last executing test programs: 2m39.424124148s ago: executing program 2 (id=1767): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000005c0)={'gre0\x00', 0x0}) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@loopback, @in=@local, 0x0, 0x0, 0x0, 0x0, 0xa, 0x100, 0x0, 0x0, r2, 0xffffffffffffffff}, {0x0, 0xa9, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x1}, {0x7fff, 0xa00, 0x40800000000000, 0x800000000000002}}}, 0xb8}}, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000001100)=ANY=[@ANYBLOB="a00000002100010028bd700000000000fc0200000000000000000000000000006401010200000000000000000002000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="049cff0000000000500011"], 0xa0}, 0x1, 0x0, 0x0, 0x40180}, 0x0) 2m39.366501876s ago: executing program 2 (id=1769): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800"/15, @ANYRES32, @ANYBLOB="0000000000000000b70800000000396f7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000002400000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000010340)='percpu_alloc_percpu\x00', r0}, 0x18) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0a000000010000003f0000004000000042000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000008000"/28], 0x48) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x62001, 0x0) r2 = socket(0x2, 0x80805, 0x0) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) connect$inet6(r3, &(0x7f0000000100)={0xa, 0x0, 0x0, @local}, 0x1c) sendmmsg$inet(r2, 0x0, 0x0, 0x4000000) r4 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r4, 0x84, 0xc, &(0x7f0000000240)=@assoc_value={0x0}, &(0x7f00000002c0)=0x8) setsockopt$inet_sctp_SCTP_MAX_BURST(r2, 0x84, 0x14, &(0x7f0000000080)=@assoc_value={r5, 0x9}, 0x8) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000a00)=@newtaction={0x48, 0x76, 0x1, 0x70bd2b, 0x25dfdbfc, {}, [{0x34, 0x1, [@m_skbmod={0x30, 0x3, 0x0, 0x0, {{0xb}, {0x4}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x3}}}}]}]}, 0x48}}, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000001440)={'\x00', 0x4212}) writev(r1, &(0x7f0000000240)=[{&(0x7f0000000000)="f4e84f0977d5f8eb15a05b", 0xb}, {&(0x7f00000000c0)="2a9d1484", 0x4}], 0x2) 2m37.977116452s ago: executing program 2 (id=1772): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000180), r0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000400)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_SET_HARDIF(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000200)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010025bd7080000000001000000008000600", @ANYRES32=r0, @ANYRES32=r0, @ANYRES32=r2], 0x34}}, 0x20004804) 2m37.728300784s ago: executing program 2 (id=1775): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300090a00000000000000000000000300060000000e0002000000e1000009000000000000000002000100000000000000000200000000030005000000000002000000e0000001"], 0x50}}, 0x1900000000000000) 2m37.420039914s ago: executing program 2 (id=1777): socket$packet(0x11, 0x3, 0x300) socket(0x2, 0x80805, 0x0) socket$packet(0x11, 0x2, 0x300) socket$netlink(0x10, 0x3, 0x4) socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r0, 0x84, 0xc, &(0x7f0000000240)=@assoc_value={0x0}, &(0x7f0000000080)=0x8) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r2) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000200)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r2, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="050000000000000000002100200008000300", @ANYRES32=r4, @ANYBLOB="10007d80", @ANYRES32=r2, @ANYRESDEC=r1], 0x2c}, 0x1, 0x0, 0x0, 0x440c0}, 0x0) 2m37.07195134s ago: executing program 2 (id=1781): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='memory.numa_stat\x00', 0x275a, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000240)={0x0, 0xffffffffffffffff, 0x0, 0xfffffffffffffd51, &(0x7f0000000000)='cgroup\x00'}, 0x30) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, '\x00', 0x0, @fallback=0x32, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) openat$cgroup_int(r1, &(0x7f0000000040)='cpu.max\x00', 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1801000021000000000000003b810000850000006d000000070000000000000095"], &(0x7f0000000040)='GPL\x00', 0x6, 0x0, 0x0, 0x0, 0x29, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000480)={&(0x7f0000000080)='rpc_call_rpcerror\x00', r2, 0x0, 0xf69}, 0x18) r3 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000280)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x6, 0x0, 0x0, 0x0, 0x29, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={&(0x7f0000000080)='rpc_call_rpcerror\x00', r2, 0x0, 0xf69}, 0x18) sendmsg$netlink(r3, &(0x7f0000000040)={0x0, 0x20, &(0x7f0000002580)=[{&(0x7f0000000000)=ANY=[@ANYBLOB="140000002500010000000000f100000006"], 0x14}], 0x1, 0x0, 0x0, 0x400048c0}, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000002e00)=ANY=[@ANYBLOB="620af8ff0c200021bfa100000000000007010000f8ffffffb702000003000000bd120000000000008500000006000000b70000000000000095000000000000003faf4f1e7f2aa3d9b18ed81c0c869b51ec6c0af4e0e4a9446c7670568982b4e020f698393aa0f3881f9c24aa56f15199fad0093c59d66b5ece9f36c70d0f13905ea23c22624c9f87f9793f50bb546040677b0c5077da80fb982c1e9400e693146cea484a415b76966118b64f751a0f241b072e90080008002d75593a286cecc93e64c227c95aa0b784625704f07a72c234664c0af9360a1f7a5e6b607130c89f18c0c1089d8b853289e01aa27ae8b09e00e79ab20b0b8e1148f42fc3199f000000000000006fa03c6468972089b302d7bf6023cdcedb5e0125ebbc08dee510cb2364149215108333719acd97cfa107d40224edc5465a932b77e74e802a0d42bc6099ad2300000080006ef6c1ff0900000000000010c63a949e8b7955394ffa82b8e942c89112f4ab87b1bfeda7be586602d985430cea0162ab3fcf4591c926abfb0767192302000000b0eea24492a660583eecb42cbcd3de3a83209da17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c95c25a573dc2edcaea2b1a52496dfcaf99431412fd134a996382a1a04d5bb924cfe5f3185418d605ffff9c4d2ec7c32f2095e63c80af735ed41793bdf9fa740b5b7632f32030916f89c6dad7603f2ba2a790d62d6faec2fed44da4928b30142ba11de6c5d50b83bae613402216b5054d1e7c13b1355d6f4a8245ffa4997da9c77af4c0eb97fca585ec6bf58351d564beb6d952aab9c70764b0a8a7583c90b3433b809bdb9fbd48bc873495cbff8a326eea31ae4e0f7505ebf6c9d13330ca005ace1a84521f14518c9b476fccbd6c712016219848624b87cec2dbc68223a0eb4fa39f6b5c02e6d6d90756ff57902a8f57000000009700cf0b4b8bc22941330000000000000000000300000000000064cf8605810000000000000010008bc0d9559711e6e8861c46495ba585a4b2d02edc3e28dd271c896249ed85b980680b00002b435ac15fc0288d9b2a169cdcacc413038dafb7a2c8cb482bac0ac502d9ba96ffffff7f00001000000000eeff7c5ad897ef3b7cda42013d53046da21b40216e14ba2d6ad5656bfff17addaedab25b30002abbba7fa725f38400be7c1f001b2cd317902f19e385be9e48dccff729eec082830689da6b53b263339863297771429d120000003341bf4abacac95900fca0493cf29b33dcc9ffffffffffffffd39fec2271ff01589646efd1cf870cd7bb2366fde41f94290c2a5ff870ce41fd3467decb05cfd9fcb32c8ed1dbd9d10a64c1083d5e71b5565b1768ee58969c41595229df17bcad70fb4021428ce970275d13b78100788f11f76161d46ea3abe0fa4d30dc94ef241875f3b4ce0232fcea69c271d7fa29822aea68a660e717a04becff0f719197724f4fce1093b62d7e8c7123d8ec571be54c72d978cf906df0042e36acd37d7f9e119f2c06f815312e0cfe222a06f56dd022c074eb8a322fb0bf47c0a8d154b405c37feaf3dd95f6ef2ae582786105c7df8be5877050c91301bb997316dbf17866fb84d4173731efe895ff2e1c5560926e90109b598502d3e959efc71f665c4d75cf2458e3546c1c776da64fb5abee0acfd235f2f4632c9062ece84c99a061887a20639b41c8c12ee86c50804042b3fb5aac518a75f9e7d7101d5e186c489b3a06fb99e0aa7f23a054de2f4d92d6bd72ee2c9fdc75aaaf1e3e483b4ad05573af40326993947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f54c2d3335457acf37331766e472391e358c3b377327ac9ecc34f24c9ae153ec60ac0694dc55bff9f5f45f90400000000000000d6b2c5ea1393fdf24285bf16b99c9cc0ad1857216f1a985f369191ae954febb3df464bfe0f7f3ee9afe7befb89d2777399f5874c553aeb3729cffe86e66964ae09bb6d163118e4cbe024fd4500f8ff0700000000cc9d8046c216c1f895778cb25122a2a9f9b444aeadea2a40da8daccf080842a486721737390cbf3a74cb2003016f1514216bdf57d2a40d40b51ab63e96ec8485b3b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde8a168c3f5db2fea6f26e4a4304e50c349f4f9ecee27defc93871c5f99b355b72d538ba4958ea8e4aa37094191e10096e7e60fc3541a2c905a1a95e9571bf38ae1981c4238ecaee6f75cd0a6881bd1517a8250ddc8674152f94e3a409e2a3bce109b60000000000000000d6d5210d7503000000a87a27602b81f76386f1535bef1497f92186086e29c6bc5a1fad6ec9a31137abf9a404abde7750898b1bd627e873f8703be8672d70d1ab57075228a9f46ed9bd1f08fb8191bbab2dc51de3a61f0868afc4294859323e6c257a45319f18101288d139bd3da20fed05a8fe64680b0a3fc22dd70400000000946912d6c98cd1a9fbe1e7d58c08acaf30235b918a31d2eca55f74a23641f61f2d5b308cf0d031b0c7f0ced69993e9960ff5f76015e6009556237badf4e7965bbe2777e808fcba821aa8e8c5c39609ff854352cb4900000000000000000000000000c1fee30a3f7a85d1b29e58c77685efc0ceb1c8e5729c66418d169fc03aa188546b3ad2a182068e1e3a0e2505bc7f41019645466a53f1c96e0d4b3bc19faa5449209b083dbd334b47f067bbab40743b2a42010082008df75cf43f8ecc8d3726602111b40e761fd21081920382f14d12ca3c3431ee97471c7868dcda7eaa69eb7f7f80572fdd11bb1d0d1280fbc22bf73468788df51710d7d31c632fc5ed1762eb0b428ee751c47d8e894f745a868404a0bf35f0121008b722b1eaa6aedfa1bf2e7ccb2d61d5d76331945ecefa26b8471d424c14283a94395b64645288d7226bbd9ccd628ab84875f2c50ba891cea592b0430a537a395dc73bda367bf12cb7d81691a5fe8c47be395656a297e9df0e71f96756ea5cce7daac4be290159f6bcd75f0dda9de5532e71ae9e48b0ed0254a83100000000f6fbb869604d51a36a54c832e45b2569dc0d90b075225fde44c4e0973171ad47d6b0fdf9743af932cd6db49a47613808bad959710300000000000000832d0a45fa4242e24c7e800003c9e8095e02985f28e678f66422436f949e2ab8f162d7e3f855e378f4a1f40b0c6fb2d4b205a800b6d713acebc5b014e61a543a5a194f9ac18d76b5440e3b1a569e7397f6cafa86966d7ba19e720413267a6ccea9c439671d2c680f2753ca184eeeb843450368acb4383a01d25eb3d1e23e0f2645d1cdfa9fa410632f95a5f622f851c66ee7e30393cd7a4d67ff2a49c4f93c0984b5c2d4523497e4d64f95f08493564a1df87111c9bf3194fef97dcecc467ace45feeb685c5870d05f88a0f463db88d377442e1349acaf766218b54a9d620100000000000000494198276eb2df7766411bef0ebb5000000000006065d635b0b7a00ee767221d8af9753387e0cd8d718f54a29df6eba3bd4c440e6e2172e3fcc01b8babb757b5c59217b80d0db3ba582814a604e4ef7a803e9ca7c85b35c9b93a9e0885e238b44ae1c2e64cce3b27083b8246829e64056000302bffff15405bd5f2eba20000000000000000000000000000000000009a9823fd8fbc5aa165099c5ed032b48ea12d8e0588dc52702e4084913a06d468d0928bad76d697e1f85ab030e788d38788ee5b5428d4a971cc97db9fd231088e570735ce129e7e77fc2777692664a1488fd8d6dff4dad618fd54f529d4555c6507009ee69dd1bc55258789b24052137e9637f3efbab71720f88c3c44b3b7486f979e8a3174b531f573fe0e5239c000be2733c49546f6e8a9175ec6f14dbf72cac91643b2fd99c29eca28a3c2e60d5e5b8795fae16a7c3ea57e728eca35eaf0155a39f97580e079175426c088a0208040982a0000000000000000000000000051ceaaf0159fe61f2eade7603d0a7a56fb09cd119ac06adb6597155ae47846892bb423c024d8cbe9240b71ec6dc2124d3a19e2d714b273d95d1d3aa737cb04a33615ff2a730e51067d5d675d7122361c37c61a43b5afd865b60d4cae891b73220f17d25985a7f76834995e53a93a1c7b9eef267df691ca983a0b15bda7f6c5c1ca7aa50261a3089a1ebf0734c9b07e8951ff023263ad5aed8cfb49b49e128c697724c057d22c5df5aef27ce3db11d5ad5527d149d076e1a87e2df27c0cb8a67ad026bf953e88f10447e125c2c0f1aebee1f3390a9e3ddad4e2a6e0f6e4569fdefa19e870e04acf9493b963f98e23cfc665e4f465fa3f801e1957c399e45f61d3459b1c606204368bb931345af2823c487d2fd99db6ea6e008e7ffa06ca861551189d155bd077a79fe2c7e961352e56824f727d21d41eae78bfec4a2d7a7edbc8ef958c5ea599f7c25bf71c2340558aa12fdd24a88aaad5921aee7dae6a2f3009d9cb43ab4898d0f0aa565431b6abe585d75db04d1c9ba0b9de4ae8b0d3132bc6810cc9a693979f55174a72e1df9fdef35bc470f9e6e591982757f45c52c645d891bf63bb21fb66926ebe1a8525611fc3e8bb8795c36dc2a86b5ab46ff33cc74f61751b2dae92676db85c8d0c721b7ea4544bf51c95c86fcac1f434d09d1ee4928aafe23de66fed972e0dddfb33f64e48701b049239e7f552d816441d11c4c2647c014462344359198d97c4b6e9ed31ca18987b64de079b2bed641e8a92f13ca70844c65cb423d01950b0ebf44bd28e09c05d9ae5dd689fb880fb18d042219f5ac60c3a03b085abf3e8e3efc842a8d328733461f04c99607061c65ed14c61322a5ac2d371a95b8ad867ec92d13a4fa4ae033a09673866cd779a8758d8855400d8c6a7242dc207251e8797eca24ea4f487663e60f2f5e1f1424958fd148f846830e88a42d93e1fe9b0b4a4a268921738938aa9f3cb3811ac87c54c8ebc8bcfb4613cc3a997ff1579edbd4ade8020e3ad001b072b1a751b588ac4639f35a58e00a50c0270608c7a7f10132b1c25b9ea81232fbef665f6212f875b2a0000000000000000000000000000002684c2d8eb8cac98930fa6a893ca44c0f64c07a87eb7b05f56ca6c70cb3a0eb328a15fe96a88235155e6d64bd434f641ddf9db2245e47e5904453577895dd81d"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000)={0x1}, 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000001440)={&(0x7f0000000540)='rcu_utilization\x00', r4}, 0x18) r5 = bpf$ITER_CREATE(0xb, 0x0, 0x0) write$cgroup_int(r5, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0xb, 0xc3072, 0xffffffffffffffff, 0x0) shutdown(0xffffffffffffffff, 0x0) r6 = socket(0x40000000015, 0x5, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000580)={0x0}, 0x1, 0xba01}, 0x810) connect$inet(r6, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10) bind$inet(r6, &(0x7f0000000340)={0x2, 0x4e20, @loopback}, 0x57) sendmsg$xdp(r6, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) recvmmsg(r6, &(0x7f0000001740)=[{{0x0, 0x0, &(0x7f0000001400)=[{&(0x7f0000000400)=""/4096, 0x1000}], 0x1}}], 0x4000210, 0x2, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0x3, 0x4, 0x0, 0x0, 0x8, 0x99, &(0x7f0000000180)=""/153, 0x0, 0x0, '\x00', 0x0, @sched_cls=0x36, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) write$cgroup_subtree(r5, &(0x7f00000005c0)=ANY=[], 0x8) mmap(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x0, 0x12, r0, 0x0) 2m29.720321995s ago: executing program 0 (id=1847): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b7030000e8ffffff850000000400000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r0, 0x0, 0x4}, 0x18) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000000), 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x414a, 0x0) socket(0x2, 0x90c3b08029fbbd66, 0x3ff) socket$inet_mptcp(0x2, 0x1, 0x106) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, 0x0, 0x0) r1 = socket(0x28, 0x5, 0x0) sendmmsg(r1, &(0x7f0000000100)=[{{0x0, 0x0, 0x0}}], 0x1, 0x24008094) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000380)=ANY=[@ANYBLOB="48e700006f020601040000000000000000000000000500010006000000050005000a00000005000400000000000900020073797a31000000000d000300686173683a6e657400000000"], 0x48}}, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)=ANY=[@ANYBLOB="44000000090601020000000000000000000000000900020073797a310000000005000100070000001c0007801800018014000240"], 0x44}, 0x1, 0x0, 0x0, 0x10000047}, 0x4000084) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), r4) socket$netlink(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000004c0)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.swap.events\x00', 0x275a, 0x0) setsockopt$sock_attach_bpf(r5, 0x1, 0x2a, &(0x7f0000000100)=r7, 0x4) recvmsg$unix(r5, &(0x7f0000000580)={0x0, 0x0, 0x0}, 0x10002) ioctl$int_in(r5, 0x5452, &(0x7f00000000c0)=0x400) sendmsg$inet(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000001c0)='l', 0x1}], 0x1}, 0x2404c140) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000240)={&(0x7f0000000100)=ANY=[], 0x0, 0x35, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x28) r8 = socket$kcm(0x2b, 0x1, 0x0) r9 = socket$kcm(0x29, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(r8, 0x89e1, &(0x7f0000000080)={r9}) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f00000000c0)={0x2, 0x4002, @dev={0xac, 0x14, 0x14, 0xad}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x300}, 0x22044888) r10 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r10, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) 2m28.112145737s ago: executing program 0 (id=1853): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0xb, &(0x7f0000000140)=@framed={{0x18, 0x2, 0x0, 0x0, 0x1}, [@printk={@i, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x7b}}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x85ff, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) 2m27.963399531s ago: executing program 0 (id=1855): r0 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x12, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180000001c0000000000000000000000711207000000"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @cgroup_sock_addr=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) sendmmsg$inet(r0, &(0x7f00000003c0)=[{{0x0, 0x0, &(0x7f0000000340)=[{0x0}, {0x0}, {&(0x7f0000000300)="a78e8f", 0x3}], 0x3, &(0x7f0000000500)=ANY=[@ANYBLOB], 0xe0}}], 0x1, 0x8000) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000b00)=@raw={'raw\x00', 0x3c1, 0x3, 0x4c8, 0x0, 0x9403, 0x3002, 0x0, 0x2c0, 0x3f8, 0x3d8, 0x3d8, 0x3f8, 0x3d8, 0x3, 0x0, {[{{@uncond, 0x0, 0x298, 0x2e0, 0x0, {}, [@common=@inet=@recent0={{0xf8}, {0x10, 0x2000000, 0x1, 0x0, 'syz1\x00'}}, @common=@inet=@recent0={{0xf8}, {0x0, 0x80, 0x1, 0x0, 'syz0\x00', 0x1}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x1, 0x5, 0x4, 0x7f, 'netbios-ns\x00', {0x6}}}}, {{@ipv6={@loopback, @private0={0xfc, 0x0, '\x00', 0x1}, [0xffffffff, 0xffffff00, 0xffffffff, 0x893be63aad8f80b8], [0xff000000, 0xffffffff, 0xff000000], 'veth1_virt_wifi\x00', 'erspan0\x00', {0xff}, {0xff}, 0x3c, 0x8, 0x1, 0x2}, 0x0, 0xd0, 0x118, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0xfffffff4, 'syz1\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x528) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) syz_emit_ethernet(0x4a, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaaaa86dd608a37f20008"], 0x0) r5 = socket$inet6_udp(0xa, 0x2, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffc, @void, @value}, 0x94) r6 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x46, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r6, 0x5, 0xb68, 0x1300, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) setsockopt$IP6T_SO_SET_REPLACE(r5, 0x29, 0x40, &(0x7f0000000580)=@raw={'raw\x00', 0x3c1, 0x3, 0x458, 0x0, 0x168, 0x10, 0x190, 0xb, 0x388, 0x250, 0x250, 0x388, 0x250, 0x3, 0x0, {[{{@ipv6={@remote, @rand_addr=' \x01\x00', [], [], 'veth1_to_batadv\x00', 'veth1_to_hsr\x00', {}, {}, 0x3a}, 0x6000000, 0x128, 0x190, 0x0, {0x0, 0x28e}, [@common=@icmp6={{0x28}, {0x0, 'K\r'}}, @common=@inet=@hashlimit1={{0x58}, {'netdevsim0\x00', {0x0, 0x0, 0x9, 0x1, 0x0, 0x10000, 0x80000001}}}]}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x0, 0x0, 0x0, 0x0, 'pptp\x00', 'syz1\x00'}}}, {{@uncond, 0x0, 0xd0, 0x1f8, 0x0, {}, [@common=@inet=@set2={{0x28}}]}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x0, 0x0, 'system_u:object_r:usb_device_t:s0\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x4b8) sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000bc0)={&(0x7f0000000180)={0x24, r3, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_SET_WIPHY_NETNS(r0, &(0x7f0000000740)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000700)={0x0}, 0x1, 0x0, 0x0, 0x850}, 0x40815) sendmsg$NL80211_CMD_START_AP(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x5c, r3, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r4}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x28, 0xe, {{{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x1, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}]}, 0x5c}}, 0x0) setsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0x17, &(0x7f0000000600), 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) sendmsg$NL80211_CMD_START_AP(r1, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000040)={&(0x7f0000000400)={0xe0, r3, 0x200, 0x70bd29, 0x25dfdbff, {{}, {@val={0x8, 0x3, r4}, @val={0xc, 0x99, {0x0, 0xffff}}}}, [@acl_policy=[@NL80211_ATTR_ACL_POLICY={0x8, 0xa5, 0x1}, @NL80211_ATTR_MAC_ADDRS={0x28, 0xa6, 0x0, 0x1, [{0xa, 0x6, @device_b}, {0xa}, {0xa}]}, @NL80211_ATTR_MAC_ADDRS={0x4c, 0xa6, 0x0, 0x1, [{0xa, 0x6, @broadcast}, {0xa}, {0xa}, {0xa, 0x6, @broadcast}, {0xa}, {0xa, 0x6, @device_b}]}, @NL80211_ATTR_MAC_ADDRS={0x28, 0xa6, 0x0, 0x1, [{0xa, 0x6, @device_b}, {0xa, 0x6, @broadcast}, {0xa, 0x6, @broadcast}]}], @NL80211_ATTR_EXTERNAL_AUTH_SUPPORT={0x4}, @NL80211_ATTR_PBSS={0x4}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}]}, 0xe0}, 0x1, 0x0, 0x0, 0x40000}, 0x4044080) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000001040)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_LEAVE_OCB(r0, &(0x7f0000001100)={&(0x7f0000000540), 0xc, &(0x7f00000010c0)={&(0x7f0000001080)={0x1c, r3, 0x1, 0x70bd25, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r7}, @void}}, ["", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000010) 2m27.394794888s ago: executing program 0 (id=1857): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000580)={0x3, 0xc, &(0x7f0000000140)=ANY=[@ANYBLOB="180200000100000000000000002000008500000028000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000084ff03001700000095"], &(0x7f0000000400)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@delnexthop={0x20, 0x69, 0x503, 0x0, 0x0, {}, [{0x8}]}, 0x20}}, 0x0) syz_emit_ethernet(0x22, &(0x7f00000011c0)={@local, @dev, @void, {@ipv4={0x800, @generic={{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0xff84, 0x0, 0x84, 0x0, @remote, @broadcast}}}}}, 0x0) 2m27.196105816s ago: executing program 0 (id=1859): r0 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'ip6tnl0\x00', &(0x7f00000000c0)={'syztnl2\x00', 0x0, 0x4, 0x8, 0x0, 0x7, 0x1d, @private2={0xfc, 0x2, '\x00', 0x1}, @loopback={0xfec0ffff00000000, 0x2}, 0x20, 0x8, 0x3, 0x84}}) r1 = socket$phonet_pipe(0x23, 0x5, 0x2) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000bc0)={0x11, 0x3, &(0x7f0000000b00)=ANY=[@ANYBLOB="1800000000000000000000000040000095"], &(0x7f00000003c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000140)='contention_end\x00', r2}, 0x10) bind$phonet(r1, &(0x7f0000000040)={0x23, 0x4}, 0x10) close(r1) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000400)=@base={0xe, 0x4, 0x4, 0x3, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) r4 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="020000080000000100000080000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00'/28], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xb, 0x1c, &(0x7f0000000d80)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0x70}, {{0x18, 0x1, 0x1, 0x0, r3}, {}, {}, {0x85, 0x0, 0x0, 0x5}}, {{0x5, 0x0, 0x3}, {0x95, 0x0, 0x0, 0x700}}, [@snprintf={{0x7, 0x0, 0xb, 0x2}, {0x3, 0x3, 0x3, 0xa, 0x9, 0xfe00}, {0x6, 0x0, 0xb, 0x9}, {0x3, 0x3, 0x6, 0xa, 0xa, 0xfff0, 0x50}, {0x7, 0x1, 0xb, 0x6, 0x8}, {0x7, 0x0, 0x0, 0x8}, {}, {}, {0x7, 0x0, 0x5, 0x0}, {0x18, 0x2, 0x2, 0x0, r4}, {}, {0x46, 0x8, 0xfff0, 0x76}}], {{0x5, 0x1, 0x4, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000040)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0xa0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0xf00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) 2m26.879507081s ago: executing program 0 (id=1860): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000400)=ANY=[], 0x44}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000001200)={&(0x7f0000000000)=ANY=[@ANYBLOB='8\x00\x00\x00T\x00=\t\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00', @ANYRES32, @ANYRES8=0x0, @ANYBLOB="00010068409e813a2583c03387978a88b24e2feceb0b6d5c66236d7f95ff80816aca2c7a10"], 0x38}, 0x1, 0x0, 0x0, 0x4010}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000002800)=@newtfilter={0x24, 0x2c, 0x100, 0x70bd25, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, {0xfffc, 0xd}, {0x5, 0xfff2}, {0x1, 0x7}}}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000000c0)={0x14, 0x25, 0x1, 0x70bd27, 0x25dfdbfc, {0x5}}, 0x14}, 0x1, 0x0, 0x0, 0x4}, 0x40000) r1 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r1, &(0x7f00000002c0), 0x40000000000009f, 0x0) 2m22.003623709s ago: executing program 32 (id=1781): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='memory.numa_stat\x00', 0x275a, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000240)={0x0, 0xffffffffffffffff, 0x0, 0xfffffffffffffd51, &(0x7f0000000000)='cgroup\x00'}, 0x30) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, '\x00', 0x0, @fallback=0x32, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) openat$cgroup_int(r1, &(0x7f0000000040)='cpu.max\x00', 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1801000021000000000000003b810000850000006d000000070000000000000095"], &(0x7f0000000040)='GPL\x00', 0x6, 0x0, 0x0, 0x0, 0x29, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000480)={&(0x7f0000000080)='rpc_call_rpcerror\x00', r2, 0x0, 0xf69}, 0x18) r3 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000280)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x6, 0x0, 0x0, 0x0, 0x29, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={&(0x7f0000000080)='rpc_call_rpcerror\x00', r2, 0x0, 0xf69}, 0x18) sendmsg$netlink(r3, &(0x7f0000000040)={0x0, 0x20, &(0x7f0000002580)=[{&(0x7f0000000000)=ANY=[@ANYBLOB="140000002500010000000000f100000006"], 0x14}], 0x1, 0x0, 0x0, 0x400048c0}, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000002e00)=ANY=[@ANYBLOB="620af8ff0c200021bfa100000000000007010000f8ffffffb702000003000000bd120000000000008500000006000000b70000000000000095000000000000003faf4f1e7f2aa3d9b18ed81c0c869b51ec6c0af4e0e4a9446c7670568982b4e020f698393aa0f3881f9c24aa56f15199fad0093c59d66b5ece9f36c70d0f13905ea23c22624c9f87f9793f50bb546040677b0c5077da80fb982c1e9400e693146cea484a415b76966118b64f751a0f241b072e90080008002d75593a286cecc93e64c227c95aa0b784625704f07a72c234664c0af9360a1f7a5e6b607130c89f18c0c1089d8b853289e01aa27ae8b09e00e79ab20b0b8e1148f42fc3199f000000000000006fa03c6468972089b302d7bf6023cdcedb5e0125ebbc08dee510cb2364149215108333719acd97cfa107d40224edc5465a932b77e74e802a0d42bc6099ad2300000080006ef6c1ff0900000000000010c63a949e8b7955394ffa82b8e942c89112f4ab87b1bfeda7be586602d985430cea0162ab3fcf4591c926abfb0767192302000000b0eea24492a660583eecb42cbcd3de3a83209da17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c95c25a573dc2edcaea2b1a52496dfcaf99431412fd134a996382a1a04d5bb924cfe5f3185418d605ffff9c4d2ec7c32f2095e63c80af735ed41793bdf9fa740b5b7632f32030916f89c6dad7603f2ba2a790d62d6faec2fed44da4928b30142ba11de6c5d50b83bae613402216b5054d1e7c13b1355d6f4a8245ffa4997da9c77af4c0eb97fca585ec6bf58351d564beb6d952aab9c70764b0a8a7583c90b3433b809bdb9fbd48bc873495cbff8a326eea31ae4e0f7505ebf6c9d13330ca005ace1a84521f14518c9b476fccbd6c712016219848624b87cec2dbc68223a0eb4fa39f6b5c02e6d6d90756ff57902a8f57000000009700cf0b4b8bc22941330000000000000000000300000000000064cf8605810000000000000010008bc0d9559711e6e8861c46495ba585a4b2d02edc3e28dd271c896249ed85b980680b00002b435ac15fc0288d9b2a169cdcacc413038dafb7a2c8cb482bac0ac502d9ba96ffffff7f00001000000000eeff7c5ad897ef3b7cda42013d53046da21b40216e14ba2d6ad5656bfff17addaedab25b30002abbba7fa725f38400be7c1f001b2cd317902f19e385be9e48dccff729eec082830689da6b53b263339863297771429d120000003341bf4abacac95900fca0493cf29b33dcc9ffffffffffffffd39fec2271ff01589646efd1cf870cd7bb2366fde41f94290c2a5ff870ce41fd3467decb05cfd9fcb32c8ed1dbd9d10a64c1083d5e71b5565b1768ee58969c41595229df17bcad70fb4021428ce970275d13b78100788f11f76161d46ea3abe0fa4d30dc94ef241875f3b4ce0232fcea69c271d7fa29822aea68a660e717a04becff0f719197724f4fce1093b62d7e8c7123d8ec571be54c72d978cf906df0042e36acd37d7f9e119f2c06f815312e0cfe222a06f56dd022c074eb8a322fb0bf47c0a8d154b405c37feaf3dd95f6ef2ae582786105c7df8be5877050c91301bb997316dbf17866fb84d4173731efe895ff2e1c5560926e90109b598502d3e959efc71f665c4d75cf2458e3546c1c776da64fb5abee0acfd235f2f4632c9062ece84c99a061887a20639b41c8c12ee86c50804042b3fb5aac518a75f9e7d7101d5e186c489b3a06fb99e0aa7f23a054de2f4d92d6bd72ee2c9fdc75aaaf1e3e483b4ad05573af40326993947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f54c2d3335457acf37331766e472391e358c3b377327ac9ecc34f24c9ae153ec60ac0694dc55bff9f5f45f90400000000000000d6b2c5ea1393fdf24285bf16b99c9cc0ad1857216f1a985f369191ae954febb3df464bfe0f7f3ee9afe7befb89d2777399f5874c553aeb3729cffe86e66964ae09bb6d163118e4cbe024fd4500f8ff0700000000cc9d8046c216c1f895778cb25122a2a9f9b444aeadea2a40da8daccf080842a486721737390cbf3a74cb2003016f1514216bdf57d2a40d40b51ab63e96ec8485b3b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde8a168c3f5db2fea6f26e4a4304e50c349f4f9ecee27defc93871c5f99b355b72d538ba4958ea8e4aa37094191e10096e7e60fc3541a2c905a1a95e9571bf38ae1981c4238ecaee6f75cd0a6881bd1517a8250ddc8674152f94e3a409e2a3bce109b60000000000000000d6d5210d7503000000a87a27602b81f76386f1535bef1497f92186086e29c6bc5a1fad6ec9a31137abf9a404abde7750898b1bd627e873f8703be8672d70d1ab57075228a9f46ed9bd1f08fb8191bbab2dc51de3a61f0868afc4294859323e6c257a45319f18101288d139bd3da20fed05a8fe64680b0a3fc22dd70400000000946912d6c98cd1a9fbe1e7d58c08acaf30235b918a31d2eca55f74a23641f61f2d5b308cf0d031b0c7f0ced69993e9960ff5f76015e6009556237badf4e7965bbe2777e808fcba821aa8e8c5c39609ff854352cb4900000000000000000000000000c1fee30a3f7a85d1b29e58c77685efc0ceb1c8e5729c66418d169fc03aa188546b3ad2a182068e1e3a0e2505bc7f41019645466a53f1c96e0d4b3bc19faa5449209b083dbd334b47f067bbab40743b2a42010082008df75cf43f8ecc8d3726602111b40e761fd21081920382f14d12ca3c3431ee97471c7868dcda7eaa69eb7f7f80572fdd11bb1d0d1280fbc22bf73468788df51710d7d31c632fc5ed1762eb0b428ee751c47d8e894f745a868404a0bf35f0121008b722b1eaa6aedfa1bf2e7ccb2d61d5d76331945ecefa26b8471d424c14283a94395b64645288d7226bbd9ccd628ab84875f2c50ba891cea592b0430a537a395dc73bda367bf12cb7d81691a5fe8c47be395656a297e9df0e71f96756ea5cce7daac4be290159f6bcd75f0dda9de5532e71ae9e48b0ed0254a83100000000f6fbb869604d51a36a54c832e45b2569dc0d90b075225fde44c4e0973171ad47d6b0fdf9743af932cd6db49a47613808bad959710300000000000000832d0a45fa4242e24c7e800003c9e8095e02985f28e678f66422436f949e2ab8f162d7e3f855e378f4a1f40b0c6fb2d4b205a800b6d713acebc5b014e61a543a5a194f9ac18d76b5440e3b1a569e7397f6cafa86966d7ba19e720413267a6ccea9c439671d2c680f2753ca184eeeb843450368acb4383a01d25eb3d1e23e0f2645d1cdfa9fa410632f95a5f622f851c66ee7e30393cd7a4d67ff2a49c4f93c0984b5c2d4523497e4d64f95f08493564a1df87111c9bf3194fef97dcecc467ace45feeb685c5870d05f88a0f463db88d377442e1349acaf766218b54a9d620100000000000000494198276eb2df7766411bef0ebb5000000000006065d635b0b7a00ee767221d8af9753387e0cd8d718f54a29df6eba3bd4c440e6e2172e3fcc01b8babb757b5c59217b80d0db3ba582814a604e4ef7a803e9ca7c85b35c9b93a9e0885e238b44ae1c2e64cce3b27083b8246829e64056000302bffff15405bd5f2eba20000000000000000000000000000000000009a9823fd8fbc5aa165099c5ed032b48ea12d8e0588dc52702e4084913a06d468d0928bad76d697e1f85ab030e788d38788ee5b5428d4a971cc97db9fd231088e570735ce129e7e77fc2777692664a1488fd8d6dff4dad618fd54f529d4555c6507009ee69dd1bc55258789b24052137e9637f3efbab71720f88c3c44b3b7486f979e8a3174b531f573fe0e5239c000be2733c49546f6e8a9175ec6f14dbf72cac91643b2fd99c29eca28a3c2e60d5e5b8795fae16a7c3ea57e728eca35eaf0155a39f97580e079175426c088a0208040982a0000000000000000000000000051ceaaf0159fe61f2eade7603d0a7a56fb09cd119ac06adb6597155ae47846892bb423c024d8cbe9240b71ec6dc2124d3a19e2d714b273d95d1d3aa737cb04a33615ff2a730e51067d5d675d7122361c37c61a43b5afd865b60d4cae891b73220f17d25985a7f76834995e53a93a1c7b9eef267df691ca983a0b15bda7f6c5c1ca7aa50261a3089a1ebf0734c9b07e8951ff023263ad5aed8cfb49b49e128c697724c057d22c5df5aef27ce3db11d5ad5527d149d076e1a87e2df27c0cb8a67ad026bf953e88f10447e125c2c0f1aebee1f3390a9e3ddad4e2a6e0f6e4569fdefa19e870e04acf9493b963f98e23cfc665e4f465fa3f801e1957c399e45f61d3459b1c606204368bb931345af2823c487d2fd99db6ea6e008e7ffa06ca861551189d155bd077a79fe2c7e961352e56824f727d21d41eae78bfec4a2d7a7edbc8ef958c5ea599f7c25bf71c2340558aa12fdd24a88aaad5921aee7dae6a2f3009d9cb43ab4898d0f0aa565431b6abe585d75db04d1c9ba0b9de4ae8b0d3132bc6810cc9a693979f55174a72e1df9fdef35bc470f9e6e591982757f45c52c645d891bf63bb21fb66926ebe1a8525611fc3e8bb8795c36dc2a86b5ab46ff33cc74f61751b2dae92676db85c8d0c721b7ea4544bf51c95c86fcac1f434d09d1ee4928aafe23de66fed972e0dddfb33f64e48701b049239e7f552d816441d11c4c2647c014462344359198d97c4b6e9ed31ca18987b64de079b2bed641e8a92f13ca70844c65cb423d01950b0ebf44bd28e09c05d9ae5dd689fb880fb18d042219f5ac60c3a03b085abf3e8e3efc842a8d328733461f04c99607061c65ed14c61322a5ac2d371a95b8ad867ec92d13a4fa4ae033a09673866cd779a8758d8855400d8c6a7242dc207251e8797eca24ea4f487663e60f2f5e1f1424958fd148f846830e88a42d93e1fe9b0b4a4a268921738938aa9f3cb3811ac87c54c8ebc8bcfb4613cc3a997ff1579edbd4ade8020e3ad001b072b1a751b588ac4639f35a58e00a50c0270608c7a7f10132b1c25b9ea81232fbef665f6212f875b2a0000000000000000000000000000002684c2d8eb8cac98930fa6a893ca44c0f64c07a87eb7b05f56ca6c70cb3a0eb328a15fe96a88235155e6d64bd434f641ddf9db2245e47e5904453577895dd81d"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000)={0x1}, 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000001440)={&(0x7f0000000540)='rcu_utilization\x00', r4}, 0x18) r5 = bpf$ITER_CREATE(0xb, 0x0, 0x0) write$cgroup_int(r5, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0xb, 0xc3072, 0xffffffffffffffff, 0x0) shutdown(0xffffffffffffffff, 0x0) r6 = socket(0x40000000015, 0x5, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000580)={0x0}, 0x1, 0xba01}, 0x810) connect$inet(r6, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10) bind$inet(r6, &(0x7f0000000340)={0x2, 0x4e20, @loopback}, 0x57) sendmsg$xdp(r6, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) recvmmsg(r6, &(0x7f0000001740)=[{{0x0, 0x0, &(0x7f0000001400)=[{&(0x7f0000000400)=""/4096, 0x1000}], 0x1}}], 0x4000210, 0x2, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0x3, 0x4, 0x0, 0x0, 0x8, 0x99, &(0x7f0000000180)=""/153, 0x0, 0x0, '\x00', 0x0, @sched_cls=0x36, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) write$cgroup_subtree(r5, &(0x7f00000005c0)=ANY=[], 0x8) mmap(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x0, 0x12, r0, 0x0) 2m11.826942994s ago: executing program 33 (id=1860): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000400)=ANY=[], 0x44}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000001200)={&(0x7f0000000000)=ANY=[@ANYBLOB='8\x00\x00\x00T\x00=\t\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00', @ANYRES32, @ANYRES8=0x0, @ANYBLOB="00010068409e813a2583c03387978a88b24e2feceb0b6d5c66236d7f95ff80816aca2c7a10"], 0x38}, 0x1, 0x0, 0x0, 0x4010}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000002800)=@newtfilter={0x24, 0x2c, 0x100, 0x70bd25, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, {0xfffc, 0xd}, {0x5, 0xfff2}, {0x1, 0x7}}}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000000c0)={0x14, 0x25, 0x1, 0x70bd27, 0x25dfdbfc, {0x5}}, 0x14}, 0x1, 0x0, 0x0, 0x4}, 0x40000) r1 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r1, &(0x7f00000002c0), 0x40000000000009f, 0x0) 1m47.990719147s ago: executing program 3 (id=1944): r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) (async) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r2, &(0x7f0000003b80)={0x10000001}) write(r3, 0x0, 0x0) (async) close(r1) (async) syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/ipc\x00') (async) unshare(0x4e020a00) syz_emit_ethernet(0xffffffffffffff4c, &(0x7f0000000480)=ANY=[@ANYRES64], 0x0) (async) r4 = socket(0x1e, 0x4, 0x0) setsockopt$TIPC_DEST_DROPPABLE(r4, 0x10f, 0x81, &(0x7f0000000480), 0x4) (async) sendmsg$tipc(r4, &(0x7f0000000200)={&(0x7f00000000c0)=@nameseq={0x1e, 0x1, 0x1, {0x1, 0x0, 0x4}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x10}, 0x4800) recvfrom$inet6(r4, &(0x7f0000000340)=""/152, 0x98, 0x40002143, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) (async) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, &(0x7f00000001c0)={0x6, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, &(0x7f00000000c0)=0x1c) r8 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=ANY=[@ANYRES64=r6], 0x50) r9 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x13, 0xd, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000000850080007b00000018110000dd7848abafd3d477b85cf09ca322e70c5aee5fb256eba21b4dc782a00a88ccc59d75107cea7e117a4bfcf8d7219c9c4b0825bc29aa900f044caa5306729f", @ANYRES32=r8, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffff070000000008000004b704000000000000850000000300000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x36, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6e985fe4, @void, @value}, 0x94) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000300)={r8, 0x0, 0x0}, 0x20) (async) socket$inet6_sctp(0xa, 0x5, 0x84) (async) r11 = socket$netlink(0x10, 0x3, 0x14) (async) r12 = socket(0x10, 0x803, 0x0) r13 = syz_open_procfs$namespace(0x0, &(0x7f0000000940)='ns/time\x00') (async) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r12, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0}, 0x1, 0x0, 0x0, 0x408d1}, 0x4040) (async) getsockname$packet(r12, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) (async) sendmsg$nl_route(r11, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x40000) r14 = socket$netlink(0x10, 0x3, 0x14) sendmsg$nl_route(r14, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)=ANY=[@ANYRES16=r2, @ANYRES32=r5, @ANYRES64=r7, @ANYRES64=r13, @ANYRESOCT=r10, @ANYRES8=0x0, @ANYRES16=r10, @ANYRES64, @ANYRES64=r8, @ANYRESOCT=r9, @ANYRESDEC=r10], 0x3c}, 0x1, 0x0, 0x0, 0xc014}, 0xc0b0) r15 = socket$inet(0xa, 0x2, 0x84) (async) pipe(&(0x7f0000000240)) listen(r15, 0x8) 1m36.848663125s ago: executing program 1 (id=1582): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0xb, &(0x7f0000000380)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000300)='rcu_utilization\x00', r0}, 0x10) socket$nl_rdma(0x10, 0x3, 0x14) bpf$BPF_PROG_GET_FD_BY_ID(0xd, 0x0, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000bc0), r1) sendmsg$NLBL_CIPSOV4_C_ADD(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000000)=ANY=[@ANYBLOB="e0000000", @ANYRES16=r2, @ANYBLOB="01000000000000000000010000000800010000030040140004800500030007000000050003000100000008000200010000000800020001000000a00008801c0007800800850002000000080006000000000008000500400003"], 0xe0}}, 0x0) 1m27.34767048s ago: executing program 3 (id=1944): r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) (async) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r2, &(0x7f0000003b80)={0x10000001}) write(r3, 0x0, 0x0) (async) close(r1) (async) syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/ipc\x00') (async) unshare(0x4e020a00) syz_emit_ethernet(0xffffffffffffff4c, &(0x7f0000000480)=ANY=[@ANYRES64], 0x0) (async) r4 = socket(0x1e, 0x4, 0x0) setsockopt$TIPC_DEST_DROPPABLE(r4, 0x10f, 0x81, &(0x7f0000000480), 0x4) (async) sendmsg$tipc(r4, &(0x7f0000000200)={&(0x7f00000000c0)=@nameseq={0x1e, 0x1, 0x1, {0x1, 0x0, 0x4}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x10}, 0x4800) recvfrom$inet6(r4, &(0x7f0000000340)=""/152, 0x98, 0x40002143, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) (async) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, &(0x7f00000001c0)={0x6, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, &(0x7f00000000c0)=0x1c) r8 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=ANY=[@ANYRES64=r6], 0x50) r9 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x13, 0xd, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000000850080007b00000018110000dd7848abafd3d477b85cf09ca322e70c5aee5fb256eba21b4dc782a00a88ccc59d75107cea7e117a4bfcf8d7219c9c4b0825bc29aa900f044caa5306729f", @ANYRES32=r8, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffff070000000008000004b704000000000000850000000300000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x36, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6e985fe4, @void, @value}, 0x94) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000300)={r8, 0x0, 0x0}, 0x20) (async) socket$inet6_sctp(0xa, 0x5, 0x84) (async) r11 = socket$netlink(0x10, 0x3, 0x14) (async) r12 = socket(0x10, 0x803, 0x0) r13 = syz_open_procfs$namespace(0x0, &(0x7f0000000940)='ns/time\x00') (async) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r12, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0}, 0x1, 0x0, 0x0, 0x408d1}, 0x4040) (async) getsockname$packet(r12, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) (async) sendmsg$nl_route(r11, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x40000) r14 = socket$netlink(0x10, 0x3, 0x14) sendmsg$nl_route(r14, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)=ANY=[@ANYRES16=r2, @ANYRES32=r5, @ANYRES64=r7, @ANYRES64=r13, @ANYRESOCT=r10, @ANYRES8=0x0, @ANYRES16=r10, @ANYRES64, @ANYRES64=r8, @ANYRESOCT=r9, @ANYRESDEC=r10], 0x3c}, 0x1, 0x0, 0x0, 0xc014}, 0xc0b0) r15 = socket$inet(0xa, 0x2, 0x84) (async) pipe(&(0x7f0000000240)) listen(r15, 0x8) 1m17.632903046s ago: executing program 1 (id=1582): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0xb, &(0x7f0000000380)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000300)='rcu_utilization\x00', r0}, 0x10) socket$nl_rdma(0x10, 0x3, 0x14) bpf$BPF_PROG_GET_FD_BY_ID(0xd, 0x0, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000bc0), r1) sendmsg$NLBL_CIPSOV4_C_ADD(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000000)=ANY=[@ANYBLOB="e0000000", @ANYRES16=r2, @ANYBLOB="01000000000000000000010000000800010000030040140004800500030007000000050003000100000008000200010000000800020001000000a00008801c0007800800850002000000080006000000000008000500400003"], 0xe0}}, 0x0) 1m8.412462171s ago: executing program 3 (id=1944): r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) (async) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r2, &(0x7f0000003b80)={0x10000001}) write(r3, 0x0, 0x0) (async) close(r1) (async) syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/ipc\x00') (async) unshare(0x4e020a00) syz_emit_ethernet(0xffffffffffffff4c, &(0x7f0000000480)=ANY=[@ANYRES64], 0x0) (async) r4 = socket(0x1e, 0x4, 0x0) setsockopt$TIPC_DEST_DROPPABLE(r4, 0x10f, 0x81, &(0x7f0000000480), 0x4) (async) sendmsg$tipc(r4, &(0x7f0000000200)={&(0x7f00000000c0)=@nameseq={0x1e, 0x1, 0x1, {0x1, 0x0, 0x4}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x10}, 0x4800) recvfrom$inet6(r4, &(0x7f0000000340)=""/152, 0x98, 0x40002143, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) (async) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, &(0x7f00000001c0)={0x6, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, &(0x7f00000000c0)=0x1c) r8 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=ANY=[@ANYRES64=r6], 0x50) r9 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x13, 0xd, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000000850080007b00000018110000dd7848abafd3d477b85cf09ca322e70c5aee5fb256eba21b4dc782a00a88ccc59d75107cea7e117a4bfcf8d7219c9c4b0825bc29aa900f044caa5306729f", @ANYRES32=r8, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffff070000000008000004b704000000000000850000000300000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x36, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6e985fe4, @void, @value}, 0x94) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000300)={r8, 0x0, 0x0}, 0x20) (async) socket$inet6_sctp(0xa, 0x5, 0x84) (async) r11 = socket$netlink(0x10, 0x3, 0x14) (async) r12 = socket(0x10, 0x803, 0x0) r13 = syz_open_procfs$namespace(0x0, &(0x7f0000000940)='ns/time\x00') (async) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r12, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0}, 0x1, 0x0, 0x0, 0x408d1}, 0x4040) (async) getsockname$packet(r12, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) (async) sendmsg$nl_route(r11, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x40000) r14 = socket$netlink(0x10, 0x3, 0x14) sendmsg$nl_route(r14, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)=ANY=[@ANYRES16=r2, @ANYRES32=r5, @ANYRES64=r7, @ANYRES64=r13, @ANYRESOCT=r10, @ANYRES8=0x0, @ANYRES16=r10, @ANYRES64, @ANYRES64=r8, @ANYRESOCT=r9, @ANYRESDEC=r10], 0x3c}, 0x1, 0x0, 0x0, 0xc014}, 0xc0b0) r15 = socket$inet(0xa, 0x2, 0x84) (async) pipe(&(0x7f0000000240)) listen(r15, 0x8) 58.116163579s ago: executing program 1 (id=1582): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0xb, &(0x7f0000000380)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000300)='rcu_utilization\x00', r0}, 0x10) socket$nl_rdma(0x10, 0x3, 0x14) bpf$BPF_PROG_GET_FD_BY_ID(0xd, 0x0, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000bc0), r1) sendmsg$NLBL_CIPSOV4_C_ADD(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000000)=ANY=[@ANYBLOB="e0000000", @ANYRES16=r2, @ANYBLOB="01000000000000000000010000000800010000030040140004800500030007000000050003000100000008000200010000000800020001000000a00008801c0007800800850002000000080006000000000008000500400003"], 0xe0}}, 0x0) 44.398887098s ago: executing program 3 (id=1944): r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) (async) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r2, &(0x7f0000003b80)={0x10000001}) write(r3, 0x0, 0x0) (async) close(r1) (async) syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/ipc\x00') (async) unshare(0x4e020a00) syz_emit_ethernet(0xffffffffffffff4c, &(0x7f0000000480)=ANY=[@ANYRES64], 0x0) (async) r4 = socket(0x1e, 0x4, 0x0) setsockopt$TIPC_DEST_DROPPABLE(r4, 0x10f, 0x81, &(0x7f0000000480), 0x4) (async) sendmsg$tipc(r4, &(0x7f0000000200)={&(0x7f00000000c0)=@nameseq={0x1e, 0x1, 0x1, {0x1, 0x0, 0x4}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x10}, 0x4800) recvfrom$inet6(r4, &(0x7f0000000340)=""/152, 0x98, 0x40002143, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) (async) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, &(0x7f00000001c0)={0x6, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, &(0x7f00000000c0)=0x1c) r8 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=ANY=[@ANYRES64=r6], 0x50) r9 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x13, 0xd, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000000850080007b00000018110000dd7848abafd3d477b85cf09ca322e70c5aee5fb256eba21b4dc782a00a88ccc59d75107cea7e117a4bfcf8d7219c9c4b0825bc29aa900f044caa5306729f", @ANYRES32=r8, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffff070000000008000004b704000000000000850000000300000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x36, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6e985fe4, @void, @value}, 0x94) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000300)={r8, 0x0, 0x0}, 0x20) (async) socket$inet6_sctp(0xa, 0x5, 0x84) (async) r11 = socket$netlink(0x10, 0x3, 0x14) (async) r12 = socket(0x10, 0x803, 0x0) r13 = syz_open_procfs$namespace(0x0, &(0x7f0000000940)='ns/time\x00') (async) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r12, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0}, 0x1, 0x0, 0x0, 0x408d1}, 0x4040) (async) getsockname$packet(r12, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) (async) sendmsg$nl_route(r11, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x40000) r14 = socket$netlink(0x10, 0x3, 0x14) sendmsg$nl_route(r14, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)=ANY=[@ANYRES16=r2, @ANYRES32=r5, @ANYRES64=r7, @ANYRES64=r13, @ANYRESOCT=r10, @ANYRES8=0x0, @ANYRES16=r10, @ANYRES64, @ANYRES64=r8, @ANYRESOCT=r9, @ANYRESDEC=r10], 0x3c}, 0x1, 0x0, 0x0, 0xc014}, 0xc0b0) r15 = socket$inet(0xa, 0x2, 0x84) (async) pipe(&(0x7f0000000240)) listen(r15, 0x8) 41.620708794s ago: executing program 1 (id=1582): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0xb, &(0x7f0000000380)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000300)='rcu_utilization\x00', r0}, 0x10) socket$nl_rdma(0x10, 0x3, 0x14) bpf$BPF_PROG_GET_FD_BY_ID(0xd, 0x0, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000bc0), r1) sendmsg$NLBL_CIPSOV4_C_ADD(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000000)=ANY=[@ANYBLOB="e0000000", @ANYRES16=r2, @ANYBLOB="01000000000000000000010000000800010000030040140004800500030007000000050003000100000008000200010000000800020001000000a00008801c0007800800850002000000080006000000000008000500400003"], 0xe0}}, 0x0) 20.840582947s ago: executing program 1 (id=1582): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0xb, &(0x7f0000000380)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000300)='rcu_utilization\x00', r0}, 0x10) socket$nl_rdma(0x10, 0x3, 0x14) bpf$BPF_PROG_GET_FD_BY_ID(0xd, 0x0, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000bc0), r1) sendmsg$NLBL_CIPSOV4_C_ADD(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000000)=ANY=[@ANYBLOB="e0000000", @ANYRES16=r2, @ANYBLOB="01000000000000000000010000000800010000030040140004800500030007000000050003000100000008000200010000000800020001000000a00008801c0007800800850002000000080006000000000008000500400003"], 0xe0}}, 0x0) 20.050689691s ago: executing program 3 (id=1944): r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) (async) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r2, &(0x7f0000003b80)={0x10000001}) write(r3, 0x0, 0x0) (async) close(r1) (async) syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/ipc\x00') (async) unshare(0x4e020a00) syz_emit_ethernet(0xffffffffffffff4c, &(0x7f0000000480)=ANY=[@ANYRES64], 0x0) (async) r4 = socket(0x1e, 0x4, 0x0) setsockopt$TIPC_DEST_DROPPABLE(r4, 0x10f, 0x81, &(0x7f0000000480), 0x4) (async) sendmsg$tipc(r4, &(0x7f0000000200)={&(0x7f00000000c0)=@nameseq={0x1e, 0x1, 0x1, {0x1, 0x0, 0x4}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x10}, 0x4800) recvfrom$inet6(r4, &(0x7f0000000340)=""/152, 0x98, 0x40002143, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) (async) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, &(0x7f00000001c0)={0x6, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, &(0x7f00000000c0)=0x1c) r8 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=ANY=[@ANYRES64=r6], 0x50) r9 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x13, 0xd, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000000850080007b00000018110000dd7848abafd3d477b85cf09ca322e70c5aee5fb256eba21b4dc782a00a88ccc59d75107cea7e117a4bfcf8d7219c9c4b0825bc29aa900f044caa5306729f", @ANYRES32=r8, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffff070000000008000004b704000000000000850000000300000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x36, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6e985fe4, @void, @value}, 0x94) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000300)={r8, 0x0, 0x0}, 0x20) (async) socket$inet6_sctp(0xa, 0x5, 0x84) (async) r11 = socket$netlink(0x10, 0x3, 0x14) (async) r12 = socket(0x10, 0x803, 0x0) r13 = syz_open_procfs$namespace(0x0, &(0x7f0000000940)='ns/time\x00') (async) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r12, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0}, 0x1, 0x0, 0x0, 0x408d1}, 0x4040) (async) getsockname$packet(r12, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) (async) sendmsg$nl_route(r11, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x40000) r14 = socket$netlink(0x10, 0x3, 0x14) sendmsg$nl_route(r14, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)=ANY=[@ANYRES16=r2, @ANYRES32=r5, @ANYRES64=r7, @ANYRES64=r13, @ANYRESOCT=r10, @ANYRES8=0x0, @ANYRES16=r10, @ANYRES64, @ANYRES64=r8, @ANYRESOCT=r9, @ANYRESDEC=r10], 0x3c}, 0x1, 0x0, 0x0, 0xc014}, 0xc0b0) r15 = socket$inet(0xa, 0x2, 0x84) (async) pipe(&(0x7f0000000240)) listen(r15, 0x8) 4.343820301s ago: executing program 4 (id=2657): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=@base={0x5, 0x4, 0x8, 0xc, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000280)=ANY=[@ANYBLOB="18010000000000000000000001080021850000006d00000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x3, 0x0, 0x81, 0x1ff, 0x1, 0x1}, 0x1c) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r2, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r2, 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r3, 0x0, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x44, 0x6, 0x4a0, 0x0, 0x0, 0x3d0, 0x160, 0x0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, 0x0, {[{{@ip={@broadcast, @multicast1=0xe0007600, 0x0, 0x0, 'geneve1\x00', 'ip6gre0\x00', {}, {}, 0x88}, 0x0, 0x70, 0x98}, @inet=@DSCP={0x28}}, {{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @local, 0x0, 0x0, 'batadv_slave_1\x00', 'veth1_virt_wifi\x00', {}, {}, 0x11}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0x0, @local}}}, {{@ip={@broadcast, @remote, 0x0, 0x0, 'vlan1\x00', 'nr0\x00'}, 0x0, 0x70, 0x98}, @unspec=@CHECKSUM={0x28}}, {{@ip={@loopback, @multicast2, 0x0, 0x0, 'syzkaller0\x00', 'veth1_to_team\x00'}, 0x0, 0x70, 0x198}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x20, 'system_u:object_r:dbusd_etc_t:s0\x00'}}}, {{@ip={@broadcast, @multicast2, 0x0, 0x0, 'lo\x00', 'batadv_slave_1\x00'}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0xfffff000, @loopback}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x500) 3.980652396s ago: executing program 4 (id=2661): ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r0 = socket$inet6(0xa, 0x3, 0xff) sendmsg$inet6(r0, &(0x7f0000000000)={&(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x1c, &(0x7f0000000180)=[{&(0x7f00000003c0)="daffc38b69363a52fe8000000000000021845a91f64fddcf51f405595faeea41974e5559ea91f7", 0x27}, {&(0x7f0000000400)="00aadade6c613a3cb2bce8a63499f39dfc1780e3705da9b7fed3b99ce087bc88ae89df1dd054255009a12f7dca37584344de261e89ed0026b408cd70dc6554e64f90ff6d79f835ae2f", 0xfffffd41}], 0x2}, 0x2000c090) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, 0x0) r2 = socket(0x400000000010, 0x3, 0x0) r3 = socket$unix(0x1, 0x5, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0xa73}}}]}, 0x38}}, 0x2c0000d8) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000006040)={0x0, 0xd, &(0x7f0000000140)={&(0x7f0000006080)=@newtfilter={0x2714, 0x2c, 0xd27, 0x70bd28, 0x25dfdbff, {0x0, 0x0, 0x0, r6, {0x0, 0x7}, {0x0, 0xfff1}, {0x7}}, [@filter_kind_options=@f_matchall={{0xd}, {0x26e0, 0x2, [@TCA_MATCHALL_CLASSID={0x8, 0x1, {0x6, 0xc}}, @TCA_MATCHALL_FLAGS={0x8, 0x3, 0x4}, @TCA_MATCHALL_ACT={0x4e4, 0x2, [@m_gact={0x184, 0x1, 0x0, 0x0, {{0x9}, {0x113, 0x2, 0x0, 0x1, [@TCA_GACT_PROB={0xc, 0x3, {0x0, 0x19f9, 0x10000007}}, @TCA_GACT_PROB={0xc, 0x3, {0x2, 0x2398, 0x10000000}}, @TCA_GACT_PROB={0xc, 0x3, {0x1, 0xe36, 0xfffffffffffffffc}}, @TCA_GACT_PARMS={0x18, 0x2, {0x32d26a09, 0x7, 0x4, 0xe3, 0x8}}, @TCA_GACT_PARMS={0x18, 0x2, {0x400, 0x0, 0x2, 0x8, 0x604}}, @TCA_GACT_PARMS={0x18, 0x2, {0x40, 0x0, 0x8, 0x1000, 0x41}}, @TCA_GACT_PARMS={0x18, 0x2, {0x0, 0xe2ab, 0x0, 0x8, 0x3}}, @TCA_GACT_PARMS={0x18, 0x2, {0x7, 0x43, 0x5, 0x1, 0x46}}, @TCA_GACT_PROB={0xc, 0x3, {0x2, 0x3d2, 0x6}}, @TCA_GACT_PROB={0xc, 0x3, {0x3, 0x1add, 0x3}}]}, {0xa2, 0x6, "4c756789150825c9f510d0df10b8590a59dfbe23d3336a4b5feb68f4c6772bc6051fb0284b682438d756207d69470c21560afcba4e7c059e029454547141df12ef191a8af068c8960f225125062bf417ff2698975b8dc14d48372d3d11e9432994d60509df26ea3bafd4ba5306b33e3637c158713eeaef885a329f4098c1443cdec0d7cf904af3f25c1b0fcfb1e97c5727baed6e5602e988db11f9ca22e6"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x0, 0x2}}}}, @m_ife={0xec, 0x2, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0x0, 0x9, 0xffffffffffffffff, 0x5, 0x1}}}]}, {0xa6, 0x6, "8a78c0aff8bb970e559debff05b3ff586bd33ccfb19bfb158171614bb447e38e26306b13ea87234fabc1b17f103bafe0aaa13bbcc2114c9668043a437656c20818ac316fb381056b6ed3c785937a5bb23e43257decc653f67a2802597a2f97d266fdecaf8c5d2b45eb6ff618f9b3a57330e005b98df294cd5527d91392c01bacc4fa47dbcbe831fa8389a35d0a82daa743efff926f6048f12f60fa72f7719b3a0c06"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1, 0x1}}}}, @m_xt={0x1b4, 0x17, 0x0, 0x0, {{0x7}, {0xc0, 0x2, 0x0, 0x1, [@TCA_IPT_HOOK={0x8, 0x2, 0x1}, @TCA_IPT_TARG={0xa4, 0x6, {0x7, 'mangle\x00', 0x7, 0x5, "e86fb13895aeb5a79e8b4cc4b493ddbe8ee8b7601449bc9aedba7880bbe2a7a1e2d7b9db77799ff4d1b7bdd26a1011336e848a38837bd72745a66fb5e85a5ef366ab7585ce2cdb9dd9218958835f8a4d111054cd8dda128fec208d6130bdd77f22b0d84161558d14ba85bba6ce607ea4a6954bd4660b1e014850"}}, @TCA_IPT_HOOK={0x8, 0x2, 0x4}, @TCA_IPT_HOOK={0x8}]}, {0xd0, 0x6, "c93bdcc0080af732d0ea7c2d85d49f2e9bde14d1cc33b1c709a6dac9633576f1a7698897edfd219639678d3883e0b5c4cee30b6cb11698ffa3a6642a45b16880b3963d9d484655598470c8adb1e0e8fe327f8c7fa2fab8b82f322b293fe842d77db51632eb245d8e5f8a95817d721e50f78cc0a58917f6a2b9f64ab7cbfcb2c7e5c6837ae536c2cd0187b67481970fee6e3b5f9db3cd27a046c863a4f8f5801a51869c3d58d0d791f8946edcc76db78b70ff1f90c9877679677c638642888d9d59d71d375264bb5f7d2db168"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x2, 0x3}}}}, @m_skbmod={0xbc, 0x8, 0x0, 0x0, {{0xb}, {0xc, 0x2, 0x0, 0x1, [@TCA_SKBMOD_ETYPE={0x6, 0x5, 0x7}]}, {0x86, 0x6, "8e4399979c1e442c25cdc2a1ae32216a6705f79fd255a160370a2ef38447ddb7dacc4ec852d29e1f9bd12c6e44bfe7b435cce7745e41f39cbf3cc007681ab21cc1bb9298cadd5c836e99bf5eddea249861b950ca90dd13ab815d835a6ecd8cadf87a5b5767d3f43c42d39035ab1a9085c77d48869233158cee5afd8cf218ac2a575b"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x2}}}}]}, @TCA_MATCHALL_ACT={0x21e0, 0x2, [@m_simple={0x10c8, 0x1, 0x0, 0x0, {{0xb}, {0x9c, 0x2, 0x0, 0x1, [@TCA_DEF_PARMS={0x0, 0x2, {0x2, 0x7, 0x8, 0x10000, 0xfffffff7}}, @TCA_DEF_DATA={0x9, 0x3, 'gact\x00'}, @TCA_DEF_DATA={0xb, 0x3, 'H\xad\x0e\\!.\x00'}, @TCA_DEF_PARMS={0x18, 0x2, {0x400, 0x5, 0x1, 0xc, 0x5}}, @TCA_DEF_PARMS={0x18, 0x2, {0x10, 0xa, 0x4, 0x1, 0x1}}, @TCA_DEF_PARMS={0x0, 0x2, {0xffffffff, 0x8, 0x20000000, 0x6bd6, 0x6aa27de3}}, @TCA_DEF_DATA={0xa, 0x3, 'wlan1\x00'}, @TCA_DEF_PARMS={0x18, 0x2, {0x5, 0x7, 0x0, 0x8, 0x1}}, @TCA_DEF_PARMS={0x18, 0x2, {0xfffffff9, 0xf, 0x5, 0x4, 0x6}}]}, {0x1004, 0x6, "8c0d4b278b199afee31d9df36b210c38ef4f143683b4ca4ff37c92806da8dc7b0d62c80fc7eb4bae70b1ba7bfa4a962c1ee9af1926350fe571be1d52b400401f4d2f9cef091b32d071e7c9974bac50c9325a4706e10fecb3dcc1306d6d53ad4ee23cf0310013f468d67c9930cfeb410402d67b5be046e41a32407d0d59beb7d98380e8613d1caf7129f9695017d1b01b79070b3fc6a2da7f6f7b7c8170ec1e891f36f1561b9a139b0b748a5fe748602b837c636f1f38a2eca1906a4829f4e16fbc33727f87aa23a9d4814de7304691834883fbfdef4ef50d4b1bead2575e585f3bc0eaf884c842f1ffb59671e1794607cd3b076dacd278664688a0bb75c00719f3cbdd4cae76e747efc4f10f500dc6d5f5dad59ef92a3936cf0f8be1b353d64205d6c373777650898cb483fb9b20c49e36a0fb92ec236fba47301098651fe3f7e66fb33ff63ae09042f5198b1f41ad3999a88704c2fe5775a3011d74b1dc3217467ae0d93af79bdb0dd94e22861a7d04aa41ec437e0cdd41f90bc57b464872ed15d4b55b114147da89d3159550458c5bf7d08f4bdade5b6b11805cd4c9624df43095c5bd9d19f3072e5f75b2dec6439ad3c71f0da8ca7a457e7047c3da0684b32cf925e78638e32df62d521912953d02ba6aa4678eb20bba6e2ca39d7dfa39fd513078c546762903ae061e1e66707e6fc0c8540e92b85753f51d145235b325a432eaf628624e7630d9265b963735bc8510e4e30a8034d41ffd1ca2bcd4f93f0bc47cad59989a29d77647d145f9d946aa79190e570258bf53dabf937cbf13aa670e062d89de2d9c35ba5472af36170db73561c888c7061e768fcdfe49991a6a3946e5d0121e5dfd3a9241f58996be1421675bb0638e04478f57a059bbcb63958b677250b32fc9ba4df3b486c0c6dd7591d6c5eddb902026b898a625ca959164da8a94bf99660daecc53db17a881192c804e779ba7cc8acccfc85ecce3058b1525d7c3f920219d3351c217a117ae1c0a8789a754062d6a53166d743babd7ca6ec082a2cbe1833d2434b4d77dba6f2d15b3055d6f3e6720f6997e2b888e0b85f99da5b11f70a8a55462c7807dfb9a96dea920965a1561053b18c1436f858b19a579b883646bb5a4dda9a14b03d202667d888ebf7a9da88ea875f3601a28a35238816b641292204549bf09713174f6051b77a31674da5c5794e3bd5a0fe8703e30018213ad77feae4e0d3a80dc4f565ff05f141b83ca3c5794cc491d23a9dc6d0019f72bce28d9de8ed343da9bf4db9001cc2b62043dd79e84027d034cecdfa9d55c018a04e41670b169aeb232440b43cafe8311998297bd8252ce7150c984b33172fb2e51d69e6865daa9178152fd838fbf67c306772cfede2c5d8793e75f210a1f5b3f0265487544dce982098bf06425669111eda6c0dea935b411ac461dbc224548cb1a0d585a2724f8f4dd66554e1fcc65c5bfc83a23ead2d30f4358021f490aa2467de04e44323146135d811ac81b5fe45ceaf31ec05e4bd644e981cd3c64ceb80784c114d291567b117f809822c1f94abf72a44a77983edc1ec367281caa4e62993fd728d3886e0a18f1471d2dc341e6661d2eabd3ce4c29dc3db148966bb4dcc2751c65662e0a141b621c82221779330582d18099326992d7575a0886f710d359ece36b74d43e56f0b28304ed600abdc913cbeb34e64036acfbcb5e757d10e35324b7e094f71493c4fae68799d498ceac92dfdae5f7bc7a03d34cb6930ff631b7773541e74cd2e1e44759c5d5b3e1e5491b93866e2edd830f4d9f1c553eb0fb51ab53b46eabfd11cbb92d60493d70bde472e697252af082c5d7e3f16a74f68f5fe5e1656d74acea7427f2740ca6d3b2f64caa4aa15ba0a681bf354c88899e02af3e6e3042f5132353ff58afe2f0692c2845ece20a6c0f8204a08a0591c067aa69301b4a9fda60be5a195efd06c5cae4bcafa0dc64ec49b2799d7d60c3a67cc44ad1d3d3897d6f972daf4018c61ff973575f1eaa0ddb216a2e43066fbba382de4697a216c9583cdac44c4e6023fd9b264733483a0057919966d823c134efe31e6b41127a3a4120c113fb512a4fd5912b671d610f74614132b66dd65488b2ccc39cd46cbe69b83b9715f7aedcb75f3a5936f54fd4c6eac9d52ed027029a31b46be92e310338d8dc90b55458e3e653c1c294d3421137c1796e61943de091bc389f0fba104efdffd4080418d567812adbba96d712df449ad2347d5c87137f2c0213b55c95208f7e4523b00caf9971ef1ab0ef56fe4cda78a924cf9a1c15d128383447369e460a2f64045f6af6d9255e262c6a316a3e3572ad7002b21c7d47116711619dfde50f95325d0ffbb7457c228ad8af3eef9431d453b481af7c7c7c95d700f81874f03c645733eaafdc2830b4ee4250eae21aaf08355a9e2b746a0a726035651e5b1cc26e62aa8aadf6508475d54a3c9aece548866bfdfec444e89503b153a18383c73d7e765d94d3eff96c01e6d2456e5505f0d24b12ef700035d4c83293451960c3a80440ba88b1d51563a5ee7d7fb51a65ea790e888b81b3ce60f73715e64cb4d7084b553e69481cd6b4298ae431ee95f646ba79d7db50ce6876775b9332cc19f92b167bb67bd7215cc660114b2e48e2044e6d0154704f2905d821ea6c5b430b6df7d78975ddfcfb665242e51da72dcec371fab129db435c604d1cee85124b96d8b3e15c2297f42628241ac35e5e0ce79f40b03cb31c444740cf1a243a171d6e328945f7a7b3d95e5e6de6c10046e4fa7e5c4be65bd475b56ee9975f57726b3482f410c78f74fc287a2fd5561de406fbbf080c21dc48070eb9f6003a201c0f6d7663b71e99ad3edc0a078f7708b3bf2e90a35fe9a4a19a42aa9defe02c6ae8841f5d2cad105e3dd024326fef7ac78e54601b3a9ea692ab72090447c35abf913054a70b3a2184ddac02a4f2229e33475b28394a7e0bab3f9ca48981ed27b99dadfeaf82528fce8a2d86c7b0d1928882a1dfe3f5eca987a3dabc8d7bcbfa79604b1bdc2afdb7a8c9330f5999e47f409e54422e7146ea0a1bdc8c228be1f4d7b87ccbc34502b642b1aadd8a28d7845c252bdb738616da7f1e08a554262e78baf32c771d85d4ecbfccdeb92feacb1491166949aa3369c741cfef2f87a51b0837e52b04adc15046c6ca4edacc0fc4c989ddaa69f4a280ca41907a708b96e6b7bae2eb0b553a6a30d7004d8adb81d9e95e0ca39f4ab66b9f4829bb589fdf906f2127b06af4fa93d4547dc3735f8b3230174c02342793874b3bd2a7db9693a4559823aa17cf7de5295488fcf77fda92fff4ac7778da130839e6c8c542055645c421b60f99a7afa712df9b3909a66f5333950ea39ed1fb9541ffcfbf024efa4416ace9454ae324af755a5cb83e617cf94ab093c53695eab288395b98930690afcacbf4765d8e83afaf3226f191b6ad7013e36caec3863d1cde0610192055e6bc0951751f57f1ef3c92b1a07acf0665715cc19df77ae41fda443ce8d2b6db1a5626579c83612133a846c33c3641726cc2c23605a99dff5feb2c89222b9cf7ba95d71520b65e4b51c417bf68b89e8b4ff444c4a2812cbb92ed87751f401da500bbf006cd3e2ce4425e1f79a688283f61e0d7541ca50cb6db56674909ecad0bbee2a59c4ccff744ee22fb48644dd7b0ecb0895b94e2b323f0592e316341f2f7bafaae0f6222da30f9acb578c3d2cdd17c5ff9835046b2f8915448ad2246d6f9869cbd1b1a2e01cb7e0bf47fcff3f2723d740ba4004a618582cb4221cd65bd8525d7b8dce0e86d41d00c3666e55d3c85292ee212261dafa70c8f5befcfcb7b12a3d529b1906b5e45d8cceb683496e1d12679458bf255024dde98c3358b5d084bd160ebbc0db9d3a4e1d6820e6ff82b50bf9996c4abdeb2d3671eb361a0c958cd54619a7ab3d16ce302152ddd3300b6c5ce3ff2fc40fb29e4622b4436c70e0cc5b9c7af37f0199eb2907ead5354d9700770154c077016e85f4d0aa0ee68d60fce5a6917bc802053ce06221c3298e4b9bdcf886b8247b6c499c4b9638bc3d5d86d97a46b6b479f38ed8e21312e7eed1d74d1a359bab2016d919c98f5df331c72ac62ec802033ba3bad8c65a9c67196a5612bb7b30a1e4f559452ca47c627aa8a8517930d2e4f1719de6aab20cb1dc4e5971725cb645359c2804909f3ff2c276392cbed509822c0c55f4f1e6ff628d971eb65d66a38542f3c59db1acbbb2737e5db153d252ed13c3927fc53f31feec9be85441c107f82434ebe576a10dea602ffbb008a658b3a086d36831751da533180063d674407297657aa00e01c3df654559d81d891681b98ed1821f4dde4b09714713615894c2f6bfdbd8cd4ba95260bb58b5e976ce98ad2371c0894cddd25aa497c911ca01d661d20b2b932ab3f5d34dc7452a79e8c38a602155edc78cc4361602762db690ded735bcadb1596516e9c931e30c2aa26f9dfe6aff0bb129b675c5bd38c39419cc640711703f4afb2b21ea16443d053ffd9159344b64d13ac14fe5b7636a1eea111023b093898dc830c10bc9f92c6342d862e89bb2dff81b6d2f9f9dff2c571a0dfd4b957b498cc923cffd2f88723f2856656fabb65cf999bae19aa235021e1267832c2bbf33f74c185ab4fe45cfcf9f167f0841ecb8ed0f53ce38829eae29d8ba9eab079c5de0721a5ce4423db6719d57287bc3076eb4851d4d7257b16c66483bd1ee5cbb1e42a6942b9e2e6d222d296050310df940fe3298e515b7524f55c18c83da69f3abbf66ea67d789ddd2b9653eed30123c8e710df3f14f9aab344a3de87628b6441a2123fda502619ef11135a268b26eb488869eb2adfa304337cc91a3de13f33ba90aa7b72772bb53da4f6c1bd1a0e7739202647976bdb70ecaf539bb59dae58fd1ad8d681ed6cf21ba10d36404af0c92a69c65b712a848d43eb81e62ff3bf265422deb5d244a65bcc72e5a55b1b8145bc5d5e3d28e260fdaf3a2d10d5bcea4c86ad96c146389fc1b65d50313d92112c66130a92856a43670928604c4a2a70ce27be8efc1d9f7654173a7bbf4c6e4a009835d42ffa17baaafa46a06e04afe1974a41a67088bab33bb83bf435c0f646e21fa5041833013f2603e3a155d953c16849a4ed8a2c8d0d5cff89809721357329b68b964a9f2684b5052232c0ca467d0103e424063394b17a8344adbf77747aac581f87c3d7efc15d2f785e42c52449b2c0031e8ff6df6a019ba06654ed75fe47c8876dcf25bbf3bcd2ddc15cdfdeccc8aae55f847b73e02e178a3b8c41b7b30c3575e61b38e115cfce84aefaaa9b15ccdec1ba35f70449b450ed127ac615a3afe166be46122e1733950e0face5cc3385396c10115cc946a4ce033a07256801a099995aaac0a1afd562a5fe6234799b49c5429617a2420ad52d3d56e77ad4e69dcea97560f6167f681988db5b9405c5fe9865c7112ecc0f41cdeccc07c4ff6b4766e4dd558a32dd035d9a616d6882b13921946689c482e59c23fcd409455e718df7199a296eb5b6f73e9d152981d1af3907bdac3b18e44a5f1d1ef8a5478677f3ed4c35f9de5910c741e7c86ade5c402b918288c97dbad59480010f6445d603dec2a32cade152558ff7f7b92e9193153803bef5144d9e59d0e86830b02fe00195afbac49e98751e9373bb69c3eecd1bf5af47b5c16c5ffb04e1e1ded586d0865e5548ace5159b097d311907505c05495d408be131bd3de354d78ccfcdc6f4446ca660b3a77d383a3353229ef0a5d4c1febb7270db972c94ca7770"}, {0xc}, {0xc, 0x8, {0x1, 0x2}}}}, @m_connmark={0x1114, 0x6, 0x0, 0x0, {{0xd}, {0xe4, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x9, 0x3, 0x7, 0xec, 0x6}, 0x4}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0xfffffff8, 0x7, 0x6, 0x0, 0x5}, 0x3}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x400008, 0x7, 0x8, 0xa259, 0x7}, 0x2}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x0, 0x7fffffff, 0x20000000, 0x1, 0x1}, 0x5}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x6, 0x6c, 0x8, 0x4, 0x3}, 0x10}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x9, 0x5, 0x10000000, 0x2472, 0x7}, 0xa}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x48, 0x2, 0x7, 0x80000000, 0x7}, 0xfc00}}, @TCA_CONNMARK_PARMS={0xfffffffffffffe25, 0x1, {{0x2, 0xc, 0x2, 0x2, 0x1}, 0x8}}]}, {0x1004, 0x6, "745ae342c92effdd172b1b6bc4f41a53fa42c1e50ccd484d23560d16f1665ec96aad36ee1c7462145b3272c451fcc06f84a612e947f09196f16465a3850b125e60f4371e5f3eaf5904d54b2b9c46299435661cd99c0ef1e6edf22ea110ab133fc48971d521798531717cebc070816da0ce51afcda05144113188a18b593d78940af79cff884785c23d2c8da36a7afeae45ea8e21b8f41a0f949cd7c6ff88db9350d0dbc2a8a64682e21e62491990ac286ba916a47da439f1d90d27539cadc34e903e2a63fa08b9b1dd432dfbf1566120456a3454d73016090d3a422385efe4dc2a6883afb1ae5911a7942ab77107481641e5a2138637f36c87bb60a6a7f8cbc30b58fc2a3e93580876c7159ebd255c627701f9ec84f1ff4c9dc64fa146feee5513a7a1098aa94094282384458d07b1e025614f26e1ab3f2190562f13880048b164814c357771e424f69f3005a3ffbb2aab8b1b231367289e1e881e6b5f5173c3e0bb7dd4a28019bf18a74f9039dc7d5baea1771827f407cbd72f0ae815999f2fd6620e6d8132e60d1467a52aec7e7cd864a09258ca44285e395f83755b71b84b31f518e75ca7a26f280b2bb12b0544a657e9d970fd7afaa475fd475d3fc671b1a2406b0ed8c794dbcafa89088b04263862c649b71328c5e32f1d67d1f5c1d9a881b941d71957cebb27a6a837e8df3bf5c1d8c38b9c63a80f43407ed96305c4376847cad12fe49d452b1769414e00d9c238ade6a5e8eb8fba589c319b787f157eeae5c38ef910cd1f8770ef393cc5e9cbf6919b127f477948ee13ce974837a336cf916a4edf1bdfd8e34658531e4d502e3db329b2fab5703b5e56b0301e3fc22f858fcee552124440ca3af4e25f79a56e06a1a189a1eace3c1626bd40f797a5e709e48f938c8a0963fd49f45be4d50924d6e84c565e12c8d771790b2a36ffdcdccc9cbff2977a9e2d34858b1fbc8506eeb24eceb5f64e8e906257ad3b5d3f440930c9befbea83ab6b2160bdb7dead664003510e0b5f1cd8c6636b86e2460398312fffc6d1ff99ea0310bcc1d24bf4701e930fdbfacc34666258fe6ca8bfc4728cc69c9a6c31e2e58a2da6899769102d2fe07eec477669d57753536a05ee124e6a006210e1ada19c6cfe859723f1d99f5be81f3a9bbf1019db59ca93742821a114337a414dc1d95820dd18cb409f914ee51b71a5f185d388669444edff4be9115b8639de684553bee70273f46d557aa139317f7b53d6525fe2071adb3ae14eceb916a8aa2c33e17ff6609a6b4b47a978cb48580b713fcbac99b92d5d7c5c2d866da6221ec4c74337bf77a17faf2af12a8768e8c0d259bf18bcb653f0ea713049e6aa2f2271350f0ea737b1e8e617da9bf2aaa7e1e6eff24e829a2b49d2507ddd3ca312bf8f3d4529ed2e09957261c2dcfdd1c257901628f8246393321c43043fa113abf737a26fa48f6e83b098ad046aca759f0d98e62b875a877503c95edbc2cf6f4c8dc40f0b44a072dc5bf50a154bb031491a24097385cc8966578de4cb8220152af753f28ecb418102027c54641662ecf605ddb069e89c615bf12e4563c8b72ce542d4d52318b37dfd853c0025ab4a096ddec753d50e1683340e6cec6bf98b1ff50e7564a472e652f75318ffcb19c54bb1bb2a73ac2a6d0a2f32b482ebdf475cb3a7eb8c1ea490e011807bcaad5bc421cfd51879387e951527d29deeec21b01737cd13e59e00e2f6aa354f64179e4f874bb9c45c044c24cef5f1df7ebdc2a4d73a3b6e71f9554bcc8e872ea75aa1b325ef681da2061d9b673934cb723d9fa99a90b4ee0bb4562da9eeb3eea249f3f1efe260ee8530ff07e71bbf0dd7f20d9b93349af71b9297a8bb442ce176c51cc5207e57ede0e7d1a80bf8bfa2f8a3467baff71a19bef47796884a38a38154e91530f025c38859f02340eeaac140c7f0ddff876337c095f31642ebf35b3e7392a936192db93dab9a6b06e703744e4e8facad1a4e8c69f0410c9c1a5700468bc7e2ab5990cd857d80cbb1e66c7c39a0df4c3f8cfe7c03cccd0885d570d146d1d0fab801a42dbe148438d4cd11cc65db08e2fd00371b6c381f8109099427188f26522f928aa465448008fcd2e5179e32d0b4f73278eca6dbfbacbf3a403988f7880afce3ab7b3a1d920e78290be45b2ec847d643b33060d9c5953ce6e85ebd9cc507915a630eae23700c8099d9251eeb309d21125396fe93d837b8cf02d6e872e5b843751b8aea691431d405177d5e5402bfd7e00d95330ad5ffb1a16a2064d4a1183d07883042b718da2aba677ca8c1f6fdc12828c7332de95ea7f08658c6ab91667c0d1f4a6247f07a8b45b45137004202f5c3dd3dc4824b0c4862dc0e899affc0f5c73f5800eebccb73f4a83ccbc8acdc0ca2ad835c51bf01ceb363c0e15003cc43456aafe5eb692e637703b6340e89fde0fbd67a50d6c702365a0912f21126124fdcc88af07a4fa2b618768193111b45473d07ee48d72bd3ff50ebe5e2b7f71c66b35deb99d04905dcf1eec324683fe5bea4ce3799dead7220f9a5d591b7f3e916ac5c2d68df6fdbbd0f83d64ade4ddc3e5e6e48acaf0667b7b6e93d3cbd3bb8e9dad6b09b4ab8a62caaaf8194aa16bdf27fe38c833fb5e0c05c33bed8000727af40fdaf9b51a53c39e56ddc5e037d3ba9f2f693e598e4c1c9dda90ac69bb2e6e02217aef83234d07966fe5d4ad447259b17043adcf9f0acbeb8272b1653c663804db1bd24952a57040704d5b2d015afb810e1fd4c77844516ac972991b5ddddcd316636dc4c74fff07875a487d22e0353a77c2a44d802ab1957d34229c7b8bf160eb41325eb42cde93ace586081bdd32c9e68317b3287ebbd0e18bc0c5af3c69fd70b8d6cc8a3dcba6bcd2586c20437a8652f60b866d8ceda4cc23595f562f7e662d18c4c1e17824032c50ab19999f0ea4ec7c965876179e552379b6671307c6fc903d38d2cb7023a9cce886f0d7133eb61c77c8b96f777e06de438781db513a09dfa1da9164e2d0acb408feda048de6b63705e8961e6e12221442a79240b0f960d00a5b755a4645ba202c8f5f639d4f834b81541d06aeda07c3de6cf308c8a9ab6a1efa4f12bc4b2d536867f18139d438ee2e4c7fa95dcf86f2869aa53e852b7414123b56552afff7d283fea88b39f05f5f99963c6ab1cef76d13b501939aa1072f1df7135528df1cea90a426bcaae83f34b789671f78b30c64958f26042b39a6bf6692037fdfbdf654ae485b93700694c5a67de2bca71901e2caf76898e487c1314144c21953c46de02f7431ef243f3bcdc216213214edc4a44b71bd7ace9cdb2d8b844b52a17915bd3caad81b778ba77b74babb8ffb7532581b03f6729d7e6484d604dd59bd369cf3008a0b70273b76ed594fc56886f26afa0d147e08a5f8ac890d83df83da3f1a6f88f09c601496e0455ac55bdbd5c1b45e03f8531ae23aecfe45460fa7696974ffdd290e5ed7f097d42252e59d2eb21e5940e868740c2de413e7d356c36cec2664c866d288f9244aed526bc99271b8ca988eedb9d6e93c11da3f1cc98962582eed41b0f983ed4c115adcdd962e2114618f9bf5d08cf4bfb34b1700ec1c8fc92349bfb280710fbc37c6943e0a57c13a7778fdc9a63960431cf8337b4522bbaea05c2b481a48de1eff93d59ed4ecdaf9419202bbefcdd0951a8d0020da5e10b88aba3a539d9aad88736e354eacca0e725aa18e025a0485650c60424144f95b922204a0773449ed13c15a806c726a376202b04c5fe02afe9d688fa21b314d9c9a1ecba526be0d174ad5291f6609e7122f528425f003943701271d8e2d90cc0f7f8e9cd504cf7649985764c70ea587157047b8775ef46f88d1c049bec3b7d87dcb6617582aece65ab254e9fc7df1b4e59f00691c6aa7837269f45538c7c61fe82be8f717ee5157267c77932e5c2368537a1c0d4a44c9c23d88a630452bf042794e77c9e78d870a612d9dd18796aa39dc16cbb9e464f105ac73c04a01ea832547c91cfb77a644d029cfa2b68e6fd5f6f1b31bb4113cdba4f9d54e0d8af8e40dcbe7d3d23639788aa60fc9d216773043011d1d20395067c8c45447e9f038be8c7804d708e9d995ca0b1a3ab2de250dec025d74fcfc091018c1be5512af5275c63ea55222248e4f046a3a6b2aa5d35d462b514e6a4d62917ca9f27860bd6ab8ab6037dc8f2efe0b7b2fee8cabd849bd9c3141c7a9a0db775ce4ae2d3d79945862cdb263484272df2b9b0fbf2989843c4ecae8c5732bc62382ef074b627ddc01cbf3f00e9959a8cacc2a52bf5f2a84a39bd19c79ecef6af93392136abcd92e039cd1d869e926589391b2d56cd8832ab91f0487a7c8a250018338453175b4ee5a1715f28b8410b6edfa39f75112b5cb8cf4ee02519be9218d3e0c3b99e1d357f9485f10905d751ac0c8f10b202aeb211705122d776fd816c66d4a694ae0d2f283b01c3466dcd2c9d167750c1aec17fa908fc6ef7dd4c29013061d28026e2e2357b98ab2a9a0351651ee37b1422aa1744f40bf703764de144c1f9974b77b5b70217dfeb61b78cddafd4f052d50adaf6a24c71dbad96a91790280e02c4ecefd1d33092e63567820d5156470b608bd99ebfe9fd4c062afa822adddb8f39f5144bad1c8d8e9a47aa9d9d34addb4305ad887c313eb567424895d4d01dd41704d7cbb50a31b50395ee1bed132dbe97821cb8eb5290d1980e1481ab82c63831f2b9c3b0326ea7a9effe39f465c459d3f3df3b6934fa6266b97eec84a50542e4c99ea7bdb7520c709697a3a88a3aa83dec84df6b04cb26b2dda923edcfe51a74b6546db63905399f75efd5f11379ad83ad2777d3c5fd6d7ee4b31d3cf8deb45461cd6ab2fd858d3eae57b07604cc5cfee90de041a496ca676caed10cb4bb385cedd2395820b3893426dae46aef22f6346cde28bc3329b0be654d925a3c1935d0740e66de69ccbf4b3c33427431d9b1adf1cf3faf94556a360528140ede722c5d8a8000fa22d3526e2972de7370808142e353492010d2a1743f1dd4b467d3d4614edb59123234bc7e5a32294d86ce059fd48873a4791f4d309da2a691bc5e0f926e1c613e172db6061d3542736533c22bc98bfc889ce1faffdbac61712256380ffbd09f572974fb4bfb530b99464b3137d671e8e07ad11aab3f8d4736e2ab71540b7e6419392152c54443335d09fc3ce7fce900fea7817fb5299befee2598ccc5dffb0d1945252526c0ef21fce09753c67fbe863901deaaa7fc41708457c786fa1b1e8c75c7969fcf3ebd5ade9bc56e3a0a9fe3aaaa438a0031a7464b3e95b7a4429b0664bef76f1e8c91eba9d18cdbe391f4b76edad8c39c97653573d6045ad890d405bb483f80053a568d32f159864f07a2c5f5061ad6c9bb0bb7a06c08cbf9f89b5561fffc3359011ccda8a4b9a8df3c447ea5840de2522772c3525b8992f28ea55ba3376054b5b2aaf3fdd8c8be9a6b0cdc4b3b6334e1009f5f1f4ff56cb73f153918152a7c42a97949951ffd993ebd834cd196dedc3e939127dcb61b62350fa127f31230d4af995a7b5a64a143f370c369b6a90aba60dac5efb623412d2fa1c099336c4e2a6eb4638f55b27e6bc0a51a654214a78bdea4ad74c702227b1d64277c3d8c0e4e413f9feafabeff05727ffb8a9140ed487d7962ab2ac3b539258f78561cafe3e200f0079959c4eb1964ccba6ecc622b7554d1a9cee38786e13db1fba7b5f4681672f348dc393f320243e57115a95112a6ecb40b6242ee2ab6742140fbe6a8904ffda3a075a6c2633d"}, {0xc}, {0xc, 0x8, {0x1, 0x1}}}}]}, @TCA_MATCHALL_FLAGS={0x8, 0x3, 0x2}]}}]}, 0x2714}, 0x1, 0x0, 0x0, 0x4000080}, 0x20040800) 3.351966081s ago: executing program 4 (id=2663): sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000700)=ANY=[@ANYBLOB="1c0000005e000100"/20, @ANYRES32=r1, @ANYRES32], 0x1c}, 0x1, 0x0, 0x0, 0x2000000}, 0x0) 3.14417804s ago: executing program 4 (id=2666): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'pim6reg1\x00', 0x1a003}) ioctl$TUNSETLINK(r0, 0x400454cd, 0x301) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000c80)=ANY=[@ANYBLOB="0600000004000000ff0f000007"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x18, 0xc, &(0x7f0000000040)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYRES32=r1, @ANYRES8=r1, @ANYRES64=r0, @ANYRES16=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x2, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r2 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r2, 0x0, 0x0) r3 = socket$inet6(0xa, 0x3, 0xff) sendmsg$inet6(r3, &(0x7f0000000000)={&(0x7f00000000c0)={0xa, 0x0, 0x0, @private1={0xfc, 0x1, '\x00', 0x1}}, 0x1c, &(0x7f0000000180)}, 0x2000c090) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_MCAST_JOIN_GROUP(r4, 0x29, 0x2a, &(0x7f0000000140)={0x1000, {{0xa, 0x4e24, 0xb0, @private2, 0x9}}}, 0x88) 3.034002579s ago: executing program 5 (id=2667): r0 = socket$inet_smc(0x2b, 0x1, 0x0) ioctl$int_in(r0, 0x5421, &(0x7f0000000100)=0x100000001) (async) setsockopt$inet_tcp_int(r0, 0x6, 0x1e, &(0x7f0000000180)=0x1, 0x4) (async) connect$inet(r0, &(0x7f0000002f00)={0x2, 0x4e20, @dev}, 0x10) (async) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r1, 0x107, 0x11, 0x0, 0x0) (async) getsockopt$IP_SET_OP_VERSION(r0, 0x1, 0x53, &(0x7f0000000000), &(0x7f0000000040)=0x8) (async) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) (async) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r3, 0x6, 0x13, &(0x7f00000000c0)=0x1, 0x4) connect$inet(r3, &(0x7f0000000080)={0x2, 0x0, @loopback}, 0x10) (async, rerun: 32) bpf$PROG_LOAD(0x5, &(0x7f0000002c40)={0x8, 0x17, &(0x7f00000007c0)=ANY=[@ANYBLOB="18000000", @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf09000000000000b60901000000000065000c000000000018010000646c6c2500000000002020207b9af8ff000000002d9a00000000000037090000f8ffffffb702000008000000b70300000000000015000000060000003d93000000000000b5030000000000008500000000000000b7"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_skb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) (async, rerun: 32) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000700)=ANY=[@ANYBLOB="640100001900010000000000040000001d0100001500040001000080fe02000031171e44b2b50e8f040000001e0106000000fd0000ec058cdecf0fa4f69652b23bf9968d372a0ddfe196faa30f83514813d0527685407bc8366e2838397d6abc25357799ac708b65efffdb10e1376a4f6d4ab9949102000036dbf30bf928c37695658578feb8f3cce47f43a42919c288f7d5430ffc0226139916866a978312dd970e64629d7cd799c5e08b64de41458eb8951a54a7cf29a810823e869f5c087d15d9d3bae1c089701f970f8e7ce853654222f07959e7cdcfcf27332cb82016ccd91be54e588f6ea7b5c35a62c0ceaa4e90b29c3edc16f20db3d7fb4d6236232de07ccd7d7301f46a287dd296abe9baba499721311e1597853a2d0c7e1e64f827d31e6917175792398e0edaa900000000000000000002c900c08ac1d7b606000000000000000000000000000008000900", @ANYRES32, @ANYBLOB="080005"], 0x164}}, 0x0) (async) setsockopt$inet_tcp_TCP_REPAIR(r3, 0x6, 0x13, 0x0, 0x0) (async) sendmmsg$inet(r3, &(0x7f0000000d00), 0x0, 0x4000000) r5 = socket$inet6_sctp(0xa, 0x801, 0x84) sendmmsg$inet6(r5, &(0x7f0000000e40)=[{{&(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x1c, &(0x7f0000000080)=[{&(0x7f0000000180)='`', 0x1}], 0x1}}, {{&(0x7f0000000300)={0xa, 0x4e21, 0x0, @private2, 0x540}, 0x1c, &(0x7f0000000380)=[{&(0x7f0000000340)="b4", 0x1}], 0x1}}], 0x2, 0x0) (async) openat$tun(0xffffffffffffff9c, &(0x7f0000002300), 0x0, 0x0) (async) epoll_create1(0x0) (async, rerun: 32) epoll_create1(0x0) (rerun: 32) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x7, 0xfffffffffffffffd, 0x800000000}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x9, 0x0, 0x0, 0x7fffffff}, 0x0, 0x0) (async) shutdown(r5, 0x1) (async, rerun: 64) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x3, 0x200000005c832, 0xffffffffffffffff, 0x0) (async, rerun: 64) bind$bt_l2cap(r2, &(0x7f0000000000)={0x1f, 0x4, @any, 0x6}, 0xe) 2.812864299s ago: executing program 4 (id=2669): socket$kcm(0x29, 0x5, 0x0) r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000000)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x31) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cgroup.controllers\x00', 0x26e1, 0x0) bpf$MAP_LOOKUP_ELEM(0x5, &(0x7f00000000c0)={r1, &(0x7f0000000000), &(0x7f0000000380)=""/76}, 0x20) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x1f, 0x18, &(0x7f00000001c0)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000000000018230000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7050000080000a8c5000000a50000001801000020206405000000000004000f7b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70400000000000085000000a700000095"], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x18, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000640)={r2, 0x0, 0x0, 0xfffffffffffffdf3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="18000000240001030000000000000000010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x8001}, 0x4000) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), 0xffffffffffffffff) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000e00)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)=ANY=[@ANYBLOB="2c000000190001000100000000000a0080201400000400050000081e0e0009000a"], 0x2c}, 0x1, 0x0, 0x0, 0x80}, 0x4000000) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f00000001c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000600)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010000000000000000000200000008000300", @ANYRES32=r7, @ANYBLOB="0c00990000000000000000000800a0007215000008009f000d000000080026000816"], 0x40}}, 0x200040b4) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$devlink(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_PORT_SPLIT(r8, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)={0x40, r9, 0x1, 0x70bd2a, 0x0, {}, [{{@pci={{0x8}, {0x11}}, {0x8}}, {0x8, 0x9, 0x3}}]}, 0x40}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) sendmsg$DEVLINK_CMD_SB_GET(r3, &(0x7f0000001ac0)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000001a80)={&(0x7f0000001980)={0xcc, r9, 0x200, 0x70bd2a, 0x25dfdbfd, {}, [{@pci={{0x8}, {0x11}}, {0x8, 0xb, 0x7}}, {@pci={{0x8}, {0x11}}, {0x8, 0xb, 0x7}}, {@pci={{0x8}, {0x11}}, {0x8, 0xb, 0xffffff06}}, {@pci={{0x8}, {0x11}}, {0x8, 0xb, 0x3}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0xb, 0x683}}]}, 0xcc}}, 0x8810) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) r11 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480), 0x48241, 0x0) ioctl$TUNSETIFF(r11, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r12 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r12, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r11, &(0x7f00000001c0)={@val={0x0, 0x886c}, @void, @eth={@local, @random, @val={@val, {0x6558}}, {@mpls_mc}}}, 0x1a) r13 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r13, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_KEY(r13, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r10, @ANYBLOB="090001000000000000000a00000008000300", @ANYRES32=r14, @ANYBLOB="140050800500090002000000050002"], 0x3c}}, 0x0) sendmsg$NL80211_CMD_SET_CQM(r1, &(0x7f00000005c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000580)={&(0x7f00000004c0)={0x88, r5, 0x1, 0x70bd2a, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r14}, @void}}, [@NL80211_ATTR_CQM={0xc, 0x5e, 0x0, 0x1, [@NL80211_ATTR_CQM_TXE_RATE={0x8, 0x5, 0x31}]}, @NL80211_ATTR_CQM={0x2c, 0x5e, 0x0, 0x1, [@NL80211_ATTR_CQM_TXE_INTVL={0x8, 0x7, 0x4cf}, @NL80211_ATTR_CQM_TXE_INTVL={0x8, 0x7, 0x208}, @NL80211_ATTR_CQM_TXE_INTVL={0x8, 0x7, 0x443}, @NL80211_ATTR_CQM_RSSI_THOLD={0x10, 0x1, [0x3, 0xfffff800, 0x80000001]}]}, @NL80211_ATTR_CQM={0x34, 0x5e, 0x0, 0x1, [@NL80211_ATTR_CQM_TXE_INTVL={0x8, 0x7, 0x19b}, @NL80211_ATTR_CQM_RSSI_HYST={0x8, 0x2, 0x4}, @NL80211_ATTR_CQM_RSSI_HYST={0x8}, @NL80211_ATTR_CQM_TXE_RATE={0x8, 0x5, 0x52}, @NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT={0x8, 0x3, 0x80}, @NL80211_ATTR_CQM_TXE_INTVL={0x8, 0x7, 0x29a}]}]}, 0x88}, 0x1, 0x0, 0x0, 0x80}, 0x80) recvmmsg(r3, &(0x7f00000086c0)=[{{0x0, 0x0, 0x0}, 0x101}, {{0x0, 0x0, 0x0}, 0x3}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f0000000240)=[{&(0x7f00000006c0)=""/186, 0xba}, {&(0x7f0000000340)=""/238, 0xee}, {&(0x7f0000000000)=""/41, 0x29}, {&(0x7f0000000440)=""/84, 0x54}, {&(0x7f00000008c0)=""/4096, 0x1000}, {&(0x7f0000000640)=""/68, 0x44}, {&(0x7f00000007c0)=""/236, 0xec}, {&(0x7f00000000c0)=""/237, 0xed}], 0x8}, 0x80000000}], 0x4, 0x4022, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000000240)={@broadcast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0xe0, 0x0, 0xe000, {0x5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11, 0x0, @rand_addr=0x64010101, @multicast1}}}}}}, 0x0) 2.757148674s ago: executing program 6 (id=2670): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), r0) sendmsg$NL80211_CMD_START_P2P_DEVICE(r0, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x14, r1, 0x1, 0x70bd2c, 0x25dfdbfe, {{}, {@void, @void}}, ["", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x8c0}, 0x24040444) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_INITMSG(r3, 0x84, 0x2, &(0x7f0000000200)={0x18d, 0x5, 0xfff8, 0xe5b}, 0x8) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r0, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)={0x3c, r2, 0x301, 0x800000, 0x25dfdbfb, {0x1c}, [@ETHTOOL_A_LINKMODES_HEADER={0x28, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'lo\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}]}, 0x3c}, 0x1, 0x0, 0x0, 0x80}, 0x40006) 2.696263058s ago: executing program 5 (id=2671): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001cc0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000ab4000000060a01040000000000000000020000280900010073797a30000000000900020073797a320000000088000480100001800c000100636f756e7465720014000180090001006d6173710000000004000280600001800a0001006c696d6974000000500002800c000140000000000000000808000440000000010c00014000000000000080010c000240"], 0xdc}}, 0x2400) sendmsg$NFT_MSG_GETRULE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="14000000190a0102"], 0x14}}, 0x0) 2.616865703s ago: executing program 5 (id=2672): bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="02000000040000000400070001", @ANYRESDEC=0x0, @ANYRES32=0x0], 0x50) (async) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) recvfrom$l2tp6(r1, 0x0, 0x0, 0x20, 0x0, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r2}, 0xc) 2.486215926s ago: executing program 5 (id=2673): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000004b64ffec850000007d000000850000000e00000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000100)='kfree\x00', r0}, 0x10) r1 = socket$netlink(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000001200)={&(0x7f00000005c0)={0x38, 0x1403, 0x1, 0x70bd2d, 0x2, "", [{{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'dummy0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x854}, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d49100dc6626c892b6bc436a", 0x10) r3 = accept4(r2, 0x0, 0x0, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000340), 0x40000, 0x0) sendmsg$alg(r3, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080)=[@assoc={0x18, 0x117, 0x4, 0x200}], 0x18}, 0x28000054) sendmsg$nl_route_sched_retired(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000012100), 0xe078}}, 0x0) recvmmsg(r3, &(0x7f0000000180)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000500)=""/229, 0xe5}, {&(0x7f0000000840)=""/127, 0x7f}, {&(0x7f0000001480)=""/127, 0x7f}, {&(0x7f00000000c0)=""/21, 0x15}, {&(0x7f00000004c0)=""/21, 0x15}], 0x5, 0x0, 0xfffffffffffffebc}, 0x4}], 0x2, 0x60, 0x0) socketpair(0x0, 0x6, 0x400, &(0x7f0000000300)) 2.436185257s ago: executing program 6 (id=2674): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000005c0)={'gre0\x00', 0x0}) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@loopback, @in=@local, 0x0, 0x0, 0x0, 0x0, 0xa, 0x100, 0x0, 0x0, r2, 0xffffffffffffffff}, {0x0, 0xa9, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x1}, {0x7fff, 0xa00, 0x40800000000000, 0x800000000000002}}}, 0xb8}}, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000001100)=ANY=[@ANYBLOB="a00000002100010028bd700000000000fc0200000000000000000000000000006401010200000000880000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="049cff0000000000500011"], 0xa0}, 0x1, 0x0, 0x0, 0x40180}, 0x0) 2.368603645s ago: executing program 3 (id=1944): r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) (async) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r2, &(0x7f0000003b80)={0x10000001}) write(r3, 0x0, 0x0) (async) close(r1) (async) syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/ipc\x00') (async) unshare(0x4e020a00) syz_emit_ethernet(0xffffffffffffff4c, &(0x7f0000000480)=ANY=[@ANYRES64], 0x0) (async) r4 = socket(0x1e, 0x4, 0x0) setsockopt$TIPC_DEST_DROPPABLE(r4, 0x10f, 0x81, &(0x7f0000000480), 0x4) (async) sendmsg$tipc(r4, &(0x7f0000000200)={&(0x7f00000000c0)=@nameseq={0x1e, 0x1, 0x1, {0x1, 0x0, 0x4}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x10}, 0x4800) recvfrom$inet6(r4, &(0x7f0000000340)=""/152, 0x98, 0x40002143, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) (async) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, &(0x7f00000001c0)={0x6, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, &(0x7f00000000c0)=0x1c) r8 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=ANY=[@ANYRES64=r6], 0x50) r9 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x13, 0xd, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000000850080007b00000018110000dd7848abafd3d477b85cf09ca322e70c5aee5fb256eba21b4dc782a00a88ccc59d75107cea7e117a4bfcf8d7219c9c4b0825bc29aa900f044caa5306729f", @ANYRES32=r8, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffff070000000008000004b704000000000000850000000300000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x36, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6e985fe4, @void, @value}, 0x94) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000300)={r8, 0x0, 0x0}, 0x20) (async) socket$inet6_sctp(0xa, 0x5, 0x84) (async) r11 = socket$netlink(0x10, 0x3, 0x14) (async) r12 = socket(0x10, 0x803, 0x0) r13 = syz_open_procfs$namespace(0x0, &(0x7f0000000940)='ns/time\x00') (async) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r12, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0}, 0x1, 0x0, 0x0, 0x408d1}, 0x4040) (async) getsockname$packet(r12, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) (async) sendmsg$nl_route(r11, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x40000) r14 = socket$netlink(0x10, 0x3, 0x14) sendmsg$nl_route(r14, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)=ANY=[@ANYRES16=r2, @ANYRES32=r5, @ANYRES64=r7, @ANYRES64=r13, @ANYRESOCT=r10, @ANYRES8=0x0, @ANYRES16=r10, @ANYRES64, @ANYRES64=r8, @ANYRESOCT=r9, @ANYRESDEC=r10], 0x3c}, 0x1, 0x0, 0x0, 0xc014}, 0xc0b0) r15 = socket$inet(0xa, 0x2, 0x84) (async) pipe(&(0x7f0000000240)) listen(r15, 0x8) 2.327239585s ago: executing program 6 (id=2675): r0 = socket$inet6(0xa, 0x3, 0xff) sendmsg$inet6(r0, &(0x7f0000000000)={&(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, 0x18, &(0x7f0000000180)=[{&(0x7f00000003c0)="daffc38b69363a52fe8000000000000021845a91f64fddcf51f405595faeea41974e5559ea", 0x25}, {&(0x7f0000000400)="00aada", 0x3}], 0x2}, 0x2000c090) 1.25625368s ago: executing program 6 (id=2676): r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_int(r0, 0x29, 0x4e, &(0x7f0000000000)=0x1, 0x4) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000380), 0xffffffffffffffff) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NFC_CMD_GET_TARGET(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x0, 0x4}, 0x14}}, 0x0) syz_genetlink_get_family_id$nfc(&(0x7f0000000140), r3) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000300), r3) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001180)=ANY=[@ANYBLOB="300000002000010000000000000000000200000000000000000000000c001440feffffffffffffff"], 0x30}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_DEL(r8, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000004c0)=ANY=[@ANYBLOB="440000000a060101000000040000000007000005300008800c000780050003000c000000100007800c0019400000000000000010100007800c001b400000000000000003"], 0x44}, 0x1, 0x0, 0x0, 0x44040000}, 0x20000014) r9 = socket$can_bcm(0x1d, 0x2, 0x2) syz_emit_ethernet(0x76, &(0x7f0000000340)=ANY=[@ANYBLOB="aaaaaaaaaaaabbbbbbbbbbbb86dd60e400ff00403a00fe88000000000000000000000040e7b03c1cc5d9f77f0000000000000000000202009078000000006000000000001100fc02000000000000000000000000000000000000000000000000ffffac14140017c1ff182e8079f39240aaaa613e76c1"], 0x0) r10 = accept(r9, 0x0, 0x0) r11 = socket$unix(0x1, 0x2, 0x0) r12 = socket$inet6_sctp(0xa, 0x801, 0x84) getsockopt$IP6T_SO_GET_REVISION_MATCH(r12, 0x29, 0x50, 0x0, &(0x7f0000000100)) bind$unix(r11, &(0x7f00000003c0)=@abs={0x1}, 0x2) r13 = openat$cgroup(0xffffffffffffffff, &(0x7f0000000300)='syz0\x00', 0x200002, 0x0) openat$cgroup_ro(r13, &(0x7f0000000340)='blkio.throttle.io_service_bytes_recursive\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000000)={'veth0_vlan\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=@getchain={0x24, 0x11, 0x43d, 0x0, 0x0, {0x0, 0x0, 0x0, r14, {0x0, 0x2}}}, 0x24}}, 0x0) getsockopt$EBT_SO_GET_ENTRIES(r10, 0x0, 0x81, &(0x7f0000000200)={'nat\x00', 0x0, 0x3, 0x0, [0x5568, 0x4, 0xfff, 0x8000000000000000, 0x3, 0x8], 0x0, &(0x7f0000000080), 0x0}, &(0x7f0000000280)=0x78) sendmsg$NL802154_CMD_DEL_SEC_DEV(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)=ANY=[@ANYBLOB="14000000e2df971de1b59440df36c3d57adb24a8893f5ed5ace85f49c3286970a8c3a8ac39d0a914c8e052d66271b5a1a884ea79d46cb2ba742b15fe482117fba36d512cef394dda679b349cecf6c2f261784b4e4ed87dd63fbe454cc355c90a3db79c8feecc91a37d237104cec578b7f1df84e4dd9f6633b559db04918f95910ea83931966923db5b2ac72d2a91c0d2bd5250d947b19e9c857a5dfd33c2de054d30b0386f8763", @ANYRES16=r4, @ANYBLOB="010027bd7000ffdbdf251b000000"], 0x14}, 0x1, 0x0, 0x0, 0x20004001}, 0x40) sendmsg$IEEE802154_LLSEC_SETPARAMS(r1, &(0x7f0000000480)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000440)={&(0x7f0000000680)=ANY=[@ANYRESOCT, @ANYRES16=r2, @ANYRESDEC=r0], 0x64}, 0x1, 0x0, 0x0, 0x4040095}, 0x4000000) bind$inet6(r0, &(0x7f0000000140)={0xa, 0x4e23, 0x8000000, @private2, 0xd46}, 0x1c) socket$inet6_tcp(0xa, 0x1, 0x0) 1.255942526s ago: executing program 1 (id=1582): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0xb, &(0x7f0000000380)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000300)='rcu_utilization\x00', r0}, 0x10) socket$nl_rdma(0x10, 0x3, 0x14) bpf$BPF_PROG_GET_FD_BY_ID(0xd, 0x0, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000bc0), r1) sendmsg$NLBL_CIPSOV4_C_ADD(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000000)=ANY=[@ANYBLOB="e0000000", @ANYRES16=r2, @ANYBLOB="01000000000000000000010000000800010000030040140004800500030007000000050003000100000008000200010000000800020001000000a00008801c0007800800850002000000080006000000000008000500400003"], 0xe0}}, 0x0) 147.09334ms ago: executing program 5 (id=2677): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0xb, &(0x7f0000000140)=@framed={{0x18, 0x2, 0x0, 0x0, 0x1}, [@printk={@i, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x7b}}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x8004, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) 96.584421ms ago: executing program 4 (id=2678): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="4400000010004b0400000000000000007a000000", @ANYRES32=0x0, @ANYBLOB="0100000000000000240012800b0001006272696467650000140002800800080081"], 0x44}, 0x1, 0x0, 0x0, 0x44091}, 0x0) 96.225838ms ago: executing program 6 (id=2679): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9990006000000000000fc000000000000000000000000000000ac1e0001821501f63ed02a170000000000000000000000000a006030"], 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x0) 14.176713ms ago: executing program 6 (id=2680): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x6, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="18020000fcffffff00000000000000008500000041000000850000007d00000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x6, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="18000000020000000000000000ee000095"], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x560b0007, &(0x7f0000000000)="259a53f271a76d2686dd4c6588a8", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x4, 0x5a, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x2, 0x0, 0x0, @void, @value, @void, @value}, 0x50) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0xb, 0x8, 0x4, 0x6, 0x1, 0xffffffffffffffff, 0x6da443c8, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000140), 0x5, r2}, 0x38) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000040)={r2}, 0x20) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x0, 0x2111, 0x300, &(0x7f0000000100), 0x0, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) 0s ago: executing program 5 (id=2681): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000005c0)=ANY=[@ANYBLOB="bc000000210001000000000000000000fc020000000000000000000000000000fc02000000000000000000000000000000000000000000ba0000000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000000000000500011007f000001000a000000000000000000000a0101000000000000000000000000000a010100000000000000000000000000640101000000000000000000000000003c000000000000000a0002001c0004"], 0xbc}}, 0x0) kernel console output (not intermixed with test programs): s mode [ 308.739669][ T64] veth0_macvtap: left promiscuous mode [ 308.745651][ T64] veth1_vlan: left promiscuous mode [ 308.751168][ T64] veth0_vlan: left promiscuous mode [ 309.289858][T12404] netlink: 36 bytes leftover after parsing attributes in process `syz.6.2055'. [ 309.629871][ T64] team0 (unregistering): Port device team_slave_1 removed [ 309.675169][ T64] team0 (unregistering): Port device team_slave_0 removed [ 310.271211][T12408] 8021q: adding VLAN 0 to HW filter on device bond1 [ 310.292167][T12408] team0: Port device bond1 added [ 310.331169][T12395] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 310.477588][T12138] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 310.503817][T12412] ip6gre1: entered promiscuous mode [ 310.551045][T12395] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 310.693798][T12418] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2060'. [ 310.733691][ T5840] Bluetooth: hci3: command tx timeout [ 310.748441][T12395] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 310.969446][T12395] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 311.081454][T12432] netlink: 'syz.6.2065': attribute type 8 has an invalid length. [ 311.092737][T12432] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2065'. [ 311.285135][T12395] netdevsim netdevsim5 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 311.305127][T12138] veth0_vlan: entered promiscuous mode [ 311.382472][T12395] netdevsim netdevsim5 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 311.391174][T12328] chnl_net:caif_netlink_parms(): no params data found [ 311.477788][T12395] netdevsim netdevsim5 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 311.615154][T12395] netdevsim netdevsim5 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 311.649423][T12138] veth1_vlan: entered promiscuous mode [ 311.945019][T12328] bridge0: port 1(bridge_slave_0) entered blocking state [ 311.952243][T12328] bridge0: port 1(bridge_slave_0) entered disabled state [ 311.979438][T12328] bridge_slave_0: entered allmulticast mode [ 312.005041][T12328] bridge_slave_0: entered promiscuous mode [ 312.025564][T12328] bridge0: port 2(bridge_slave_1) entered blocking state [ 312.032758][T12328] bridge0: port 2(bridge_slave_1) entered disabled state [ 312.077617][T12328] bridge_slave_1: entered allmulticast mode [ 312.095515][T12328] bridge_slave_1: entered promiscuous mode [ 312.114665][T12458] netlink: 'syz.6.2074': attribute type 30 has an invalid length. [ 312.138348][T12465] netlink: 36 bytes leftover after parsing attributes in process `syz.5.2077'. [ 312.180539][T12465] FAULT_INJECTION: forcing a failure. [ 312.180539][T12465] name failslab, interval 1, probability 0, space 0, times 0 [ 312.213555][T12465] CPU: 1 UID: 0 PID: 12465 Comm: syz.5.2077 Not tainted 6.15.0-rc6-syzkaller-01204-gb8fa067c4a76 #0 PREEMPT(full) [ 312.213589][T12465] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 312.213602][T12465] Call Trace: [ 312.213611][T12465] [ 312.213620][T12465] dump_stack_lvl+0x189/0x250 [ 312.213662][T12465] ? __pfx_dump_stack_lvl+0x10/0x10 [ 312.213694][T12465] ? __pfx__printk+0x10/0x10 [ 312.213713][T12465] ? __lock_acquire+0xaac/0xd20 [ 312.213764][T12465] should_fail_ex+0x414/0x560 [ 312.213794][T12465] should_failslab+0xa8/0x100 [ 312.213826][T12465] kmem_cache_alloc_noprof+0x73/0x3c0 [ 312.213854][T12465] ? skb_clone+0x212/0x3a0 [ 312.213880][T12465] skb_clone+0x212/0x3a0 [ 312.213905][T12465] __netlink_deliver_tap+0x404/0x850 [ 312.213950][T12465] ? netlink_deliver_tap+0x2e/0x1b0 [ 312.213983][T12465] netlink_deliver_tap+0x19c/0x1b0 [ 312.214015][T12465] netlink_sendskb+0x68/0x140 [ 312.214045][T12465] netlink_rcv_skb+0x2a0/0x490 [ 312.214076][T12465] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 312.214107][T12465] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 312.214160][T12465] ? netlink_deliver_tap+0x2e/0x1b0 [ 312.214189][T12465] ? netlink_deliver_tap+0x2e/0x1b0 [ 312.214225][T12465] netlink_unicast+0x758/0x8d0 [ 312.214265][T12465] netlink_sendmsg+0x805/0xb30 [ 312.214308][T12465] ? __pfx_netlink_sendmsg+0x10/0x10 [ 312.214351][T12465] ? aa_sock_msg_perm+0x94/0x160 [ 312.214379][T12465] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 312.214406][T12465] ? __pfx_netlink_sendmsg+0x10/0x10 [ 312.214437][T12465] __sock_sendmsg+0x219/0x270 [ 312.214466][T12465] ____sys_sendmsg+0x505/0x830 [ 312.214505][T12465] ? __pfx_____sys_sendmsg+0x10/0x10 [ 312.214549][T12465] ? import_iovec+0x74/0xa0 [ 312.214590][T12465] ___sys_sendmsg+0x21f/0x2a0 [ 312.214626][T12465] ? __pfx____sys_sendmsg+0x10/0x10 [ 312.214702][T12465] ? __fget_files+0x2a/0x420 [ 312.214731][T12465] ? __fget_files+0x3a0/0x420 [ 312.214773][T12465] __x64_sys_sendmsg+0x19b/0x260 [ 312.214809][T12465] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 312.214862][T12465] ? do_syscall_64+0xba/0x210 [ 312.214893][T12465] do_syscall_64+0xf6/0x210 [ 312.214920][T12465] ? clear_bhb_loop+0x60/0xb0 [ 312.214946][T12465] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 312.214967][T12465] RIP: 0033:0x7fcef8f8e969 [ 312.214986][T12465] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 312.215006][T12465] RSP: 002b:00007fcef9e44038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 312.215028][T12465] RAX: ffffffffffffffda RBX: 00007fcef91b5fa0 RCX: 00007fcef8f8e969 [ 312.215043][T12465] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 0000000000000003 [ 312.215056][T12465] RBP: 00007fcef9e44090 R08: 0000000000000000 R09: 0000000000000000 [ 312.215068][T12465] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 312.215081][T12465] R13: 0000000000000000 R14: 00007fcef91b5fa0 R15: 00007fffb26b9668 [ 312.215116][T12465] [ 312.537004][T12475] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2081'. [ 312.586648][T12328] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 312.612651][T12328] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 312.804614][ T5840] Bluetooth: hci3: command tx timeout [ 312.809273][T12328] team0: Port device team_slave_0 added [ 312.881312][T12328] team0: Port device team_slave_1 added [ 313.027255][T12138] veth0_macvtap: entered promiscuous mode [ 313.084908][T12328] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 313.097651][T12328] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 313.193361][T12328] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 313.209305][T12498] xt_cgroup: invalid path, errno=-2 [ 313.227076][T12328] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 313.239729][T12328] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 313.280564][T12499] netlink: 48 bytes leftover after parsing attributes in process `syz.5.2092'. [ 313.293369][T12328] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 313.312377][T12502] netlink: 'syz.4.2093': attribute type 8 has an invalid length. [ 313.329239][T12502] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2093'. [ 313.330744][T12138] veth1_macvtap: entered promiscuous mode [ 313.508860][T12505] netlink: 'syz.4.2097': attribute type 1 has an invalid length. [ 313.525998][T12507] batadv0: entered promiscuous mode [ 313.542218][T12507] netlink: 28 bytes leftover after parsing attributes in process `syz.5.2095'. [ 313.550066][T12328] hsr_slave_0: entered promiscuous mode [ 313.563816][T12507] netlink: 28 bytes leftover after parsing attributes in process `syz.5.2095'. [ 313.574803][T12328] hsr_slave_1: entered promiscuous mode [ 313.581193][T12328] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 313.592469][T12328] Cannot create hsr debugfs directory [ 313.607518][T12138] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 313.657359][T12507] erspan0: entered promiscuous mode [ 313.664950][T12507] erspan0: left promiscuous mode [ 313.745945][T12138] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 313.778635][T12505] bond18: (slave ip6gretap2): Enslaving as a backup interface with an up link [ 313.810146][T12506] batadv0: left promiscuous mode [ 313.839512][T12511] 8021q: adding VLAN 0 to HW filter on device bond18 [ 313.855080][ T3537] bond18: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 314.123198][T12505] bond18 (unregistering): (slave ip6gretap2): Removing an active aggregator [ 314.145172][T12505] bond18 (unregistering): (slave ip6gretap2): Releasing backup interface [ 314.174224][T12505] bond18 (unregistering): Released all slaves [ 314.232765][T12138] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 314.244537][T12138] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 314.267273][T12138] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 314.283458][T12138] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 314.366959][T12530] netlink: 36 bytes leftover after parsing attributes in process `syz.6.2102'. [ 314.392146][T12530] FAULT_INJECTION: forcing a failure. [ 314.392146][T12530] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 314.449228][T12530] CPU: 1 UID: 0 PID: 12530 Comm: syz.6.2102 Not tainted 6.15.0-rc6-syzkaller-01204-gb8fa067c4a76 #0 PREEMPT(full) [ 314.449262][T12530] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 314.449277][T12530] Call Trace: [ 314.449285][T12530] [ 314.449296][T12530] dump_stack_lvl+0x189/0x250 [ 314.449339][T12530] ? __pfx_dump_stack_lvl+0x10/0x10 [ 314.449372][T12530] ? __pfx__printk+0x10/0x10 [ 314.449409][T12530] should_fail_ex+0x414/0x560 [ 314.449440][T12530] _copy_to_user+0x31/0xb0 [ 314.449476][T12530] simple_read_from_buffer+0xe1/0x170 [ 314.449511][T12530] proc_fail_nth_read+0x1df/0x250 [ 314.449547][T12530] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 314.449583][T12530] ? rw_verify_area+0x258/0x650 [ 314.449608][T12530] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 314.449642][T12530] vfs_read+0x1fd/0x980 [ 314.449674][T12530] ? __pfx___mutex_lock+0x10/0x10 [ 314.449701][T12530] ? __pfx_vfs_read+0x10/0x10 [ 314.449728][T12530] ? __fget_files+0x2a/0x420 [ 314.449764][T12530] ? __fget_files+0x3a0/0x420 [ 314.449793][T12530] ? __fget_files+0x2a/0x420 [ 314.449833][T12530] ksys_read+0x145/0x250 [ 314.449857][T12530] ? rcu_is_watching+0x15/0xb0 [ 314.449880][T12530] ? __pfx_ksys_read+0x10/0x10 [ 314.449911][T12530] ? do_syscall_64+0xba/0x210 [ 314.449942][T12530] do_syscall_64+0xf6/0x210 [ 314.449968][T12530] ? clear_bhb_loop+0x60/0xb0 [ 314.449995][T12530] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 314.450017][T12530] RIP: 0033:0x7f22dd58d37c [ 314.450036][T12530] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 314.450055][T12530] RSP: 002b:00007f22db3f6030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 314.450078][T12530] RAX: ffffffffffffffda RBX: 00007f22dd7b5fa0 RCX: 00007f22dd58d37c [ 314.450093][T12530] RDX: 000000000000000f RSI: 00007f22db3f60a0 RDI: 0000000000000004 [ 314.450107][T12530] RBP: 00007f22db3f6090 R08: 0000000000000000 R09: 0000000000000000 [ 314.450121][T12530] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 314.450133][T12530] R13: 0000000000000000 R14: 00007f22dd7b5fa0 R15: 00007ffc859fb8e8 [ 314.450168][T12530] [ 314.883699][ T5840] Bluetooth: hci3: command tx timeout [ 314.947925][T12532] lo speed is unknown, defaulting to 1000 [ 314.981335][ T3537] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 315.012579][ T3537] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 315.186201][T10872] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 315.195774][T10872] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 315.381928][T12551] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2109'. [ 315.817319][ T36] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 316.017256][ T36] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 316.184295][ T36] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 316.225685][T12328] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 316.241223][T12328] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 316.276440][ T36] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 316.291812][T12328] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 316.304421][T12328] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 316.470671][T12328] 8021q: adding VLAN 0 to HW filter on device bond0 [ 316.505912][ T36] bridge_slave_1: left allmulticast mode [ 316.511629][ T36] bridge_slave_1: left promiscuous mode [ 316.517962][ T36] bridge0: port 2(bridge_slave_1) entered disabled state [ 316.528945][ T36] bridge_slave_0: left allmulticast mode [ 316.535439][ T36] bridge_slave_0: left promiscuous mode [ 316.541223][ T36] bridge0: port 1(bridge_slave_0) entered disabled state [ 317.384792][ T36] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 317.452061][ T36] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 317.472076][T12617] netlink: 'syz.4.2120': attribute type 8 has an invalid length. [ 317.481066][T12617] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2120'. [ 317.492721][ T36] bond0 (unregistering): Released all slaves [ 317.720177][ T5140] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 317.730453][ T5140] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 317.741410][ T5140] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 317.750058][ T5140] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 317.766354][ T5140] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 317.965859][T12328] 8021q: adding VLAN 0 to HW filter on device team0 [ 318.023651][T12625] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2123'. [ 318.159729][T12595] bridge0: port 1(bridge_slave_0) entered blocking state [ 318.167009][T12595] bridge0: port 1(bridge_slave_0) entered forwarding state [ 318.215592][T12618] lo speed is unknown, defaulting to 1000 [ 318.268469][T12595] bridge0: port 2(bridge_slave_1) entered blocking state [ 318.275738][T12595] bridge0: port 2(bridge_slave_1) entered forwarding state [ 318.318530][T12645] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2128'. [ 318.467444][ T36] hsr_slave_0: left promiscuous mode [ 318.488818][ T36] hsr_slave_1: left promiscuous mode [ 318.495572][ T36] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 318.503438][ T36] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 318.514294][ T36] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 318.521779][ T36] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 318.570718][ T36] veth1_macvtap: left promiscuous mode [ 318.583137][ T36] veth0_macvtap: left promiscuous mode [ 318.601817][ T36] veth1_vlan: left promiscuous mode [ 318.612179][ T36] veth0_vlan: left promiscuous mode [ 319.758305][ T36] team0 (unregistering): Port device team_slave_1 removed [ 319.846371][ T5140] Bluetooth: hci1: command tx timeout [ 319.889238][ T36] team0 (unregistering): Port device team_slave_0 removed [ 320.619715][T12663] batadv0: entered promiscuous mode [ 320.659101][T12663] netlink: 28 bytes leftover after parsing attributes in process `syz.6.2133'. [ 320.693560][T12663] netlink: 28 bytes leftover after parsing attributes in process `syz.6.2133'. [ 320.717648][T12328] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 320.786994][T12663] erspan0: entered promiscuous mode [ 320.844082][T12663] erspan0: left promiscuous mode [ 320.942561][T12662] batadv0: left promiscuous mode [ 321.119983][T12618] chnl_net:caif_netlink_parms(): no params data found [ 321.245958][T12683] netlink: 36 bytes leftover after parsing attributes in process `syz.6.2137'. [ 321.400641][T12693] netlink: 'syz.5.2139': attribute type 1 has an invalid length. [ 321.524699][T12691] 8021q: adding VLAN 0 to HW filter on device bond18 [ 321.533091][T12691] bond18: entered promiscuous mode [ 321.539684][T12691] team0: Port device bond18 added [ 321.653006][T12618] bridge0: port 1(bridge_slave_0) entered blocking state [ 321.669901][T12618] bridge0: port 1(bridge_slave_0) entered disabled state [ 321.692212][T12618] bridge_slave_0: entered allmulticast mode [ 321.717922][T12618] bridge_slave_0: entered promiscuous mode [ 321.720146][T12703] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2143'. [ 321.742793][T12618] bridge0: port 2(bridge_slave_1) entered blocking state [ 321.758945][T12618] bridge0: port 2(bridge_slave_1) entered disabled state [ 321.775024][T12618] bridge_slave_1: entered allmulticast mode [ 321.787069][T12618] bridge_slave_1: entered promiscuous mode [ 321.876383][T12618] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 321.906081][T12618] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 321.925904][ T5140] Bluetooth: hci1: command tx timeout [ 322.020191][T12618] team0: Port device team_slave_0 added [ 322.036990][T12328] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 322.047545][T12618] team0: Port device team_slave_1 added [ 322.154516][T12618] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 322.165527][T12618] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 322.193606][T12618] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 322.264737][T12618] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 322.271752][T12618] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 322.340522][T12618] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 322.505497][T12728] xt_hashlimit: size too large, truncated to 1048576 [ 322.674694][T12618] hsr_slave_0: entered promiscuous mode [ 322.699789][T12618] hsr_slave_1: entered promiscuous mode [ 322.717036][T12618] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 322.736546][T12618] Cannot create hsr debugfs directory [ 322.887817][T12735] netlink: 148 bytes leftover after parsing attributes in process `syz.6.2154'. [ 322.966658][T12328] veth0_vlan: entered promiscuous mode [ 323.113874][T12328] veth1_vlan: entered promiscuous mode [ 323.147029][T12739] lo speed is unknown, defaulting to 1000 [ 323.387714][T12328] veth0_macvtap: entered promiscuous mode [ 323.554212][T12328] veth1_macvtap: entered promiscuous mode [ 323.776794][T12757] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 323.825272][T12328] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 323.935772][T12761] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2161'. [ 323.977985][T12328] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 324.004016][ T5140] Bluetooth: hci1: command tx timeout [ 324.017635][T12328] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 324.043437][T12328] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 324.052359][T12328] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 324.063116][T12328] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 324.219968][T12618] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 324.285011][T12618] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 324.298025][T12770] xt_hashlimit: size too large, truncated to 1048576 [ 324.327993][T12618] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 324.379074][T12618] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 324.496396][T12595] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 324.515156][T12595] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 324.681959][ T6020] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 324.713040][ T6020] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 324.881958][T12618] 8021q: adding VLAN 0 to HW filter on device bond0 [ 324.971551][T12785] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2168'. [ 324.996071][T12779] 8021q: adding VLAN 0 to HW filter on device bond2 [ 325.006219][T12779] team0: Port device bond2 added [ 325.120139][T12618] 8021q: adding VLAN 0 to HW filter on device team0 [ 325.166645][ T6020] bridge0: port 1(bridge_slave_0) entered blocking state [ 325.173904][ T6020] bridge0: port 1(bridge_slave_0) entered forwarding state [ 325.281141][T12792] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 325.341531][T12602] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 325.387626][ T6020] bridge0: port 2(bridge_slave_1) entered blocking state [ 325.394922][ T6020] bridge0: port 2(bridge_slave_1) entered forwarding state [ 325.403608][T12791] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 325.419293][T12789] warn_alloc: 1 callbacks suppressed [ 325.419312][T12789] syz.6.2170: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 325.433722][T12791] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 325.483641][T12789] CPU: 1 UID: 0 PID: 12789 Comm: syz.6.2170 Not tainted 6.15.0-rc6-syzkaller-01204-gb8fa067c4a76 #0 PREEMPT(full) [ 325.483674][T12789] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 325.483688][T12789] Call Trace: [ 325.483696][T12789] [ 325.483706][T12789] dump_stack_lvl+0x189/0x250 [ 325.483749][T12789] ? __pfx_dump_stack_lvl+0x10/0x10 [ 325.483782][T12789] ? __pfx__printk+0x10/0x10 [ 325.483802][T12789] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 325.483826][T12789] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 325.483857][T12789] ? cpuset_print_current_mems_allowed+0x2ee/0x360 [ 325.483885][T12789] warn_alloc+0x214/0x310 [ 325.483925][T12789] ? __pfx_warn_alloc+0x10/0x10 [ 325.483957][T12789] ? kasan_save_track+0x4f/0x80 [ 325.483981][T12789] ? __kmalloc_cache_noprof+0x230/0x3d0 [ 325.484007][T12789] ? xskq_create+0x56/0x170 [ 325.484032][T12789] ? __x64_sys_setsockopt+0x18b/0x220 [ 325.484062][T12789] ? do_syscall_64+0xf6/0x210 [ 325.484086][T12789] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 325.484122][T12789] __vmalloc_node_range_noprof+0x125/0x12c0 [ 325.484192][T12789] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 325.484231][T12789] ? __kasan_kmalloc+0x93/0xb0 [ 325.484266][T12789] vmalloc_user_noprof+0x74/0x80 [ 325.484301][T12789] ? xskq_create+0xbf/0x170 [ 325.484323][T12789] xskq_create+0xbf/0x170 [ 325.484350][T12789] xsk_init_queue+0xb0/0x110 [ 325.484377][T12789] xsk_setsockopt+0x43f/0x710 [ 325.484403][T12789] ? __pfx_xsk_setsockopt+0x10/0x10 [ 325.484449][T12789] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 325.484477][T12789] ? __pfx_xsk_setsockopt+0x10/0x10 [ 325.484500][T12789] do_sock_setsockopt+0x257/0x3e0 [ 325.484537][T12789] ? __pfx_do_sock_setsockopt+0x10/0x10 [ 325.484566][T12789] ? __fget_files+0x2a/0x420 [ 325.484604][T12789] ? __fget_files+0x3a0/0x420 [ 325.484633][T12789] ? __fget_files+0x2a/0x420 [ 325.484674][T12789] __x64_sys_setsockopt+0x18b/0x220 [ 325.484714][T12789] do_syscall_64+0xf6/0x210 [ 325.484742][T12789] ? clear_bhb_loop+0x60/0xb0 [ 325.484769][T12789] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 325.484790][T12789] RIP: 0033:0x7f22dd58e969 [ 325.484810][T12789] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 325.484829][T12789] RSP: 002b:00007f22db3f6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 325.484852][T12789] RAX: ffffffffffffffda RBX: 00007f22dd7b5fa0 RCX: 00007f22dd58e969 [ 325.484868][T12789] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000007 [ 325.484881][T12789] RBP: 00007f22dd610ab1 R08: 0000000000000004 R09: 0000000000000000 [ 325.484894][T12789] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 325.484907][T12789] R13: 0000000000000000 R14: 00007f22dd7b5fa0 R15: 00007ffc859fb8e8 [ 325.484942][T12789] [ 325.484952][T12789] Mem-Info: [ 325.783500][T12789] active_anon:5773 inactive_anon:0 isolated_anon:0 [ 325.783500][T12789] active_file:1872 inactive_file:39939 isolated_file:0 [ 325.783500][T12789] unevictable:768 dirty:102 writeback:0 [ 325.783500][T12789] slab_reclaimable:11064 slab_unreclaimable:126564 [ 325.783500][T12789] mapped:34840 shmem:1491 pagetables:762 [ 325.783500][T12789] sec_pagetables:0 bounce:0 [ 325.783500][T12789] kernel_misc_reclaimable:0 [ 325.783500][T12789] free:1294459 free_pcp:6765 free_cma:0 [ 325.866002][T12602] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 325.908936][T12789] Node 0 active_anon:23092kB inactive_anon:0kB active_file:7488kB inactive_file:159552kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:139360kB dirty:408kB writeback:0kB shmem:4428kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:13836kB pagetables:3048kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 325.963709][T12789] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:48kB pagetables:0kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 326.005588][T12789] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 326.034045][T12789] lowmem_reserve[]: 0 2503 2503 2503 2503 [ 326.039900][T12789] Node 0 DMA32 free:1257204kB boost:0kB min:34304kB low:42880kB high:51456kB reserved_highatomic:0KB active_anon:23924kB inactive_anon:0kB active_file:7488kB inactive_file:159452kB unevictable:1536kB writepending:408kB present:3129332kB managed:2563984kB mlocked:0kB bounce:0kB free_pcp:26064kB local_pcp:6204kB free_cma:0kB [ 326.073676][T12789] lowmem_reserve[]: 0 0 0 0 0 [ 326.078490][T12789] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0KB active_anon:8kB inactive_anon:0kB active_file:0kB inactive_file:100kB unevictable:0kB writepending:4kB present:1048580kB managed:108kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 326.108977][ T5140] Bluetooth: hci1: command tx timeout [ 326.114660][T12789] lowmem_reserve[]: 0 0 0 0 0 [ 326.119451][T12789] Node 1 Normal free:3905784kB boost:0kB min:55592kB low:69488kB high:83384kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB writepending:0kB present:4194300kB managed:4111164kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 326.151812][T12789] lowmem_reserve[]: 0 0 0 0 0 [ 326.156736][T12789] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 326.171270][T12789] Node 0 DMA32: 516*4kB (U) 537*8kB (UME) 246*16kB (UME) 344*32kB (UME) 184*64kB (UM) 129*128kB (UM) 76*256kB (UME) 58*512kB (UME) 23*1024kB (UM) 4*2048kB (UM) 275*4096kB (UM) = 1256888kB [ 326.190324][T12789] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 326.206488][T12789] Node 1 Normal: 238*4kB (U) 58*8kB (UM) 49*16kB (UME) 221*32kB (UME) 105*64kB (UME) 37*128kB (UME) 16*256kB (UM) 10*512kB (UM) 3*1024kB (UME) 1*2048kB (E) 945*4096kB (UM) = 3905784kB [ 326.226687][T12789] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 326.236644][T12789] Node 0 hugepages_total=2 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 326.247358][T12789] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 326.257959][T12789] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 326.267692][T12789] 43303 total pagecache pages [ 326.272415][T12789] 0 pages in swap cache [ 326.277052][T12789] Free swap = 124996kB [ 326.281242][T12789] Total swap = 124996kB [ 326.293104][T12789] 2097051 pages RAM [ 326.298367][T12789] 0 pages HighMem/MovableOnly [ 326.303116][T12789] 424397 pages reserved [ 326.307912][T12789] 0 pages cma reserved [ 326.374458][T12602] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 326.536351][T12602] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 326.842526][ T5840] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 326.857713][ T5840] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 326.885748][ T5840] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 326.899683][ T5840] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 326.911250][ T5840] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 327.132502][T12821] bond_slave_0: entered promiscuous mode [ 327.138331][T12821] bond_slave_1: entered promiscuous mode [ 327.167719][T12825] FAULT_INJECTION: forcing a failure. [ 327.167719][T12825] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 327.181527][T12821] vlan2: entered promiscuous mode [ 327.202799][T12825] CPU: 0 UID: 0 PID: 12825 Comm: syz.5.2179 Not tainted 6.15.0-rc6-syzkaller-01204-gb8fa067c4a76 #0 PREEMPT(full) [ 327.202831][T12825] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 327.202845][T12825] Call Trace: [ 327.202853][T12825] [ 327.202863][T12825] dump_stack_lvl+0x189/0x250 [ 327.202903][T12825] ? __pfx_dump_stack_lvl+0x10/0x10 [ 327.202935][T12825] ? __pfx__printk+0x10/0x10 [ 327.202973][T12825] should_fail_ex+0x414/0x560 [ 327.203003][T12825] _copy_to_user+0x31/0xb0 [ 327.203037][T12825] mptcp_getsockopt+0x16cd/0x1b90 [ 327.203081][T12825] ? __pfx_mptcp_getsockopt+0x10/0x10 [ 327.203126][T12825] ? __lock_acquire+0xaac/0xd20 [ 327.203167][T12825] ? __lock_acquire+0xaac/0xd20 [ 327.203210][T12825] ? __lock_acquire+0xaac/0xd20 [ 327.203263][T12825] ? is_bpf_text_address+0x26/0x2b0 [ 327.203324][T12825] ? __might_fault+0xb0/0x130 [ 327.203407][T12825] ? __might_fault+0xb0/0x130 [ 327.203445][T12825] ? sock_common_getsockopt+0x2d/0xb0 [ 327.203470][T12825] do_sock_getsockopt+0x35d/0x650 [ 327.203499][T12825] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 327.203524][T12825] ? do_syscall_64+0x40/0x210 [ 327.203544][T12825] ? __fget_files+0x2a/0x420 [ 327.203568][T12825] ? __fget_files+0x3a0/0x420 [ 327.203591][T12825] ? __fget_files+0x2a/0x420 [ 327.203629][T12825] __x64_sys_getsockopt+0x1a5/0x250 [ 327.203654][T12825] ? do_syscall_64+0x40/0x210 [ 327.203675][T12825] ? do_syscall_64+0x40/0x210 [ 327.203699][T12825] do_syscall_64+0xf6/0x210 [ 327.203721][T12825] ? clear_bhb_loop+0x60/0xb0 [ 327.203743][T12825] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 327.203760][T12825] RIP: 0033:0x7fcef8f8e969 [ 327.203776][T12825] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 327.203792][T12825] RSP: 002b:00007fcef9e44038 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 327.203811][T12825] RAX: ffffffffffffffda RBX: 00007fcef91b5fa0 RCX: 00007fcef8f8e969 [ 327.203824][T12825] RDX: 0000000000000004 RSI: 000000000000011c RDI: 0000000000000003 [ 327.203834][T12825] RBP: 00007fcef9e44090 R08: 00002000000000c0 R09: 0000000000000000 [ 327.203846][T12825] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000001 [ 327.203861][T12825] R13: 0000000000000000 R14: 00007fcef91b5fa0 R15: 00007fffb26b9668 [ 327.203889][T12825] [ 327.473285][T12821] bond0: entered promiscuous mode [ 327.621387][T12602] bridge_slave_1: left allmulticast mode [ 327.660879][T12602] bridge_slave_1: left promiscuous mode [ 327.670665][T12602] bridge0: port 2(bridge_slave_1) entered disabled state [ 327.680542][T12830] FAULT_INJECTION: forcing a failure. [ 327.680542][T12830] name failslab, interval 1, probability 0, space 0, times 0 [ 327.706114][T12830] CPU: 1 UID: 0 PID: 12830 Comm: syz.5.2182 Not tainted 6.15.0-rc6-syzkaller-01204-gb8fa067c4a76 #0 PREEMPT(full) [ 327.706146][T12830] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 327.706159][T12830] Call Trace: [ 327.706168][T12830] [ 327.706177][T12830] dump_stack_lvl+0x189/0x250 [ 327.706218][T12830] ? __pfx_dump_stack_lvl+0x10/0x10 [ 327.706250][T12830] ? __pfx__printk+0x10/0x10 [ 327.706281][T12830] ? ref_tracker_alloc+0x318/0x460 [ 327.706311][T12830] should_fail_ex+0x414/0x560 [ 327.706342][T12830] should_failslab+0xa8/0x100 [ 327.706375][T12830] kmem_cache_alloc_noprof+0x73/0x3c0 [ 327.706403][T12830] ? skb_clone+0x212/0x3a0 [ 327.706428][T12830] skb_clone+0x212/0x3a0 [ 327.706453][T12830] __netlink_deliver_tap+0x404/0x850 [ 327.706500][T12830] ? netlink_deliver_tap+0x2e/0x1b0 [ 327.706533][T12830] netlink_deliver_tap+0x19c/0x1b0 [ 327.706574][T12830] netlink_unicast+0x72f/0x8d0 [ 327.706614][T12830] netlink_sendmsg+0x805/0xb30 [ 327.706655][T12830] ? __pfx_netlink_sendmsg+0x10/0x10 [ 327.706689][T12830] ? aa_sock_msg_perm+0x94/0x160 [ 327.706721][T12830] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 327.706745][T12830] ? __pfx_netlink_sendmsg+0x10/0x10 [ 327.706778][T12830] __sock_sendmsg+0x219/0x270 [ 327.706806][T12830] ____sys_sendmsg+0x505/0x830 [ 327.706846][T12830] ? __pfx_____sys_sendmsg+0x10/0x10 [ 327.706888][T12830] ? import_iovec+0x74/0xa0 [ 327.706923][T12830] ___sys_sendmsg+0x21f/0x2a0 [ 327.706959][T12830] ? __pfx____sys_sendmsg+0x10/0x10 [ 327.707036][T12830] ? __fget_files+0x2a/0x420 [ 327.707064][T12830] ? __fget_files+0x3a0/0x420 [ 327.707106][T12830] __x64_sys_sendmsg+0x19b/0x260 [ 327.707141][T12830] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 327.707194][T12830] ? do_syscall_64+0xba/0x210 [ 327.707225][T12830] do_syscall_64+0xf6/0x210 [ 327.707251][T12830] ? clear_bhb_loop+0x60/0xb0 [ 327.707279][T12830] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 327.707299][T12830] RIP: 0033:0x7fcef8f8e969 [ 327.707318][T12830] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 327.707336][T12830] RSP: 002b:00007fcef9e44038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 327.707359][T12830] RAX: ffffffffffffffda RBX: 00007fcef91b5fa0 RCX: 00007fcef8f8e969 [ 327.707375][T12830] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 0000000000000003 [ 327.707388][T12830] RBP: 00007fcef9e44090 R08: 0000000000000000 R09: 0000000000000000 [ 327.707401][T12830] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 327.707413][T12830] R13: 0000000000000000 R14: 00007fcef91b5fa0 R15: 00007fffb26b9668 [ 327.707447][T12830] [ 327.730237][T12830] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2182'. [ 327.745780][T12602] bridge_slave_0: left allmulticast mode [ 328.057827][T12602] bridge_slave_0: left promiscuous mode [ 328.065134][T12602] bridge0: port 1(bridge_slave_0) entered disabled state [ 328.695928][T12852] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 328.720120][T12602] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 328.733560][T12602] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 328.745916][T12602] bond0 (unregistering): Released all slaves [ 328.769599][T12852] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 328.780093][T12814] lo speed is unknown, defaulting to 1000 [ 328.801023][T12852] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 328.849954][T12848] 8021q: adding VLAN 0 to HW filter on device bond5 [ 328.867568][T12848] team0: Port device bond5 added [ 328.963755][ T5140] Bluetooth: hci3: command tx timeout [ 329.175338][T12618] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 329.258751][T12864] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2191'. [ 329.269189][T12864] openvswitch: netlink: nsh attribute has 65532 unknown bytes. [ 329.277249][T12864] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 329.372701][T12864] netlink: 'syz.5.2191': attribute type 1 has an invalid length. [ 329.473819][T12602] hsr_slave_0: left promiscuous mode [ 329.479969][T12602] hsr_slave_1: left promiscuous mode [ 329.491186][T12602] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 329.499090][T12602] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 329.508566][T12602] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 329.520545][T12602] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 329.555714][T12602] veth1_macvtap: left promiscuous mode [ 329.561533][T12602] veth0_macvtap: left promiscuous mode [ 329.567464][T12602] veth1_vlan: left promiscuous mode [ 329.572960][T12602] veth0_vlan: left promiscuous mode [ 330.237231][T12880] xt_recent: hitcount (33554432) is larger than allowed maximum (65535) [ 330.382543][T12881] xt_CT: No such helper "pptp" [ 330.495875][T12602] team0 (unregistering): Port device team_slave_1 removed [ 330.569127][T12602] team0 (unregistering): Port device team_slave_0 removed [ 331.056796][ T5140] Bluetooth: hci3: command tx timeout [ 331.234971][T12618] veth0_vlan: entered promiscuous mode [ 331.357425][T12890] netlink: 'syz.5.2200': attribute type 8 has an invalid length. [ 331.401060][T12890] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2200'. [ 331.462026][T12885] 8021q: adding VLAN 0 to HW filter on device bond3 [ 331.499502][T12885] team0: Port device bond3 added [ 331.679828][T12618] veth1_vlan: entered promiscuous mode [ 331.766326][T12902] netlink: 36 bytes leftover after parsing attributes in process `syz.6.2201'. [ 331.774298][T12814] chnl_net:caif_netlink_parms(): no params data found [ 331.940920][T12908] netlink: 56 bytes leftover after parsing attributes in process `syz.6.2204'. [ 331.986926][T12915] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 332.018001][T12618] veth0_macvtap: entered promiscuous mode [ 332.047364][ T36] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 332.097477][T12906] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 332.152812][T12906] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 332.272844][T12924] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2208'. [ 332.341185][T12618] veth1_macvtap: entered promiscuous mode [ 332.376350][T12814] bridge0: port 1(bridge_slave_0) entered blocking state [ 332.400275][T12814] bridge0: port 1(bridge_slave_0) entered disabled state [ 332.425372][T12814] bridge_slave_0: entered allmulticast mode [ 332.457792][T12814] bridge_slave_0: entered promiscuous mode [ 332.481198][T12814] bridge0: port 2(bridge_slave_1) entered blocking state [ 332.498857][T12814] bridge0: port 2(bridge_slave_1) entered disabled state [ 332.516737][T12814] bridge_slave_1: entered allmulticast mode [ 332.540363][T12814] bridge_slave_1: entered promiscuous mode [ 332.828249][T12814] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 332.867076][T12814] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 333.088910][T12618] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 333.123605][ T5140] Bluetooth: hci3: command tx timeout [ 333.136794][T12814] team0: Port device team_slave_0 added [ 333.167191][T12814] team0: Port device team_slave_1 added [ 333.187231][T12618] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 333.227328][T12618] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 333.243262][T12618] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 333.262330][T12618] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 333.282658][T12618] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 333.322673][T12952] netlink: 56 bytes leftover after parsing attributes in process `syz.4.2217'. [ 333.525998][T12814] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 333.544065][T12814] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 333.575675][T12814] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 333.589521][T12814] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 333.597173][T12814] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 333.619896][T12954] netlink: 46 bytes leftover after parsing attributes in process `syz.5.2218'. [ 333.624392][T12814] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 333.832953][T12814] hsr_slave_0: entered promiscuous mode [ 333.850166][T12814] hsr_slave_1: entered promiscuous mode [ 333.867948][T12814] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 333.880117][T12814] Cannot create hsr debugfs directory [ 334.008836][T12596] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 334.031288][T12596] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 334.131487][T12969] syz_tun: entered promiscuous mode [ 334.158226][T12969] syz_tun: left promiscuous mode [ 334.338488][T12596] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 334.364624][T12596] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 334.689595][T12987] netlink: 56 bytes leftover after parsing attributes in process `syz.5.2229'. [ 334.957620][T12990] pim6reg1: entered promiscuous mode [ 334.974132][T12990] pim6reg1: entered allmulticast mode [ 335.068421][T12994] 8021q: adding VLAN 0 to HW filter on device bond19 [ 335.078893][T12994] bond19: entered promiscuous mode [ 335.087463][T12994] team0: Port device bond19 added [ 335.209004][ T5140] Bluetooth: hci3: command tx timeout [ 335.247038][T12602] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 335.365011][T12602] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 335.527898][T12814] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 335.539450][T12814] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 335.555284][T12814] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 335.566674][T12814] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 335.671184][T12602] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 335.717298][T12814] 8021q: adding VLAN 0 to HW filter on device bond0 [ 335.748248][T12602] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 335.781216][T12814] 8021q: adding VLAN 0 to HW filter on device team0 [ 335.806667][ T36] bridge0: port 1(bridge_slave_0) entered blocking state [ 335.813923][ T36] bridge0: port 1(bridge_slave_0) entered forwarding state [ 335.856398][ T3537] bridge0: port 2(bridge_slave_1) entered blocking state [ 335.863609][ T3537] bridge0: port 2(bridge_slave_1) entered forwarding state [ 336.073454][T12602] bridge_slave_1: left allmulticast mode [ 336.079272][T12602] bridge_slave_1: left promiscuous mode [ 336.118438][T12602] bridge0: port 2(bridge_slave_1) entered disabled state [ 336.195827][T12602] bridge_slave_0: left allmulticast mode [ 336.201552][T12602] bridge_slave_0: left promiscuous mode [ 336.244160][T12602] bridge0: port 1(bridge_slave_0) entered disabled state [ 336.775243][T13020] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2239'. [ 336.798458][T13020] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2239'. [ 336.818186][ T5840] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 336.828370][ T5840] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 336.836848][ T5840] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 336.847288][ T5840] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 336.859655][ T5840] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 337.091259][T12602] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 337.105723][T12602] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 337.117410][T12602] bond0 (unregistering): Released all slaves [ 337.278828][T13021] lo speed is unknown, defaulting to 1000 [ 337.856725][T12814] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 338.014379][T12602] hsr_slave_0: left promiscuous mode [ 338.029649][T12602] hsr_slave_1: left promiscuous mode [ 338.044289][T12602] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 338.062048][T12602] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 338.084734][T12602] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 338.113877][T12602] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 338.218654][T12602] veth1_macvtap: left promiscuous mode [ 338.246294][T12602] veth0_macvtap: left promiscuous mode [ 338.252065][T12602] veth1_vlan: left promiscuous mode [ 338.265889][T12602] veth0_vlan: left promiscuous mode [ 338.973760][ T5140] Bluetooth: hci1: command tx timeout [ 339.528963][T12602] team0 (unregistering): Port device team_slave_1 removed [ 339.580030][T12602] team0 (unregistering): Port device team_slave_0 removed [ 340.234413][T13054] lo speed is unknown, defaulting to 1000 [ 340.319780][T13021] chnl_net:caif_netlink_parms(): no params data found [ 340.806607][T13021] bridge0: port 1(bridge_slave_0) entered blocking state [ 340.823393][T13021] bridge0: port 1(bridge_slave_0) entered disabled state [ 340.830894][T13021] bridge_slave_0: entered allmulticast mode [ 340.842832][T13021] bridge_slave_0: entered promiscuous mode [ 340.867447][T12814] veth0_vlan: entered promiscuous mode [ 340.899450][T13021] bridge0: port 2(bridge_slave_1) entered blocking state [ 340.908860][T13021] bridge0: port 2(bridge_slave_1) entered disabled state [ 340.933721][T13021] bridge_slave_1: entered allmulticast mode [ 340.941697][T13021] bridge_slave_1: entered promiscuous mode [ 341.045250][ T5140] Bluetooth: hci1: command tx timeout [ 341.135805][T13021] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 341.183008][T13021] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 341.280386][T12814] veth1_vlan: entered promiscuous mode [ 341.366394][T13021] team0: Port device team_slave_0 added [ 341.401490][T13108] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 341.446455][T13021] team0: Port device team_slave_1 added [ 341.478996][T13110] xt_recent: hitcount (33554432) is larger than allowed maximum (65535) [ 341.793125][T13113] xt_CT: No such helper "pptp" [ 341.803850][T13021] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 341.810868][T13021] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 341.886748][T13021] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 341.900001][T13021] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 341.907397][T13021] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 341.934143][T13021] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 342.223086][T13021] hsr_slave_0: entered promiscuous mode [ 342.231114][T13021] hsr_slave_1: entered promiscuous mode [ 342.240982][T13021] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 342.263235][T13021] Cannot create hsr debugfs directory [ 342.288316][T12814] veth0_macvtap: entered promiscuous mode [ 342.340313][T13135] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2268'. [ 342.361515][T12814] veth1_macvtap: entered promiscuous mode [ 342.386464][T13135] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2268'. [ 342.410925][T13138] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2269'. [ 342.538811][T12814] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 342.677032][T12814] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 342.844366][T12814] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 342.871325][T12814] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 342.897838][T12814] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 342.923364][T12814] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 343.135672][ T5140] Bluetooth: hci1: command tx timeout [ 343.239275][T13167] 8021q: adding VLAN 0 to HW filter on device bond20 [ 343.247384][T13167] bond20: entered promiscuous mode [ 343.253672][T13167] team0: Port device bond20 added [ 343.374562][ T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 343.382467][ T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 343.487628][T12594] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 343.536393][T12594] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 343.834779][T13021] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 343.939833][T13021] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 344.038699][T13189] tipc: Started in network mode [ 344.048665][T13189] tipc: Node identity , cluster identity 4711 [ 344.084111][T13021] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 344.110568][T13021] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 344.317040][ T3537] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 344.365773][T13183] lo speed is unknown, defaulting to 1000 [ 344.581701][ T3537] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 344.779519][ T3537] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 344.848629][ T3537] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 344.928815][T13021] 8021q: adding VLAN 0 to HW filter on device bond0 [ 344.962728][T13021] 8021q: adding VLAN 0 to HW filter on device team0 [ 344.977349][T12596] bridge0: port 1(bridge_slave_0) entered blocking state [ 344.984605][T12596] bridge0: port 1(bridge_slave_0) entered forwarding state [ 345.012972][T12596] bridge0: port 2(bridge_slave_1) entered blocking state [ 345.020244][T12596] bridge0: port 2(bridge_slave_1) entered forwarding state [ 345.119027][T13021] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 345.203375][ T5140] Bluetooth: hci1: command tx timeout [ 345.695450][ T3537] bridge_slave_1: left allmulticast mode [ 345.716820][ T3537] bridge_slave_1: left promiscuous mode [ 345.723686][ T3537] bridge0: port 2(bridge_slave_1) entered disabled state [ 345.829881][ T3537] bridge_slave_0: left allmulticast mode [ 345.856184][ T3537] bridge_slave_0: left promiscuous mode [ 345.862064][ T3537] bridge0: port 1(bridge_slave_0) entered disabled state [ 345.959033][ T5840] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 345.968002][T13237] netlink: 'syz.5.2298': attribute type 1 has an invalid length. [ 345.982901][ T5840] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 345.989495][T13237] netlink: 244 bytes leftover after parsing attributes in process `syz.5.2298'. [ 346.005804][ T5840] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 346.017937][ T5840] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 346.026326][ T5840] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 346.497044][ T3537] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 346.509435][ T3537] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 346.521642][ T3537] bond0 (unregistering): Released all slaves [ 346.543806][T13229] netlink: 96 bytes leftover after parsing attributes in process `syz.5.2298'. [ 346.711099][T13243] 8021q: adding VLAN 0 to HW filter on device bond21 [ 346.719173][T13243] bond21: entered promiscuous mode [ 346.726163][T13243] team0: Port device bond21 added [ 346.926266][T13235] lo speed is unknown, defaulting to 1000 [ 346.940281][T13254] netlink: 136 bytes leftover after parsing attributes in process `syz.6.2307'. [ 346.982274][T13021] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 347.366041][T13268] netlink: 20 bytes leftover after parsing attributes in process `syz.6.2312'. [ 347.376549][T13268] netlink: 12 bytes leftover after parsing attributes in process `syz.6.2312'. [ 347.385786][ T3537] hsr_slave_0: left promiscuous mode [ 347.404087][ T3537] hsr_slave_1: left promiscuous mode [ 347.412050][ T3537] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 347.431501][ T3537] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 347.453330][ T3537] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 347.461038][ T3537] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 347.509858][ T3537] veth1_macvtap: left promiscuous mode [ 347.523291][ T3537] veth0_macvtap: left promiscuous mode [ 347.529010][ T3537] veth1_vlan: left promiscuous mode [ 347.543381][ T3537] veth0_vlan: left promiscuous mode [ 348.097245][ T5140] Bluetooth: hci3: command tx timeout [ 348.189569][ T3537] team0 (unregistering): Port device team_slave_1 removed [ 348.252284][ T3537] team0 (unregistering): Port device team_slave_0 removed [ 350.166194][ T5140] Bluetooth: hci3: command tx timeout [ 350.871482][T13021] veth0_vlan: entered promiscuous mode [ 350.919363][T13021] veth1_vlan: entered promiscuous mode [ 351.007778][T13281] 8021q: adding VLAN 0 to HW filter on device bond22 [ 351.016006][T13281] bond22: entered promiscuous mode [ 351.022211][T13281] team0: Port device bond22 added [ 351.072564][T13287] netlink: 48 bytes leftover after parsing attributes in process `syz.6.2317'. [ 351.112442][T13021] veth0_macvtap: entered promiscuous mode [ 351.196614][T13021] veth1_macvtap: entered promiscuous mode [ 351.254867][T13278] lo speed is unknown, defaulting to 1000 [ 351.521683][T13021] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 351.575311][T13021] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 351.600033][T13235] chnl_net:caif_netlink_parms(): no params data found [ 351.667362][T13021] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 351.690085][T13021] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 351.699269][T13021] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 351.709286][T13021] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 352.044667][T13307] xt_recent: hitcount (33554432) is larger than allowed maximum (65535) [ 352.154261][T13305] 8021q: adding VLAN 0 to HW filter on device bond4 [ 352.184343][T13305] team0: Port device bond4 added [ 352.243434][ T5140] Bluetooth: hci3: command tx timeout [ 352.294471][T13312] xt_CT: No such helper "pptp" [ 352.700187][T13235] bridge0: port 1(bridge_slave_0) entered blocking state [ 352.723465][T13235] bridge0: port 1(bridge_slave_0) entered disabled state [ 352.736464][T13235] bridge_slave_0: entered allmulticast mode [ 352.773632][T13235] bridge_slave_0: entered promiscuous mode [ 352.804709][T13235] bridge0: port 2(bridge_slave_1) entered blocking state [ 352.811942][T13235] bridge0: port 2(bridge_slave_1) entered disabled state [ 352.846604][T13235] bridge_slave_1: entered allmulticast mode [ 352.855341][T13235] bridge_slave_1: entered promiscuous mode [ 352.919645][T13336] bond5: entered promiscuous mode [ 352.924880][T13336] bond5: entered allmulticast mode [ 352.930628][T13336] 8021q: adding VLAN 0 to HW filter on device bond5 [ 353.140436][T13235] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 353.169811][T13235] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 353.364385][ T3537] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 353.372282][ T3537] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 353.383858][T13353] xt_recent: hitcount (33554432) is larger than allowed maximum (65535) [ 353.410167][T13235] team0: Port device team_slave_0 added [ 353.485387][T13235] team0: Port device team_slave_1 added [ 353.611204][T13353] xt_CT: No such helper "pptp" [ 353.717490][ T6020] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 353.761221][ T6020] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 353.822310][T13362] 8021q: adding VLAN 0 to HW filter on device bond6 [ 353.830839][T13362] team0: Port device bond6 added [ 353.879806][T13235] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 353.887465][T13235] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 353.913845][T13235] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 353.926983][T13235] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 353.934045][T13235] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 353.986956][T13235] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 354.132170][T13235] hsr_slave_0: entered promiscuous mode [ 354.152758][T13235] hsr_slave_1: entered promiscuous mode [ 354.184446][T13235] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 354.192594][T13235] Cannot create hsr debugfs directory [ 354.224617][T13376] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2342'. [ 354.252496][T13376] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2342'. [ 354.323909][ T5140] Bluetooth: hci3: command tx timeout [ 354.377063][T13375] sch_tbf: burst 0 is lower than device ip6gre0 mtu (1448) ! [ 354.464136][T13373] bond0: (slave team0): Releasing backup interface [ 354.502075][T13373] team0: left promiscuous mode [ 354.510333][T13373] team_slave_0: left promiscuous mode [ 354.524757][T13373] team_slave_1: left promiscuous mode [ 354.531125][T13373] bond1: left promiscuous mode [ 354.551361][T13373] bond2: left promiscuous mode [ 354.561495][T13373] bond3: left promiscuous mode [ 354.582001][T13373] bond4: left promiscuous mode [ 354.592150][T13373] bond5: left promiscuous mode [ 354.602268][T13373] bond6: left promiscuous mode [ 354.613614][T13373] bond7: left promiscuous mode [ 354.618788][T13373] bond8: left promiscuous mode [ 354.653851][T13373] bond9: left promiscuous mode [ 354.658894][T13373] bond10: left promiscuous mode [ 354.676733][T13373] bond11: left promiscuous mode [ 354.681906][T13373] bond12: left promiscuous mode [ 354.687805][T13373] bond13: left promiscuous mode [ 354.692887][T13373] bond14: left promiscuous mode [ 354.698542][T13373] bond15: left promiscuous mode [ 354.705240][T13373] bond17: left promiscuous mode [ 354.710304][T13373] bond18: left promiscuous mode [ 354.715926][T13373] bond19: left promiscuous mode [ 354.721103][T13373] bond20: left promiscuous mode [ 354.727358][T13373] bond21: left promiscuous mode [ 354.732500][T13373] bond22: left promiscuous mode [ 354.758430][T13373] bridge_slave_0: left allmulticast mode [ 354.774698][T13373] bridge_slave_0: left promiscuous mode [ 354.793619][T13373] bridge0: port 1(bridge_slave_0) entered disabled state [ 354.807986][T13373] bond0: (slave bond_slave_0): Releasing backup interface [ 354.824503][T13373] bond_slave_0: left promiscuous mode [ 354.850240][T13373] bond0: (slave bond_slave_1): Releasing backup interface [ 354.866611][T13373] bond_slave_1: left promiscuous mode [ 354.887454][T13373] team0: Port device team_slave_0 removed [ 354.900686][T13373] team0: Port device team_slave_1 removed [ 354.908767][T13373] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 354.922910][T13373] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 354.935842][T13373] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 354.944660][T13373] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 354.970433][T13373] team0: Port device bond1 removed [ 354.996483][T13373] team0: Port device bond2 removed [ 355.002863][T13373] batman_adv: batadv0: Interface deactivated: macvlan2 [ 355.033329][T13373] batman_adv: batadv0: Removing interface: macvlan2 [ 355.048038][T13373] team0: Port device bond3 removed [ 355.069310][T13373] team0: Port device bond4 removed [ 355.094305][T13373] team0: Port device bond5 removed [ 355.117055][T13373] team0: Port device bond6 removed [ 355.129424][T13373] team0: Port device bond7 removed [ 355.141699][T13373] team0: Port device bond8 removed [ 355.151195][T13373] team0: Port device bond9 removed [ 355.162551][T13373] team0: Port device bond10 removed [ 355.186363][T13373] team0: Port device bond11 removed [ 355.200279][T13373] team0: Port device bond12 removed [ 355.211618][T13373] team0: Port device bond13 removed [ 355.222449][T13373] team0: Port device bond14 removed [ 355.232207][T13373] team0: Port device bond15 removed [ 355.241999][T13373] team0: Port device bond17 removed [ 355.252137][T13373] team0: Port device bond18 removed [ 355.261984][T13373] team0: Port device bond19 removed [ 355.272126][T13373] team0: Port device bond20 removed [ 355.282134][T13373] team0: Port device bond21 removed [ 355.295795][T13373] team0: Port device bond22 removed [ 355.333479][T13375] (unnamed net_device) (uninitialized): option packets_per_slave: mode dependency failed, not supported in mode active-backup(1) [ 355.440365][T12602] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 355.955737][T12602] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 356.188980][T12602] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 356.215636][T13400] xt_recent: hitcount (33554432) is larger than allowed maximum (65535) [ 356.301090][T13402] 8021q: adding VLAN 0 to HW filter on device bond6 [ 356.311846][T13402] team0: Port device bond6 added [ 356.406327][T13407] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2354'. [ 356.427031][ T5840] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 356.453523][ T5840] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 356.465005][ T5840] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 356.476570][ T5840] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 356.498695][ T5840] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 356.568322][T13404] xt_CT: No such helper "pptp" [ 356.675392][T12602] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 356.844955][T13408] lo speed is unknown, defaulting to 1000 [ 357.043802][T13420] 8021q: adding VLAN 0 to HW filter on device bond23 [ 357.052743][T13420] team0: Port device bond23 added [ 357.088225][T13235] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 357.211948][T13235] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 357.238703][T13434] tipc: Enabling of bearer rejected, failed to enable media [ 357.264476][T13434] netlink: 56 bytes leftover after parsing attributes in process `syz.6.2362'. [ 357.309425][T13235] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 357.406334][T13235] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 357.497892][T12602] bridge_slave_1: left allmulticast mode [ 357.513480][T12602] bridge_slave_1: left promiscuous mode [ 357.519859][T12602] bridge0: port 2(bridge_slave_1) entered disabled state [ 357.532332][T12602] bridge_slave_0: left allmulticast mode [ 357.538999][T12602] bridge_slave_0: left promiscuous mode [ 357.546313][T12602] bridge0: port 1(bridge_slave_0) entered disabled state [ 357.558409][T13447] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2366'. [ 358.093447][T12602] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 358.109587][T12602] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 358.122653][T12602] bond0 (unregistering): Released all slaves [ 358.339768][T13443] netlink: 24 bytes leftover after parsing attributes in process `syz.6.2366'. [ 358.354242][T13443] tipc: Enabling of bearer rejected, failed to enable media [ 358.413932][T13449] 8021q: adding VLAN 0 to HW filter on device bond7 [ 358.424579][T13449] team0: Port device bond7 added [ 358.563512][ T5140] Bluetooth: hci1: command tx timeout [ 358.787399][T13465] netlink: 36 bytes leftover after parsing attributes in process `syz.4.2372'. [ 358.795497][T13463] netlink: 36 bytes leftover after parsing attributes in process `syz.4.2372'. [ 358.945223][T13467] 8021q: adding VLAN 0 to HW filter on device bond7 [ 358.954011][T13467] team0: Port device bond7 added [ 359.072968][T13476] xt_hashlimit: size too large, truncated to 1048576 [ 359.078635][T12602] hsr_slave_0: left promiscuous mode [ 359.106204][T12602] hsr_slave_1: left promiscuous mode [ 359.112465][T12602] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 359.134185][T12602] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 359.165934][T12602] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 359.203492][T12602] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 359.307029][T12602] veth1_macvtap: left promiscuous mode [ 359.312686][T12602] veth0_macvtap: left promiscuous mode [ 359.327907][T12602] veth1_vlan: left promiscuous mode [ 359.344215][T12602] veth0_vlan: left promiscuous mode [ 359.678388][T13488] TCP: request_sock_subflow_v4: Possible SYN flooding on port [::]:20002. Sending cookies. [ 360.362216][T12602] team0 (unregistering): Port device team_slave_1 removed [ 360.419541][T12602] team0 (unregistering): Port device team_slave_0 removed [ 360.643418][ T5140] Bluetooth: hci1: command tx timeout [ 361.096880][T13408] chnl_net:caif_netlink_parms(): no params data found [ 361.300615][T13497] lo: entered promiscuous mode [ 361.306116][T13501] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2381'. [ 361.306547][T13497] lo: entered allmulticast mode [ 361.329047][T13497] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 361.669061][T13408] bridge0: port 1(bridge_slave_0) entered blocking state [ 361.683547][T13408] bridge0: port 1(bridge_slave_0) entered disabled state [ 361.699511][T13408] bridge_slave_0: entered allmulticast mode [ 361.713124][T13408] bridge_slave_0: entered promiscuous mode [ 361.755713][T13408] bridge0: port 2(bridge_slave_1) entered blocking state [ 361.783824][T13408] bridge0: port 2(bridge_slave_1) entered disabled state [ 361.791309][T13408] bridge_slave_1: entered allmulticast mode [ 361.806198][T13408] bridge_slave_1: entered promiscuous mode [ 361.929592][T13408] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 361.960179][T13235] 8021q: adding VLAN 0 to HW filter on device bond0 [ 361.995857][T13408] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 362.144920][T13519] xt_hashlimit: size too large, truncated to 1048576 [ 362.245009][T13516] 8021q: adding VLAN 0 to HW filter on device bond8 [ 362.277126][T13516] team0: Port device bond8 added [ 362.450281][T13408] team0: Port device team_slave_0 added [ 362.477932][T13408] team0: Port device team_slave_1 added [ 362.556044][T13235] 8021q: adding VLAN 0 to HW filter on device team0 [ 362.584424][T13529] netlink: 20 bytes leftover after parsing attributes in process `syz.5.2391'. [ 362.593806][T13529] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2391'. [ 362.606302][T13408] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 362.615112][T13529] netlink: 16 bytes leftover after parsing attributes in process `syz.5.2391'. [ 362.615501][T13408] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 362.666308][T13408] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 362.734662][ T5140] Bluetooth: hci1: command tx timeout [ 362.771105][T13408] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 362.778340][T13408] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 362.806033][T13408] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 362.861410][T12595] bridge0: port 1(bridge_slave_0) entered blocking state [ 362.868632][T12595] bridge0: port 1(bridge_slave_0) entered forwarding state [ 363.141687][T13408] hsr_slave_0: entered promiscuous mode [ 363.206755][T13408] hsr_slave_1: entered promiscuous mode [ 363.268170][T13408] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 363.322106][T13408] Cannot create hsr debugfs directory [ 363.411378][T12595] bridge0: port 2(bridge_slave_1) entered blocking state [ 363.419731][T12595] bridge0: port 2(bridge_slave_1) entered forwarding state [ 363.529596][T13538] tap0: tun_chr_ioctl cmd 1074025677 [ 363.600529][T13538] tap0: linktype set to 780 [ 363.829373][T13546] vlan2: entered promiscuous mode [ 363.985405][T13548] netlink: 56 bytes leftover after parsing attributes in process `syz.4.2396'. [ 364.509343][T13235] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 364.527180][T13557] FAULT_INJECTION: forcing a failure. [ 364.527180][T13557] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 364.548046][T13557] CPU: 0 UID: 0 PID: 13557 Comm: syz.6.2400 Not tainted 6.15.0-rc6-syzkaller-01204-gb8fa067c4a76 #0 PREEMPT(full) [ 364.548077][T13557] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 364.548095][T13557] Call Trace: [ 364.548108][T13557] [ 364.548117][T13557] dump_stack_lvl+0x189/0x250 [ 364.548156][T13557] ? __lock_acquire+0xaac/0xd20 [ 364.548191][T13557] ? __pfx_dump_stack_lvl+0x10/0x10 [ 364.548223][T13557] ? __pfx__printk+0x10/0x10 [ 364.548246][T13557] ? __might_fault+0xb0/0x130 [ 364.548289][T13557] should_fail_ex+0x414/0x560 [ 364.548318][T13557] _copy_from_user+0x2d/0xb0 [ 364.548351][T13557] __sys_bpf+0x1ed/0x860 [ 364.548383][T13557] ? __pfx___sys_bpf+0x10/0x10 [ 364.548427][T13557] ? ksys_write+0x1f0/0x250 [ 364.548469][T13557] __x64_sys_bpf+0x7c/0x90 [ 364.548496][T13557] do_syscall_64+0xf6/0x210 [ 364.548524][T13557] ? clear_bhb_loop+0x60/0xb0 [ 364.548552][T13557] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 364.548573][T13557] RIP: 0033:0x7f22dd58e969 [ 364.548593][T13557] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 364.548613][T13557] RSP: 002b:00007f22db3f6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 364.548636][T13557] RAX: ffffffffffffffda RBX: 00007f22dd7b5fa0 RCX: 00007f22dd58e969 [ 364.548653][T13557] RDX: 0000000000000094 RSI: 0000200000000140 RDI: 0000000000000005 [ 364.548667][T13557] RBP: 00007f22db3f6090 R08: 0000000000000000 R09: 0000000000000000 [ 364.548680][T13557] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 364.548693][T13557] R13: 0000000000000001 R14: 00007f22dd7b5fa0 R15: 00007ffc859fb8e8 [ 364.548727][T13557] [ 364.804155][ T5140] Bluetooth: hci1: command tx timeout [ 365.030129][T13568] xt_hashlimit: size too large, truncated to 1048576 [ 365.230998][T13575] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2406'. [ 365.251747][T13235] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 365.442424][T13408] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 365.486522][T13408] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 365.526159][T13408] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 365.589251][T13408] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 365.820968][T13235] veth0_vlan: entered promiscuous mode [ 365.917354][T13235] veth1_vlan: entered promiscuous mode [ 366.164565][T13408] 8021q: adding VLAN 0 to HW filter on device bond0 [ 366.191009][T13235] veth0_macvtap: entered promiscuous mode [ 366.252156][T13235] veth1_macvtap: entered promiscuous mode [ 366.301177][T13408] 8021q: adding VLAN 0 to HW filter on device team0 [ 366.335729][T12595] bridge0: port 1(bridge_slave_0) entered blocking state [ 366.343012][T12595] bridge0: port 1(bridge_slave_0) entered forwarding state [ 366.413541][ T6020] bridge0: port 2(bridge_slave_1) entered blocking state [ 366.420766][ T6020] bridge0: port 2(bridge_slave_1) entered forwarding state [ 366.501474][T13235] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 366.570495][T13235] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 366.603892][T13608] netlink: 24 bytes leftover after parsing attributes in process `syz.5.2413'. [ 366.623785][T13608] tipc: Enabling of bearer rejected, failed to enable media [ 366.666757][T13613] netlink: 56 bytes leftover after parsing attributes in process `syz.6.2416'. [ 366.680271][T13235] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 366.703390][T13613] FAULT_INJECTION: forcing a failure. [ 366.703390][T13613] name failslab, interval 1, probability 0, space 0, times 0 [ 366.716650][T13235] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 366.723420][T13613] CPU: 1 UID: 0 PID: 13613 Comm: syz.6.2416 Not tainted 6.15.0-rc6-syzkaller-01204-gb8fa067c4a76 #0 PREEMPT(full) [ 366.723456][T13613] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 366.723472][T13613] Call Trace: [ 366.723481][T13613] [ 366.723493][T13613] dump_stack_lvl+0x189/0x250 [ 366.723538][T13613] ? __pfx_dump_stack_lvl+0x10/0x10 [ 366.723582][T13613] ? __pfx__printk+0x10/0x10 [ 366.723613][T13613] ? __pfx___might_resched+0x10/0x10 [ 366.723637][T13613] ? fs_reclaim_acquire+0x7d/0x100 [ 366.723679][T13613] should_fail_ex+0x414/0x560 [ 366.723712][T13613] should_failslab+0xa8/0x100 [ 366.723748][T13613] kmem_cache_alloc_node_noprof+0x76/0x3c0 [ 366.723782][T13613] ? __alloc_skb+0x112/0x2d0 [ 366.723820][T13613] __alloc_skb+0x112/0x2d0 [ 366.723858][T13613] netlink_ack+0x146/0xa50 [ 366.723887][T13613] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 366.723923][T13613] ? ref_tracker_free+0x63a/0x7d0 [ 366.723948][T13613] ? __copy_skb_header+0xa7/0x550 [ 366.723995][T13613] netlink_rcv_skb+0x2a0/0x490 [ 366.724029][T13613] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 366.724060][T13613] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 366.724117][T13613] ? netlink_deliver_tap+0x2e/0x1b0 [ 366.724149][T13613] ? netlink_deliver_tap+0x2e/0x1b0 [ 366.724188][T13613] netlink_unicast+0x758/0x8d0 [ 366.724230][T13613] netlink_sendmsg+0x805/0xb30 [ 366.724276][T13613] ? __pfx_netlink_sendmsg+0x10/0x10 [ 366.724314][T13613] ? aa_sock_msg_perm+0x94/0x160 [ 366.724344][T13613] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 366.724372][T13613] ? __pfx_netlink_sendmsg+0x10/0x10 [ 366.724407][T13613] __sock_sendmsg+0x219/0x270 [ 366.724437][T13613] ____sys_sendmsg+0x505/0x830 [ 366.724479][T13613] ? __pfx_____sys_sendmsg+0x10/0x10 [ 366.724526][T13613] ? import_iovec+0x74/0xa0 [ 366.724573][T13613] ___sys_sendmsg+0x21f/0x2a0 [ 366.724611][T13613] ? __pfx____sys_sendmsg+0x10/0x10 [ 366.724690][T13613] ? __fget_files+0x2a/0x420 [ 366.724722][T13613] ? __fget_files+0x3a0/0x420 [ 366.724767][T13613] __x64_sys_sendmsg+0x19b/0x260 [ 366.724805][T13613] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 366.724860][T13613] ? do_syscall_64+0xba/0x210 [ 366.724894][T13613] do_syscall_64+0xf6/0x210 [ 366.724922][T13613] ? clear_bhb_loop+0x60/0xb0 [ 366.724952][T13613] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 366.724976][T13613] RIP: 0033:0x7f22dd58e969 [ 366.724998][T13613] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 366.725017][T13613] RSP: 002b:00007f22db3f6038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 366.725044][T13613] RAX: ffffffffffffffda RBX: 00007f22dd7b5fa0 RCX: 00007f22dd58e969 [ 366.725061][T13613] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 0000000000000003 [ 366.725075][T13613] RBP: 00007f22db3f6090 R08: 0000000000000000 R09: 0000000000000000 [ 366.725090][T13613] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 366.725108][T13613] R13: 0000000000000000 R14: 00007f22dd7b5fa0 R15: 00007ffc859fb8e8 [ 366.725145][T13613] [ 367.035887][T13235] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 367.050715][T13235] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 367.129291][T13621] xt_hashlimit: size too large, truncated to 1048576 [ 367.451668][ T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 367.485199][ T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 367.608865][ T6020] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 367.637965][ T6020] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 367.722089][T13630] lo speed is unknown, defaulting to 1000 [ 367.728137][T13635] netlink: 132 bytes leftover after parsing attributes in process `syz.4.2419'. [ 367.740125][T13635] ªªªªªª: renamed from lo [ 368.128403][T13408] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 368.387957][T10872] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 368.517939][T10872] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 368.598367][T13408] veth0_vlan: entered promiscuous mode [ 368.615722][T13408] veth1_vlan: entered promiscuous mode [ 368.654980][T13408] veth0_macvtap: entered promiscuous mode [ 368.672817][T13408] veth1_macvtap: entered promiscuous mode [ 368.707982][T10872] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 368.740070][T13408] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 368.779416][T10872] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 368.801267][T13408] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 368.817391][T13408] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 368.827000][T13408] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 368.835854][T13408] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 368.844704][T13408] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 369.055308][T12596] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 369.064496][T12596] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 369.194206][ T6020] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 369.202100][ T6020] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 369.270956][T10872] bridge_slave_1: left allmulticast mode [ 369.277411][T10872] bridge_slave_1: left promiscuous mode [ 369.313376][T13657] netlink: 'syz.6.2427': attribute type 8 has an invalid length. [ 369.323860][T10872] bridge0: port 2(bridge_slave_1) entered disabled state [ 369.353306][T13657] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2427'. [ 369.394771][T10872] bridge_slave_0: left allmulticast mode [ 369.400509][T10872] bridge_slave_0: left promiscuous mode [ 369.423718][T10872] bridge0: port 1(bridge_slave_0) entered disabled state [ 369.479032][T13663] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2428'. [ 369.897081][ T5840] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 369.909549][ T5840] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 369.918711][ T5840] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 369.934886][ T5840] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 369.944742][ T5840] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 370.260417][T10872] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 370.272679][T10872] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 370.289689][T10872] bond0 (unregistering): Released all slaves [ 370.476040][T13663] bridge_slave_1: left allmulticast mode [ 370.481808][T13663] bridge_slave_1: left promiscuous mode [ 370.491344][T13663] bridge0: port 2(bridge_slave_1) entered disabled state [ 370.520203][T13663] bridge_slave_0: left allmulticast mode [ 370.526158][T13663] bridge_slave_0: left promiscuous mode [ 370.540239][T13663] bridge0: port 1(bridge_slave_0) entered disabled state [ 370.980770][T13684] xt_hashlimit: size too large, truncated to 1048576 [ 371.238328][T13673] lo speed is unknown, defaulting to 1000 [ 371.484336][T10872] hsr_slave_0: left promiscuous mode [ 371.494424][T10872] hsr_slave_1: left promiscuous mode [ 371.500833][T10872] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 371.543405][T10872] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 371.568290][T10872] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 371.593490][T10872] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 371.646495][T10872] veth1_macvtap: left promiscuous mode [ 371.655621][T10872] veth0_macvtap: left promiscuous mode [ 371.661304][T10872] veth1_vlan: left promiscuous mode [ 371.667967][T10872] veth0_vlan: left promiscuous mode [ 372.003916][ T5140] Bluetooth: hci3: command tx timeout [ 372.279686][T10872] team0 (unregistering): Port device team_slave_1 removed [ 372.347260][T10872] team0 (unregistering): Port device team_slave_0 removed [ 372.998929][T13705] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2438'. [ 373.197111][ T5840] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 373.213504][ T5840] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 373.223552][ T5840] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 373.251344][ T5840] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 373.265298][ T5840] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 373.392701][T13699] 8021q: adding VLAN 0 to HW filter on device bond24 [ 373.404649][T13699] team0: Port device bond24 added [ 373.410695][T13701] netlink: 24 bytes leftover after parsing attributes in process `syz.6.2438'. [ 373.421150][T13701] tipc: Enabling of bearer rejected, failed to enable media [ 373.442131][T13702] bond_slave_0: entered promiscuous mode [ 373.448011][T13702] bond_slave_1: entered promiscuous mode [ 373.484549][T13702] vlan2: entered promiscuous mode [ 373.494557][T13702] bond0: entered promiscuous mode [ 373.540704][T13710] x_tables: duplicate underflow at hook 2 [ 373.851239][T13717] 8021q: adding VLAN 0 to HW filter on device bond8 [ 373.882340][T13717] team0: Port device bond8 added [ 373.919296][T13725] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2445'. [ 373.953332][T13706] lo speed is unknown, defaulting to 1000 [ 374.086223][ T5840] Bluetooth: hci3: command tx timeout [ 374.444701][T13731] bond0 (unregistering): Released all slaves [ 374.783680][T13752] tipc: New replicast peer: 255.255.255.255 [ 374.791764][T13752] tipc: Enabled bearer , priority 10 [ 375.025888][T13673] chnl_net:caif_netlink_parms(): no params data found [ 375.094773][T13763] xt_hashlimit: size too large, truncated to 1048576 [ 375.136829][T13761] vlan2: entered promiscuous mode [ 375.295402][T13767] FAULT_INJECTION: forcing a failure. [ 375.295402][T13767] name failslab, interval 1, probability 0, space 0, times 0 [ 375.310963][T13767] CPU: 1 UID: 0 PID: 13767 Comm: syz.4.2457 Not tainted 6.15.0-rc6-syzkaller-01204-gb8fa067c4a76 #0 PREEMPT(full) [ 375.310995][T13767] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 375.311008][T13767] Call Trace: [ 375.311017][T13767] [ 375.311027][T13767] dump_stack_lvl+0x189/0x250 [ 375.311069][T13767] ? __pfx_dump_stack_lvl+0x10/0x10 [ 375.311101][T13767] ? __pfx__printk+0x10/0x10 [ 375.311131][T13767] ? ref_tracker_alloc+0x318/0x460 [ 375.311160][T13767] should_fail_ex+0x414/0x560 [ 375.311189][T13767] should_failslab+0xa8/0x100 [ 375.311223][T13767] kmem_cache_alloc_noprof+0x73/0x3c0 [ 375.311251][T13767] ? skb_clone+0x212/0x3a0 [ 375.311277][T13767] skb_clone+0x212/0x3a0 [ 375.311301][T13767] __netlink_deliver_tap+0x404/0x850 [ 375.311346][T13767] ? netlink_deliver_tap+0x2e/0x1b0 [ 375.311378][T13767] netlink_deliver_tap+0x19c/0x1b0 [ 375.311410][T13767] netlink_unicast+0x72f/0x8d0 [ 375.311451][T13767] netlink_sendmsg+0x805/0xb30 [ 375.311493][T13767] ? __pfx_netlink_sendmsg+0x10/0x10 [ 375.311528][T13767] ? aa_sock_msg_perm+0x94/0x160 [ 375.311556][T13767] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 375.311582][T13767] ? __pfx_netlink_sendmsg+0x10/0x10 [ 375.311614][T13767] __sock_sendmsg+0x219/0x270 [ 375.311642][T13767] ____sys_sendmsg+0x505/0x830 [ 375.311681][T13767] ? __pfx_____sys_sendmsg+0x10/0x10 [ 375.311725][T13767] ? import_iovec+0x74/0xa0 [ 375.311762][T13767] ___sys_sendmsg+0x21f/0x2a0 [ 375.311797][T13767] ? __pfx____sys_sendmsg+0x10/0x10 [ 375.311874][T13767] ? __fget_files+0x2a/0x420 [ 375.311904][T13767] ? __fget_files+0x3a0/0x420 [ 375.311978][T13767] __x64_sys_sendmsg+0x19b/0x260 [ 375.312013][T13767] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 375.312066][T13767] ? do_syscall_64+0xba/0x210 [ 375.312096][T13767] do_syscall_64+0xf6/0x210 [ 375.312122][T13767] ? clear_bhb_loop+0x60/0xb0 [ 375.312150][T13767] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 375.312170][T13767] RIP: 0033:0x7f89c0b8e969 [ 375.312189][T13767] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 375.312207][T13767] RSP: 002b:00007f89c1ad8038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 375.312228][T13767] RAX: ffffffffffffffda RBX: 00007f89c0db5fa0 RCX: 00007f89c0b8e969 [ 375.312243][T13767] RDX: 0000000000000000 RSI: 0000200000000580 RDI: 0000000000000003 [ 375.312255][T13767] RBP: 00007f89c1ad8090 R08: 0000000000000000 R09: 0000000000000000 [ 375.312267][T13767] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 375.312277][T13767] R13: 0000000000000000 R14: 00007f89c0db5fa0 R15: 00007fff475c2fd8 [ 375.312307][T13767] [ 375.579349][ T5840] Bluetooth: hci1: command tx timeout [ 375.829813][T13780] netlink: 26 bytes leftover after parsing attributes in process `syz.4.2461'. [ 375.845741][T13780] netlink: 148 bytes leftover after parsing attributes in process `syz.4.2461'. [ 375.907108][T13783] x_tables: duplicate underflow at hook 2 [ 375.916537][T10872] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 375.997647][T13774] 8021q: adding VLAN 0 to HW filter on device bond9 [ 376.009832][T13774] team0: Port device bond9 added [ 376.059127][T13673] bridge0: port 1(bridge_slave_0) entered blocking state [ 376.078104][T13673] bridge0: port 1(bridge_slave_0) entered disabled state [ 376.094019][T13673] bridge_slave_0: entered allmulticast mode [ 376.105728][T13673] bridge_slave_0: entered promiscuous mode [ 376.114637][T13786] netlink: 'syz.4.2462': attribute type 5 has an invalid length. [ 376.146719][T10872] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 376.164293][ T5840] Bluetooth: hci3: command tx timeout [ 376.177052][T13788] ªªªªªª: left allmulticast mode [ 376.295624][T13790] 8021q: adding VLAN 0 to HW filter on device bond10 [ 376.316650][T13790] team0: Port device bond10 added [ 376.322488][T13673] bridge0: port 2(bridge_slave_1) entered blocking state [ 376.330971][T13673] bridge0: port 2(bridge_slave_1) entered disabled state [ 376.338733][T13673] bridge_slave_1: entered allmulticast mode [ 376.355292][T13673] bridge_slave_1: entered promiscuous mode [ 376.500793][T10872] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 376.591417][T13706] chnl_net:caif_netlink_parms(): no params data found [ 376.636321][T13673] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 376.871727][T10872] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 376.909374][T13808] netlink: 'syz.4.2468': attribute type 8 has an invalid length. [ 376.932496][T13808] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2468'. [ 376.946367][T13673] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 377.264203][T13819] xt_hashlimit: size too large, truncated to 1048576 [ 377.307185][T13673] team0: Port device team_slave_0 added [ 377.358482][T13673] team0: Port device team_slave_1 added [ 377.454907][T13706] bridge0: port 1(bridge_slave_0) entered blocking state [ 377.462220][T13706] bridge0: port 1(bridge_slave_0) entered disabled state [ 377.483599][T13706] bridge_slave_0: entered allmulticast mode [ 377.513929][T13706] bridge_slave_0: entered promiscuous mode [ 377.550362][T13825] xt_hashlimit: size too large, truncated to 1048576 [ 377.599425][T13706] bridge0: port 2(bridge_slave_1) entered blocking state [ 377.605029][ T5840] Bluetooth: hci1: command tx timeout [ 377.615040][T13706] bridge0: port 2(bridge_slave_1) entered disabled state [ 377.626386][T13706] bridge_slave_1: entered allmulticast mode [ 377.635649][T13706] bridge_slave_1: entered promiscuous mode [ 377.790373][T13673] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 377.803098][T13673] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 377.872214][T13673] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 377.987971][T13673] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 378.033486][T13673] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 378.082144][T13673] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 378.131918][T13706] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 378.167233][T13706] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 378.245279][ T5840] Bluetooth: hci3: command tx timeout [ 378.318945][T10872] bridge_slave_1: left allmulticast mode [ 378.348776][T10872] bridge_slave_1: left promiscuous mode [ 378.367432][T10872] bridge0: port 2(bridge_slave_1) entered disabled state [ 378.403034][T10872] bridge_slave_0: left allmulticast mode [ 378.413424][T10872] bridge_slave_0: left promiscuous mode [ 378.419297][T10872] bridge0: port 1(bridge_slave_0) entered disabled state [ 378.609135][T13848] netlink: 'syz.5.2480': attribute type 1 has an invalid length. [ 378.980768][T10872] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 378.992927][T10872] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 379.004935][T10872] bond0 (unregistering): Released all slaves [ 379.081278][T13706] team0: Port device team_slave_0 added [ 379.102820][T13706] team0: Port device team_slave_1 added [ 379.221658][T13843] 8021q: adding VLAN 0 to HW filter on device bond0 [ 379.246160][T13843] team0: Port device bond0 added [ 379.320927][T13848] 8021q: adding VLAN 0 to HW filter on device bond9 [ 379.364869][T13849] veth3: entered promiscuous mode [ 379.404387][T13849] bond9: (slave veth3): Enslaving as an active interface with a down link [ 379.426880][T13850] erspan0: entered allmulticast mode [ 379.469908][T13850] bond9: (slave erspan0): making interface the new active one [ 379.484476][T13850] erspan0: entered promiscuous mode [ 379.490201][T13850] bond9: (slave erspan0): Enslaving as an active interface with an up link [ 379.684255][ T5840] Bluetooth: hci1: command tx timeout [ 379.818270][T13872] xt_hashlimit: size too large, truncated to 1048576 [ 379.827994][T13706] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 379.852292][T13706] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 379.901169][T13706] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 379.921452][T13673] hsr_slave_0: entered promiscuous mode [ 379.930502][T13673] hsr_slave_1: entered promiscuous mode [ 379.937494][T13673] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 379.946622][T13673] Cannot create hsr debugfs directory [ 380.059472][T13878] xt_hashlimit: size too large, truncated to 1048576 [ 380.091066][T13706] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 380.117108][T13706] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 380.166434][T13881] FAULT_INJECTION: forcing a failure. [ 380.166434][T13881] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 380.186633][T13706] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 380.203000][T13881] CPU: 1 UID: 0 PID: 13881 Comm: syz.6.2488 Not tainted 6.15.0-rc6-syzkaller-01204-gb8fa067c4a76 #0 PREEMPT(full) [ 380.203035][T13881] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 380.203049][T13881] Call Trace: [ 380.203059][T13881] [ 380.203069][T13881] dump_stack_lvl+0x189/0x250 [ 380.203106][T13881] ? __lock_acquire+0xaac/0xd20 [ 380.203143][T13881] ? __pfx_dump_stack_lvl+0x10/0x10 [ 380.203175][T13881] ? __pfx__printk+0x10/0x10 [ 380.203195][T13881] ? __might_fault+0xb0/0x130 [ 380.203236][T13881] should_fail_ex+0x414/0x560 [ 380.203267][T13881] _copy_from_iter+0x1db/0x15a0 [ 380.203306][T13881] ? policy_nodemask+0x27c/0x720 [ 380.203334][T13881] ? __pfx__copy_from_iter+0x10/0x10 [ 380.203370][T13881] ? set_page_refcounted+0xa0/0x1e0 [ 380.203400][T13881] ? page_copy_sane+0x4e/0x280 [ 380.203429][T13881] copy_page_from_iter+0x7b/0x100 [ 380.203460][T13881] tun_get_user+0x1b13/0x3c20 [ 380.203498][T13881] ? tun_get_user+0x687/0x3c20 [ 380.203545][T13881] ? __pfx_tun_get_user+0x10/0x10 [ 380.203576][T13881] ? aa_file_perm+0x11f/0xed0 [ 380.203615][T13881] ? aa_file_perm+0x3e7/0xed0 [ 380.203657][T13881] ? ref_tracker_alloc+0x318/0x460 [ 380.203685][T13881] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 380.203717][T13881] ? tun_get+0x1c/0x2f0 [ 380.203755][T13881] ? tun_get+0x1c/0x2f0 [ 380.203786][T13881] ? tun_get+0x1c/0x2f0 [ 380.203824][T13881] tun_chr_write_iter+0x113/0x200 [ 380.203860][T13881] vfs_write+0x548/0xa90 [ 380.203892][T13881] ? __pfx_tun_chr_write_iter+0x10/0x10 [ 380.203924][T13881] ? __pfx_vfs_write+0x10/0x10 [ 380.203962][T13881] ? __fget_files+0x2a/0x420 [ 380.204003][T13881] ksys_write+0x145/0x250 [ 380.204028][T13881] ? rcu_is_watching+0x15/0xb0 [ 380.204051][T13881] ? __pfx_ksys_write+0x10/0x10 [ 380.204082][T13881] ? do_syscall_64+0xba/0x210 [ 380.204113][T13881] do_syscall_64+0xf6/0x210 [ 380.204140][T13881] ? clear_bhb_loop+0x60/0xb0 [ 380.204167][T13881] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 380.204188][T13881] RIP: 0033:0x7f22dd58d41f [ 380.204209][T13881] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48 [ 380.204229][T13881] RSP: 002b:00007f22db3d5000 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 380.204252][T13881] RAX: ffffffffffffffda RBX: 00007f22dd7b6080 RCX: 00007f22dd58d41f [ 380.204268][T13881] RDX: 000000000000009a RSI: 0000200000000080 RDI: 00000000000000c8 [ 380.204282][T13881] RBP: 00007f22db3d5090 R08: 0000000000000000 R09: 0000000000000000 [ 380.204294][T13881] R10: 000000000000009a R11: 0000000000000293 R12: 0000000000000001 [ 380.204306][T13881] R13: 0000000000000000 R14: 00007f22dd7b6080 R15: 00007ffc859fb8e8 [ 380.204340][T13881] [ 380.824688][T13891] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2492'. [ 380.872660][T13706] hsr_slave_0: entered promiscuous mode [ 380.912298][T13706] hsr_slave_1: entered promiscuous mode [ 380.919449][T13706] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 380.943340][T13706] Cannot create hsr debugfs directory [ 381.005236][T10872] hsr_slave_0: left promiscuous mode [ 381.025542][T10872] hsr_slave_1: left promiscuous mode [ 381.032371][T10872] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 381.052963][T10872] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 381.093001][T10872] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 381.114585][T10872] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 381.202537][T10872] veth1_macvtap: left promiscuous mode [ 381.232529][T10872] veth0_macvtap: left promiscuous mode [ 381.248527][T10872] veth1_vlan: left promiscuous mode [ 381.265352][T10872] veth0_vlan: left promiscuous mode [ 381.368537][T13906] netlink: 60 bytes leftover after parsing attributes in process `syz.5.2497'. [ 381.403074][T13906] unsupported nlmsg_type 40 [ 381.766131][ T5840] Bluetooth: hci1: command tx timeout [ 381.917108][T12594] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 382.102694][T10872] team0 (unregistering): Port device team_slave_1 removed [ 382.158077][T10872] team0 (unregistering): Port device team_slave_0 removed [ 382.740985][T13897] syzkaller1: entered promiscuous mode [ 382.747016][T13897] syzkaller1: entered allmulticast mode [ 382.764780][T13913] (unnamed net_device) (uninitialized): option lacp_rate: invalid value (16) [ 383.292370][ T5885] IPVS: starting estimator thread 0... [ 383.298361][T13924] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 383.384015][T13926] IPVS: using max 34 ests per chain, 81600 per kthread [ 383.500692][T13921] lo speed is unknown, defaulting to 1000 [ 384.525780][T13706] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 384.552353][T13706] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 384.565458][T13706] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 384.580099][T13706] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 384.641890][T13960] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2516'. [ 384.954053][T13966] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2518'. [ 385.006397][T13673] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 385.047933][T13673] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 385.118314][T13673] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 385.158476][T13673] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 385.542192][T13980] syzkaller0: entered promiscuous mode [ 385.549800][T13980] syzkaller0: entered allmulticast mode [ 385.636313][T13706] 8021q: adding VLAN 0 to HW filter on device bond0 [ 385.683475][T13706] 8021q: adding VLAN 0 to HW filter on device team0 [ 385.743729][T12596] bridge0: port 1(bridge_slave_0) entered blocking state [ 385.750990][T12596] bridge0: port 1(bridge_slave_0) entered forwarding state [ 385.825191][T13998] netlink: 104 bytes leftover after parsing attributes in process `syz.4.2527'. [ 385.877648][T13995] 8021q: adding VLAN 0 to HW filter on device bond10 [ 385.915243][T13995] team0: Port device bond10 added [ 385.936289][T12596] bridge0: port 2(bridge_slave_1) entered blocking state [ 385.943614][T12596] bridge0: port 2(bridge_slave_1) entered forwarding state [ 386.041020][T14003] netlink: 'syz.5.2529': attribute type 10 has an invalid length. [ 386.049581][T14003] netlink: 40 bytes leftover after parsing attributes in process `syz.5.2529'. [ 386.138899][T14003] team0: Port device geneve0 added [ 389.050190][T13673] 8021q: adding VLAN 0 to HW filter on device bond0 [ 389.205922][T13673] 8021q: adding VLAN 0 to HW filter on device team0 [ 389.267538][T12597] bridge0: port 1(bridge_slave_0) entered blocking state [ 389.274806][T12597] bridge0: port 1(bridge_slave_0) entered forwarding state [ 389.326640][T12597] bridge0: port 2(bridge_slave_1) entered blocking state [ 389.333916][T12597] bridge0: port 2(bridge_slave_1) entered forwarding state [ 389.547774][T14033] netlink: 'syz.5.2539': attribute type 8 has an invalid length. [ 389.588475][T14033] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2539'. [ 389.621171][T14034] 8021q: adding VLAN 0 to HW filter on device bond25 [ 389.632699][T14034] team0: Port device bond25 added [ 390.012474][T13706] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 390.034413][T14052] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2543'. [ 390.043863][T14052] tipc: Bearer : already 2 bearers with priority 10 [ 390.051469][T14052] tipc: Bearer : trying with adjusted priority [ 390.061802][T14052] tipc: Enabling of bearer rejected, failed to enable media [ 390.077420][T13673] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 390.091411][T14052] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2543'. [ 390.256706][T13673] veth0_vlan: entered promiscuous mode [ 390.282712][T13706] veth0_vlan: entered promiscuous mode [ 390.334186][T13706] veth1_vlan: entered promiscuous mode [ 390.356763][T13673] veth1_vlan: entered promiscuous mode [ 390.475502][T13706] veth0_macvtap: entered promiscuous mode [ 390.509960][T13673] veth0_macvtap: entered promiscuous mode [ 390.521261][T13706] veth1_macvtap: entered promiscuous mode [ 390.560998][T13673] veth1_macvtap: entered promiscuous mode [ 390.605028][T13706] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 390.626388][T13706] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 390.657513][T13706] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 390.667980][T13706] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 390.679090][T13706] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 390.688716][T13706] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 390.726034][T13673] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 390.749585][T14066] netlink: 12 bytes leftover after parsing attributes in process `syz.6.2550'. [ 390.779976][T13673] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 390.888050][T13673] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 390.923941][T13673] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 390.948740][T13673] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 390.958962][T13673] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 391.017306][T14077] xt_addrtype: output interface limitation not valid in PREROUTING and INPUT [ 391.086668][T12597] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 391.111519][T12597] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 391.226557][ T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 391.244624][ T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 391.349393][T12595] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 391.382155][T14082] xt_hashlimit: size too large, truncated to 1048576 [ 391.396600][T12595] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 391.491560][T14084] ip6tnl1: entered promiscuous mode [ 391.506320][T14085] af_packet: tpacket_rcv: packet too big, clamped from 140 to 4294967272. macoff=96 [ 391.561260][T14084] ip6tnl1: entered allmulticast mode [ 391.594827][T14090] netlink: 16 bytes leftover after parsing attributes in process `syz.5.2556'. [ 391.666530][T12597] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 391.675010][T12597] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 391.724807][T12594] erspan0: left promiscuous mode [ 391.914970][T12597] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 392.145612][T12597] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 392.409113][T12597] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 392.565334][T12597] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 392.612431][T14096] vlan2: entered promiscuous mode [ 392.924893][T12597] bridge_slave_1: left allmulticast mode [ 392.930638][T12597] bridge_slave_1: left promiscuous mode [ 392.943810][T12597] bridge0: port 2(bridge_slave_1) entered disabled state [ 392.957664][T12597] bridge_slave_0: left allmulticast mode [ 392.983393][T12597] bridge_slave_0: left promiscuous mode [ 392.989234][T12597] bridge0: port 1(bridge_slave_0) entered disabled state [ 393.007073][ T5140] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 393.018024][ T5140] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 393.028178][ T5140] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 393.052227][ T5140] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 393.063108][ T5140] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 393.751970][ T5140] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 393.765296][ T5140] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 393.774776][ T5140] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 393.794878][ T5140] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 393.816559][ T5140] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 393.866879][T12597] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 393.880253][T12597] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 393.892675][T12597] bond0 (unregistering): Released all slaves [ 394.025957][T14100] lo speed is unknown, defaulting to 1000 [ 394.187640][T14118] lo speed is unknown, defaulting to 1000 [ 394.336037][T14126] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2565'. [ 394.461180][T14124] 8021q: adding VLAN 0 to HW filter on device bond26 [ 394.486431][T14124] team0: Port device bond26 added [ 394.979800][T14145] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2568'. [ 394.992485][T14139] netlink: 24 bytes leftover after parsing attributes in process `syz.6.2568'. [ 395.002083][T14139] tipc: Enabling of bearer rejected, failed to enable media [ 395.081468][T12597] hsr_slave_0: left promiscuous mode [ 395.124276][ T5140] Bluetooth: hci1: command tx timeout [ 395.125606][T12597] hsr_slave_1: left promiscuous mode [ 395.157286][T12597] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 395.179906][T12597] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 395.246028][T12597] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 395.276178][T12597] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 395.349855][T14158] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2573'. [ 395.370371][T12597] veth1_macvtap: left promiscuous mode [ 395.385301][T12597] veth0_macvtap: left promiscuous mode [ 395.391481][T12597] veth1_vlan: left promiscuous mode [ 395.399770][T12597] veth0_vlan: left promiscuous mode [ 395.682438][T14164] netlink: 20 bytes leftover after parsing attributes in process `syz.5.2576'. [ 395.699355][T14164] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 395.768080][T14165] netlink: 56 bytes leftover after parsing attributes in process `syz.5.2576'. [ 395.938218][ T5140] Bluetooth: hci3: command tx timeout [ 396.169963][ T5140] Bluetooth: hci5: command 0x0406 tx timeout [ 396.241813][T12597] team0 (unregistering): Port device team_slave_1 removed [ 396.302611][T12597] team0 (unregistering): Port device team_slave_0 removed [ 396.913498][T14152] netlink: 24 bytes leftover after parsing attributes in process `syz.6.2573'. [ 396.922710][T14152] tipc: Enabling of bearer rejected, failed to enable media [ 397.203441][ T5840] Bluetooth: hci1: command tx timeout [ 397.367328][T14174] 8021q: adding VLAN 0 to HW filter on device bond11 [ 397.377645][T14174] team0: Port device bond11 added [ 397.389683][T14118] chnl_net:caif_netlink_parms(): no params data found [ 397.457180][T14100] chnl_net:caif_netlink_parms(): no params data found [ 397.956264][T14118] bridge0: port 1(bridge_slave_0) entered blocking state [ 397.967079][T14118] bridge0: port 1(bridge_slave_0) entered disabled state [ 397.976907][T14118] bridge_slave_0: entered allmulticast mode [ 397.984992][T14118] bridge_slave_0: entered promiscuous mode [ 397.994540][T14100] bridge0: port 1(bridge_slave_0) entered blocking state [ 398.003770][ T5840] Bluetooth: hci3: command tx timeout [ 398.005628][T14100] bridge0: port 1(bridge_slave_0) entered disabled state [ 398.016818][T14100] bridge_slave_0: entered allmulticast mode [ 398.029568][T14100] bridge_slave_0: entered promiscuous mode [ 398.047133][T14100] bridge0: port 2(bridge_slave_1) entered blocking state [ 398.063343][T14100] bridge0: port 2(bridge_slave_1) entered disabled state [ 398.073731][T14100] bridge_slave_1: entered allmulticast mode [ 398.105489][T14100] bridge_slave_1: entered promiscuous mode [ 398.122319][T14118] bridge0: port 2(bridge_slave_1) entered blocking state [ 398.133971][T14118] bridge0: port 2(bridge_slave_1) entered disabled state [ 398.173503][T14118] bridge_slave_1: entered allmulticast mode [ 398.185596][T14118] bridge_slave_1: entered promiscuous mode [ 398.298577][T14212] netlink: 16 bytes leftover after parsing attributes in process `syz.5.2588'. [ 398.420313][T14118] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 398.443990][T14100] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 398.462920][T14118] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 398.561887][T14100] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 398.591771][T14222] netlink: 'syz.6.2592': attribute type 8 has an invalid length. [ 398.600601][T14222] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2592'. [ 398.628804][T14224] xt_recent: hitcount (33554432) is larger than allowed maximum (65535) [ 398.657050][T14118] team0: Port device team_slave_0 added [ 398.822924][T14225] xt_CT: No such helper "pptp" [ 398.948256][T12597] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 399.012210][T14118] team0: Port device team_slave_1 added [ 399.060913][T14118] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 399.070074][T14118] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 399.097234][T14118] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 399.120878][T14100] team0: Port device team_slave_0 added [ 399.176760][T12597] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 399.208966][T14240] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2597'. [ 399.250825][T14100] team0: Port device team_slave_1 added [ 399.285587][ T5840] Bluetooth: hci1: command tx timeout [ 399.329524][T14118] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 399.370506][T14118] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 399.393944][T14246] xt_hashlimit: size too large, truncated to 1048576 [ 399.434290][T14118] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 399.466948][T14240] vlan2: entered promiscuous mode [ 399.718423][T12597] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 399.781571][T14100] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 399.793391][T14100] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 399.853079][T14100] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 399.959476][T12597] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 400.001972][T14100] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 400.015292][T14100] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 400.049345][T14100] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 400.083455][ T5840] Bluetooth: hci3: command tx timeout [ 400.385615][T14118] hsr_slave_0: entered promiscuous mode [ 400.393012][T14118] hsr_slave_1: entered promiscuous mode [ 400.418613][T14118] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 400.441128][T14118] Cannot create hsr debugfs directory [ 400.465333][T14271] xt_recent: hitcount (33554432) is larger than allowed maximum (65535) [ 400.618056][T14276] xt_CT: No such helper "pptp" [ 400.768017][T14100] hsr_slave_0: entered promiscuous mode [ 400.775665][T14100] hsr_slave_1: entered promiscuous mode [ 400.782409][T14100] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 400.815562][T14100] Cannot create hsr debugfs directory [ 401.373466][ T5840] Bluetooth: hci1: command tx timeout [ 401.435965][T12597] bridge_slave_1: left allmulticast mode [ 401.451941][T12597] bridge_slave_1: left promiscuous mode [ 401.461016][T14294] netlink: 'syz.6.2614': attribute type 8 has an invalid length. [ 401.480176][T12597] bridge0: port 2(bridge_slave_1) entered disabled state [ 401.492200][T14294] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2614'. [ 401.520281][T12597] bridge_slave_0: left allmulticast mode [ 401.535528][T12597] bridge_slave_0: left promiscuous mode [ 401.551735][T12597] bridge0: port 1(bridge_slave_0) entered disabled state [ 402.173916][ T5840] Bluetooth: hci3: command tx timeout [ 402.365546][T12597] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 402.407857][T12597] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 402.411781][T14296] No such timeout policy "syz0" [ 402.445891][T12597] bond0 (unregistering): Released all slaves [ 402.817987][T14307] xt_recent: hitcount (33554432) is larger than allowed maximum (65535) [ 402.845483][T14312] netlink: 36 bytes leftover after parsing attributes in process `syz.6.2619'. [ 403.118170][T14307] xt_CT: No such helper "pptp" [ 403.364019][T14326] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2621'. [ 403.515696][T14324] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2621'. [ 403.534619][T14324] tipc: Bearer : already 2 bearers with priority 10 [ 403.546231][T14324] tipc: Bearer : trying with adjusted priority [ 403.559598][T14324] tipc: Enabling of bearer rejected, failed to enable media [ 403.633865][T12597] hsr_slave_0: left promiscuous mode [ 403.654479][T12597] hsr_slave_1: left promiscuous mode [ 403.660758][T12597] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 403.683075][T12597] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 403.706545][T12597] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 403.714124][T12597] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 403.756264][T14333] IPVS: Scheduler module ip_vs_ not found [ 403.796214][T12597] veth1_macvtap: left promiscuous mode [ 403.801851][T12597] veth0_macvtap: left promiscuous mode [ 403.808059][T12597] veth1_vlan: left promiscuous mode [ 403.815410][T12597] veth0_vlan: left promiscuous mode [ 404.626167][T12597] team0 (unregistering): Port device team_slave_1 removed [ 404.676830][T12597] team0 (unregistering): Port device team_slave_0 removed [ 405.208138][T14330] netlink: 'syz.6.2623': attribute type 4 has an invalid length. [ 405.338309][T14349] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2627'. [ 405.847106][T14118] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 405.981629][T14118] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 406.028288][T14118] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 406.117566][T14375] netlink: 596 bytes leftover after parsing attributes in process `syz.6.2634'. [ 406.126751][T14118] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 406.144777][T14378] netlink: 45 bytes leftover after parsing attributes in process `syz.4.2635'. [ 406.144792][T14375] netlink: 596 bytes leftover after parsing attributes in process `syz.6.2634'. [ 406.176177][T14375] netlink: 596 bytes leftover after parsing attributes in process `syz.6.2634'. [ 406.187962][T14375] netlink: 596 bytes leftover after parsing attributes in process `syz.6.2634'. [ 406.200579][T14375] netlink: 596 bytes leftover after parsing attributes in process `syz.6.2634'. [ 406.419624][ T5840] Bluetooth: hci6: command 0x0406 tx timeout [ 406.615438][T14118] 8021q: adding VLAN 0 to HW filter on device bond0 [ 406.696540][T14100] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 406.738117][T14100] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 406.789587][T14118] 8021q: adding VLAN 0 to HW filter on device team0 [ 406.826124][T14100] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 406.867889][T14100] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 406.920414][T12595] bridge0: port 1(bridge_slave_0) entered blocking state [ 406.927692][T12595] bridge0: port 1(bridge_slave_0) entered forwarding state [ 406.988052][T14400] netlink: 'syz.5.2643': attribute type 1 has an invalid length. [ 407.024191][T12595] bridge0: port 2(bridge_slave_1) entered blocking state [ 407.031421][T12595] bridge0: port 2(bridge_slave_1) entered forwarding state [ 407.422252][T14100] 8021q: adding VLAN 0 to HW filter on device bond0 [ 407.519913][T14100] 8021q: adding VLAN 0 to HW filter on device team0 [ 407.564688][T10872] bridge0: port 1(bridge_slave_0) entered blocking state [ 407.571909][T10872] bridge0: port 1(bridge_slave_0) entered forwarding state [ 407.644527][T10872] bridge0: port 2(bridge_slave_1) entered blocking state [ 407.651769][T10872] bridge0: port 2(bridge_slave_1) entered forwarding state [ 407.714596][T14423] netlink: 'syz.4.2649': attribute type 5 has an invalid length. [ 407.891361][T14118] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 407.985392][T14433] SET target dimension over the limit! [ 408.047892][T14118] veth0_vlan: entered promiscuous mode [ 408.101331][T14441] __nla_validate_parse: 60 callbacks suppressed [ 408.101357][T14441] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2655'. [ 408.104135][T14118] veth1_vlan: entered promiscuous mode [ 408.302556][T14118] veth0_macvtap: entered promiscuous mode [ 408.339380][T14118] veth1_macvtap: entered promiscuous mode [ 408.444117][T14118] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 408.481080][T14118] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 408.568025][T14118] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 408.593203][T14118] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 408.601993][T14118] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 408.653353][T14118] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 408.910149][T14100] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 409.235444][ T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 409.251613][T14100] veth0_vlan: entered promiscuous mode [ 409.268674][ T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 409.342098][T14100] veth1_vlan: entered promiscuous mode [ 409.426877][T12595] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 409.448214][T12595] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 409.498468][T14100] veth0_macvtap: entered promiscuous mode [ 409.535155][T14100] veth1_macvtap: entered promiscuous mode [ 409.631224][T14100] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 409.669075][T14100] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 409.701028][T14100] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 409.729381][T14100] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 409.753286][T14100] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 409.762098][T14100] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 409.988797][T14489] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2669'. [ 410.154284][T14500] siw: device registration error -23 [ 410.360710][T12602] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 410.415661][ T3537] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 410.443605][ T3537] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 410.527759][T12602] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 410.637771][T12602] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 410.671936][T12594] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 410.689959][T12594] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 410.713647][T12602] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 410.932261][T12602] bridge_slave_1: left allmulticast mode [ 410.942253][T12602] bridge_slave_1: left promiscuous mode [ 410.965026][T12602] bridge0: port 2(bridge_slave_1) entered disabled state [ 410.976555][T12602] bridge_slave_0: left allmulticast mode [ 410.982272][T12602] bridge_slave_0: left promiscuous mode [ 410.997018][T12602] bridge0: port 1(bridge_slave_0) entered disabled state [ 411.337893][T14508] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2676'. [ 411.350703][T14508] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2676'. [ 411.766355][ T5840] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 411.775536][ T5840] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 411.784368][ T5840] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 411.794527][ T5840] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 411.804451][ T5840] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 411.816394][T12602] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 411.829816][T12602] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 411.843282][T12602] bond0 (unregistering): Released all slaves [ 412.447863][T14510] lo speed is unknown, defaulting to 1000 [ 412.480843][T14517] netlink: 'syz.4.2678': attribute type 8 has an invalid length. [ 412.533241][T14517] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2678'. [ 412.654502][ T31] INFO: task syz.0.1860:11704 blocked for more than 143 seconds. [ 412.662314][ T31] Not tainted 6.15.0-rc6-syzkaller-01204-gb8fa067c4a76 #0 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 412.711541][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 412.738120][ T31] task:syz.0.1860 state:D stack:27400 pid:11704 tgid:11703 ppid:5828 task_flags:0x400040 flags:0x00000004 [ 412.755465][ T31] Call Trace: [ 412.758816][ T31] [ 412.776761][ T31] __schedule+0x16e2/0x4cd0 [ 412.814367][ T31] ? __lock_acquire+0xaac/0xd20 [ 412.819326][ T31] ? schedule+0x165/0x360 [ 412.842537][ T31] ? __pfx___schedule+0x10/0x10 [ 412.847876][ T31] ? schedule+0x91/0x360 [ 412.852185][ T31] schedule+0x165/0x360 [ 412.923189][ T31] schedule_preempt_disabled+0x13/0x30 [ 412.928756][ T31] __mutex_lock+0x724/0xe80 [ 412.975949][ T31] ? __mutex_lock+0x51b/0xe80 [ 412.980732][ T31] ? nfsd_nl_version_get_doit+0x16e/0xb60 [ 413.018233][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 413.023680][ T31] ? __nlmsg_put+0xef/0x1b0 [ 413.028353][ T31] ? genlmsg_put+0x137/0x2e0 [ 413.032983][ T31] nfsd_nl_version_get_doit+0x16e/0xb60 [ 413.063259][ T31] ? __pfx_nfsd_nl_version_get_doit+0x10/0x10 [ 413.069424][ T31] ? __local_bh_enable_ip+0x12d/0x1c0 [ 413.083196][ T31] ? __pfx___local_bh_enable_ip+0x10/0x10 [ 413.089013][ T31] genl_family_rcv_msg_doit+0x215/0x300 [ 413.113197][ T31] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 413.119399][ T31] genl_rcv_msg+0x60e/0x790 [ 413.133266][ T31] ? __pfx_genl_rcv_msg+0x10/0x10 [ 413.138383][ T31] ? __pfx_nfsd_nl_version_get_doit+0x10/0x10 [ 413.163184][ T31] ? ref_tracker_free+0x63a/0x7d0 [ 413.168312][ T31] ? __copy_skb_header+0xa7/0x550 [ 413.183240][ T31] netlink_rcv_skb+0x21c/0x490 [ 413.188127][ T31] ? __pfx_genl_rcv_msg+0x10/0x10 [ 413.204821][ T31] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 413.210239][ T31] ? down_read+0x1ad/0x2e0 [ 413.233202][ T31] genl_rcv+0x28/0x40 [ 413.237277][ T31] netlink_unicast+0x758/0x8d0 [ 413.242095][ T31] netlink_sendmsg+0x805/0xb30 [ 413.263193][ T31] ? __pfx_netlink_sendmsg+0x10/0x10 [ 413.268598][ T31] ? aa_sock_msg_perm+0x94/0x160 [ 413.283178][ T31] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 413.288585][ T31] ? __pfx_netlink_sendmsg+0x10/0x10 [ 413.313257][ T31] __sock_sendmsg+0x219/0x270 [ 413.318037][ T31] ____sys_sendmsg+0x505/0x830 [ 413.322852][ T31] ? __pfx_____sys_sendmsg+0x10/0x10 [ 413.343206][ T31] ? import_iovec+0x74/0xa0 [ 413.347821][ T31] ___sys_sendmsg+0x21f/0x2a0 [ 413.363310][ T31] ? __pfx____sys_sendmsg+0x10/0x10 [ 413.368654][ T31] ? __fget_files+0x2a/0x420 [ 413.373468][ T31] ? __fget_files+0x3a0/0x420 [ 413.378211][ T31] __x64_sys_sendmsg+0x19b/0x260 [ 413.383286][ T31] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 413.388824][ T31] ? do_syscall_64+0xba/0x210 [ 413.393852][ T31] do_syscall_64+0xf6/0x210 [ 413.398406][ T31] ? clear_bhb_loop+0x60/0xb0 [ 413.403448][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 413.409522][ T31] RIP: 0033:0x7ff29638e969 [ 413.421709][ T31] RSP: 002b:00007ff2972d1038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 413.430588][ T31] RAX: ffffffffffffffda RBX: 00007ff2965b5fa0 RCX: 00007ff29638e969 [ 413.438980][ T31] RDX: 0000000000040000 RSI: 0000200000000540 RDI: 0000000000000003 [ 413.447880][ T31] RBP: 00007ff296410ab1 R08: 0000000000000000 R09: 0000000000000000 [ 413.469836][ T31] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 413.482762][ T31] R13: 0000000000000000 R14: 00007ff2965b5fa0 R15: 00007ffe58a967d8 [ 413.491460][ T31] [ 413.495002][ T31] [ 413.495002][ T31] Showing all locks held in the system: [ 413.502832][ T31] 1 lock held by khungtaskd/31: [ 413.508024][ T31] #0: ffffffff8df3dce0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 413.518117][ T31] 3 locks held by kworker/u8:2/36: [ 413.538539][ T31] #0: ffff88801a089148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x9b1/0x17a0 [ 413.550442][ T31] #1: ffffc90000ad7c60 ((linkwatch_work).work){+.+.}-{0:0}, at: process_scheduled_works+0x9ec/0x17a0 [ 413.562827][ T31] #2: ffffffff8f2f7c88 (rtnl_mutex){+.+.}-{4:4}, at: linkwatch_event+0xe/0x60 [ 413.572398][ T31] 3 locks held by kworker/u8:7/3537: [ 413.577809][ T31] #0: ffff88814d548148 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0x9b1/0x17a0 [ 413.589570][ T31] #1: ffffc9000bfafc60 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ec/0x17a0 [ 413.602606][ T31] #2: ffffffff8f2f7c88 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_dad_work+0x112/0x14b0 [ 413.612558][ T31] 2 locks held by getty/5591: [ 413.617353][ T31] #0: ffff888031c880a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 413.627434][ T31] #1: ffffc900033532f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x43e/0x1400 [ 413.637850][ T31] 2 locks held by syz.2.1781/11432: [ 413.643071][ T31] #0: ffffffff8f35dc30 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 413.651515][ T31] #1: ffffffff8e2139e8 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_nl_listener_set_doit+0x12a/0x1650 [ 413.674120][ T31] 2 locks held by syz.0.1860/11704: [ 413.679385][ T31] #0: ffffffff8f35dc30 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 413.700696][ T31] #1: ffffffff8e2139e8 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_nl_version_get_doit+0x16e/0xb60 [ 413.711215][ T31] 2 locks held by kworker/u8:21/12594: [ 413.717062][ T31] 4 locks held by kworker/u8:27/12602: [ 413.722555][ T31] #0: ffff88801aefe148 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x9b1/0x17a0 [ 413.733661][ T31] #1: ffffc90003ea7c60 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0x9ec/0x17a0 [ 413.744352][ T31] #2: ffffffff8f2eb0d0 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xf7/0x8a0 [ 413.761183][ T31] #3: ffffffff8f2f7c88 (rtnl_mutex){+.+.}-{4:4}, at: default_device_exit_batch+0xdc/0x890 [ 413.772326][ T31] 2 locks held by syz-executor/14510: [ 413.777952][ T31] #0: ffffffff8f2eb0d0 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x317/0x590 [ 413.788058][ T31] #1: ffffffff8f2f7c88 (rtnl_mutex){+.+.}-{4:4}, at: ip_tunnel_init_net+0x2ab/0x800 [ 413.797717][ T31] 1 lock held by syz.6.2680/14521: [ 413.802855][ T31] #0: ffffffff8f2faf08 (bpf_dispatcher_xdp.mutex){+.+.}-{4:4}, at: bpf_dispatcher_change_prog+0x9c/0xc90 [ 413.814436][ T31] 2 locks held by syz.6.2680/14523: [ 413.819671][ T31] #0: ffffffff8f2faf08 (bpf_dispatcher_xdp.mutex){+.+.}-{4:4}, at: bpf_dispatcher_change_prog+0x9c/0xc90 [ 413.831915][ T31] #1: ffffffff8df437b8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x3b7/0x730 [ 413.844045][ T5840] Bluetooth: hci1: command tx timeout [ 413.851756][ T31] [ 413.854444][ T31] ============================================= [ 413.854444][ T31] [ 413.867361][ T31] NMI backtrace for cpu 0 [ 413.867381][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted 6.15.0-rc6-syzkaller-01204-gb8fa067c4a76 #0 PREEMPT(full) [ 413.867403][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 413.867414][ T31] Call Trace: [ 413.867422][ T31] [ 413.867430][ T31] dump_stack_lvl+0x189/0x250 [ 413.867459][ T31] ? __wake_up_klogd+0xd9/0x110 [ 413.867484][ T31] ? __pfx_dump_stack_lvl+0x10/0x10 [ 413.867509][ T31] ? __pfx__printk+0x10/0x10 [ 413.867539][ T31] nmi_cpu_backtrace+0x39e/0x3d0 [ 413.867578][ T31] ? __pfx_nmi_cpu_backtrace+0x10/0x10 [ 413.867604][ T31] ? _printk+0xcf/0x120 [ 413.867626][ T31] ? __pfx__printk+0x10/0x10 [ 413.867648][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 413.867669][ T31] nmi_trigger_cpumask_backtrace+0x17a/0x300 [ 413.867699][ T31] watchdog+0xfee/0x1030 [ 413.867723][ T31] ? watchdog+0x1de/0x1030 [ 413.867753][ T31] kthread+0x711/0x8a0 [ 413.867777][ T31] ? __pfx_watchdog+0x10/0x10 [ 413.867799][ T31] ? __pfx_kthread+0x10/0x10 [ 413.867822][ T31] ? __pfx_kthread+0x10/0x10 [ 413.867842][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 413.867859][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 413.867879][ T31] ? __pfx_kthread+0x10/0x10 [ 413.867899][ T31] ret_from_fork+0x4b/0x80 [ 413.867917][ T31] ? __pfx_kthread+0x10/0x10 [ 413.867938][ T31] ret_from_fork_asm+0x1a/0x30 [ 413.867970][ T31] [ 413.867976][ T31] Sending NMI from CPU 0 to CPUs 1: [ 414.019479][ C1] NMI backtrace for cpu 1 [ 414.019498][ C1] CPU: 1 UID: 0 PID: 12596 Comm: kworker/u8:23 Not tainted 6.15.0-rc6-syzkaller-01204-gb8fa067c4a76 #0 PREEMPT(full) [ 414.019520][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 414.019532][ C1] Workqueue: bat_events batadv_nc_worker [ 414.019560][ C1] RIP: 0010:__lock_acquire+0x68c/0xd20 [ 414.019590][ C1] Code: 00 00 48 8b 3c 24 85 c0 0f 84 04 03 00 00 41 8b 47 20 a9 00 00 18 00 0f 84 c2 00 00 00 4c 89 fe ba 08 00 00 00 e8 a4 25 00 00 <45> 31 e4 85 c0 0f 84 57 04 00 00 83 3d c2 9c e3 17 00 75 13 48 63 [ 414.019605][ C1] RSP: 0018:ffffc900040679a0 EFLAGS: 00000006 [ 414.019620][ C1] RAX: 0000000000000001 RBX: 0000000000000002 RCX: ffffffff931f5c58 [ 414.019632][ C1] RDX: 0000000000000008 RSI: ffff888028a8e540 RDI: ffff888028a8da00 [ 414.019644][ C1] RBP: ffff888028a8e4f0 R08: 0000000000000000 R09: 0000000000000000 [ 414.019655][ C1] R10: 0000000000000000 R11: ffffffff8b261062 R12: 00000000ffffff05 [ 414.019666][ C1] R13: 0000000000000000 R14: ffff888028a8e560 R15: ffff888028a8e540 [ 414.019680][ C1] FS: 0000000000000000(0000) GS:ffff8881261b6000(0000) knlGS:0000000000000000 [ 414.019694][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 414.019706][ C1] CR2: 0000560b59ca3000 CR3: 000000003231a000 CR4: 00000000003526f0 [ 414.019722][ C1] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 414.019733][ C1] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 414.019745][ C1] Call Trace: [ 414.019752][ C1] [ 414.019764][ C1] ? batadv_nc_worker+0xd2/0x610 [ 414.019780][ C1] lock_acquire+0x120/0x360 [ 414.019805][ C1] ? batadv_nc_worker+0xd2/0x610 [ 414.019826][ C1] ? batadv_nc_worker+0xd2/0x610 [ 414.019842][ C1] ? batadv_nc_worker+0xd2/0x610 [ 414.019858][ C1] batadv_nc_worker+0xef/0x610 [ 414.019873][ C1] ? batadv_nc_worker+0xd2/0x610 [ 414.019890][ C1] ? process_scheduled_works+0x9ec/0x17a0 [ 414.019909][ C1] process_scheduled_works+0xade/0x17a0 [ 414.019941][ C1] ? __pfx_process_scheduled_works+0x10/0x10 [ 414.019968][ C1] worker_thread+0x8a0/0xda0 [ 414.019999][ C1] kthread+0x711/0x8a0 [ 414.020022][ C1] ? __pfx_worker_thread+0x10/0x10 [ 414.020040][ C1] ? __pfx_kthread+0x10/0x10 [ 414.020062][ C1] ? __pfx_kthread+0x10/0x10 [ 414.020083][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 414.020100][ C1] ? lockdep_hardirqs_on+0x9c/0x150 [ 414.020119][ C1] ? __pfx_kthread+0x10/0x10 [ 414.020140][ C1] ret_from_fork+0x4b/0x80 [ 414.020159][ C1] ? __pfx_kthread+0x10/0x10 [ 414.020180][ C1] ret_from_fork_asm+0x1a/0x30 [ 414.020206][ C1] [ 414.029478][ T31] Kernel panic - not syncing: hung_task: blocked tasks [ 414.029504][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted 6.15.0-rc6-syzkaller-01204-gb8fa067c4a76 #0 PREEMPT(full) [ 414.029530][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 414.029546][ T31] Call Trace: [ 414.029556][ T31] [ 414.029566][ T31] dump_stack_lvl+0x99/0x250 [ 414.029609][ T31] ? __asan_memcpy+0x40/0x70 [ 414.029637][ T31] ? __pfx_dump_stack_lvl+0x10/0x10 [ 414.029673][ T31] ? __pfx__printk+0x10/0x10 [ 414.029713][ T31] panic+0x2db/0x790 [ 414.029755][ T31] ? __pfx_panic+0x10/0x10 [ 414.029789][ T31] ? nmi_backtrace_stall_check+0x433/0x440 [ 414.029827][ T31] ? preempt_schedule_thunk+0x16/0x30 [ 414.029857][ T31] ? nmi_trigger_cpumask_backtrace+0x2b6/0x300 [ 414.029905][ T31] watchdog+0x102d/0x1030 [ 414.029941][ T31] ? watchdog+0x1de/0x1030 [ 414.029983][ T31] kthread+0x711/0x8a0 [ 414.030017][ T31] ? __pfx_watchdog+0x10/0x10 [ 414.030048][ T31] ? __pfx_kthread+0x10/0x10 [ 414.030080][ T31] ? __pfx_kthread+0x10/0x10 [ 414.030109][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 414.030134][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 414.030162][ T31] ? __pfx_kthread+0x10/0x10 [ 414.030191][ T31] ret_from_fork+0x4b/0x80 [ 414.030216][ T31] ? __pfx_kthread+0x10/0x10 [ 414.030246][ T31] ret_from_fork_asm+0x1a/0x30 [ 414.030296][ T31] [ 414.415589][ T31] Kernel Offset: disabled [ 414.419927][ T31] Rebooting in 86400 seconds..