: hci2: command tx timeout [ 374.074679][T17708] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 374.153907][T17779] bond0: mtu greater than device maximum [ 374.160267][T17779] team0: Device bond0 failed to change mtu [ 374.306734][T17791] syz_tun: entered allmulticast mode [ 374.367611][T17708] hsr_slave_0: entered promiscuous mode [ 374.391586][T17708] hsr_slave_1: entered promiscuous mode [ 374.407832][T17708] debugfs: 'hsr0' already exists in 'hsr' [ 374.433726][T17708] Cannot create hsr debugfs directory [ 374.467612][T17786] syz_tun: left allmulticast mode [ 374.528390][T17802] netlink: 'syz.1.3120': attribute type 1 has an invalid length. [ 374.577630][T17803] syz_tun: entered allmulticast mode [ 374.642360][T17802] 8021q: adding VLAN 0 to HW filter on device bond12 [ 374.817620][T17807] syzkaller1: entered promiscuous mode [ 374.832125][T17807] syzkaller1: entered allmulticast mode [ 374.912229][T17816] netlink: 108 bytes leftover after parsing attributes in process `syz.1.3124'. [ 374.935974][T17816] netlink: 108 bytes leftover after parsing attributes in process `syz.1.3124'. [ 374.957696][T17817] netlink: 108 bytes leftover after parsing attributes in process `syz.1.3124'. [ 374.975240][T17817] netlink: 108 bytes leftover after parsing attributes in process `syz.1.3124'. [ 375.020634][T17708] netdevsim netdevsim4 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 375.051749][T17708] netdevsim netdevsim4 eth3 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 375.137549][T17828] sctp: [Deprecated]: syz.1.3126 (pid 17828) Use of struct sctp_assoc_value in delayed_ack socket option. [ 375.137549][T17828] Use struct sctp_sack_info instead [ 375.177007][T17832] netlink: 'syz.3.3125': attribute type 20 has an invalid length. [ 375.289543][T17708] netdevsim netdevsim4 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 375.314337][T17708] netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 375.470836][T17708] netdevsim netdevsim4 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 375.500771][T17708] netdevsim netdevsim4 eth1 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 375.569246][T17845] syz_tun: entered allmulticast mode [ 375.596966][T17847] Cannot find set identified by id 3 to match [ 375.617022][T17708] netdevsim netdevsim4 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 375.641281][T17708] netdevsim netdevsim4 eth0 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 375.701938][T17838] lo speed is unknown, defaulting to 1000 [ 375.702593][T17842] syz_tun: left allmulticast mode [ 376.110685][T17708] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 376.118935][ T5824] Bluetooth: hci2: command tx timeout [ 376.138588][T17708] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 376.162026][T17708] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 376.211266][T17708] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 376.233689][T17708] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 376.256134][T17708] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 376.274239][T17708] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 376.308484][T17708] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 376.337946][T17863] syzkaller1: entered promiscuous mode [ 376.351390][T17863] syzkaller1: entered allmulticast mode [ 376.512672][T17881] netlink: 'syz.2.3137': attribute type 2 has an invalid length. [ 376.625101][T17885] delete_channel: no stack [ 376.779247][T17894] syzkaller0: entered promiscuous mode [ 376.797626][T17894] syzkaller0: entered allmulticast mode [ 376.890752][T17901] syz_tun: entered allmulticast mode [ 376.903821][T17903] netlink: 'syz.1.3143': attribute type 1 has an invalid length. [ 376.957292][T17708] 8021q: adding VLAN 0 to HW filter on device bond0 [ 377.014661][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 377.022742][ C0] lec:lec_tx_timeout: lec0 [ 377.027646][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 377.132870][T17708] 8021q: adding VLAN 0 to HW filter on device team0 [ 377.160994][T17915] lo speed is unknown, defaulting to 1000 [ 377.161081][T17897] syz_tun: left allmulticast mode [ 377.229878][ T138] bridge0: port 1(bridge_slave_0) entered blocking state [ 377.237087][ T138] bridge0: port 1(bridge_slave_0) entered forwarding state [ 377.281859][ T138] bridge0: port 2(bridge_slave_1) entered blocking state [ 377.289081][ T138] bridge0: port 2(bridge_slave_1) entered forwarding state [ 377.314738][ C0] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 377.695526][T17945] netlink: 76 bytes leftover after parsing attributes in process `syz.3.3149'. [ 377.786697][T17948] syzkaller1: entered promiscuous mode [ 377.804383][T17948] syzkaller1: entered allmulticast mode [ 377.896325][T17954] netlink: 'syz.0.3151': attribute type 1 has an invalid length. [ 377.931254][T17954] netlink: 'syz.0.3151': attribute type 1 has an invalid length. [ 377.934286][T17958] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3151'. [ 378.063825][T17708] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 378.194798][ T5824] Bluetooth: hci2: command tx timeout [ 378.220790][T17970] netlink: 112 bytes leftover after parsing attributes in process `syz.1.3155'. [ 378.239581][T17973] syz_tun: entered allmulticast mode [ 378.378010][T17966] syz_tun: left allmulticast mode [ 378.745769][T17708] veth0_vlan: entered promiscuous mode [ 378.779784][T17708] veth1_vlan: entered promiscuous mode [ 378.897127][T17708] veth0_macvtap: entered promiscuous mode [ 378.908826][T18003] syzkaller1: entered promiscuous mode [ 378.918748][T18003] syzkaller1: entered allmulticast mode [ 378.938389][T17708] veth1_macvtap: entered promiscuous mode [ 378.981100][T18008] netlink: 'syz.2.3166': attribute type 1 has an invalid length. [ 378.999002][T18008] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 379.115948][T17708] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 379.150107][T17708] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 379.174027][ T138] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 379.194356][ T138] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 379.220173][ T138] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 379.241575][ T138] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 379.379485][ T48] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 379.398204][ T48] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 379.453616][ T138] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 379.467029][ T138] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 379.537474][T18023] syz_tun: entered allmulticast mode [ 379.630268][T18027] syzkaller0: entered promiscuous mode [ 379.642931][T18027] syzkaller0: entered allmulticast mode [ 379.678478][T18020] syz_tun: left allmulticast mode [ 380.040401][ T5826] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 380.053999][ T5826] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 380.063818][ T5826] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 380.075115][ T5826] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 380.084020][ T5826] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 380.146280][T18046] ip6tnl1: entered allmulticast mode [ 380.177064][T18048] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3177'. [ 380.227891][T18046] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3177'. [ 380.277061][ T5824] Bluetooth: hci2: command tx timeout [ 380.294988][T18046] netlink: 40 bytes leftover after parsing attributes in process `syz.4.3177'. [ 380.327202][T18045] lo speed is unknown, defaulting to 1000 [ 380.328042][T18050] syzkaller1: entered promiscuous mode [ 380.339254][T18050] syzkaller1: entered allmulticast mode [ 380.356362][T18046] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3177'. [ 380.361058][T18052] netlink: 68 bytes leftover after parsing attributes in process `syz.0.3179'. [ 381.022780][T18087] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3182'. [ 381.113298][T18090] macvtap1: entered promiscuous mode [ 381.128561][T18090] macvtap1: entered allmulticast mode [ 381.150591][T18090] veth1_vlan: entered allmulticast mode [ 381.538197][T18118] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3188'. [ 381.558638][T18110] syz_tun: entered allmulticast mode [ 381.594005][T18097] lo speed is unknown, defaulting to 1000 [ 381.596978][T18099] syz_tun: left allmulticast mode [ 381.662579][T18128] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3189'. [ 381.717590][T18130] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 381.726558][T18130] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 381.734482][T18130] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 381.742541][T18130] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 381.793298][T18045] chnl_net:caif_netlink_parms(): no params data found [ 381.990015][T18136] syzkaller1: entered promiscuous mode [ 382.008038][T18136] syzkaller1: entered allmulticast mode [ 382.034748][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 382.042837][ C0] lec:lec_tx_timeout: lec0 [ 382.047616][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 382.197092][ T5824] Bluetooth: hci4: command tx timeout [ 382.469106][T18045] bridge0: port 1(bridge_slave_0) entered blocking state [ 382.488639][T18045] bridge0: port 1(bridge_slave_0) entered disabled state [ 382.517841][T18045] bridge_slave_0: entered allmulticast mode [ 382.530976][T18045] bridge_slave_0: entered promiscuous mode [ 382.566540][T18045] bridge0: port 2(bridge_slave_1) entered blocking state [ 382.600372][T18045] bridge0: port 2(bridge_slave_1) entered disabled state [ 382.607782][T18172] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3200'. [ 382.643178][T18045] bridge_slave_1: entered allmulticast mode [ 382.652555][T18045] bridge_slave_1: entered promiscuous mode [ 382.709866][T18177] syz_tun: entered allmulticast mode [ 382.792764][T18045] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 382.827462][T18045] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 382.838266][T18173] syz_tun: left allmulticast mode [ 382.933004][T18045] team0: Port device team_slave_0 added [ 382.951689][T18045] team0: Port device team_slave_1 added [ 383.039611][T18185] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3202'. [ 383.056020][T18186] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 383.088494][T18045] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 383.105961][T18045] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 383.154901][T18045] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 383.202256][T18045] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 383.221306][T18045] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 383.279425][T18045] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 383.294407][T18190] syzkaller1: entered promiscuous mode [ 383.303139][T18190] syzkaller1: entered allmulticast mode [ 383.493534][T18197] lo speed is unknown, defaulting to 1000 [ 383.668313][T18045] hsr_slave_0: entered promiscuous mode [ 383.684011][T18045] hsr_slave_1: entered promiscuous mode [ 383.690788][T18045] debugfs: 'hsr0' already exists in 'hsr' [ 383.699215][T18045] Cannot create hsr debugfs directory [ 383.725440][T18193] lo speed is unknown, defaulting to 1000 [ 383.979947][T18221] syz_tun: entered allmulticast mode [ 384.042206][T18213] lo speed is unknown, defaulting to 1000 [ 384.066439][T18199] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 384.083960][T18214] syz_tun: left allmulticast mode [ 384.275337][ T5824] Bluetooth: hci4: command tx timeout [ 384.865961][T18249] syzkaller1: entered promiscuous mode [ 384.886848][T18249] syzkaller1: entered allmulticast mode [ 384.898354][T18241] lo speed is unknown, defaulting to 1000 [ 385.373422][T18272] syz_tun: entered allmulticast mode [ 385.415640][T18272] FAULT_INJECTION: forcing a failure. [ 385.415640][T18272] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 385.442522][T18272] CPU: 1 UID: 0 PID: 18272 Comm: syz.0.3224 Not tainted syzkaller #0 PREEMPT(full) [ 385.442547][T18272] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 385.442558][T18272] Call Trace: [ 385.442566][T18272] [ 385.442573][T18272] dump_stack_lvl+0xe8/0x150 [ 385.442605][T18272] should_fail_ex+0x412/0x560 [ 385.442635][T18272] _copy_from_user+0x2d/0xb0 [ 385.442654][T18272] copy_from_sockptr+0x48/0x70 [ 385.442678][T18272] ip_mroute_setsockopt+0x812/0x1090 [ 385.442709][T18272] ? __pfx_ip_mroute_setsockopt+0x10/0x10 [ 385.442733][T18272] ? get_pid_task+0x20/0x1f0 [ 385.442763][T18272] ? __lock_acquire+0x6b5/0x2cf0 [ 385.442790][T18272] do_ip_setsockopt+0xf1e/0x2ea0 [ 385.442819][T18272] ? __pfx_do_ip_setsockopt+0x10/0x10 [ 385.442840][T18272] ? aa_sk_perm+0x6d5/0x900 [ 385.442863][T18272] ? __fget_files+0x2a/0x420 [ 385.442889][T18272] ? __pfx_aa_sk_perm+0x10/0x10 [ 385.442912][T18272] ? __fget_files+0x2a/0x420 [ 385.442931][T18272] ? aa_sock_opt_perm+0xff/0x1a0 [ 385.442956][T18272] ip_setsockopt+0x66/0x110 [ 385.442975][T18272] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 385.442999][T18272] do_sock_setsockopt+0x17c/0x1b0 [ 385.443034][T18272] __x64_sys_setsockopt+0x13d/0x1b0 [ 385.443060][T18272] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 385.443080][T18272] do_syscall_64+0x15f/0xf80 [ 385.443100][T18272] ? trace_irq_disable+0x3b/0x140 [ 385.443118][T18272] ? clear_bhb_loop+0x40/0x90 [ 385.443139][T18272] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 385.443162][T18272] RIP: 0033:0x7fa8e0f9c819 [ 385.443178][T18272] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 385.443192][T18272] RSP: 002b:00007fa8df1f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 385.443211][T18272] RAX: ffffffffffffffda RBX: 00007fa8e1216090 RCX: 00007fa8e0f9c819 [ 385.443222][T18272] RDX: 00000000000000d2 RSI: 0000000000000000 RDI: 000000000000000a [ 385.443233][T18272] RBP: 00007fa8df1f6090 R08: 000000000000003c R09: 0000000000000000 [ 385.443241][T18272] R10: 0000200000000200 R11: 0000000000000246 R12: 0000000000000001 [ 385.443251][T18272] R13: 00007fa8e1216128 R14: 00007fa8e1216090 R15: 00007fff23e776e8 [ 385.443281][T18272] [ 385.738595][T18267] syz_tun: left allmulticast mode [ 385.763073][T18280] __nla_validate_parse: 5 callbacks suppressed [ 385.763089][T18280] netlink: 187824 bytes leftover after parsing attributes in process `syz.4.3227'. [ 385.921032][T18291] netlink: 'syz.4.3230': attribute type 1 has an invalid length. [ 385.923544][T18282] netlink: 'syz.1.3228': attribute type 1 has an invalid length. [ 385.931027][T18292] netlink: 'syz.4.3230': attribute type 1 has an invalid length. [ 385.945664][T18291] netlink: 'syz.4.3230': attribute type 4 has an invalid length. [ 385.947795][T18292] netlink: 'syz.4.3230': attribute type 4 has an invalid length. [ 385.962022][T18292] netlink: 9462 bytes leftover after parsing attributes in process `syz.4.3230'. [ 385.971507][T18291] netlink: 9462 bytes leftover after parsing attributes in process `syz.4.3230'. [ 386.071667][T18282] 8021q: adding VLAN 0 to HW filter on device bond13 [ 386.099537][T18297] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3231'. [ 386.116156][T18045] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 386.128438][T18045] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 386.138137][T18045] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 386.150347][T18045] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 386.176675][T18045] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 386.194142][T18045] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 386.204424][T18045] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 386.224014][T18045] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 386.308886][T18309] syzkaller1: entered promiscuous mode [ 386.314447][T18309] syzkaller1: entered allmulticast mode [ 386.355473][ T5824] Bluetooth: hci4: command tx timeout [ 386.396132][T18045] 8021q: adding VLAN 0 to HW filter on device bond0 [ 386.421085][T18045] 8021q: adding VLAN 0 to HW filter on device team0 [ 386.438870][T11663] bridge0: port 1(bridge_slave_0) entered blocking state [ 386.446072][T11663] bridge0: port 1(bridge_slave_0) entered forwarding state [ 386.467253][ T3575] bridge0: port 2(bridge_slave_1) entered blocking state [ 386.474452][ T3575] bridge0: port 2(bridge_slave_1) entered forwarding state [ 386.565436][T18315] syz_tun: entered allmulticast mode [ 386.650452][T18312] syz_tun: left allmulticast mode [ 386.804010][T18321] lo speed is unknown, defaulting to 1000 [ 386.837668][ T3575] wlan1: Trigger new scan to find an IBSS to join [ 387.003594][T18045] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 387.054615][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 387.062680][ C0] lec:lec_tx_timeout: lec0 [ 387.067971][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 387.402706][T18045] veth0_vlan: entered promiscuous mode [ 387.408643][T18354] netlink: 'syz.1.3244': attribute type 1 has an invalid length. [ 387.468358][T18359] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3244'. [ 387.497964][T18354] bond14: entered promiscuous mode [ 387.503551][T18354] 8021q: adding VLAN 0 to HW filter on device bond14 [ 387.590614][T18354] bond14: (slave bridge11): making interface the new active one [ 387.602158][T18354] bridge11: entered promiscuous mode [ 387.614458][T18354] bond14: (slave bridge11): Enslaving as an active interface with an up link [ 387.630514][T18367] syz_tun: entered allmulticast mode [ 387.655554][T18045] veth1_vlan: entered promiscuous mode [ 387.670826][T18363] syz_tun: left allmulticast mode [ 387.759461][T18045] veth0_macvtap: entered promiscuous mode [ 387.787024][T18045] veth1_macvtap: entered promiscuous mode [ 387.847188][T18374] netlink: 43 bytes leftover after parsing attributes in process `syz.3.3249'. [ 387.863747][T18045] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 387.940512][T18374] IPv6: sit1: Disabled Multicast RS [ 387.947360][T18374] sit1: entered allmulticast mode [ 387.959963][T18045] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 388.012326][ T13] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 388.028649][ T13] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 388.053015][ T13] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 388.062824][ T13] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 388.229656][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 388.254369][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 388.330482][T18383] netlink: 'syz.1.3252': attribute type 1 has an invalid length. [ 388.343420][ T3575] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 388.359661][ T3575] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 388.435675][ T5824] Bluetooth: hci4: command tx timeout [ 388.474219][T18386] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3255'. [ 388.531347][T18390] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3256'. [ 388.544892][T18390] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3256'. [ 388.544926][T18386] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3255'. [ 388.587018][ T3575] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 388.619520][ T3575] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 388.644431][ T3575] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 388.653810][ T3575] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 388.762122][T18395] openvswitch: netlink: nsh attribute has 4 unknown bytes. [ 388.785849][ T7211] IPVS: starting estimator thread 0... [ 388.792996][T18395] netlink: 'syz.3.3257': attribute type 1 has an invalid length. [ 388.803569][T18399] syzkaller1: entered promiscuous mode [ 388.809649][T18399] syzkaller1: entered allmulticast mode [ 388.884750][T18400] IPVS: using max 30 ests per chain, 72000 per kthread [ 388.941143][T18395] 8021q: adding VLAN 0 to HW filter on device bond3 [ 388.998668][ T5826] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 389.011615][ T5826] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 389.021575][ T5826] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 389.034218][ T5826] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 389.045251][ T5826] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 389.165619][T18409] syz_tun: entered allmulticast mode [ 389.220206][T18408] FAULT_INJECTION: forcing a failure. [ 389.220206][T18408] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 389.271721][T18408] CPU: 1 UID: 0 PID: 18408 Comm: syz.0.3261 Not tainted syzkaller #0 PREEMPT(full) [ 389.271764][T18408] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 389.271785][T18408] Call Trace: [ 389.271792][T18408] [ 389.271799][T18408] dump_stack_lvl+0xe8/0x150 [ 389.271829][T18408] should_fail_ex+0x412/0x560 [ 389.271858][T18408] _copy_from_user+0x2d/0xb0 [ 389.271876][T18408] kstrtouint_from_user+0xd6/0x180 [ 389.271900][T18408] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 389.271938][T18408] proc_fail_nth_write+0x8e/0x210 [ 389.271962][T18408] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 389.271988][T18408] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 389.272012][T18408] vfs_write+0x29a/0xb90 [ 389.272046][T18408] ? __pfx_vfs_write+0x10/0x10 [ 389.272070][T18408] ? __fget_files+0x2a/0x420 [ 389.272094][T18408] ? __fget_files+0x3a0/0x420 [ 389.272112][T18408] ? __fget_files+0x2a/0x420 [ 389.272142][T18408] ksys_write+0x150/0x270 [ 389.272170][T18408] ? __pfx_ksys_write+0x10/0x10 [ 389.272202][T18408] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 389.272221][T18408] do_syscall_64+0x15f/0xf80 [ 389.272241][T18408] ? trace_irq_disable+0x3b/0x140 [ 389.272260][T18408] ? clear_bhb_loop+0x40/0x90 [ 389.272282][T18408] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 389.272299][T18408] RIP: 0033:0x7fa8e0f5d04e [ 389.272316][T18408] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 389.272330][T18408] RSP: 002b:00007fa8df1f5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 389.272350][T18408] RAX: ffffffffffffffda RBX: 00007fa8df1f66c0 RCX: 00007fa8e0f5d04e [ 389.272363][T18408] RDX: 0000000000000001 RSI: 00007fa8df1f60a0 RDI: 000000000000000b [ 389.272374][T18408] RBP: 00007fa8df1f6090 R08: 0000000000000000 R09: 0000000000000000 [ 389.272384][T18408] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 389.272395][T18408] R13: 00007fa8e1216128 R14: 00007fa8e1216090 R15: 00007fff23e776e8 [ 389.272425][T18408] [ 389.607882][T18405] syz_tun: left allmulticast mode [ 389.636783][T18403] lo speed is unknown, defaulting to 1000 [ 389.719149][T18419] vlan3: entered promiscuous mode [ 389.732684][T18419] bridge0: entered promiscuous mode [ 389.840220][T18421] tipc: Started in network mode [ 389.870504][T18421] tipc: Node identity feb3d2b9973f, cluster identity 4711 [ 389.878031][ T3575] wlan1: Trigger new scan to find an IBSS to join [ 389.902154][T18421] tipc: Enabled bearer , priority 0 [ 389.969394][T18429] IPv6: NLM_F_CREATE should be specified when creating new route [ 390.006713][T18423] syzkaller0: entered promiscuous mode [ 390.012753][T18423] syzkaller0: entered allmulticast mode [ 390.189524][T18423] tipc: Resetting bearer [ 390.238668][T18420] tipc: Resetting bearer [ 390.296747][T18420] tipc: Disabling bearer [ 390.443853][T18450] syz_tun: entered allmulticast mode [ 390.480121][T18443] syz_tun: left allmulticast mode [ 390.555065][T18461] syzkaller1: entered promiscuous mode [ 390.560649][T18461] syzkaller1: entered allmulticast mode [ 390.650842][T18403] chnl_net:caif_netlink_parms(): no params data found [ 390.955893][T18403] bridge0: port 1(bridge_slave_0) entered blocking state [ 390.965631][T18403] bridge0: port 1(bridge_slave_0) entered disabled state [ 390.972929][T18403] bridge_slave_0: entered allmulticast mode [ 390.980975][T18403] bridge_slave_0: entered promiscuous mode [ 390.989645][T18403] bridge0: port 2(bridge_slave_1) entered blocking state [ 390.997264][T18403] bridge0: port 2(bridge_slave_1) entered disabled state [ 391.004818][T18403] bridge_slave_1: entered allmulticast mode [ 391.018768][T18403] bridge_slave_1: entered promiscuous mode [ 391.093652][T18491] __nla_validate_parse: 12 callbacks suppressed [ 391.093670][T18491] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3284'. [ 391.110130][T18491] openvswitch: netlink: Flow key attr not present in new flow. [ 391.155497][ T5824] Bluetooth: hci1: command tx timeout [ 391.160373][T18403] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 391.212807][T18403] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 391.341435][T18403] team0: Port device team_slave_0 added [ 391.389267][T18403] team0: Port device team_slave_1 added [ 391.491702][T18403] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 391.519059][T18403] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 391.562253][T18403] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 391.578442][T18517] syz_tun: entered allmulticast mode [ 391.599987][T18520] Cannot find set identified by id 65534 to match [ 391.601320][T18403] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 391.611272][T18520] netlink: 48 bytes leftover after parsing attributes in process `syz.3.3290'. [ 391.628829][T18403] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 391.661553][T18403] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 391.716932][T18513] xt_CT: No such helper "syz1" [ 391.767376][T18519] lo speed is unknown, defaulting to 1000 [ 391.767442][T18506] syz_tun: left allmulticast mode [ 391.917092][T18403] hsr_slave_0: entered promiscuous mode [ 391.923937][T18403] hsr_slave_1: entered promiscuous mode [ 391.931378][T18403] debugfs: 'hsr0' already exists in 'hsr' [ 391.937468][T18403] Cannot create hsr debugfs directory [ 392.061980][T18537] sctp: [Deprecated]: syz.3.3293 (pid 18537) Use of struct sctp_assoc_value in delayed_ack socket option. [ 392.061980][T18537] Use struct sctp_sack_info instead [ 392.078508][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 392.078540][ C0] lec:lec_tx_timeout: lec0 [ 392.087145][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 392.095279][T18539] netlink: 32 bytes leftover after parsing attributes in process `syz.4.3296'. [ 392.135336][T18530] lo speed is unknown, defaulting to 1000 [ 392.324002][T18543] netlink: 'syz.4.3297': attribute type 1 has an invalid length. [ 392.345854][T18543] netlink: 'syz.4.3297': attribute type 3 has an invalid length. [ 392.353891][T18543] netlink: 224 bytes leftover after parsing attributes in process `syz.4.3297'. [ 392.680815][T18552] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable [ 392.711705][T18554] bridge0: port 2(bridge_slave_1) entered disabled state [ 392.720749][T18554] bridge0: port 1(bridge_slave_0) entered disabled state [ 392.834974][T11661] wlan1: Trigger new scan to find an IBSS to join [ 393.018776][T18403] netdevsim netdevsim1 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 393.030307][T18560] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3302'. [ 393.088622][T18563] netlink: 52 bytes leftover after parsing attributes in process `syz.4.3302'. [ 393.235136][ T5824] Bluetooth: hci1: command tx timeout [ 393.310953][T18403] netdevsim netdevsim1 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 393.469103][T18403] netdevsim netdevsim1 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 393.520536][T18572] syz_tun: entered allmulticast mode [ 393.558244][T18403] netdevsim netdevsim1 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 393.640568][T18567] syz_tun: left allmulticast mode [ 393.657910][T18577] netlink: 36 bytes leftover after parsing attributes in process `syz.4.3306'. [ 393.778999][T18585] bond0: option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0) [ 393.837025][ T3575] wlan1: Creating new IBSS network, BSSID aa:67:d0:99:34:2a [ 393.854000][T18580] lo speed is unknown, defaulting to 1000 [ 394.286506][T18608] netlink: 'syz.4.3313': attribute type 21 has an invalid length. [ 394.296616][T18610] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3314'. [ 394.318902][T18608] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3313'. [ 394.362350][T18610] netlink: 'syz.0.3314': attribute type 2 has an invalid length. [ 394.370465][T18610] netlink: 'syz.0.3314': attribute type 1 has an invalid length. [ 394.370655][T18403] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 394.378996][T18610] netlink: 152 bytes leftover after parsing attributes in process `syz.0.3314'. [ 394.415079][T18403] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 394.422957][T18403] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 394.452237][T18403] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 394.693556][T18403] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 394.754530][T18403] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 394.782858][T18403] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 394.816179][T18403] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 394.836792][T18629] syz_tun: entered allmulticast mode [ 394.909786][T18622] syz_tun: left allmulticast mode [ 395.039184][T18648] batadv0: entered promiscuous mode [ 395.050558][T18648] macvtap1: entered promiscuous mode [ 395.060870][T18648] macvtap1: entered allmulticast mode [ 395.069605][T18648] batadv0: entered allmulticast mode [ 395.077695][T18648] 8021q: adding VLAN 0 to HW filter on device macvtap1 [ 395.088148][T18653] netlink: 'syz.0.3324': attribute type 1 has an invalid length. [ 395.092147][T18630] lo speed is unknown, defaulting to 1000 [ 395.107312][T18653] netlink: 'syz.0.3324': attribute type 2 has an invalid length. [ 395.133792][T18651] batadv0: left allmulticast mode [ 395.148157][T18651] batadv0: left promiscuous mode [ 395.315351][ T5824] Bluetooth: hci1: command tx timeout [ 395.489022][T18403] 8021q: adding VLAN 0 to HW filter on device bond0 [ 395.509296][T18403] 8021q: adding VLAN 0 to HW filter on device team0 [ 395.578098][T11664] bridge0: port 1(bridge_slave_0) entered blocking state [ 395.585331][T11664] bridge0: port 1(bridge_slave_0) entered forwarding state [ 395.616941][T18670] syzkaller0: entered promiscuous mode [ 395.622479][T18670] syzkaller0: entered allmulticast mode [ 395.642048][T11664] bridge0: port 2(bridge_slave_1) entered blocking state [ 395.649295][T11664] bridge0: port 2(bridge_slave_1) entered forwarding state [ 396.200249][T18705] netlink: 'syz.0.3339': attribute type 1 has an invalid length. [ 396.232526][T18705] IPv6: NLM_F_CREATE should be specified when creating new route [ 396.262838][T18705] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 396.270149][T18705] IPv6: NLM_F_CREATE should be set when creating new route [ 396.277469][T18705] IPv6: NLM_F_CREATE should be set when creating new route [ 396.284756][T18705] IPv6: NLM_F_CREATE should be set when creating new route [ 396.379320][T18705] __nla_validate_parse: 3 callbacks suppressed [ 396.379337][T18705] netlink: 16186 bytes leftover after parsing attributes in process `syz.0.3339'. [ 396.471676][T18705] netlink: 'syz.0.3339': attribute type 1 has an invalid length. [ 396.478146][T18713] netlink: 'syz.3.3341': attribute type 10 has an invalid length. [ 396.504824][T18705] netlink: 224 bytes leftover after parsing attributes in process `syz.0.3339'. [ 396.540337][T18713] 8021q: adding VLAN 0 to HW filter on device team0 [ 396.599095][T18713] team0: entered promiscuous mode [ 396.646384][T18713] team_slave_0: entered promiscuous mode [ 396.664365][T18713] team_slave_1: entered promiscuous mode [ 396.705642][T18713] bond0: (slave team0): Enslaving as an active interface with an up link [ 396.819272][T18403] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 396.847361][T18729] xt_TCPMSS: Only works on TCP SYN packets [ 396.879658][T18728] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3345'. [ 397.080791][T18728] syzkaller0: entered promiscuous mode [ 397.088436][T18728] syzkaller0: entered allmulticast mode [ 397.106856][T18403] veth0_vlan: entered promiscuous mode [ 397.260484][T18403] veth1_vlan: entered promiscuous mode [ 397.395230][ T5824] Bluetooth: hci1: command tx timeout [ 397.462846][T18746] hsr0: entered promiscuous mode [ 397.471923][T18749] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3351'. [ 397.483516][T18403] veth0_macvtap: entered promiscuous mode [ 397.514344][T18403] veth1_macvtap: entered promiscuous mode [ 397.579918][T18403] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 397.632466][T18403] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 397.684007][ T13] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 397.722853][ T13] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 397.753683][ T13] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 397.793845][ T13] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 397.855560][T18762] netlink: 34 bytes leftover after parsing attributes in process `syz.3.3357'. [ 397.876133][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5790 ms [ 397.884192][ C0] lec:lec_tx_timeout: lec0 [ 397.886835][T18767] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3358'. [ 397.889208][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 397.923541][T18762] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3357'. [ 397.993186][T18770] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3357'. [ 398.023602][T18766] validate_nla: 1 callbacks suppressed [ 398.023621][T18766] netlink: 'syz.2.3359': attribute type 1 has an invalid length. [ 398.097544][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 398.129776][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 398.252953][T18776] xt_CT: No such helper "syz1" [ 398.262225][T18782] netlink: 'syz.4.3361': attribute type 1 has an invalid length. [ 398.295598][T18769] lo speed is unknown, defaulting to 1000 [ 398.331146][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 398.354136][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 398.367166][T18784] syz.3.3362 uses old SIOCAX25GETINFO [ 398.418751][T18784] netlink: 36 bytes leftover after parsing attributes in process `syz.3.3362'. [ 398.559378][T18792] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3364'. [ 398.609241][T18796] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 398.851759][T18795] syzkaller1: entered promiscuous mode [ 398.858052][T18795] syzkaller1: entered allmulticast mode [ 399.041129][T18805] lo speed is unknown, defaulting to 1000 [ 399.442670][T18844] IPVS: sync thread started: state = MASTER, mcast_ifn = bridge_slave_0, syncid = 3, id = 0 [ 399.561337][T18836] lo speed is unknown, defaulting to 1000 [ 399.669027][T18855] netlink: 'syz.3.3380': attribute type 21 has an invalid length. [ 400.006749][T18864] batadv_slave_0: entered promiscuous mode [ 400.020591][T18866] syzkaller1: entered promiscuous mode [ 400.031387][T18866] syzkaller1: entered allmulticast mode [ 400.087311][T18864] bond1: entered promiscuous mode [ 400.103544][T18864] 8021q: adding VLAN 0 to HW filter on device bond1 [ 400.120595][T18864] bond1 (unregistering): Released all slaves [ 400.218190][T18862] batadv_slave_0: left promiscuous mode [ 400.586744][T18903] Bluetooth: MGMT ver 1.23 [ 401.017691][T18928] netlink: 'syz.0.3401': attribute type 21 has an invalid length. [ 401.087539][T18928] netlink: 'syz.0.3401': attribute type 4 has an invalid length. [ 401.272962][T18929] syzkaller1: entered promiscuous mode [ 401.288951][T18929] syzkaller1: entered allmulticast mode [ 401.387869][T18922] netlink: zone id is out of range [ 401.393459][T18922] netlink: zone id is out of range [ 401.399809][T18922] netlink: zone id is out of range [ 401.406326][T18922] netlink: zone id is out of range [ 401.413318][T18922] netlink: zone id is out of range [ 401.420802][T18922] netlink: zone id is out of range [ 401.461851][T18922] netlink: zone id is out of range [ 401.486266][T18922] netlink: zone id is out of range [ 401.499055][T18922] netlink: zone id is out of range [ 401.551418][T18936] bridge0: port 3(veth0_to_bridge) entered blocking state [ 401.561626][T18936] bridge0: port 3(veth0_to_bridge) entered disabled state [ 401.569777][T18936] veth0_to_bridge: entered allmulticast mode [ 401.609699][T18936] veth0_to_bridge: entered promiscuous mode [ 401.625269][T18936] bridge0: adding interface veth0_to_bridge with same address as a received packet (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 401.661550][T18936] bridge0: port 3(veth0_to_bridge) entered blocking state [ 401.670264][T18936] bridge0: port 3(veth0_to_bridge) entered forwarding state [ 401.922209][T18952] netlink: 'syz.4.3409': attribute type 1 has an invalid length. [ 401.981394][T18952] __nla_validate_parse: 6 callbacks suppressed [ 401.981421][T18952] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3409'. [ 401.990582][T18961] netlink: 'syz.2.3406': attribute type 1 has an invalid length. [ 402.058388][T18962] netlink: 'syz.1.3410': attribute type 1 has an invalid length. [ 402.071811][T18961] netlink: 'syz.2.3406': attribute type 1 has an invalid length. [ 402.077558][T18952] netlink: 'syz.4.3409': attribute type 1 has an invalid length. [ 402.084744][T18962] netlink: 260 bytes leftover after parsing attributes in process `syz.1.3410'. [ 402.115141][T18961] netlink: 9172 bytes leftover after parsing attributes in process `syz.2.3406'. [ 402.139301][T18962] bridge0: port 1(bridge_slave_0) entered disabled state [ 402.199197][T18966] syzkaller0: entered promiscuous mode [ 402.215686][T18966] syzkaller0: entered allmulticast mode [ 402.307193][T18971] bridge1: entered promiscuous mode [ 402.548851][T18981] syzkaller1: entered promiscuous mode [ 402.563645][T18981] syzkaller1: entered allmulticast mode [ 402.622880][T18991] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3418'. [ 402.916135][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 402.924194][ C0] lec:lec_tx_timeout: lec0 [ 402.929262][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 403.191187][T18990] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 403.330518][T19018] xt_connbytes: Forcing CT accounting to be enabled [ 403.369600][T19018] ip6t_REJECT: TCP_RESET illegal for non-tcp [ 403.421595][T18990] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 403.540534][T18990] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 403.614127][T19034] syzkaller1: entered promiscuous mode [ 403.623315][T19034] syzkaller1: entered allmulticast mode [ 403.639890][T19035] netlink: 68 bytes leftover after parsing attributes in process `syz.0.3428'. [ 403.682687][T18990] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 403.897814][T11664] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 403.947540][T11661] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 403.957026][T11661] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 404.010726][T19055] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3432'. [ 404.029277][T18075] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 404.136599][T19057] RDS: rds_bind could not find a transport for fec0:ffff::1, load rds_tcp or rds_rdma? [ 404.272880][T19063] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3438'. [ 404.371788][T19067] lo speed is unknown, defaulting to 1000 [ 404.560114][T19075] syzkaller1: entered promiscuous mode [ 404.575095][T19075] syzkaller1: entered allmulticast mode [ 404.750832][T19081] IPVS: set_ctl: invalid protocol: 4 172.20.20.187:20001 [ 405.202158][T19109] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3453'. [ 405.347589][T19113] lo speed is unknown, defaulting to 1000 [ 405.404045][T19116] lo speed is unknown, defaulting to 1000 [ 405.602644][T19135] bpq0: entered promiscuous mode [ 405.615983][T19135] bpq0: entered allmulticast mode [ 405.680181][T19130] dummy0: entered promiscuous mode [ 405.716104][T19130] hsr1: entered allmulticast mode [ 405.735183][T19130] dummy0: entered allmulticast mode [ 405.754447][T19130] bridge0: entered allmulticast mode [ 405.786447][T19121] set match dimension is over the limit! [ 405.990424][T19154] netlink: 4804 bytes leftover after parsing attributes in process `syz.3.3464'. [ 406.621767][T19177] validate_nla: 1 callbacks suppressed [ 406.621780][T19177] netlink: 'syz.2.3470': attribute type 1 has an invalid length. [ 406.689619][T19177] bond1: entered promiscuous mode [ 406.705305][T19177] 8021q: adding VLAN 0 to HW filter on device bond1 [ 407.944620][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 407.952653][ C0] lec:lec_tx_timeout: lec0 [ 407.957546][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 408.895212][T19143] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 409.207792][T19197] net_ratelimit: 9 callbacks suppressed [ 409.207802][T19197] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 409.280222][T19195] netlink: 56 bytes leftover after parsing attributes in process `syz.3.3473'. [ 409.482619][T19207] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3479'. [ 409.518801][T19215] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3479'. [ 409.955369][ C0] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 410.599349][T19261] lo speed is unknown, defaulting to 1000 [ 410.866468][T19275] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3499'. [ 411.109310][T19272] lo speed is unknown, defaulting to 1000 [ 411.276189][T19275] hsr0: left promiscuous mode [ 411.288645][T19304] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3505'. [ 411.359361][T19305] netlink: 'syz.1.3505': attribute type 13 has an invalid length. [ 411.523639][T19305] bridge0: port 1(bridge_slave_0) entered blocking state [ 411.530860][T19305] bridge0: port 1(bridge_slave_0) entered forwarding state [ 411.860007][T19319] syzkaller1: entered promiscuous mode [ 411.867402][T19319] syzkaller1: entered allmulticast mode [ 412.088072][T19337] openvswitch: netlink: Flow actions attr not present in new flow. [ 412.118655][T19336] lo speed is unknown, defaulting to 1000 [ 412.125005][T19338] netlink: 'syz.1.3513': attribute type 13 has an invalid length. [ 412.143397][T19338] netlink: 'syz.1.3513': attribute type 17 has an invalid length. [ 412.346327][T19351] netlink: 'syz.0.3517': attribute type 11 has an invalid length. [ 412.615829][T19337] bridge0: port 2(bridge_slave_1) entered disabled state [ 412.623324][T19337] bridge0: port 1(bridge_slave_0) entered disabled state [ 412.678041][T19337] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 412.692983][T19337] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 412.810395][T19338] 8021q: adding VLAN 0 to HW filter on device bond0 [ 412.818591][T19338] 8021q: adding VLAN 0 to HW filter on device team0 [ 412.828661][T19338] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 412.916413][ T3575] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 412.957436][ T3575] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 412.966379][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 412.966408][ C0] lec:lec_tx_timeout: lec0 [ 412.975734][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 413.174873][ T3575] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 413.197405][ T3575] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 413.278708][T19367] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 413.337934][T19374] netlink: 'syz.3.3526': attribute type 62 has an invalid length. [ 413.460706][T19379] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3528'. [ 413.738310][T19393] bond2: (slave gretap0): Device is not bonding slave [ 413.745534][T19393] bond2: option active_slave: invalid value (gretap0) [ 413.760131][T19393] bond2 (unregistering): Released all slaves [ 413.871426][T19403] syzkaller0: entered promiscuous mode [ 413.897793][T19403] syzkaller0: entered allmulticast mode [ 413.951986][T19403] netlink: 32 bytes leftover after parsing attributes in process `syz.2.3536'. [ 413.963631][T19403] nbd: socks must be embedded in a SOCK_ITEM attr [ 414.290985][T19416] lo speed is unknown, defaulting to 1000 [ 414.318980][T19420] syzkaller1: entered promiscuous mode [ 414.330208][T19420] syzkaller1: entered allmulticast mode [ 414.538874][ T3575] bridge_slave_1: left allmulticast mode [ 414.554090][ T3575] bridge_slave_1: left promiscuous mode [ 414.573729][ T3575] bridge0: port 2(bridge_slave_1) entered disabled state [ 414.767562][ T3575] pimreg9: left allmulticast mode [ 415.007352][ T3575] bond7 (unregistering): (slave gretap2): Releasing active interface [ 415.299218][ T3575] bond5 (unregistering): (slave bridge4): Releasing active interface [ 415.328420][T19468] netlink: 27 bytes leftover after parsing attributes in process `syz.2.3550'. [ 415.628967][ T3575] bond14 (unregistering): (slave bridge11): Releasing backup interface [ 415.637673][ T3575] bridge11 (unregistering): left promiscuous mode [ 415.679914][ T3575] bond1 (unregistering): (slave bond2): Releasing backup interface [ 415.690318][ T3575] bond1 (unregistering): Released all slaves [ 415.703401][ T3575] bond2 (unregistering): Released all slaves [ 415.717758][ T3575] team0: Port device bond0 removed [ 415.723734][ T3575] bond0 (unregistering): Released all slaves [ 415.739136][ T3575] bond3 (unregistering): Released all slaves [ 415.758842][ T3575] bond4 (unregistering): Released all slaves [ 415.771845][ T3575] bond5 (unregistering): Released all slaves [ 415.787856][ T3575] bond6 (unregistering): Released all slaves [ 415.811780][ T3575] bond7 (unregistering): Released all slaves [ 415.824864][ T3575] bond8 (unregistering): Released all slaves [ 415.838158][ T3575] bond9 (unregistering): Released all slaves [ 415.851327][ T3575] bond10 (unregistering): Released all slaves [ 415.866754][ T3575] bond11 (unregistering): (slave veth13): Releasing backup interface [ 415.886291][ T3575] bond11 (unregistering): (slave batadv1): Releasing backup interface [ 415.895929][ T3575] bond11 (unregistering): Released all slaves [ 415.909914][ T3575] bond12 (unregistering): Released all slaves [ 415.922867][ T3575] bond13 (unregistering): Released all slaves [ 415.937169][ T3575] bond14 (unregistering): Released all slaves [ 416.011623][T19438] netlink: 144 bytes leftover after parsing attributes in process `syz.4.3544'. [ 416.273480][T19455] bridge0: port 3(veth0_to_bridge) entered disabled state [ 416.280857][T19455] bridge0: port 2(bridge_slave_1) entered disabled state [ 416.288535][T19455] bridge0: port 1(bridge_slave_0) entered disabled state [ 416.313580][T19476] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3553'. [ 416.517236][T19455] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 416.573092][T19455] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 416.884307][T19461] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3550'. [ 416.948312][T19479] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3555'. [ 417.019845][ T3575] tipc: Disabling bearer [ 417.030154][ T3575] tipc: Left network mode [ 417.050581][T18075] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 417.170197][T18075] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 417.209257][T18075] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 417.233848][T18075] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 417.273703][T19493] netlink: 'syz.4.3559': attribute type 1 has an invalid length. [ 417.278890][T19488] syzkaller1: entered promiscuous mode [ 417.295392][T19488] syzkaller1: entered allmulticast mode [ 417.312833][T19493] netlink: 'syz.4.3559': attribute type 2 has an invalid length. [ 417.342606][T19493] netlink: 'syz.4.3559': attribute type 1 has an invalid length. [ 417.352829][T19493] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3559'. [ 417.465244][T19498] netlink: 72 bytes leftover after parsing attributes in process `syz.2.3560'. [ 417.512609][T19503] syz_tun: entered allmulticast mode [ 417.545119][T19499] syz_tun: left allmulticast mode [ 417.608505][T19506] dvmrp0: entered allmulticast mode [ 417.835848][T19515] bridge2: trying to set multicast startup query interval above maximum, setting to 8640000 (86400000ms) [ 417.984617][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 417.992693][ C0] lec:lec_tx_timeout: lec0 [ 417.993233][T19522] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3568'. [ 417.997687][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 418.084422][T19529] netlink: 'syz.0.3571': attribute type 11 has an invalid length. [ 418.152078][T19525] lo speed is unknown, defaulting to 1000 [ 418.209036][T19536] netlink: 60 bytes leftover after parsing attributes in process `syz.1.3568'. [ 418.888346][T19546] lo speed is unknown, defaulting to 1000 [ 419.019142][T19556] syz_tun: entered allmulticast mode [ 419.170440][ T3575] hsr_slave_0: left promiscuous mode [ 419.190931][ T3575] hsr_slave_1: left promiscuous mode [ 419.201699][ T3575] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 419.225909][ T3575] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 419.970027][T19595] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3585'. [ 419.979148][T19595] netlink: 'syz.1.3585': attribute type 7 has an invalid length. [ 419.996508][ T3575] team0 (unregistering): Port device team_slave_1 removed [ 420.137127][T19547] syz_tun: left allmulticast mode [ 420.256411][T11664] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 420.282444][T11664] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 420.306967][T11664] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 420.398805][T19603] wg1 speed is unknown, defaulting to 1000 [ 420.403187][T11664] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 420.428974][T19603] wg1 speed is unknown, defaulting to 1000 [ 420.499164][T19603] wg1 speed is unknown, defaulting to 1000 [ 420.531468][T19616] netlink: 'syz.0.3591': attribute type 11 has an invalid length. [ 420.565912][T19616] __nla_validate_parse: 2 callbacks suppressed [ 420.565928][T19616] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3591'. [ 420.570745][T19603] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98 [ 420.599594][T19613] No such timeout policy "syz0" [ 420.726855][T19603] wg1 speed is unknown, defaulting to 1000 [ 420.768807][T19603] wg1 speed is unknown, defaulting to 1000 [ 420.799153][T19603] wg1 speed is unknown, defaulting to 1000 [ 420.862800][T19603] wg1 speed is unknown, defaulting to 1000 [ 420.912533][ T3575] IPVS: stop unused estimator thread 0... [ 420.930128][T19603] wg1 speed is unknown, defaulting to 1000 [ 420.995059][T19603] wg1 speed is unknown, defaulting to 1000 [ 421.059036][T19603] wg1 speed is unknown, defaulting to 1000 [ 421.121075][T19603] wg1 speed is unknown, defaulting to 1000 [ 421.313682][T19648] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 421.328012][T19603] wg1 speed is unknown, defaulting to 1000 [ 421.347022][T19648] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 421.931535][T19687] netlink: 68 bytes leftover after parsing attributes in process `syz.4.3605'. [ 422.013680][T19687] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3605'. [ 422.090816][T19687] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3605'. [ 422.839349][T19732] netlink: 'syz.2.3612': attribute type 8 has an invalid length. [ 422.867371][T19732] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3612'. [ 423.014583][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 423.022644][ C0] lec:lec_tx_timeout: lec0 [ 423.027537][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 424.957244][T19709] tipc: Enabling of bearer rejected, failed to enable media [ 424.993049][T19732] bond0: entered promiscuous mode [ 425.011349][T19732] bond_slave_0: entered promiscuous mode [ 425.029720][T19732] bond_slave_1: entered promiscuous mode [ 425.079511][T19732] gretap0: entered promiscuous mode [ 425.106345][T19732] debugfs: 'hsr1' already exists in 'hsr' [ 425.119259][T19732] Cannot create hsr debugfs directory [ 425.132520][T19732] hsr1: entered promiscuous mode [ 425.153802][T19677] lo speed is unknown, defaulting to 1000 [ 425.170172][T19798] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3614'. [ 425.241760][T19801] xt_TCPMSS: Only works on TCP SYN packets [ 425.287841][T19792] syz_tun: entered allmulticast mode [ 425.301891][T19677] wg1 speed is unknown, defaulting to 1000 [ 425.317645][T19791] syz_tun: left allmulticast mode [ 425.317659][T19812] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth0_to_team, syncid = 0, id = 0 [ 425.528926][T19819] FAULT_INJECTION: forcing a failure. [ 425.528926][T19819] name failslab, interval 1, probability 0, space 0, times 0 [ 425.559916][T19823] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3620'. [ 425.564999][T19819] CPU: 0 UID: 0 PID: 19819 Comm: syz.4.3618 Not tainted syzkaller #0 PREEMPT(full) [ 425.565022][T19819] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 425.565033][T19819] Call Trace: [ 425.565041][T19819] [ 425.565047][T19819] dump_stack_lvl+0xe8/0x150 [ 425.565078][T19819] should_fail_ex+0x412/0x560 [ 425.565106][T19819] should_failslab+0xa8/0x100 [ 425.565127][T19819] __kmalloc_noprof+0xe8/0x760 [ 425.565151][T19819] ? tomoyo_encode2+0x27f/0x530 [ 425.565173][T19819] ? tomoyo_check_unix_address+0x167/0x7f0 [ 425.565206][T19819] tomoyo_encode2+0x27f/0x530 [ 425.565234][T19819] tomoyo_check_unix_address+0x3d9/0x7f0 [ 425.565258][T19819] ? put_pid+0xd8/0x130 [ 425.565285][T19819] ? tomoyo_check_unix_address+0x167/0x7f0 [ 425.565307][T19819] ? __pfx_tomoyo_check_unix_address+0x10/0x10 [ 425.565339][T19819] ? __lock_acquire+0x6b5/0x2cf0 [ 425.565371][T19819] tomoyo_socket_sendmsg_permission+0x1d9/0x300 [ 425.565405][T19819] security_socket_sendmsg+0x97/0x280 [ 425.565433][T19819] ____sys_sendmsg+0x522/0x9f0 [ 425.565467][T19819] ? __pfx_____sys_sendmsg+0x10/0x10 [ 425.565498][T19819] ? import_iovec+0x73/0xa0 [ 425.565518][T19819] ___sys_sendmsg+0x2a5/0x360 [ 425.565541][T19819] ? __lock_acquire+0x6b5/0x2cf0 [ 425.565565][T19819] ? __pfx____sys_sendmsg+0x10/0x10 [ 425.565586][T19819] ? __lock_acquire+0x6b5/0x2cf0 [ 425.565611][T19819] ? kstrtouint+0x6e/0xe0 [ 425.565668][T19819] __sys_sendmmsg+0x27c/0x4e0 [ 425.565697][T19819] ? __pfx___sys_sendmmsg+0x10/0x10 [ 425.565719][T19819] ? __mutex_unlock_slowpath+0x1be/0x6f0 [ 425.565764][T19819] ? ksys_write+0x242/0x270 [ 425.565789][T19819] ? __pfx_ksys_write+0x10/0x10 [ 425.565818][T19819] __x64_sys_sendmmsg+0xa0/0xc0 [ 425.565841][T19819] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 425.565859][T19819] do_syscall_64+0x15f/0xf80 [ 425.565879][T19819] ? trace_irq_disable+0x3b/0x140 [ 425.565896][T19819] ? clear_bhb_loop+0x40/0x90 [ 425.565917][T19819] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 425.565933][T19819] RIP: 0033:0x7f611e39c819 [ 425.565949][T19819] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 425.565963][T19819] RSP: 002b:00007f611f2ec028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 425.565982][T19819] RAX: ffffffffffffffda RBX: 00007f611e615fa0 RCX: 00007f611e39c819 [ 425.565994][T19819] RDX: 0000000000000002 RSI: 0000200000000ec0 RDI: 0000000000000004 [ 425.566004][T19819] RBP: 00007f611f2ec090 R08: 0000000000000000 R09: 0000000000000000 [ 425.566014][T19819] R10: 00000000000000f6 R11: 0000000000000246 R12: 0000000000000001 [ 425.566024][T19819] R13: 00007f611e616038 R14: 00007f611e615fa0 R15: 00007fff2a304158 [ 425.566052][T19819] [ 425.893525][T19833] netlink: 'syz.3.3619': attribute type 15 has an invalid length. [ 425.903408][T19833] netlink: 666 bytes leftover after parsing attributes in process `syz.3.3619'. [ 425.928656][T19831] veth3: entered allmulticast mode [ 426.041254][T19846] netlink: 312 bytes leftover after parsing attributes in process `syz.4.3625'. [ 426.105353][T19837] bond2 (unregistering): Released all slaves [ 426.139912][ T7503] IPVS: starting estimator thread 0... [ 426.156799][T19851] IPVS: length: 35 != 24 [ 426.254717][T19853] IPVS: using max 38 ests per chain, 91200 per kthread [ 426.424333][T19866] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3631'. [ 426.475446][T19869] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3632'. [ 426.499520][T19872] syz_tun: entered allmulticast mode [ 426.606639][T19879] netlink: 'syz.1.3633': attribute type 6 has an invalid length. [ 426.669427][T19874] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 426.699974][T19877] netlink: 192 bytes leftover after parsing attributes in process `syz.2.3634'. [ 426.736894][T19884] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3635'. [ 427.315209][T19865] syz_tun: left allmulticast mode [ 427.463452][T19892] netlink: 'syz.3.3636': attribute type 10 has an invalid length. [ 427.480007][T19881] lo speed is unknown, defaulting to 1000 [ 427.492243][T19892] netlink: 228 bytes leftover after parsing attributes in process `syz.3.3636'. [ 427.508625][T19881] wg1 speed is unknown, defaulting to 1000 [ 427.527692][T19890] netlink: 80 bytes leftover after parsing attributes in process `syz.3.3636'. [ 428.034647][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 428.042719][ C0] lec:lec_tx_timeout: lec0 [ 428.047658][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 428.225298][ T5893] IPVS: starting estimator thread 0... [ 428.238076][T19926] Unsupported ieee802154 address type: 0 [ 428.297053][T19921] lo speed is unknown, defaulting to 1000 [ 428.325519][T19938] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3646'. [ 428.347943][T19921] wg1 speed is unknown, defaulting to 1000 [ 428.437201][T19928] IPVS: using max 29 ests per chain, 69600 per kthread [ 429.132264][T19980] netlink: 'syz.3.3653': attribute type 1 has an invalid length. [ 429.140972][T19981] netlink: 'syz.3.3653': attribute type 1 has an invalid length. [ 429.328050][T19992] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3657'. [ 429.746318][T20010] syz_tun: entered allmulticast mode [ 429.777957][T20006] syz_tun: left allmulticast mode [ 430.392054][T20037] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth0_to_bond, syncid = 0, id = 0 [ 431.154022][T20067] __nla_validate_parse: 66 callbacks suppressed [ 431.154042][T20067] netlink: 156 bytes leftover after parsing attributes in process `syz.4.3678'. [ 431.176209][T20067] openvswitch: netlink: Missing key (keys=40, expected=10000000) [ 431.234832][ T5826] Bluetooth: hci1: command 0x0405 tx timeout [ 431.396268][T20082] lo speed is unknown, defaulting to 1000 [ 431.451684][T20082] wg1 speed is unknown, defaulting to 1000 [ 431.590875][T20096] bond4: option arp_interval: invalid value (18446744073709551615) [ 431.599712][T20096] bond4: option arp_interval: allowed values 0 - 2147483647 [ 431.612730][T20096] bond4 (unregistering): Released all slaves [ 431.672384][T20098] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3686'. [ 431.939177][T20110] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3688'. [ 432.056186][T20116] netlink: 'syz.4.3690': attribute type 1 has an invalid length. [ 432.080459][T20116] netlink: 'syz.4.3690': attribute type 11 has an invalid length. [ 432.137776][T20122] Cannot find set identified by id 65534 to match [ 432.248308][T20125] A link change request failed with some changes committed already. Interface wg1 may have been left with an inconsistent configuration, please check. [ 432.829984][T20176] Bluetooth: MGMT ver 1.23 [ 432.837841][T20177] netlink: 'syz.4.3708': attribute type 11 has an invalid length. [ 433.054584][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 433.062667][ C0] lec:lec_tx_timeout: lec0 [ 433.067358][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 433.151756][T20191] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 433.366063][T20208] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3719'. [ 433.475072][T20217] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3722'. [ 433.475658][T20216] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3722'. [ 433.571424][T20212] lo speed is unknown, defaulting to 1000 [ 433.584172][T20212] wg1 speed is unknown, defaulting to 1000 [ 433.721323][T20230] syz_tun: entered allmulticast mode [ 433.760152][T20223] syz_tun: left allmulticast mode [ 434.039998][T20245] netlink: 14 bytes leftover after parsing attributes in process `syz.0.3729'. [ 434.163966][T20251] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3731'. [ 434.190415][T20250] xt_SECMARK: invalid mode: 4 [ 435.039171][T20288] syzkaller1: entered promiscuous mode [ 435.049859][T20288] syzkaller1: entered allmulticast mode [ 435.172687][T20296] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3742'. [ 435.241534][T20296] hsr0: entered promiscuous mode [ 435.278926][T20296] macvlan2: entered allmulticast mode [ 435.303982][T20296] hsr0: entered allmulticast mode [ 435.320680][T20296] hsr_slave_0: entered allmulticast mode [ 435.333726][T20300] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3745'. [ 435.343264][T20296] hsr_slave_1: entered allmulticast mode [ 435.379642][T20300] : entered promiscuous mode [ 436.075495][T20325] bond4: entered promiscuous mode [ 436.109877][T20325] 8021q: adding VLAN 0 to HW filter on device bond4 [ 436.170546][T20328] 8021q: adding VLAN 0 to HW filter on device bond1 [ 436.211751][T20330] bond1: entered promiscuous mode [ 436.228899][T20330] bond1: entered allmulticast mode [ 436.261909][T20330] 8021q: adding VLAN 0 to HW filter on device bond1 [ 436.312168][T20330] team0: Port device bond1 added [ 436.379106][T20335] vxcan3: entered promiscuous mode [ 436.386200][T20335] bond1: (slave vxcan3): refused to change device type [ 436.443761][T20339] syzkaller1: entered promiscuous mode [ 436.456180][T20339] syzkaller1: entered allmulticast mode [ 436.480886][T20329] lo speed is unknown, defaulting to 1000 [ 436.587778][T20329] wg1 speed is unknown, defaulting to 1000 [ 437.184458][T20375] __nla_validate_parse: 1 callbacks suppressed [ 437.184478][T20375] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3764'. [ 437.232697][T20380] syz_tun: entered allmulticast mode [ 437.283311][T20375] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3764'. [ 437.314515][T20378] lo speed is unknown, defaulting to 1000 [ 437.370065][T20378] wg1 speed is unknown, defaulting to 1000 [ 437.381823][T20368] syz_tun: left allmulticast mode [ 437.599199][T20389] netlink: 88 bytes leftover after parsing attributes in process `syz.2.3768'. [ 437.802683][T20398] IPVS: ip_vs_add_dest(): lower threshold is higher than upper threshold [ 437.832886][T20400] lo speed is unknown, defaulting to 1000 [ 437.888899][T20400] wg1 speed is unknown, defaulting to 1000 [ 437.906316][T20398] 8021q: adding VLAN 0 to HW filter on device bond0 [ 437.919400][T20398] A link change request failed with some changes committed already. Interface teql0 may have been left with an inconsistent configuration, please check. [ 437.937205][T20406] netlink: 128 bytes leftover after parsing attributes in process `syz.3.3773'. [ 437.976261][T20406] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3773'. [ 438.074624][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 438.082708][ C0] lec:lec_tx_timeout: lec0 [ 438.087393][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 438.271572][T20418] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3775'. [ 438.327782][T20423] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3775'. [ 438.670221][T20438] netlink: 'syz.2.3778': attribute type 10 has an invalid length. [ 438.708034][T20438] netlink: 40 bytes leftover after parsing attributes in process `syz.2.3778'. [ 438.743081][T20444] netlink: 192 bytes leftover after parsing attributes in process `syz.3.3780'. [ 438.923091][T20449] lo speed is unknown, defaulting to 1000 [ 438.941312][T20449] wg1 speed is unknown, defaulting to 1000 [ 439.188386][T20467] lo speed is unknown, defaulting to 1000 [ 439.477561][T20467] wg1 speed is unknown, defaulting to 1000 [ 439.546917][T20479] netlink: 'syz.1.3789': attribute type 3 has an invalid length. [ 439.581865][T20479] netlink: 'syz.1.3789': attribute type 3 has an invalid length. [ 439.671574][T20496] netlink: 56 bytes leftover after parsing attributes in process `syz.2.3790'. [ 439.741114][T20498] sctp: [Deprecated]: syz.3.3791 (pid 20498) Use of int in max_burst socket option. [ 439.741114][T20498] Use struct sctp_assoc_value instead [ 440.023541][T20491] lo speed is unknown, defaulting to 1000 [ 440.025474][T20511] openvswitch: netlink: Flow set message rejected, Key attribute missing. [ 440.043907][T20512] A link change request failed with some changes committed already. Interface dummy0 may have been left with an inconsistent configuration, please check. [ 440.068658][T20491] wg1 speed is unknown, defaulting to 1000 [ 440.152710][T20507] veth1_macvtap: left promiscuous mode [ 440.460664][T20522] lo speed is unknown, defaulting to 1000 [ 440.498218][T20522] wg1 speed is unknown, defaulting to 1000 [ 440.587240][T20533] syz_tun: entered allmulticast mode [ 440.609290][T20529] syz_tun: left allmulticast mode [ 440.647869][T20535] netlink: 'syz.0.3801': attribute type 5 has an invalid length. [ 440.761684][T20538] x_tables: unsorted underflow at hook 3 [ 440.798277][T20538] netlink: 'syz.3.3802': attribute type 1 has an invalid length. [ 441.000620][T20556] Cannot find map_set index 2 as target [ 441.088174][T20538] bond5: entered promiscuous mode [ 441.093620][T20538] 8021q: adding VLAN 0 to HW filter on device bond5 [ 441.161695][T20555] bond5: (slave bridge3): making interface the new active one [ 441.203453][T20555] bridge3: entered promiscuous mode [ 441.238631][T20555] bridge3: left promiscuous mode [ 441.329798][T20558] vlan2: entered allmulticast mode [ 441.336486][T20558] bond0: entered allmulticast mode [ 441.341662][T20558] bond_slave_0: entered allmulticast mode [ 441.347835][T20558] bond_slave_1: entered allmulticast mode [ 441.404502][T20559] bond0 (unregistering): left promiscuous mode [ 441.412905][T20559] bond_slave_0: left promiscuous mode [ 441.420414][T20559] bond_slave_1: left promiscuous mode [ 441.430054][T20559] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 441.440570][T20559] bond_slave_0: left allmulticast mode [ 441.454205][T20559] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 441.463423][T20559] bond_slave_1: left allmulticast mode [ 441.473564][T20559] bond0 (unregistering): Released all slaves [ 441.537602][T20576] bond2: entered promiscuous mode [ 441.543038][T20576] 8021q: adding VLAN 0 to HW filter on device bond2 [ 441.661219][T20580] veth1_macvtap: left promiscuous mode [ 441.696020][T20580] macsec0: entered promiscuous mode [ 441.769654][T20580] veth1_macvtap: entered promiscuous mode [ 441.781242][T20580] macsec0: left promiscuous mode [ 441.857178][T20586] lo speed is unknown, defaulting to 1000 [ 441.881973][T20586] wg1 speed is unknown, defaulting to 1000 [ 442.141767][T20601] team0: Device vlan2 is already an upper device of the team interface [ 442.693049][ T29] audit: type=1800 audit(1776511849.276:15): pid=20642 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.3833" name=3A202E31323334352E2E2E2E2028313829207238203D2030783363333130303030300A202020202020323A202E31323334352E2E382E20283835292063616C6C2070632B360A202020202020333A202E2E2E2E2E2E2E2E382E2028313829207230203D203078313130303030303066666666666666660A202020202020353A202E2E2E2E2E2E2E2E382E202836362920696620773820733E2030783020676F746F2070632B300A202020202020363A202E2E2E2E2E2E2E2E2E2E20283138292072 dev="tmpfs" ino=503 res=0 errno=0 [ 443.078302][T20665] __nla_validate_parse: 11 callbacks suppressed [ 443.078321][T20665] netlink: 72 bytes leftover after parsing attributes in process `syz.3.3837'. [ 443.103636][T20664] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3841'. [ 443.131178][T20664] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3841'. [ 443.512743][T20695] netlink: 56 bytes leftover after parsing attributes in process `syz.4.3851'. [ 443.737202][T20707] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3857'. [ 443.753115][T20708] syzkaller1: entered promiscuous mode [ 443.756166][T20707] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3857'. [ 443.768534][T20708] syzkaller1: entered allmulticast mode [ 443.874648][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5790 ms [ 443.882712][ C0] lec:lec_tx_timeout: lec0 [ 443.887928][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 444.076521][T20715] lo speed is unknown, defaulting to 1000 [ 444.098832][T20715] wg1 speed is unknown, defaulting to 1000 [ 444.126126][T20717] netlink: 192 bytes leftover after parsing attributes in process `syz.3.3861'. [ 444.557164][T20729] syzkaller0: entered promiscuous mode [ 444.574769][T20729] syzkaller0: entered allmulticast mode [ 444.780925][T20733] syzkaller0: entered promiscuous mode [ 444.798856][T20733] syzkaller0: entered allmulticast mode [ 444.848760][T20737] netlink: 'syz.4.3869': attribute type 1 has an invalid length. [ 444.873248][T20743] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3870'. [ 444.895639][T20740] delete_channel: no stack [ 444.924874][T20745] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3870'. [ 444.945970][T20737] 8021q: adding VLAN 0 to HW filter on device bond1 [ 444.976960][T20743] batadv0: entered promiscuous mode [ 445.001416][T20743] macvtap2: entered promiscuous mode [ 445.013304][T20743] macvtap2: entered allmulticast mode [ 445.019044][T20743] batadv0: entered allmulticast mode [ 445.025673][T20743] 8021q: adding VLAN 0 to HW filter on device macvtap2 [ 445.065486][T20745] batadv0: left allmulticast mode [ 445.066192][T20749] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3873'. [ 445.084947][T20749] openvswitch: netlink: nsh attribute has 4 unknown bytes. [ 445.094319][T20745] batadv0: left promiscuous mode [ 445.120928][ T796] IPVS: starting estimator thread 0... [ 445.218572][T20752] IPVS: using max 41 ests per chain, 98400 per kthread [ 445.308879][T20764] : entered promiscuous mode [ 445.542786][T20780] lo speed is unknown, defaulting to 1000 [ 445.567620][T20780] wg1 speed is unknown, defaulting to 1000 [ 445.650492][T20789] xt_CT: You must specify a L4 protocol and not use inversions on it [ 446.375978][T20817] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 447.071377][T20160] netdevsim netdevsim4 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 447.083426][T20160] netdevsim netdevsim4 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 447.103760][T20160] netdevsim netdevsim4 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 447.128154][T20160] netdevsim netdevsim4 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 448.151403][T20754] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 448.288276][T20843] __nla_validate_parse: 2 callbacks suppressed [ 448.288294][T20843] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3897'. [ 448.357061][T20847] netlink: 'syz.4.3899': attribute type 4 has an invalid length. [ 448.369273][T20843] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3897'. [ 448.404426][T20853] IPv6: addrconf: prefix option has invalid lifetime [ 448.457983][T20853] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3901'. [ 448.582809][T20862] netlink: 'syz.1.3904': attribute type 21 has an invalid length. [ 448.832231][T20869] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3906'. [ 448.859061][T20868] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3906'. [ 448.900494][T20884] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3910'. [ 448.914596][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5030 ms [ 448.922654][ C0] lec:lec_tx_timeout: lec0 [ 448.927449][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 448.978246][T20887] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3911'. [ 448.991414][T20882] syzkaller0: entered promiscuous mode [ 448.994399][T20889] netlink: 'syz.2.3909': attribute type 1 has an invalid length. [ 448.997824][T20882] syzkaller0: entered allmulticast mode [ 451.144485][T20902] lo speed is unknown, defaulting to 1000 [ 451.161071][T20902] wg1 speed is unknown, defaulting to 1000 [ 451.164767][T20883] lo speed is unknown, defaulting to 1000 [ 451.203209][T20883] wg1 speed is unknown, defaulting to 1000 [ 451.903400][T20892] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 452.081214][T20936] hsr0: entered promiscuous mode [ 452.179660][T20933] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3924'. [ 452.185582][T20940] tipc: Started in network mode [ 452.197238][ T30] INFO: task udevd:8418 blocked for more than 143 seconds. [ 452.215587][T20940] tipc: Node identity 76e2119289b2, cluster identity 4711 [ 452.219136][ T30] Not tainted syzkaller #0 [ 452.226383][T20940] tipc: Enabled bearer , priority 0 [ 452.229493][T20933] openvswitch: netlink: nsh attribute has 4 unknown bytes. [ 452.242116][T20940] syzkaller0: entered promiscuous mode [ 452.247956][T20940] syzkaller0: entered allmulticast mode [ 452.266413][ T30] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 452.291398][T20940] tipc: Resetting bearer [ 452.304129][ T30] task:udevd state:D stack:23288 pid:8418 tgid:8418 ppid:5195 task_flags:0x400140 flags:0x00080000 [ 452.326085][ T30] Call Trace: [ 452.329603][ T30] [ 452.332633][ T30] __schedule+0x17b4/0x5680 [ 452.337753][ T30] ? __pfx_blk_mq_flush_plug_list+0x10/0x10 [ 452.343849][ T30] ? __blk_flush_plug+0x416/0x4d0 [ 452.354209][ T30] ? __pfx___schedule+0x10/0x10 [ 452.361146][T20951] netlink: 192 bytes leftover after parsing attributes in process `syz.1.3925'. [ 452.371161][ T30] ? schedule+0x90/0x360 [ 452.376776][ T30] schedule+0x164/0x360 [ 452.383491][ T7509] IPVS: starting estimator thread 0... [ 452.389551][ T30] schedule_timeout+0x158/0x2c0 [ 452.404707][ T30] ? __pfx_schedule_timeout+0x10/0x10 [ 452.410173][ T30] ? __pfx_process_timeout+0x10/0x10 [ 452.424371][ T30] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 452.430276][ T30] ? prepare_to_wait_event+0x436/0x480 [ 452.435962][ T30] nbd_queue_rq+0x857/0x1100 [ 452.440615][ T30] ? __pfx_nbd_queue_rq+0x10/0x10 [ 452.446019][ T30] ? is_bpf_text_address+0x26/0x2b0 [ 452.451247][ T30] ? __pfx_autoremove_wake_function+0x10/0x10 [ 452.457618][ T30] blk_mq_dispatch_rq_list+0xa70/0x1910 [ 452.463205][ T30] ? sbitmap_get+0x229/0x390 [ 452.467996][ T30] ? __pfx_blk_mq_dispatch_rq_list+0x10/0x10 [ 452.474010][ T30] ? __blk_mq_alloc_driver_tag+0x2e7/0x6e0 [ 452.480893][ T30] __blk_mq_sched_dispatch_requests+0xdcc/0x1600 [ 452.484796][T20952] IPVS: using max 33 ests per chain, 79200 per kthread [ 452.487333][ T30] ? __pfx___blk_mq_sched_dispatch_requests+0x10/0x10 [ 452.501216][ T30] ? blk_mq_hw_queue_need_run+0x13c/0x680 [ 452.507054][ T30] ? blk_mq_run_hw_queue+0x31f/0x4f0 [ 452.512368][ T30] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 452.519983][ T30] ? blk_mq_run_hw_queue+0x31f/0x4f0 [ 452.526064][ T30] blk_mq_run_hw_queue+0x348/0x4f0 [ 452.532988][ T30] blk_mq_dispatch_list+0xd16/0xe10 [ 452.535733][T20957] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3922'. [ 452.544594][ T30] ? bdev_count_inflight+0x1cf/0x210 [ 452.564614][ T30] ? blk_mq_dispatch_list+0x1f0/0xe10 [ 452.570060][ T30] ? __pfx_blk_mq_dispatch_list+0x10/0x10 [ 452.579770][ T30] ? rcu_is_watching+0x15/0xb0 [ 452.584664][ T30] blk_mq_flush_plug_list+0x48d/0x570 [ 452.590402][ T30] ? blk_add_rq_to_plug+0x300/0x450 [ 452.595864][ T30] ? blk_mq_submit_bio+0x1acf/0x28e0 [ 452.601177][ T30] ? __pfx_blk_mq_flush_plug_list+0x10/0x10 [ 452.607238][ T30] __blk_flush_plug+0x3ed/0x4d0 [ 452.612130][ T30] ? __pfx___blk_flush_plug+0x10/0x10 [ 452.617924][ T30] __submit_bio+0x28d/0x580 [ 452.622485][ T30] ? __pfx___submit_bio+0x10/0x10 [ 452.628401][ T30] ? bio_associate_blkg+0x6d/0x230 [ 452.633538][ T30] submit_bio_noacct_nocheck+0x2f4/0xa40 [ 452.639868][ T30] ? __pfx_submit_bio_noacct_nocheck+0x10/0x10 [ 452.646399][ T30] block_read_full_folio+0x7b7/0x830 [ 452.651726][ T30] ? __pfx_blkdev_get_block+0x10/0x10 [ 452.657238][ T30] filemap_read_folio+0x137/0x3b0 [ 452.662299][ T30] ? __pfx_blkdev_read_folio+0x10/0x10 [ 452.667845][ T30] ? __pfx_filemap_read_folio+0x10/0x10 [ 452.673397][ T30] ? filemap_add_folio+0x356/0x530 [ 452.678631][ T30] do_read_cache_folio+0x358/0x590 [ 452.683769][ T30] ? __pfx_blkdev_read_folio+0x10/0x10 [ 452.689383][ T30] read_part_sector+0xb6/0x2b0 [ 452.694195][ T30] adfspart_check_ICS+0xb1/0x960 [ 452.699587][ T30] ? seq_buf_printf+0x212/0x2d0 [ 452.704472][ T30] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 452.710969][ T30] ? __pfx_adfspart_check_ICS+0x10/0x10 [ 452.716628][ T30] bdev_disk_changed+0x817/0x1770 [ 452.721669][ T30] ? __pfx_bdev_disk_changed+0x10/0x10 [ 452.731106][ T30] blkdev_get_whole+0x380/0x510 [ 452.737093][ T30] bdev_open+0x31e/0xd30 [ 452.741400][ T30] blkdev_open+0x470/0x610 [ 452.745925][ T30] ? __pfx_blkdev_open+0x10/0x10 [ 452.750871][ T30] do_dentry_open+0x785/0x14e0 [ 452.756362][ T30] vfs_open+0x3b/0x340 [ 452.760477][ T30] ? path_openat+0x2df0/0x3860 [ 452.765342][ T30] path_openat+0x2e08/0x3860 [ 452.769951][ T30] ? __pfx_stack_trace_save+0x10/0x10 [ 452.775410][ T30] ? stack_depot_save_flags+0x33/0x810 [ 452.780927][ T30] ? __pfx_path_openat+0x10/0x10 [ 452.785919][ T30] ? __x64_sys_openat+0x138/0x170 [ 452.790961][ T30] ? __lock_acquire+0x6b5/0x2cf0 [ 452.796005][ T30] do_file_open+0x23e/0x4a0 [ 452.800530][ T30] ? __pfx_do_file_open+0x10/0x10 [ 452.805748][ T30] ? _raw_spin_unlock+0x28/0x50 [ 452.810612][ T30] ? alloc_fd+0x64b/0x6c0 [ 452.815080][ T30] do_sys_openat2+0x113/0x200 [ 452.819771][ T30] ? __pfx___x64_sys_recvmsg+0x10/0x10 [ 452.825316][ T30] ? __pfx_do_sys_openat2+0x10/0x10 [ 452.830526][ T30] ? rcu_is_watching+0x15/0xb0 [ 452.836127][ T30] __x64_sys_openat+0x138/0x170 [ 452.841011][ T30] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 452.847399][ T30] do_syscall_64+0x15f/0xf80 [ 452.852047][ T30] ? clear_bhb_loop+0x40/0x90 [ 452.857723][ T30] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 452.863668][ T30] RIP: 0033:0x7f96350a7407 [ 452.868238][ T30] RSP: 002b:00007ffc794023f0 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 452.879116][ T30] RAX: ffffffffffffffda RBX: 00007f9634fbb880 RCX: 00007f96350a7407 [ 452.887233][ T30] RDX: 00000000000a0800 RSI: 00005574ec0552c0 RDI: ffffffffffffff9c [ 452.895266][ T30] RBP: 00005574ec046910 R08: 0000000000000000 R09: 0000000000000000 [ 452.903249][ T30] R10: 0000000000000000 R11: 0000000000000202 R12: 00005574ec05b830 [ 452.911290][ T30] R13: 00005574ec054190 R14: 0000000000000000 R15: 00005574ec05b830 [ 452.919596][ T30] [ 452.923070][T20935] tipc: Resetting bearer [ 452.929232][ T30] [ 452.929232][ T30] Showing all locks held in the system: [ 452.942880][ T30] 3 locks held by kworker/1:0/24: [ 452.954721][ T30] #0: ffff88813fe53140 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0xa35/0x1860 [ 452.970756][ T30] #1: ffffc900001e7c40 ((fqdir_free_work).work){+.+.}-{0:0}, at: process_scheduled_works+0xa70/0x1860 [ 452.981985][ T30] #2: ffffffff8e9631f8 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x580 [ 452.991979][ T30] 1 lock held by khungtaskd/30: [ 452.996905][ T30] #0: ffffffff8e95d020 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 453.006941][ T30] 2 locks held by getty/5580: [ 453.011635][ T30] #0: ffff888036bc90a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 453.021501][ T30] #1: ffffc9000322b2e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45c/0x13a0 [ 453.031663][ T30] 3 locks held by udevd/8418: [ 453.036455][ T30] #0: ffff888026b34350 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0xe0/0xd30 [ 453.045790][ T30] #1: ffff888022b2f498 (set->srcu){.+.+}-{0:0}, at: blk_mq_run_hw_queue+0x31f/0x4f0 [ 453.055420][ T30] #2: ffff888026cb51f8 (&cmd->lock){+.+.}-{4:4}, at: nbd_queue_rq+0xc6/0x1100 [ 453.064418][ T30] 2 locks held by syz.2.3923/20935: [ 453.069770][ T30] #0: ffffffff8fdceac0 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x3e/0x1c0 [ 453.078844][ T30] #1: ffffffff8e963328 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x2d0/0x770 [ 453.089788][ T30] 1 lock held by syz.4.3922/20941: [ 453.094965][ T30] #0: ffffffff8fdceac0 (rtnl_mutex){+.+.}-{4:4}, at: xsk_bind+0x156/0x1020 [ 453.103670][ T30] 1 lock held by syz.4.3922/20944: [ 453.109280][ T30] #0: ffffffff8fdceac0 (rtnl_mutex){+.+.}-{4:4}, at: xsk_bind+0x156/0x1020 [ 453.118056][ T30] 1 lock held by syz.4.3922/20957: [ 453.123168][ T30] #0: ffffffff8fdceac0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_dellink+0x42a/0x820 [ 453.132449][ T30] 2 locks held by syz.1.3925/20945: [ 453.137761][ T30] #0: ffffffff8fdc01c8 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x4f7/0x730 [ 453.147286][ T30] #1: ffffffff8fdceac0 (rtnl_mutex){+.+.}-{4:4}, at: register_nexthop_notifier+0x88/0x290 [ 453.158474][ T30] 2 locks held by syz.1.3925/20951: [ 453.163823][ T30] #0: ffffffff90340150 (&ops->srcu#2){.+.+}-{0:0}, at: rtnl_link_ops_get+0x23/0x250 [ 453.173610][ T30] #1: ffffffff8fdceac0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x883/0x1bb0 [ 453.182873][ T30] [ 453.205273][ T30] ============================================= [ 453.205273][ T30] [ 453.215028][T20935] tipc: Disabling bearer [ 453.220885][ T30] NMI backtrace for cpu 0 [ 453.220900][ T30] CPU: 0 UID: 0 PID: 30 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 453.220920][ T30] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 453.220930][ T30] Call Trace: [ 453.220936][ T30] [ 453.220941][ T30] dump_stack_lvl+0xe8/0x150 [ 453.220960][ T30] nmi_cpu_backtrace+0x274/0x2d0 [ 453.220975][ T30] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 453.220991][ T30] nmi_trigger_cpumask_backtrace+0x17a/0x300 [ 453.221006][ T30] sys_info+0x135/0x170 [ 453.221018][ T30] watchdog+0xfaa/0x1000 [ 453.221031][ T30] ? watchdog+0x209/0x1000 [ 453.221044][ T30] kthread+0x388/0x470 [ 453.221055][ T30] ? __pfx_watchdog+0x10/0x10 [ 453.221063][ T30] ? __pfx_kthread+0x10/0x10 [ 453.221073][ T30] ret_from_fork+0x514/0xb70 [ 453.221088][ T30] ? __pfx_ret_from_fork+0x10/0x10 [ 453.221101][ T30] ? __switch_to+0xc79/0x1410 [ 453.221113][ T30] ? __pfx_kthread+0x10/0x10 [ 453.221123][ T30] ret_from_fork_asm+0x1a/0x30 [ 453.221143][ T30] [ 453.221150][ T30] Sending NMI from CPU 0 to CPUs 1: [ 453.330952][ C1] NMI backtrace for cpu 1 [ 453.330970][ C1] CPU: 1 UID: 0 PID: 12 Comm: kworker/u8:0 Not tainted syzkaller #0 PREEMPT(full) [ 453.330988][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 453.330998][ C1] Workqueue: events_unbound toggle_allocation_gate [ 453.331020][ C1] RIP: 0010:__switch_to_asm+0x0/0x70 [ 453.331043][ C1] Code: 41 5b 41 5a 41 59 41 58 58 59 5a 5e 5f 5d c3 cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 <55> 53 41 54 41 55 41 56 41 57 48 89 a7 48 19 00 00 48 8b a6 48 19 [ 453.331057][ C1] RSP: 0018:ffffc900001175b8 EFLAGS: 00000046 [ 453.331069][ C1] RAX: 1ffff110170e75d3 RBX: ffff8880b873ae98 RCX: 0000000080000002 [ 453.331081][ C1] RDX: 0000000000000005 RSI: ffff888033278000 RDI: ffff88801daa8000 [ 453.331091][ C1] RBP: ffffc900001177c8 R08: ffff888035212ed3 R09: 1ffff11006a425da [ 453.331102][ C1] R10: dffffc0000000000 R11: ffffed1006a425db R12: ffff888033278000 [ 453.331113][ C1] R13: ffff88801daa8000 R14: dffffc0000000000 R15: 1ffff110170e773c [ 453.331124][ C1] FS: 0000000000000000(0000) GS:ffff888125345000(0000) knlGS:0000000000000000 [ 453.331136][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 453.331146][ C1] CR2: 000000110c2ce896 CR3: 0000000075acc000 CR4: 00000000003526f0 [ 453.331167][ C1] Call Trace: [ 453.331174][ C1] [ 453.331180][ C1] __schedule+0x17b4/0x5680 [ 453.331197][ C1] ? irqentry_exit+0x218/0x730 [ 453.331217][ C1] ? irqentry_exit+0x218/0x730 [ 453.331243][ C1] ? smp_call_function_many_cond+0xe32/0x1210 [ 453.331261][ C1] ? smp_call_function_many_cond+0xeb5/0x1210 [ 453.331279][ C1] ? __pfx___schedule+0x10/0x10 [ 453.331295][ C1] ? __pfx_do_sync_core+0x10/0x10 [ 453.331314][ C1] ? preempt_schedule_thunk+0x16/0x30 [ 453.331331][ C1] preempt_schedule_common+0x82/0xd0 [ 453.331347][ C1] ? __pfx_do_sync_core+0x10/0x10 [ 453.331361][ C1] preempt_schedule_thunk+0x16/0x30 [ 453.331378][ C1] ? on_each_cpu_cond_mask+0x75/0x80 [ 453.331395][ C1] on_each_cpu_cond_mask+0x7a/0x80 [ 453.331413][ C1] smp_text_poke_batch_finish+0xec2/0x1160 [ 453.331436][ C1] ? __pfx_smp_text_poke_batch_finish+0x10/0x10 [ 453.331454][ C1] ? arch_jump_label_transform_queue+0x97/0x110 [ 453.331477][ C1] arch_jump_label_transform_apply+0x1c/0x30 [ 453.331495][ C1] static_key_disable_cpuslocked+0xc5/0x1a0 [ 453.331515][ C1] static_key_disable+0x1a/0x20 [ 453.331532][ C1] toggle_allocation_gate+0x1fe/0x290 [ 453.331546][ C1] ? __pfx_toggle_allocation_gate+0x10/0x10 [ 453.331569][ C1] ? __pfx_autoremove_wake_function+0x10/0x10 [ 453.331589][ C1] ? process_scheduled_works+0xa70/0x1860 [ 453.331608][ C1] ? process_scheduled_works+0xa70/0x1860 [ 453.331627][ C1] process_scheduled_works+0xb5d/0x1860 [ 453.331661][ C1] ? __pfx_process_scheduled_works+0x10/0x10 [ 453.331682][ C1] ? assign_work+0x3d5/0x5e0 [ 453.331702][ C1] worker_thread+0xa53/0xfc0 [ 453.331735][ C1] kthread+0x388/0x470 [ 453.331749][ C1] ? __pfx_worker_thread+0x10/0x10 [ 453.331767][ C1] ? __pfx_kthread+0x10/0x10 [ 453.331781][ C1] ret_from_fork+0x514/0xb70 [ 453.331802][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 453.331821][ C1] ? __switch_to+0xc79/0x1410 [ 453.331839][ C1] ? __pfx_kthread+0x10/0x10 [ 453.331854][ C1] ret_from_fork_asm+0x1a/0x30 [ 453.331882][ C1] [ 453.657680][ T30] Kernel panic - not syncing: hung_task: blocked tasks [ 453.664553][ T30] CPU: 0 UID: 0 PID: 30 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 453.673663][ T30] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 453.683710][ T30] Call Trace: [ 453.686982][ T30] [ 453.689899][ T30] vpanic+0x56c/0xa60 [ 453.693874][ T30] ? __pfx___schedule+0x10/0x10 [ 453.698720][ T30] ? __pfx_vpanic+0x10/0x10 [ 453.703227][ T30] ? __pfx_console_unlock+0x10/0x10 [ 453.708422][ T30] panic+0xc5/0xd0 [ 453.712150][ T30] ? __pfx_panic+0x10/0x10 [ 453.716557][ T30] ? preempt_schedule_thunk+0x16/0x30 [ 453.721927][ T30] ? nmi_trigger_cpumask_backtrace+0x2bb/0x300 [ 453.728075][ T30] watchdog+0xff4/0x1000 [ 453.732313][ T30] ? watchdog+0x209/0x1000 [ 453.736723][ T30] kthread+0x388/0x470 [ 453.740775][ T30] ? __pfx_watchdog+0x10/0x10 [ 453.745433][ T30] ? __pfx_kthread+0x10/0x10 [ 453.750013][ T30] ret_from_fork+0x514/0xb70 [ 453.754598][ T30] ? __pfx_ret_from_fork+0x10/0x10 [ 453.759704][ T30] ? __switch_to+0xc79/0x1410 [ 453.764375][ T30] ? __pfx_kthread+0x10/0x10 [ 453.768963][ T30] ret_from_fork_asm+0x1a/0x30 [ 453.773832][ T30] [ 453.777172][ T30] Kernel Offset: disabled [ 453.781497][ T30] Rebooting in 86400 seconds..