last executing test programs: 4m38.138545614s ago: executing program 0 (id=603): syz_emit_ethernet(0x26, &(0x7f0000000040)=ANY=[@ANYRES32=0x0], 0x0) 4m37.936253515s ago: executing program 0 (id=606): bpf$ENABLE_STATS(0x20, 0x0, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000bc0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0xd, &(0x7f00000004c0)=ANY=[@ANYBLOB="18020000000000000000000000000000850000002000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000009800000095"], &(0x7f0000000680)='syzkaller\x00'}, 0x6b) (async) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0xd, &(0x7f00000004c0)=ANY=[@ANYBLOB="18020000000000000000000000000000850000002000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000009800000095"], &(0x7f0000000680)='syzkaller\x00'}, 0x6b) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r1, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x2f00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r2 = socket$inet_tcp(0x2, 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x10, 0x10, 0x2, [@var={0x4, 0x0, 0x0, 0xe, 0x3}]}}, 0x0, 0x2a}, 0x28) setsockopt$inet_tcp_int(r2, 0x6, 0x11, &(0x7f0000000240), 0x4) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) (async) mmap(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2}, {0x0, [0x0]}}, &(0x7f0000001f80)=""/226, 0x26, 0x81, 0x2}, 0x20) socket$nl_generic(0x10, 0x3, 0x10) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000000)={0x0, 0xfffffffffffffeb5, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="3000000040000701feffffff00000000047c0000040042801400018006000600800a000008001c00", @ANYRES32=r4], 0x30}, 0x1, 0x0, 0x0, 0x48015}, 0x4048010) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r4) socket$netlink(0x10, 0x3, 0x5) (async) socket$netlink(0x10, 0x3, 0x5) r6 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000300)={'virt_wifi0\x00'}) (async) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000300)={'virt_wifi0\x00', 0x0}) setsockopt$inet6_mreq(r6, 0x29, 0x1b, &(0x7f0000000000)={@remote, r7}, 0x14) (async) setsockopt$inet6_mreq(r6, 0x29, 0x1b, &(0x7f0000000000)={@remote, r7}, 0x14) sendmmsg$inet6(r6, &(0x7f0000000c40)=[{{&(0x7f0000000040)={0xa, 0x4e20, 0x4, @mcast2}, 0x1c, 0x0, 0x0, &(0x7f00000006c0)=[@pktinfo={{0x24, 0x29, 0x32, {@local, r7}}}], 0x28}}], 0x1, 0x44000) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010600000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff1b000000020000000900010073797a30000001000900038073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x25}, 0x0) sendmsg$NFT_BATCH(r8, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000001000010000000000000000000080000a3c000000120a010200000000000000000200000009000200737905000000000008000440000000000900010073797a3000000000080003400000000a"], 0x64}}, 0x0) (async) sendmsg$NFT_BATCH(r8, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000001000010000000000000000000080000a3c000000120a010200000000000000000200000009000200737905000000000008000440000000000900010073797a3000000000080003400000000a"], 0x64}}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f00000002c0)={'wlan1\x00', 0x0}) sendmsg$IPVS_CMD_SET_INFO(r4, &(0x7f0000000440)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000380)={&(0x7f0000000700)={0xb8, 0x0, 0x10, 0x70bd25, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_DAEMON={0x20, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x9}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @mcast2}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x9}, @IPVS_CMD_ATTR_SERVICE={0x44, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@dev={0xfe, 0x80, '\x00', 0x13}}, @IPVS_SVC_ATTR_AF={0x6, 0x1, 0xa}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_SCHED_NAME={0x7, 0x6, 'fo\x00'}, @IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x4}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x37, 0x1a}}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x4}, @IPVS_CMD_ATTR_SERVICE={0x20, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x2}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x1a, 0x18}}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x80000000}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0xfffffc00}]}, 0xb8}, 0x1, 0x0, 0x0, 0x8c0}, 0x40004) sendmsg$NL80211_CMD_SET_MPATH(r4, &(0x7f0000000200)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000300)={0x70, r5, 0x8, 0x70bd25, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r9}, @val={0xc, 0x99, {0xfffffffa, 0x44}}}}, [@NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @device_b}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}]}, 0x70}, 0x1, 0x0, 0x0, 0x40010}, 0x4000004) (async) sendmsg$NL80211_CMD_SET_MPATH(r4, &(0x7f0000000200)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000300)={0x70, r5, 0x8, 0x70bd25, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r9}, @val={0xc, 0x99, {0xfffffffa, 0x44}}}}, [@NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @device_b}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}]}, 0x70}, 0x1, 0x0, 0x0, 0x40010}, 0x4000004) 4m37.708965303s ago: executing program 0 (id=607): r0 = socket$inet6_sctp(0xa, 0x801, 0x84) setsockopt$inet_sctp6_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000400)=@assoc_value={0x0, 0x1c7}, 0x8) syz_emit_ethernet(0x36, &(0x7f0000000040)=ANY=[], 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f00000002c0), r1) sendmsg$NLBL_CIPSOV4_C_ADD(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)={0x58, r2, 0x1, 0x0, 0x3, {}, [@NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0xffffffffffffffff}, @NLBL_CIPSOV4_A_DOI={0x0, 0x1, 0x1}, @NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0xffffffffffffffff}]}, 0x9c}, 0x1, 0x0, 0x0, 0x20040004}, 0xc000) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_ADD_DEV(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10010000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000140)={0x20, r3, 0x0, 0x70bd2a, 0x25dfdbfe, {}, [@IEEE802154_ATTR_DEV_NAME={0x7, 0x1, 'wpan0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x2000c001}, 0x44040) 4m37.509343874s ago: executing program 0 (id=612): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x3c000, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-serpent-sse2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, 0x0, 0x0) r3 = accept4(r2, 0x0, 0x0, 0x800) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0x4d}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538", 0x58}], 0x3, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18, 0x4004014}], 0x1, 0x40800) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x51}, {&(0x7f0000000300)=""/99, 0x63}], 0x2}, 0x20) recvfrom(r3, &(0x7f00000023c0)=""/231, 0xe7, 0x20, 0x0, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'wp512-generic\x00'}, 0x58) syz_emit_ethernet(0x66, &(0x7f0000000000)={@link_local={0x5}, @link_local, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x2f, 0x0, @private, @empty}, {{0x0, 0x0, 0x1, 0x0, 0x2, 0x0, 0x0, 0x4, 0x6558}, {0x0, 0x0, 0x0, 0x0, 0x11}, {}, {0x8, 0x88be, 0x0, {{0x0, 0x1, 0xb2}}}}}}}}, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r4, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="3800000056000100000000f70000000007020000", @ANYRES32, @ANYBLOB="200001"], 0x38}}, 0x0) r5 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r5, &(0x7f0000000000)=[{&(0x7f00000001c0)="580000001500add427323b472545b4562f117fffffff81000e224e217f000001925aa80020007b00090080007ff00001e809000000ff0000f03ac71036000000ffffffffffffffffffe7ee00000000000000000200000000", 0x58}], 0x1) r6 = accept4(r1, 0x0, 0x0, 0x80800) sendmmsg$alg(r6, &(0x7f0000002340)=[{0x0, 0x0, &(0x7f0000000900)=[{&(0x7f0000000540)="919f", 0x2}, {&(0x7f00000001c0)='L', 0x1}], 0x2}], 0x1, 0x10) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r9, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x8, 0x4}}]}}]}, 0x48}}, 0x20040084) r10 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)=@newqdisc={0x8c, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r11, {0xd}, {0xffff, 0xffff}, {0x2, 0x2}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x5c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x39, 0x1, {0x4, [0x2, 0x5, 0x9, 0x7, 0xc, 0x2, 0x4, 0x2, 0xf, 0x6, 0x0, 0xb, 0x5, 0x6, 0x1, 0x4], 0x3, [0x8b, 0x101, 0x200, 0x2002, 0x1, 0x4, 0x2, 0xd06, 0xff05, 0x2, 0xb, 0x3, 0x5, 0x6, 0xdff, 0x100], [0xfff2, 0x5, 0xffff, 0xfff5, 0x3, 0x8, 0x1, 0x9, 0x5, 0x2, 0xc, 0x40, 0xfdfc, 0x8, 0x1]}}]}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x400dc}, 0x0) 4m37.166434014s ago: executing program 0 (id=618): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) r1 = bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f0000000000)=0xffffffffffffffff, 0x4) sendfile(r0, r1, &(0x7f00000000c0)=0x6, 0x3) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000280)={0xa, 0x4, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x8000}, [@ldst={0x3, 0x0, 0x3, 0x1, 0x0, 0xffffffffffffffff}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0xb}, 0x94) 4m37.040965729s ago: executing program 0 (id=619): bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0xe, &(0x7f0000000380)=ANY=[@ANYBLOB="b7020000b96871dfbfa30000000000000703000000feffff7a0af0fff8ffff1971a4f0ff00000000b7060000080000003c6400000000000045040400010000001704000001000a00b7040000000100006a0af2fe0000004f850000001a000000b7000000000000009500000000000000455781a5feee5e1ce784909b849d5550adf200000000000000b61d69f2ffdaa10350e11cb97c8ad51bcda0c4ee6d9674c77404ceb9971e43405d62de53a9a53608c10556e5734eb84049761451ce2e2d9f8004e26f7fcc059c06220002595f6dba87b81d1106fb026cce67a66afd9ac3d09e29a9d542ca9d85a5c9c88474895d679838def0a83a733dc6a39b63a5ed69d32394c53361d7480884bd6fee53f5b2e7b91c61ced1ebad000000000000e8122a793c080a882add4e1179bd4a44f2fcb6d753a78845d8363e0401861abebe428ba953df4aece69311687f4122073a236c3ad198e3f3a532efa04137d452ff47d2638da3261c8362bb7c7824be6195a66d2e17e122040e11e3bd4a69fc6e8d9f7043e09b9e10dc7777bfae58e99e30810400000000000000d63d716c0975e1ce4a655362e7062ff6ab3934555c01840219829472ad529cefa06d3482c7b2711b98eabdca89b77efd13e6dba4a431ce47911834118093b6cabaa17a57727474e1785ee234835088445aa4a9b677d3d342640e328504aea02a2d727e62b7f097a02dbf8fe1d704765de7482040b2fc3000000000000000008947baeaaf954aff687deaa2f804924600273ee26d8115cbca081a14cba24788779291745083fccdddc979ddca066da478c197d4a550470557bc99cca336bd88cd28a5ee651627e3a6fbf6ea53b95ddb64c69c7d8d2f4baddc239828760459564124bad68209d2a1d16ad085886c017679cfcda8b10700ac1e2bcc5ede5b5687aa418abfa09acd7339e73b2cd185c9eb5fb34fccd20ffa155b16c0c309ed6f6663677df37de0ec0d0f548b183940be5d1fe0bae14d1a76bf741330dacd9cc19c0163bcc93059e8d2d1bfa928e2ba458ecd989cb3581a3f270ad48255ac0dad4923e3e357e4e90583ce8d43ec65ed491d87a51d7c13f665dcf772e3ead71112008b16b0ea821f70aee1ccbd71c5a1c21e87d5b7b73d356337d15b9dcae4d0d750ffa07909c955e718585b2456308beda2fa03bb9bcf03cdff31ee4b1665b987829c0f0872c006c6e4ed666fe23b343aae943923eedbdb0e7abee90e3da7b98b7d07d2d4816201ad1737798635b0a3ebd3aed120e4500c16e6c9dc729f009db49c6b8b19613e4d792cb4ff5106419291d4222980b49ddb9527ce785822d8f4e2"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000340), 0xfffffffffffffe19, 0x0, 0xffffffffffffffff, 0x54}, 0x42) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a0000070800"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=@base={0x5, 0xa, 0x42, 0x40, 0xc0, 0x1, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0xfffffffc}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080), &(0x7f0000000080), 0x1003, r0}, 0x38) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000000)={r0, &(0x7f00000001c0), &(0x7f0000000300)=""/225}, 0x20) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(0xffffffffffffffff, 0x89fb, &(0x7f00000007c0)={'sit0\x00', &(0x7f0000000280)={@private1={0xfc, 0x1, '\x00', 0x1}, @dev={0xac, 0x14, 0x14, 0xa}, 0x14, 0xe}}) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r2 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f0000000300)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560aff820fffff5bab003a0000002058000b4824ca945f6400940f6a0325010ebc000000000000008000f0fffeffe809005300fff5dd00000010000100040c100000000000224e0000", 0xfffffffffffffe50}], 0x1) r3 = syz_init_net_socket$ax25(0x3, 0x2, 0xc4) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r5, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="5800000002060102000000000000000a0000000005000400000000000900020073797a30000000000500010007000000050005000a00000014000780080011400000000108001240000117ff0c000300686173683a6970"], 0x58}, 0x1, 0x0, 0x0, 0x8000}, 0x0) r6 = syz_genetlink_get_family_id$tipc(&(0x7f0000000980), r2) sendmsg$TIPC_CMD_SET_LINK_TOL(r4, &(0x7f0000000a40)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000a00)={&(0x7f0000000a80)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="010027bd7000fcdbdf2501000000000000000741000000140018000000077564e4e4ca28142385e1518eb6703a73797a3000000000"], 0x30}, 0x1, 0x0, 0x0, 0x80}, 0x20000851) ioctl$SIOCAX25NOUID(r3, 0x89e3, &(0x7f0000000840)=0x1) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0xd, 0x4, &(0x7f0000000700)=ANY=[@ANYBLOB="1800000041ffffff00000000080000009111c9000000000095"], &(0x7f0000000c40)='GPL\x00', 0x3, 0xfffffffffffffed4, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffff9}, 0x94) syz_genetlink_get_family_id$ipvs(&(0x7f00000002c0), r2) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r9, &(0x7f0000000000)={0x0, 0xffffffffffffff2f, &(0x7f0000000040)={&(0x7f0000000240)={0x14, 0x26, 0x1, 0xf0bd26, 0x25dfdbfc, {0x6}}, 0x14}, 0x1, 0x0, 0x0, 0x4001d}, 0x48000) setsockopt$sock_int(r8, 0x1, 0x26, &(0x7f0000000000)=0x4006, 0x4) sendmmsg$unix(r7, &(0x7f0000000900), 0x0, 0x4008081) 4m21.629865704s ago: executing program 32 (id=619): bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0xe, &(0x7f0000000380)=ANY=[@ANYBLOB="b7020000b96871dfbfa30000000000000703000000feffff7a0af0fff8ffff1971a4f0ff00000000b7060000080000003c6400000000000045040400010000001704000001000a00b7040000000100006a0af2fe0000004f850000001a000000b7000000000000009500000000000000455781a5feee5e1ce784909b849d5550adf200000000000000b61d69f2ffdaa10350e11cb97c8ad51bcda0c4ee6d9674c77404ceb9971e43405d62de53a9a53608c10556e5734eb84049761451ce2e2d9f8004e26f7fcc059c06220002595f6dba87b81d1106fb026cce67a66afd9ac3d09e29a9d542ca9d85a5c9c88474895d679838def0a83a733dc6a39b63a5ed69d32394c53361d7480884bd6fee53f5b2e7b91c61ced1ebad000000000000e8122a793c080a882add4e1179bd4a44f2fcb6d753a78845d8363e0401861abebe428ba953df4aece69311687f4122073a236c3ad198e3f3a532efa04137d452ff47d2638da3261c8362bb7c7824be6195a66d2e17e122040e11e3bd4a69fc6e8d9f7043e09b9e10dc7777bfae58e99e30810400000000000000d63d716c0975e1ce4a655362e7062ff6ab3934555c01840219829472ad529cefa06d3482c7b2711b98eabdca89b77efd13e6dba4a431ce47911834118093b6cabaa17a57727474e1785ee234835088445aa4a9b677d3d342640e328504aea02a2d727e62b7f097a02dbf8fe1d704765de7482040b2fc3000000000000000008947baeaaf954aff687deaa2f804924600273ee26d8115cbca081a14cba24788779291745083fccdddc979ddca066da478c197d4a550470557bc99cca336bd88cd28a5ee651627e3a6fbf6ea53b95ddb64c69c7d8d2f4baddc239828760459564124bad68209d2a1d16ad085886c017679cfcda8b10700ac1e2bcc5ede5b5687aa418abfa09acd7339e73b2cd185c9eb5fb34fccd20ffa155b16c0c309ed6f6663677df37de0ec0d0f548b183940be5d1fe0bae14d1a76bf741330dacd9cc19c0163bcc93059e8d2d1bfa928e2ba458ecd989cb3581a3f270ad48255ac0dad4923e3e357e4e90583ce8d43ec65ed491d87a51d7c13f665dcf772e3ead71112008b16b0ea821f70aee1ccbd71c5a1c21e87d5b7b73d356337d15b9dcae4d0d750ffa07909c955e718585b2456308beda2fa03bb9bcf03cdff31ee4b1665b987829c0f0872c006c6e4ed666fe23b343aae943923eedbdb0e7abee90e3da7b98b7d07d2d4816201ad1737798635b0a3ebd3aed120e4500c16e6c9dc729f009db49c6b8b19613e4d792cb4ff5106419291d4222980b49ddb9527ce785822d8f4e2"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000340), 0xfffffffffffffe19, 0x0, 0xffffffffffffffff, 0x54}, 0x42) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a0000070800"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=@base={0x5, 0xa, 0x42, 0x40, 0xc0, 0x1, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0xfffffffc}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080), &(0x7f0000000080), 0x1003, r0}, 0x38) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000000)={r0, &(0x7f00000001c0), &(0x7f0000000300)=""/225}, 0x20) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(0xffffffffffffffff, 0x89fb, &(0x7f00000007c0)={'sit0\x00', &(0x7f0000000280)={@private1={0xfc, 0x1, '\x00', 0x1}, @dev={0xac, 0x14, 0x14, 0xa}, 0x14, 0xe}}) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r2 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f0000000300)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560aff820fffff5bab003a0000002058000b4824ca945f6400940f6a0325010ebc000000000000008000f0fffeffe809005300fff5dd00000010000100040c100000000000224e0000", 0xfffffffffffffe50}], 0x1) r3 = syz_init_net_socket$ax25(0x3, 0x2, 0xc4) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r5, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="5800000002060102000000000000000a0000000005000400000000000900020073797a30000000000500010007000000050005000a00000014000780080011400000000108001240000117ff0c000300686173683a6970"], 0x58}, 0x1, 0x0, 0x0, 0x8000}, 0x0) r6 = syz_genetlink_get_family_id$tipc(&(0x7f0000000980), r2) sendmsg$TIPC_CMD_SET_LINK_TOL(r4, &(0x7f0000000a40)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000a00)={&(0x7f0000000a80)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="010027bd7000fcdbdf2501000000000000000741000000140018000000077564e4e4ca28142385e1518eb6703a73797a3000000000"], 0x30}, 0x1, 0x0, 0x0, 0x80}, 0x20000851) ioctl$SIOCAX25NOUID(r3, 0x89e3, &(0x7f0000000840)=0x1) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0xd, 0x4, &(0x7f0000000700)=ANY=[@ANYBLOB="1800000041ffffff00000000080000009111c9000000000095"], &(0x7f0000000c40)='GPL\x00', 0x3, 0xfffffffffffffed4, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffff9}, 0x94) syz_genetlink_get_family_id$ipvs(&(0x7f00000002c0), r2) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r9, &(0x7f0000000000)={0x0, 0xffffffffffffff2f, &(0x7f0000000040)={&(0x7f0000000240)={0x14, 0x26, 0x1, 0xf0bd26, 0x25dfdbfc, {0x6}}, 0x14}, 0x1, 0x0, 0x0, 0x4001d}, 0x48000) setsockopt$sock_int(r8, 0x1, 0x26, &(0x7f0000000000)=0x4006, 0x4) sendmmsg$unix(r7, &(0x7f0000000900), 0x0, 0x4008081) 2m38.245299301s ago: executing program 5 (id=1968): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) connect$can_bcm(r1, &(0x7f00000000c0)={0x1d, r2}, 0x10) sendmsg$can_bcm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)={0x1, 0x922, 0x0, {0x0, 0x2710}, {0x0, 0x2710}, {}, 0x1, @canfd={{}, 0x0, 0x0, 0x0, 0x0, "5c91440132bb112240fcbcc3fa9d0431575f8614d3538ce09c50eecd6ac579e8e83b944b666113f3afed71231e6653a13532f17b33515bdd7e1be14f53b9fc9b"}}, 0x80}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc080003400000001408000c40b5000000400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d103000014000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) 2m38.12667218s ago: executing program 5 (id=1970): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) shutdown(r0, 0x0) setsockopt$MRT_DONE(0xffffffffffffffff, 0x0, 0xc9, 0x0, 0x0) sendmsg$nfc_llcp(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000000)={0x27, 0x0, 0x1, 0x4, 0x2, 0x67, "fe69909135d4dada04562644d100eb4a14e41754d8f18c52e72321819a9f54754244acb540ee4050c3e55d20ad46be7473604a96540f4f9a6db8e9948f5b75", 0x4}, 0x60, &(0x7f0000000400)=[{&(0x7f0000000080)="2c3022f97b64824ad4d2ef2696917c0b088a2a53f769ccecaf7c24696e3fa801c8ebbc6f14103e31b83d15e77dabba59b5af524ffdf2ab6faf87f9e8ac41b6feca2ad37ed2f7df7569659ec067d45a9ff4227a42d286c085e55cbfaf1e", 0x5d}, {&(0x7f0000000100)="2061aae7550789ab65f34f5ee34e2a033ea937b1f7085f2a71e60aee11ca24e97b7023ddd06076ce03e395f6b53197753f3673fdd69dbc4f0330b3630aef0f005ec3b2ce72e118e7ea77b2b2d1c036b7ec", 0x51}, {&(0x7f0000000180)="871963b7e6179874ae03c79c1401e32ffa7a57031f80ccf7c1189b487b8a58c1fe3b0498026812a3d213276d0a4ac30a017c3ff0fcbb03e301d741877a448710881544cc138f987aa09e032fad", 0x4d}, {&(0x7f0000000200)="3eef18331f259663a096430d39b61414bb8676f7256d5875cf4a3236e32ee11fce7197b8ca6e4caf3be73b22f5a51747c3446fc205ca731bd6da361920f567a86efeb94d2ccda7106623e1ed5f734ca46f2468e26037d505e6b87a021b8502c5", 0x60}, {&(0x7f0000000280)="017f9900be1f587c0393d62ae8e3bc81cd1db4052d7237b523b8a8c1fb0eea51df3560e9eeb796fa582e01f8accb9f8a", 0x30}, {&(0x7f00000002c0)="f1a90de8e7a80ef37c973191b8b8ecb5b8f20f0167634547a414c7e45c8e", 0x1e}, {&(0x7f0000000300)="24a51ad782702c62fbc014f1027875845f2cc56a065c648a3480b29d09971ebae8eb9ac917387c8635d7f2eae972756e8c1f54883b183ab7283d8d6f88348e4fc186d37c3637fd4d6017552b83b3f6bfa5646cb0c0f22faf9aaf3c58a9c455fa713da5ed69510bb6005ecf6b8e4cfd5ee4c7b66d54b87ecd369511b5446e0a5c8cfffecd9943a2ebd5bb37a5b95959dac2b6449220adaf50dc104b363f54ba429a3655810e1e826dc809f16e3db54f5e6c9762c4838c45d9fa2f932de07da4036ffec85944ee4f46", 0xc8}], 0x7, 0x0, 0x0, 0x4000}, 0x20024098) r1 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$inet_sctp_SCTP_AUTOCLOSE(r1, 0x84, 0x4, &(0x7f00000004c0)=0x1, 0x4) setsockopt$inet_mreq(r1, 0x0, 0x0, &(0x7f0000000500)={@rand_addr=0x64010101, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x8) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0xdd34e000) setsockopt$inet_sctp_SCTP_HMAC_IDENT(r1, 0x84, 0x16, &(0x7f0000000540), 0x4) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000580)={0x0, 0xd6}, &(0x7f00000005c0)=0x8) setsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, &(0x7f0000000600)={r2, 0xc}, 0x8) r3 = accept$inet6(0xffffffffffffffff, &(0x7f0000000640)={0xa, 0x0, 0x0, @mcast1}, &(0x7f0000000680)=0x1c) setsockopt$sock_linger(r3, 0x1, 0xd, &(0x7f00000006c0)={0x0, 0x9}, 0x8) r4 = socket$inet6_icmp(0xa, 0x2, 0x3a) setsockopt$inet6_mreq(r4, 0x29, 0x14, &(0x7f0000000700)={@mcast2}, 0x14) setsockopt$inet_sctp_SCTP_AUTO_ASCONF(r1, 0x84, 0x1e, &(0x7f0000000740)=0xb6, 0x4) sendto$inet(r1, &(0x7f0000000780)="1de2317962bac43396284e7fe993aa0dc42db6c999a8b16e65a86bc74cf84eca533e573aeb4fea0697098369e4f3057e4e725d0f46b06039b366bda70787ce0e3fafb9115bf437cfa5efef0d8d752a4c99c511f86aa261ce4ffc904ef39637156b842f5258e65ef0d911b69c1dae76862aeae228f3d6beeda4ec4455ff74c3d3711b2b24a9dde76f2c0dfa1f0876beded62258012c1efdca43abee8b4d2ea3d318e87ae3939a2da3ded00e65e32373c80be63b5a3ffb95d6790aea6c7d85871fab9733133264294c0adf5cb210d796e479395653f026e57ae0a5a7254dd9e265ebc086802a3cb255a3c55c", 0xeb, 0x800, &(0x7f0000000880)={0x2, 0x4e23, @private=0xa010102}, 0x10) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f00000008c0)) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000900)='./cgroup.cpu/syz1\x00', 0x1ff) setsockopt$SO_VM_SOCKETS_BUFFER_SIZE(0xffffffffffffffff, 0x28, 0x0, &(0x7f0000000940)=0x37e9, 0x8) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCOUTQ(r0, 0x5411, &(0x7f0000000980)) getsockname(r4, &(0x7f00000009c0)=@l2tp={0x2, 0x0, @broadcast}, &(0x7f0000000a40)=0x80) r5 = socket$can_raw(0x1d, 0x3, 0x1) close(r5) setsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x1f, &(0x7f0000000a80)={r2, @in={{0x2, 0x4e22, @rand_addr=0x64010102}}, 0x9, 0x4}, 0x90) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000d40)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000d00)={&(0x7f0000000b80)=@deltaction={0x158, 0x31, 0x300, 0x70bd2c, 0x25dfdbfb, {}, [@TCA_ACT_TAB={0x40, 0x1, [{0x10, 0x17, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'vlan\x00'}}, {0x14, 0x1, 0x0, 0x0, @TCA_ACT_KIND={0xf, 0x1, 'tunnel_key\x00'}}, {0xc, 0x9, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x5}}, {0xc, 0x20, 0x0, 0x0, @TCA_ACT_INDEX={0x8}}]}, @TCA_ACT_TAB={0x20, 0x1, [{0x10, 0x1e, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'sample\x00'}}, {0xc, 0x1b, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x3}}]}, @TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x20, 0x0, 0x0, @TCA_ACT_KIND={0xc, 0x1, 'skbedit\x00'}}]}, @TCA_ACT_TAB={0x10, 0x1, [{0xc, 0x9, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x422a}}]}, @TCA_ACT_TAB={0x20, 0x1, [{0xc, 0x1e, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x8}}, {0x10, 0x11, 0x0, 0x0, @TCA_ACT_KIND={0xc, 0x1, 'skbedit\x00'}}]}, @TCA_ACT_TAB={0x10, 0x1, [{0xc, 0x8, 0x0, 0x0, @TCA_ACT_INDEX={0x8}}]}, @TCA_ACT_TAB={0x90, 0x1, [{0xc, 0x5, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0xdb3}}, {0x10, 0x20, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}, {0xc, 0x19, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x246}}, {0xc, 0xc, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x9}}, {0xc, 0xc, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'bpf\x00'}}, {0xc, 0x0, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x6}}, {0x10, 0x1a, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'police\x00'}}, {0x10, 0xe, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'gact\x00'}}, {0x14, 0x20, 0x0, 0x0, @TCA_ACT_KIND={0xd, 0x1, 'connmark\x00'}}, {0xc, 0xc, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0xb}}]}]}, 0x158}, 0x1, 0x0, 0x0, 0x20001000}, 0x4000000) r7 = accept4(r3, &(0x7f0000000d80)=@nfc, &(0x7f0000000e00)=0x80, 0x800) sendmsg$RDMA_NLDEV_CMD_RES_QP_GET(r7, &(0x7f0000000f00)={&(0x7f0000000e40)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000ec0)={&(0x7f0000000e80)={0x40, 0x140a, 0x400, 0x70bd2b, 0x25dfdbfe, "", [@RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x1}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_RES_LQPN={0x8, 0x15, 0x4}, @RDMA_NLDEV_ATTR_RES_LQPN={0x8, 0x15, 0x3}]}, 0x40}, 0x1, 0x0, 0x0, 0x80080}, 0x4004000) 2m37.212428389s ago: executing program 5 (id=1981): r0 = socket$netlink(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_MODIFY(r0, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)=ANY=[@ANYBLOB="8b9f3e34", @ANYRES16=0x0, @ANYBLOB="00042abd7000fedbdf2507000000060002000000000008000a0001000000"], 0x24}, 0x1, 0x0, 0x0, 0x1}, 0x0) r1 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r1, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000000000)=0x80, 0x4) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r2, 0x10e, 0x8, &(0x7f00000000c0)=0x401, 0x4) sendmsg$IPCTNL_MSG_CT_GET_STATS_CPU(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000001380)={0x14, 0x4, 0x1, 0x101, 0x0, 0x0, {0x0, 0x0, 0x9}}, 0x14}, 0x1, 0x0, 0x0, 0x188ab52633285340}, 0x20000c44) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r1, 0x10e, 0x4, &(0x7f0000000180)=0x800, 0x4) r3 = socket(0x2, 0x80805, 0x0) sendmmsg$inet_sctp(r3, &(0x7f0000000880)=[{&(0x7f0000000440)=@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f00000004c0)=[{&(0x7f0000000100)="03", 0x1}], 0x1}], 0x1, 0x0) sendmmsg$inet_sctp(r3, &(0x7f00000032c0)=[{&(0x7f00000000c0)=@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f0000000240)=[{0x0, 0x300}, {&(0x7f0000000300)="359cb6", 0x3}], 0x2, &(0x7f0000000000)=ANY=[@ANYBLOB="30000000000000008400000001000000000000000c000400"/44, @ANYRES32=0x0], 0x30}], 0x1, 0x0) r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$SO_TIMESTAMPING(r4, 0x1, 0x41, &(0x7f0000000040)=0x2563, 0x4) sendto$inet(r4, &(0x7f0000000100)="1ce0", 0xffeb, 0x0, &(0x7f0000001100)={0x2, 0x0, @private}, 0x10) recvmmsg(r4, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000000b40)=[{&(0x7f0000000700)=""/183, 0xb7}], 0x1}, 0x1000}], 0x1, 0x2020, 0x0) r5 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_NEW(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000300)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="0100fcfffffffbdbe4aa2996b081f14a249945e2dba93cdf21250000000f"], 0x24}, 0x1, 0x0, 0x0, 0x41}, 0x0) r6 = socket$kcm(0x2, 0x5, 0x106) sendmsg$inet(r6, &(0x7f0000000000)={&(0x7f0000000140)={0x2, 0x4001, @empty}, 0x10, 0x0}, 0x30006041) r7 = socket$inet(0x2, 0x1, 0x0) setsockopt$sock_int(r7, 0x1, 0xf, &(0x7f0000356ffc)=0xffffffffffffff40, 0x4) bind$inet(r7, &(0x7f0000e15000)={0x2, 0x4e20, @multicast1}, 0x10) r8 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_REPAIR(r8, 0x6, 0x13, &(0x7f0000000140)=0x1, 0x4) setsockopt$sock_int(r8, 0x1, 0xf, &(0x7f0000000040)=0x80000004, 0x4) setsockopt$SO_ATTACH_FILTER(r8, 0x1, 0x33, &(0x7f0000000640)={0x1, &(0x7f00000000c0)=[{0x6, 0x81, 0xca}]}, 0x10) bind$inet6(r8, &(0x7f0000000000)={0xa, 0x4e20, 0x1, @empty, 0xfffffffc}, 0x1c) ppoll(&(0x7f0000000340)=[{r1, 0x8000}, {r7, 0x80}, {0xffffffffffffffff, 0x501a}, {0xffffffffffffffff, 0x213}], 0x4, &(0x7f0000000380)={0x77359400}, &(0x7f00000003c0)={[0x1]}, 0x8) close(r6) 2m36.681324268s ago: executing program 5 (id=1988): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[@ANYBLOB="300000000000000000781b917c76e518eadac2bc", @ANYRES32=0x0, @ANYBLOB="040004000000000008000400f923000008001b0000000000"], 0x30}}, 0x4040040) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r1, &(0x7f0000000800)=[{&(0x7f0000000f80)="4191062c14", 0x5}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}], 0x9, 0x9) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f00000001c0)={r1, 0x20, &(0x7f0000000240)={&(0x7f0000000040)=""/251, 0xfb, 0x0, &(0x7f0000000140)=""/27, 0x1b}}, 0x10) 2m36.504905681s ago: executing program 5 (id=1992): r0 = socket(0x1d, 0x2, 0x6) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000400)=0x1, 0x4) recvfrom(r1, &(0x7f0000001300)=""/4096, 0x1000, 0x2, 0x0, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000200), r1) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f00000000c0)=0x8, 0x4) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) bind$can_j1939(r0, &(0x7f0000000040)={0x1d, r2, 0x1, {0x1, 0x1, 0x4}, 0xfd}, 0x18) setsockopt$packet_int(r0, 0x6a, 0x9, 0x0, 0x0) r3 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r4 = bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000a00)=ANY=[@ANYBLOB="0a000000c0000000b30000007f"], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x13, &(0x7f0000000080)=ANY=[@ANYBLOB="18080000a10000000000000000000010851000000600000018180000", @ANYRES32=r4, @ANYBLOB="0000000000000000660000007fffffff18000000f8ffffff00000000100000009500000000000000360a00000000000018010000202078250000000000202020db1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b50a00000000000085000000060000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0xa, 0xff5c, &(0x7f0000000340)=""/222}, 0x78) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r5) ioctl$IOCTL_GET_NCIDEV_IDX(r3, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x1c, r6, 0x401, 0x70bd26, 0x25dfdbf8, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r7}]}, 0x1c}}, 0x8d0) write$nci(r3, &(0x7f0000000040)=ANY=[@ANYBLOB="50000304"], 0x7) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r8, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010000000000ffdbdf2503000000400001802c0004001400010002004e2bac14140f00000000000000001400020002000000ffffffa5d0000000000000000d0001007564703a73797a3200000000"], 0x54}}, 0x0) 2m35.938711072s ago: executing program 5 (id=2001): r0 = socket$nl_generic(0x10, 0x3, 0x10) getsockopt$inet_mptcp_buf(0xffffffffffffffff, 0x11c, 0x2, 0x0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) bind$xdp(0xffffffffffffffff, &(0x7f0000000100)={0x2c, 0x2}, 0x10) sendmsg$NFT_BATCH(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="140000001000040000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000058000000160a01000000000000000000010000000900010073797a30000000000900020073797a30000000002c0003800800014000000000080002400000000010000380140001007465616d3000000000000000000000005c000000160a0101000b000000000000010000000900020073797a30000000000900010073797a3000000000300003802c00038014"], 0xfc}}, 0x0) write$tun(r1, &(0x7f0000000240)=ANY=[@ANYBLOB="00000000bbbbbbbbbbbbbbbbbbbbbbbb88a84d008100660008004519004300e400000811"], 0x5d) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000006c0)=ANY=[@ANYBLOB="14000000260001032bbd3000fcffbfff01"], 0x14}, 0x1, 0x0, 0x0, 0x448d3}, 0x800) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000001200)={&(0x7f0000000000)=@ipv6_getroute={0x4c, 0x1a, 0x4, 0x70bd2b, 0xaa, {0xa, 0x20, 0x80, 0x4, 0x0, 0x3, 0xff, 0x2, 0x1400}, [@RTA_GATEWAY={0x14, 0x5, @mcast2}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, '\x00', 0xa}}, @RTA_PREF={0x5, 0x14, 0xfe}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8840}, 0x0) 1m18.238587097s ago: executing program 33 (id=2001): r0 = socket$nl_generic(0x10, 0x3, 0x10) getsockopt$inet_mptcp_buf(0xffffffffffffffff, 0x11c, 0x2, 0x0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) bind$xdp(0xffffffffffffffff, &(0x7f0000000100)={0x2c, 0x2}, 0x10) sendmsg$NFT_BATCH(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="140000001000040000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000058000000160a01000000000000000000010000000900010073797a30000000000900020073797a30000000002c0003800800014000000000080002400000000010000380140001007465616d3000000000000000000000005c000000160a0101000b000000000000010000000900020073797a30000000000900010073797a3000000000300003802c00038014"], 0xfc}}, 0x0) write$tun(r1, &(0x7f0000000240)=ANY=[@ANYBLOB="00000000bbbbbbbbbbbbbbbbbbbbbbbb88a84d008100660008004519004300e400000811"], 0x5d) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000006c0)=ANY=[@ANYBLOB="14000000260001032bbd3000fcffbfff01"], 0x14}, 0x1, 0x0, 0x0, 0x448d3}, 0x800) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000001200)={&(0x7f0000000000)=@ipv6_getroute={0x4c, 0x1a, 0x4, 0x70bd2b, 0xaa, {0xa, 0x20, 0x80, 0x4, 0x0, 0x3, 0xff, 0x2, 0x1400}, [@RTA_GATEWAY={0x14, 0x5, @mcast2}, @RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, '\x00', 0xa}}, @RTA_PREF={0x5, 0x14, 0xfe}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8840}, 0x0) 5.607021443s ago: executing program 3 (id=2941): mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CIPSOV4_C_ADD(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000500)={0x48, 0x0, 0x1, 0x70bd27, 0x25dfdbfb, {}, [@NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0xffffffffffffffff}, @NLBL_CIPSOV4_A_TAGLST={0x24, 0x4, 0x0, 0x1, [{0x5, 0x3, 0x1}, {0x5}, {0x5, 0x3, 0x2}, {0x5, 0x3, 0x1}]}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x2}]}, 0x48}, 0x1, 0x0, 0x0, 0x805}, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000100)={&(0x7f0000000640)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x68, 0x68, 0x2, [@func_proto={0x0, 0x0, 0x0, 0xd, 0xa}, @enum={0x0, 0x4, 0x0, 0x6, 0x4, [{0xb, 0x6}, {0xb, 0x7}, {0x1, 0x7}, {0x5, 0x8}]}, @struct={0x8, 0x1, 0x0, 0x4, 0x0, 0x1, [{0xa, 0x4, 0x2}]}, @struct={0x3, 0x1, 0x0, 0x4, 0x0, 0x9, [{0xc, 0x5, 0x3}]}]}}, &(0x7f0000000f40)=""/4089, 0x82, 0xff9, 0x7}, 0x28) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r1) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000d40)=ANY=[@ANYBLOB="6c000000020603"], 0x6c}}, 0x4000) r2 = socket(0x28, 0x5, 0x0) bind$vsock_stream(r2, &(0x7f0000000040)={0x28, 0x0, 0x0, @local}, 0x10) listen(r2, 0x0) r3 = socket(0x28, 0x5, 0x0) connect$vsock_stream(r3, &(0x7f0000000080), 0x10) sendmmsg(r3, &(0x7f0000000b40)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000000)="1b", 0x1}], 0x1}}], 0x1, 0x0) r4 = accept4$unix(r2, 0x0, 0x0, 0x0) r5 = socket$can_j1939(0x1d, 0x2, 0x7) recvmmsg(r5, &(0x7f0000000c00)=[{{0x0, 0x0, 0x0}, 0x807}, {{0x0, 0x0, &(0x7f0000000b00)=[{&(0x7f00000006c0)=""/240, 0xf0}], 0x1}, 0x1ff}], 0x2, 0x40020163, 0x0) recvfrom$unix(r4, &(0x7f00000004c0)=""/249, 0xf9, 0x10022, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000100)=ANY=[@ANYBLOB="1400000010000100f7000000000000000500000a44000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc08000340000000144c0000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a3100000000200003801c0000800c00018006000100d10300000c000440000000000000000114000000110001"], 0xb8}}, 0x4040) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_STRSET_GET(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000540)={0x34, 0x0, 0x705, 0x70bd2b, 0x25dfdbff, {}, [@ETHTOOL_A_STRSET_STRINGSETS={0x1c, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x6}]}, {0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x5}]}]}, @ETHTOOL_A_STRSET_COUNTS_ONLY={0x4}]}, 0x34}, 0x1, 0x0, 0x0, 0x80}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a480000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a31000000001c000380180000800c000180060001"], 0x70}, 0x1, 0x0, 0x0, 0x4451099e661a63b1}, 0x0) r7 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000300)="2e00000011008108090f9becdb4cb92e0a4831371400000069bd6efb2502eaf60d000300020400bf050005001201", 0x2e}], 0x1}, 0x48000) 5.329095737s ago: executing program 3 (id=2945): socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) sendmmsg$inet(r0, &(0x7f0000001540)=[{{0x0, 0xfffffffffffffda1, 0x0}}], 0x40001b6, 0x0) (fail_nth: 13) connect$tipc(r0, &(0x7f00000000c0)=@nameseq={0x1e, 0x1, 0x0, {0x1, 0x3, 0x4}}, 0x10) 4.965162423s ago: executing program 3 (id=2949): r0 = socket(0x27, 0x2, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1000000004000000080000000500000000000000", @ANYRES32, @ANYBLOB="00000000000000000000bf3881b30000000800005f1311c955dd039d7551316f6bb459ac4d46279fafc01f1657eb8cc4af6f4df8d0098981de233799a3c07e4099f2dad480e261d4f9ea32e916ba5c0e6b30f02d73a681be0fc11d99af6d4a4b72c29e3f32c2da2061ecc55fedeb49b2db2004da25ec9e132af10471f3090c15c7b81777ae2c4500520bbdb99552a3dd900d99", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008900000b703000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000080)={{r3}, &(0x7f0000000000), &(0x7f0000000040)=r4}, 0x20) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000003c0)={r4, r2}, 0x14) syz_emit_ethernet(0x11, &(0x7f00000002c0)={@multicast, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x36}, @void, {@x25={0x805, {0x3, 0x80, 0x1b}}}}, 0x0) write(r0, &(0x7f00000002c0)="fc0000001c000704ab5b2509b868030002ab087a0100000001481093210001c0f0030584050060100000000000039815fa2c53c28648000000b9d95662537a00bc000c00f0ff7f0000b400600033d44000040560916a0033f436313012dafd5a32e273fc83ab82d710f74cec184406f90d435ef8b29d3ef3d92c94170e5bba2e177312e081bea05d3a021e8ca062914a46ccfc510bb73c9455cdc8363ae4f5df77bc4cfd6239ec2a0f0d1bcae5fa0f5f9dcdd51af51af8502943283f4bb102b2b8f5566791cf190201ded815b2ccd243f395ed94e0ad91bd6433802e0784f2013cd1890058a10000c880ac801fe4af000049f0d4796f0000090548de", 0xfc) connect$inet(0xffffffffffffffff, &(0x7f0000000400)={0x2, 0x4e23, @loopback}, 0x10) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000005240)=[{{0x0, 0x0, 0x0}, 0xfffffdef}], 0x4000095, 0x0) r5 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSARP(r5, 0x8955, &(0x7f0000000180)={{0x2, 0x4e23, @empty}, {0x20000010304, @local}, 0x4, {0x2, 0x4e20, @rand_addr=0x64010102}}) 4.623442396s ago: executing program 3 (id=2953): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), 0xffffffffffffffff) r3 = socket$pptp(0x18, 0x1, 0x2) r4 = socket$pptp(0x18, 0x1, 0x2) bind$pptp(r4, &(0x7f0000000480)={0x18, 0x2, {0x0, @multicast2}}, 0x1e) bind$pptp(r3, &(0x7f0000000000)={0x18, 0x2, {0x1, @local}}, 0x1e) connect$pptp(r3, &(0x7f0000000080)={0x18, 0x2, {0x0, @rand_addr=0x64010102}}, 0x1e) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r5, 0x8933, &(0x7f0000000040)={'batadv_slave_0\x00', 0x0}) syz_emit_ethernet(0x84, &(0x7f00000003c0)={@multicast, @empty, @void, {@ipv6={0x86dd, @generic={0xe, 0x6, 'V\ak', 0x4e, 0x88, 0xff, @local, @mcast2, {[@routing={0x3a, 0x0, 0x1, 0x8, 0x8004e00}], "4b1fd8cc2c4c4a9b6473b50eab09d362926e1581157c9b0f2fa44de8bfb24e9177ac8476292901261b7bd9e62f4b02f9ea35a2a23e826c809588a153bb6ecc015155f6625671"}}}}}, 0x0) sendmsg$ETHTOOL_MSG_FEATURES_SET(r1, &(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000880)={&(0x7f0000000580)={0x40, r2, 0xe1a4cdd49ac64d35, 0x70bd2b, 0x25dfdbfe, {}, [@ETHTOOL_A_FEATURES_HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}, @ETHTOOL_A_FEATURES_WANTED={0x18, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_BITS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x2}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}]}]}]}]}, 0x40}, 0x1, 0x0, 0x0, 0x8004}, 0x800) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_COALESCE_SET(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="000427bd7000ffdbdf1f140000000800150002000000080003000900000000000008ff7f0000672b1da74badd9d1a9c10102219619decc2aaffa5b32f724f1705e23eb4abff044485fe15c7d586b341a85c445ec0c8486afcdfb0e18cf3715444e00001868c2d685afbc16a4c82d8c34119533466b3c1c1833561f7ecc"], 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0xc84) sendmsg$OSF_MSG_ADD(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000380)={&(0x7f00000005c0)={0x268, 0x0, 0x5, 0x801, 0x0, 0x0, {0x1, 0x0, 0x3}, [{{0x254, 0x1, {{0x0, 0x37}, 0x3, 0x45, 0x6, 0x6, 0x1, 'syz1\x00', "b275f5718a9394bd99fcc348453e771726bf2f0063bd5e132c1fb2ee789d03d8", "5decd803a3a098e6c32d5e78bdcf6c7adbda12508b048ee1ec58ee35032dce26", [{0x385, 0x9, {0x1, 0x10001}}, {0x8000, 0x200, {0x0, 0x3}}, {0x8, 0xfc00}, {0xff, 0x0, {0x1}}, {0x877, 0x0, {0x1, 0x2}}, {0x2, 0x10, {0x1, 0x9}}, {0x10, 0x0, {0x0, 0xfffffc00}}, {0x4e, 0x8001, {0x3, 0x3}}, {0x81, 0x4, {0x3}}, {0xce, 0x6, {0x2, 0x3}}, {0x7ff, 0x2, {0x1, 0xc1e9}}, {0x9, 0x5, {0x0, 0x10000}}, {0x2, 0x242c, {0x0, 0x4}}, {0x7fff, 0x401, {0x3, 0x9}}, {0x0, 0x7, {0x0, 0x7ff}}, {0x3, 0x0, {0x2, 0x7}}, {0x9, 0x49e, {0x3, 0x8000}}, {0x6058, 0x4, {0x2, 0xe}}, {0x3, 0x0, {0x0, 0x1f}}, {0x401, 0x7ff, {0x0, 0x8}}, {0xaf1, 0x0, {0x3, 0x9a}}, {0x2, 0x200, {0x2, 0x81}}, {0x3, 0x0, {0x2, 0xd}}, {0x0, 0x9, {0x0, 0x1}}, {0xc, 0x9, {0x0, 0x8}}, {0x5, 0x4, {0x1, 0x10001}}, {0xa3, 0x1ff, {0x2, 0x7}}, {0x2, 0x4, {0x1, 0x2}}, {0x3, 0x2, {0x2, 0x1}}, {0x1, 0x7, {0x1, 0xfb}}, {0x9, 0x401, {0x1, 0xfffffffc}}, {0x8, 0x2, {0x2, 0x10}}, {0x3, 0x0, {0x3, 0x7fffffff}}, {0x28e7, 0x0, {0x0, 0x1}}, {0x83e2, 0xcb67, {0x0, 0x2}}, {0x0, 0x3ff, {0x1, 0xc}}, {0x3, 0x684, {0x0, 0x5}}, {0x2, 0x200, {0x3, 0xfffffff8}}, {0x6fe, 0x8, {0x1, 0xdd}}, {0x9, 0xe, {0x1}}]}}}]}, 0x268}, 0x1, 0x0, 0x0, 0x24004005}, 0x8000) r7 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$WG_CMD_SET_DEVICE(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000840)={&(0x7f0000000140)={0x7c, r7, 0x1, 0x70bd2b, 0x25dfdbfd, {}, [@WGDEVICE_A_PEERS={0x54, 0x8, 0x0, 0x1, [{0x50, 0x0, 0x0, 0x1, [@WGPEER_A_FLAGS={0x8, 0x3, 0x6}, @WGPEER_A_ENDPOINT6={0x20, 0x4, {0xa, 0x4e22, 0x2, @dev={0xfe, 0x80, '\x00', 0x19}, 0x1}}, @WGPEER_A_PUBLIC_KEY={0x24, 0x1, @a_g}]}]}, @WGDEVICE_A_IFNAME={0x14, 0x2, 'wg2\x00'}]}, 0x7c}, 0x1, 0x0, 0x0, 0xc880}, 0x40010) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=@newtaction={0x64, 0x30, 0xb, 0x0, 0x0, {}, [{0x50, 0x1, [@m_ct={0x4c, 0x1, 0x0, 0x0, {{0x7}, {0x24, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0xfdb}}, @TCA_CT_MARK={0x8, 0x10, 0x2}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x64}, 0x1, 0x0, 0x0, 0x20004000}, 0x10000800) r9 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r9, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_rx_ring(r9, 0x107, 0x5, &(0x7f0000000140)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x3ff, 0x2, 0x5}, 0x1c) r10 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x42901, 0x0) ioctl$TUNSETIFF(r10, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r11 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r11, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @broadcast}) write$tun(r10, &(0x7f0000000240)=ANY=[@ANYBLOB="034886dd0900300003003000000060ce902d9f0c2f0081e949b93897bc3b0000000000007d01ff02000000000000000000000000000112006558"], 0xfdef) close(r0) r12 = socket$inet6(0xa, 0x4, 0x2) setsockopt$inet6_IPV6_ADDRFORM(r12, 0x29, 0x1, &(0x7f00000001c0), 0x4) 4.052548812s ago: executing program 3 (id=2954): mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x32, 0xffffffffffffffff, 0x0) unshare(0x24060400) r0 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'macvtap0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = bpf$TOKEN_CREATE(0x24, &(0x7f0000000400), 0x8) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(r4, 0x1, 0x2f, &(0x7f0000000400), 0xa5e) bind$packet(r0, 0x0, 0x0) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xe, 0x6, &(0x7f0000000500)=ANY=[@ANYBLOB="05000000000000000000000000000f00851000000200000085000000a000000095000016000000009500a50500000000346b102ae0a6dddcabbaab778afc08129b"], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x6}, 0x70) sendmsg$nl_route_sched(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)=@getchain={0x24, 0x11, 0x1, 0xfffffffe, 0x2000001, {0x0, 0x0, 0x0, r1, {0x7, 0xa}, {0xd, 0xc}, {0x8}}}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x20048054) bpf$TOKEN_CREATE(0x24, 0x0, 0x0) r5 = socket$inet_tcp(0x2, 0x1, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r6, 0x8933, &(0x7f0000000000)={'vxcan1\x00', 0x0}) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=ANY=[@ANYBLOB="4000000010002104000000000200000000000000", @ANYRES32=0x0, @ANYBLOB="0000000000000000200012800800010068738008000100", @ANYRES32=r7, @ANYBLOB="08000200", @ANYRES32=r7, @ANYBLOB], 0x40}, 0x1, 0x0, 0x0, 0x20048000}, 0x0) pwritev(r3, &(0x7f00000002c0)=[{0x0}, {0x0}, {&(0x7f0000000600)="d6c0157595ef2ee22dfa3002d0521fd35d3e3f7c9ed4b7438de335e16ecb6e488abf28d0bcb075d0d2a307b4eb23e19276263ab8e6df34ee910ddc4d578e28d2356b3e99b46055e0f823c85acdb005972766b769a6f4dfddfa44c23343f64daa15def2c23f9badec570801431888c9bf99df02dd1247c0c46499a2be00", 0x7d}], 0x3, 0x8040000, 0x2) setsockopt$inet_tcp_int(r5, 0x6, 0x24, &(0x7f0000000280)=0x1, 0x4) recvmmsg(r5, &(0x7f0000000440)=[{{0x0, 0x0, 0x0}}], 0x300, 0x0, 0x0) syz_init_net_socket$x25(0x9, 0x5, 0x0) r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r9, 0x400454ca, &(0x7f0000000300)={'veth0_to_team\x00', 0x7101}) r10 = socket(0x400000000010, 0xa, 0x0) r11 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r10, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000180)=@newtfilter={0x54, 0x2c, 0x42f, 0x870bd28, 0x25dfdbff, {0x0, 0x0, 0x0, r12, {0x8, 0x7}, {}, {0xa, 0xf}}, [@filter_kind_options=@f_flower={{0xb}, {0x24, 0x2, [@TCA_FLOWER_KEY_ENC_OPTS={0x20, 0x54, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_GENEVE={0x1c, 0x1, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_GENEVE_CLASS={0x6}, @TCA_FLOWER_KEY_ENC_OPT_GENEVE_TYPE={0x2, 0x2, 0x81}, @TCA_FLOWER_KEY_ENC_OPT_GENEVE_DATA={0x5, 0x3, 0x3}]}]}]}}]}, 0x54}, 0x1, 0x0, 0x0, 0x22044028}, 0x0) r13 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xb, 0xb, &(0x7f00000009c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000202070250000000000202020c31af8ffa1000000bfa10000000000000701000000feffffb702000008000000b7030000000000008500000076000000fe243a0e5d65acee"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$INCFS_IOC_CREATE_FILE(r13, 0xc058671e, &(0x7f0000000180)={{'\x00', 0x1}, {0x1000}, 0x1, 0x0, 0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000480)='./file0\x00', &(0x7f0000000680)="7080a4ddae8d54331f6b28f1b15cb757f7c98a856ff0a00c57097298a3e40988fcfa6e452cf79efa8eeef208d6e3b7c7754f77ef271a708d52c1646e4d15b0bd538e9a07f59ed7dcd1e60d60c773f4f4bc8323abd5f84a9404347d1efc285a3e9a1564fa3b789c92699ed44d6f0cb2e85a40b30c8e35bea2cba5bcce0aeedddb390993934085f065c4eae222879a878bf74831dbf98a2e670720eae6bc0bb2113728e96a4a8114407cca8c8384f47cb835dc08632fa880eba1a3b5340ec2e754c5bb0c074524b5ddd6fb5243b893da78a56a413ae3493d6d1e87bdd7a72cdca8ebf7d8434d4630ddc6c2faa64108a43e5b6adc11fbf23adaf6027f3c3e1bd4059ad19739bf2e64edec67a81c15dd443d0707696d14bd103cf9535b02ff5a76f23ed285c95e5d8a8a000c8ae92d9609e68b90ece91c498ddfff4cade087fbccf4593803bc1ca08bf379bc5fd56dc0492b8d522c510a1954f6358c39351d43e94a05de2076aeee14511a3fddb0d6256cf3c73ee4308cab354331aec5dafdb7c1e58d5bb0c0b3f36a10cd838478e88659481a4992d15d0f02e59cab825471531dc3c658e983d40e3ed67dd35e66050a795fad08224212bbb30d4d2c896d6d18", 0x1be, 0x0, &(0x7f0000000680)=ANY=[], 0x1ec}) 3.496592921s ago: executing program 6 (id=2961): setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000040)=@raw={'raw\x00', 0x3c1, 0x3, 0x380, 0x0, 0xc8, 0x8, 0x0, 0x5803, 0x328, 0x2e8, 0x2e8, 0x328, 0x2e8, 0x3, 0x0, {[{{@ipv6={@local, @private1, [0xffffff00, 0xff000000], [0xff, 0x34da508f3e8fb0eb, 0xffffff00, 0xff], 'veth0_to_batadv\x00', 'veth1_to_team\x00', {0xff}, {0xff}, 0x89, 0x7, 0x7, 0x38}, 0x0, 0x168, 0x1a0, 0x0, {0x0, 0x2000000000000}, [@common=@unspec=@string={{0xc0}, {0x0, 0x100, 'bm\x00', "cfcaf80c672f61cd17ae5119b5135c2aee0500000000000000ecef50c3234e082555f67222476147864fa03182f5cf11d8c348cbd06d7d4e252c3394fed47bf78c70f607b0178fa5ea3350ebc989f1f34a214e67442ce98bbaa8e0f7323a4ca0a7be6c60c527bac2b500", 0x1, 0x3}}]}, @common=@inet=@SET3={0x38, 'SET\x00', 0x3, {{0x3, 0x6, 0x7}, {0x3, 0x3, 0x6}, {0x1, 0x1, 0x2}, 0x3, 0x29b}}}, {{@ipv6={@remote, @loopback, [], [], 'macvtap0\x00', 'syzkaller1\x00', {}, {0xff}, 0x0, 0x0, 0x2}, 0x0, 0xa8, 0x110}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x0, 0x0, 0x0, 0x0, 'netbios-ns\x00', 'syz1\x00', {0xfffffffffffffffd}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3e0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) unshare(0x20000400) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000feffff10850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000140)={r2, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f00000002c0)='./cgroup/cgroup.procs\x00', &(0x7f0000000300)=[0x0], 0x0, 0x0, 0x1}}, 0x40) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000100)={r3, 0x83, &(0x7f00000010c0)={0x0, 0x0, 0x0, &(0x7f0000000340)=""/194, 0xc2}}, 0x10) shutdown(r1, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000140)={0x0, 0x1c, &(0x7f0000000180)=[@in6={0xa, 0x4e20, 0x0, @private0}]}, &(0x7f0000000040)=0x10) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r1, 0x84, 0x77, &(0x7f0000000080)=ANY=[@ANYRES32=r4], 0x18) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ENABLE(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="14000000", @ANYRES16=r5, @ANYBLOB="039b0000"], 0x14}}, 0x0) 3.450905912s ago: executing program 3 (id=2962): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) getsockname$packet(r1, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000840)={&(0x7f0000000640)=ANY=[], 0x3c}}, 0x4c000) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="3c00000010000305005b68fdce0afc5924000000", @ANYRES32=0x0, @ANYBLOB="0000000006100000140012800b00010062726964676500000400028008000a00", @ANYRES32=r2], 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x440b0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_SET_LBT_MODE(r4, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000740)=ANY=[@ANYBLOB="14000000", @ANYRES16=0x0, @ANYBLOB="04006e4d9ca20000000000000000"], 0x14}}, 0x0) syz_genetlink_get_family_id$nfc(&(0x7f0000000cc0), r4) r5 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f00000012c0), r4) sendmsg$NLBL_MGMT_C_VERSION(r4, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r5, @ANYBLOB="030f0000000029740000000000000000008000000000"], 0x1c}}, 0x48000) r6 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000180), 0xffffffffffffffff) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r9 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r9, &(0x7f0000000380)={0xa, 0x14e24}, 0x1c) connect$inet6(r9, &(0x7f0000000100)={0xa, 0x4e24, 0x0, @rand_addr, 0x1}, 0x1c) sendmmsg(r9, &(0x7f000000b640)=[{{0x0, 0x0, &(0x7f00000007c0)=[{&(0x7f0000001140)="ef49b32ae11de7332688d5e5d53e3fc2256904d3a45408641c2e32280988a3630b4cc39529313132d3285e628df90c2ff7bcfc76c8bf4c1903a3a129e298a309eb3d06d19c55bd05f056101456286a2e83d4d33121534da6156517fd7d3323b5d3d89f036aed990dce419b702266c32ca5b6968793a79fc9318bd46563cfc465acef22796607d9fb0b80e133bed7d7db1dcdcc6d18389749e330ed1f86c48bce5b779e17731eca879f0fe6cf97b264abb2ebd9c23d95602e2c151adefce57a06cb5d6e7f4c5ba47747d05645899c7251b0f24329f6ef8d92d34ceb0b926c87bf683175102f690f24bc14a40b738d7d7ab3fff3a079df80e714cdb6f24241bb203e651d79b4c3286693ad775d64fe8cfe85977b34bb3bf98b9bad17f701493a5db07be42c8210a37e0b35ea4db720cefee5afb2a5170ff601c47737180222344337d0da94513885ea1a4d9883673b5226625ba6f04faeb3c4c308e96a288c6fcc24613471a5770d80f7133bcdb1e97860aa33a74f7cdfdba50b041f26f329dc02ef052d71f472032b51b39c9143cf58f306800483a3cc8d02aa7fa47449aea457490a92725e4d117f2c4cb192acfaa072202e44c4a347e499d0f9673f94d1ef87ce8ee2517a7cd3881119ffd0054eec273c9928817a288744c55d680d1ce008762d138d3809fa370942e4f8176d2d66e2170aed336ea1494c708f9934f8219e9b61ac662af2459c2e9107fb469c09227fb220e99b52d21a529f4588ffef69846c5cdf111b474a128c5790f99ae09fb66c4cd2171dfde68c7d9a3969c0a4f644c8ab0a1979ab9a88b958e9682ce8a80fe0f728708f78af3591247fbce3f492de416f1685880d37e2d94c98edbea8674e94362835d8c6aedc2aaf2a3c4456554c84ac6dc8d180ae12aecd6967ad20ff59d4beec7bf630418b07cef3dd7f29e6d844310c51a1d961d17d59bb94fb9cb4dd272c1c3cb3c5acf327e4434a2ec6cfb0734bbf31aeb23d54b3db6b6a89a558fd943e651576f91a450414e67e63a0c9b498165e128f88532393c4a79126e4f3bb2544fa81a571a0431a3a2f047fdcf8fcc159b62260523929e95b565f31e65ccc50863a6ea4bf5374c944ace6f82c1710eedd209f35f7f6496122f58b119c61bb355ea009070bd4dce5d8429c8b06675e1e9dc1e346860d0b48913e45dd4e2271f8c79eab93582c819c870edcab6da3c84d4614a22552a015c83e9cdc20e2819063d8eb4a40c406c27d86638fef08e2c5ff101a55b8e86a2de75f9978f365245332335e12dfe077b0d62604816ad0544391a49981cd2eb52ba554667744ba7b0c3a9fd7fda1508c2594854225bc880c810189608ee22bd22ceb3a2010fc173e2f5aa6f20eae8e8de25fb8fb925eb3825aed9a6bd60ae8fc4597b8b077c132f8bdba181be2b65b1656ce13691bdbd5894b0430d66ce0f383206f67ebc1b0797c6a1cef9e7ac5a736d3f9e3c396f302d6e39bdf698be92093dc86e3447ceb47183e4c8806a11a5d7e3b0fbf8b02a7f1a4d7e848ecd9120242de1ec9d05a09b96c4a75298bf552e8d0597bd82b723dfeecbdd2a52ec89ed9f55b13a4825579b590237a6e2fb0f4f86cf3b50ec79ccb8967eded43e906918bd692190e7ffe708ebe4f11d22737529e75e7c721c95a1deaaaedfe3d4cd7be7a683108c08f316912e0353ab91528fa7d63475025114a6bd799bd7b5025600ad83266712d7301cd24d6a1b72abf39549007fcdb167665665164c2dcc86fc38f5da03cafc91fa9b25e0c5719da1661064b7403138a9530a1a80a3ceec76abcbb172d94af89a765b88fb2b078216d8a318ce6aa05b3b21a877f2aefb6db214d2d03fceaae654e4c3c4cff6b2201f5e084036697f06d61a71cb5fbb055ab9b952a6d8012ffb650b2e79badca1be2ca924ab3465d184ecd4f3601b52ea42c4beb478b11b9b5d2375c5999cb3d440c14d288f24dbf9fbf8a7a8190c57f019a0d65a7eb41ce16aa99d8382d449c4c8d4df1116668bc6a5caa0b05d8edddedd3b56dbd5faabe790666a7a83f5ba2b49de8e030ebfb05b8169d3a9e0dda2d7c4f5c3b7a9b932c86ec02312ded68fd95669a6624119aafecd5bd6309b0ead6b1d17f7722bebdef5c758e6aca8ba597f53bda4fa4060d7763b34a8a7a07a19dfcb25ce38fbc761a587a02daeb1db444dcc5c40c0d473dc119f1af64edc510b43ad8af4fb504b8d1e425c4af32c6ae8496a8e9d0dbbbe55ba2aaf7acffbea6ed058dd7ffc98148fd50a1e423d91572b5c9708d51f041c44f2569d22b8770e6b2faf24faa85cdd3b5c5040f7dc9b36cd21e42a711937e5f0b9d78682b5e2f7d671dad98fdf31bcfd4a2e33c76c199cf1207073c27c22626518da1ad41cadd052de538675ff4544487853bb7b3c57222630778c808558db92597a478a4a695fd2e48e26687b926460faa3b6c16ef2f30559babff5033e78e483a4d88cebb94db56407f6d2bf1fba3b4be6cd42df2c7fffca8d808d21698a6851026cfac547478a4d4421399c90c381538f2e4b39c5a3cdc5711da5661f303c74069c46eb284da30950226cee43fadaeee8df27d88c466c7def91204dfbd0194e85a8a2b0197888b4c066c782d7cf79524c254aa0a0c15c0c71befdd4b3d855c87e5d186cbe452607c342d49691dd573d8ccce8abb39215fd3677d80366b77d869771e97fcf3a322ad3f8fd4158f680e71ebc5a4785e9a9f68128e1d0059b3bf41048a592bbd4a24bea39c679543382507de5394dc78a7210fafcab1133ab15cd5528bedb57ba0c78f53630f9467476ef8cf00d13e71d3413b5cb5ef7907e6e5ce34b5eea6b5af32f0a910a63b75b6a4f3d426c1fc003127e48e717e925ab70e106878d905dfa5ecd05d46c531c0561f8b77cd77ecb0172d42bd224485c512f02cd52d83c17788b82bb34d55f2f42089b3429bf25b1a8170972f684bdf7fef9a84abf0fb2d739a18985e7034c39dad5e0a77c454b7a62e7ec62756107f3af45b496f4cceb1abaa127223ff7f9ac258ded68ac0bca380292f2640403a90a6dfee658831bb50cbee5b3783b63385ef3d5cfe2e27515eab7839cb96106b8ffbeb0ab86897c5631e4ba02d4012579f495603602628646e9e7214954cf58da85a925e8ed90ada05c32aa1145e59507fe6f07661e5d055a1214dbf093664f78df372e4e761fa5f01bcd9f0efd359a80a48db89c90aaa778876c8b7392cd1d3cc62c64346a015f09e012d16604bed65d2d6e13d4ac71c3d4b2843ac6498669c53ebe6edc3031c730ce9de5f10a844dc6acbd4bc2b99ec1db3f1cd24642a04813c813c5ad73c1056873670c2f0045b5a468334ad0759d9e2c32d6f42f1a13087cc6922bd84d92319c92f4b02c1d9c11f1db7502c4e2e23e929ee8802234c7a60739e8998489bf872407eb0be314c0f257a3e55ce7c5805b97fb693cc554a8896f0868425b7885a28e8e636c540370f3de7879010cc0d12a2d179de12bc1d1e5e9425a6dee932adf348c1feef49c3955eab7dcd6b2b5d64c5142622fe0991df90bbf6bf59ee7f7ccc494444faff990a7987f601e3d0ac0673be9c5c42037df15a02be081d8e5464d634d39b865ad69367160588ce219a35f26845233dc62bfc009f8433b78fd5b5d1b9ecf0d2ffc8a8fa049b5adebcc4d55ae5df2b19bbc697bee351b1a3f0e18793d26223bdce74d140f6f2252f2ffdfd0d57b85e54506183edb4fe9244158033dfc2691a3fa0376762472389ad3552510fc9e05d8dbfe41d46e52fa87d027bb2e461b2a6b3b671a16c5593283cdbe48e538cc1ef48ee9997efa469d9da7a6d53332c1ace2b2ac67e4b339de48e9c7cdd11cf1665fced96488e78dbe2da8019dcc44e7c8b5136bb9cb820ed037d68a9ef507472f0242f8afe25048b6c32f35c18b49002825a82bfc4647ff952be8815d0da78c27e0f910f049a747300ba4c687169910a3c898216d490a458c16944b6b8d274a7e830d24f643cc1a96317a72b743ab593e7379b207b7be78ffa949c5f2b57f206abf90964c036ed767f413fb724d716bfd01aed146ea207bfdb7bae9b590f099a195de9a0489da2bd366cd045ed9b0e84cfbf9f3dc655c4963bdc0c31be7f0805157fd806d4ba4d2d114cb151c65ef9a73f6d3604c08812b9ebd416ee9866d62ed60bdebbf2deed92eeff79ec3b1589fd83df4c49f4de72d816e133534f17619c5cbfcc5a4d4bb5565b6967c095a6411a1926d6aeb66546c9083008a30205b2d67eaf9eb01c0f57a9854c18601c2fcf253021713faf78645a59e88af915986b23cfd8a40a56b5eb031e0a46e23db9c1ae87be47a14dec210583cdc75f0a43e3701df8a6a07469b64a37ab9cf1aa0194739631f367ad0fb98f148e740bf08961d792f0c87bb03772a7e8e814192c749b3600aa9314de472cee5a50ed462ae2737301d398df6f716010dd69cf12728ee3a42174347d075ea22b8b5806053756e132c195ea9c3e65d9f74ecbb2c203776bf8d815488100d855a70cce1187acac3d24c1fb33cdc2a4d9c45ddcb59d816bc9faeba580affbe9d113c11dfc76f992cde852d340cf37a9dd051d2c61673312807bdcfcf733bd946f3e0391bbb9cf5e869ea7d80af3f59b95ee460aacbb8763b758893520401c71a27fe66030a7b4a9f1be6d1ebb092e54e13d34d456de2d42b2394ffa9e23558a52cf92bb8623f30cd027ab74558f30c5c804df04e7a32358bf6ec253b443599456b9c79f558b421e738498c6bbf28db29a25c108ea8dc0818ce43114b08de03030c56571fde5f3a4361a4692b998ae53ba2da9a7b85fafbcecaffd84e96c7013c92279211f87e5e735cbd5f3c398b9c907064233837b40eceac8695db6661826f4d48cea2bdd1af57d17f2e17a08b7ee4fd5e94c86355ec36b0e3fae10a270ca63b43f0b780fad8a06e258d545c84d9ea7077f9262ea1108169ca7f2110725fb3f19e12a5e1fe63b1796fbb403cbee0ac2808ab5e28117c906c60cdddccb7c085580c25df844215e918e6468f0131e0903917e604c6bbc3ea6749eba68afe8a12df81f6828a6f68edf0ff91c55eb6e0ae0ae39fa7b1bca3427e94e81230bf4768fd035e8a7e9a9d52e3e1e6003d052b03edb06e00071ba1144a3a509056a6af20cf40e4c0200262ba55cbcd61e0742cb344fcfac533b9eb553bed88d330684d0583efb7007c2a2932d0aa8a3255dd6265d01ce1512ca89795accfcc85b71a873581c94b63e7405a2c47cb932d9679d8acdddbca0035852b52c7ec285f5584fe4ddaa25d692b018d2366de1d78e7f13d1da401e0f1deb9d902f27578c534c26f0ca325f86979a40f33ad732928e506cfff38de594ed61975234efab433503a444b2cf4e9c3d8e2d55edc7c13fab9f6f55ccb35d78fa7ab0ea587d34e417ecfcf01dc5ae7ad645fe8926f948df8aa058c5a64a2580cf5bb87609bb0cf0501280de48e43ff4b34a7a51d3cec1587518a78965d5dae1a32f4d612eb8743fa02042f530253c3687b41babd0b2c2601334bf4c3041c8642a2f43d865f4565bf97491959bc70a55d046476edcff322e1c63cc4dd43842e2142a1a6201ef5d5ce77ff22cdf25a023a054e8fcfdf293b7bae92343981a257f44fff69187f69069c0b998ce50334eba85f7fd89cf73117c1ea4ab0a118652de36426d058233f1cb44fe93ddf353623d9703d2d35b041b1a250c162ef60c65e301d8862bbba435e9f8a77661d37f7810720757156926d1254becf1f4199b1cd4d29b5299632c76d2e2", 0x1000}, {&(0x7f0000000200)="0a0cbed687a805b6cdb05279ac658ba3f79c571164e84d1426cdeb5ae6af9b98df887583a0b697cf0d046f0fbc3e1d435ed3992276ca148018dfac9e24f120fd0a2833d325c48ddff092206552bf2a4686ae8589a243f3c2206e6c2a10fbd5ec454faaf00a21bd22e85e11ab46687e7144d4c185719a7b6e572a80553a11da5c1d0920e9ccbd0049a0204f612d3a303108e505a1955b662da0a3fc992225db3037a766277f6a2b9ced43ccaf700285cc1d1fdfa2f524ac5047a8004483a27504480df759a0d8d59b0f2ad717291a24f0dec269", 0xd3}, {&(0x7f0000000140)="7c2ca058cd778bcd7f6e4a8ac3a458067b4aa774d60e509632433f90207b68c4", 0x20}, {&(0x7f0000000440)="2cacc77e9bd1ce9e3f72ae85eb6e880645030451f5ed4313291cdcc1253834de243da5c6d25555d65723efaba5db88ec595f7aaa52af8f26c41c62e53708cbbfb948a5136182cf12ad70d6b1a41f0148d91f583e9347edb168a02d4dd6aee65c247638514faf470b35295ccfa0cd19bb694df6ca68c17b366acf7a4bc298c7def44f61bdc746c75683c974d0ebeb4e3d1983f6", 0x93}, {&(0x7f0000000500)="ebc419191e2f02155ff0816f306057441c8d56b00737df62040fcde1710b72000b9156c3439091439ec523029821932875afe93d92894f79d61da850ef4a3d8bef0b83bb3bd78b6d87be961c4604167fe50ac9f01c7a1f33108860af1018896f0a07a44f98024038de97c7e96482768e4ba573664d8df7a5a8ca6b2aa6e355f01da8f1f3f0f0bcf8104702e4d3e0977666b3df93f89438fa3e62b2dc014b623c3b24c832d1972c2142582120b4820f9ed48e6a3d4c72f290df939205559c6b2e824272033d822dbfab0174a76652fa6f3e28d6538c7c96af9d239dddf3a7e463478e451db4f4e7a7c334a66601a003acee7030e392a5cc4e", 0xf8}, {&(0x7f0000000600)="da0aa59bf0a53f3fe46c032eeab8a7e78fe0a66865cb1089a6f80ec1227ab1afabb5b60eddcebed1497227a64c8d140aa2ceb65a1cf016b214e62befa2efe52da173dcf655ade64964abeab4d0cf112e82ac0d545e75bbc98405dcf8dbceb4f9c64d4ee91c207b65301ebd1d1bcc32ad3cdf48bfef968971cfeb86460de84e994db582a2563040ca20b69435f8ea2b6de12eeff04c49be81c78f001b930f39", 0x9f}, {&(0x7f00000006c0)="b1a201eb6ed35cbf98ec0671ca2f324b4bd625e1942b437c790b032f93ee5364f4132f1a3d5328c1e09f9f575d2f63d4f3dcdddd082de18b44c731c3fdf761eb7a7b174cff4d0f876aa0d35463f6f333c9ff0753f23320a5a14d47216d8755f62764200fd4a739af525e14f3186d22aa1d520bc757e45ee6b4dd4d43f63b2f7d910e099219e7388c5532385bcc015ef3c1ec37399d5f9e632e90f442577dcb1e05212a963cd84adbc4203f03adac7369ca60bfc97ed235b3e90438c63ef3cac2de053f228ed5e8b307f157cb4f232926a49306a977", 0xd5}, {&(0x7f0000002140)="2a99141f475248cb81ed4db45f7ccae5d20b50326f49aa17051a7d5da9060e0c15927b5d2b6c7adf58cd7abc9f1a6da252a555a82beb31880bb55ff0d7dfcbfc8ed279404bd4bbe02c85e3c345bdb1e99af77c53d6db825ed58da3a1b5b9854769c388d54629e4fa86cffc1ed1483cd879c6e2ca4283f0e2ca2c9246a3c064df360740f73e95063a2c1b2405b7d1c290a0438d3bd805c639af7a11f4aca1e23da8851ec3be154cd54d395a21e11373894eb89ea18178004d31696d73b42304d05cf9a9f406d72433c57eba14924bd55328e8be7e6b22b10f9ac71f6bf0a813254ba387b71804ba05ff08623e39e2d4bde0aecdd3702a43d150ab35cef675296b097afbd9e0358261c57ac09e940d49ad35353ce3d6a26e39e1340133df4f1fb9ca00adc40e659e57fe4f7e29475ed7de1d4415276a7fcaef9b21517f9897f53c564b6ca3f71508510370e67dadf4fa982f3c0e59890ac4516a9d55cf498bcb9938334532d57831b39f9fae5a36ebb17073d7a4b7c436762eb807968b1eeddb4b12dbedb77ce584dc519e8852df90c7d6a9663a8b4315bae7cf575ea17ec3d4f2248e96f22feb35e17603a2d3d54b403a9bd8e8f2b79bf229de7b1be665a945378745198a1cfd8f4d4c7f78f5de54f7593352ecddbe05df7725f99f5fb5e093f6c1af3db4a6d042c1e34200cebd4ebc063db9c632d46b0f815de46749f2172f17b31bde4b647f34d6eb37e3c22329ad85370ad9ee9acc6dbbfe241924cc25018c05b2015ae8f7cc0575ba7fddf8008e22667774168f6e2568d6d08532134c969d1c110ed80670beed7e7009048689efc08b7a7593488a1bb2c92fdd4d7bcd162531445b56abd2d6463fb752b44c13709ea58966b47c7f8f36cd1dfc576145f8c702ee34d0233f16cefb33c335a58c8f2ef1688318a3ad6d8f91b08e5f32aa8d55a822a68560fef5e76db21aa45f30ad6eeaa0e26ccdb24a0a6f1aa4578c5b92aafe23ad2f1c9b9579f8da99ed2ea281befe69105c0d0cdf5a79dfc61cb543332d6173492b72c43f0b934aff5731787033394eeb15ba6c09f23bf537ad70a08c658b5b7c854720405dbbb705485c66a17dcf52bd60c465cc653f58aa97e528f90a7ee1ffdfc6bfff323ab939ab6fa2782a75c3316c7c990767cd95256f860b25dac6ee2e8d1b49742571390ebe14e709764ceae47e0349420e98b33e007ab0f5f83b875455c8caece02c89ce715bc57a4b5a6d2731f8190bb77a41eb32046bcc3b9e524e741a1bd78e864c4644b53823150b18169f4fed2fb2ef4db25ccd9ac8e67a5e0c7a2dabff7100772e3c542c42bc92b77b309025505f85c28264302acae5a230d3b7e5ff65e9a91d75db423ecb0581a2da726693ca4e808f65b8da0aee9499eb218c4192e930f80232a5ac7d19dc939bff8c402dac0e63f1ec7d1b056b94c2d0411b01ef4e80f5ddc80cf8b1da283d744e34203a4a1ed8d69d6bf1a29d28c3e9ddd95d53b218e5b74e89ecdd822d5c6bbebde4a537252cda18ee8c02983ad9b278d73dbf5aeba9ce64e2be421263948c2002f82bcbd109d88200d644ffbd912a3648fd371f2e457c75622a28362c031476ee213586eb0546ad9b965d527ffe5bc80f29c51f8171f91fe432928d33b21269dde23f83ad5e0b7f5a904cd63f2619f01c100edbad22f95239e5bc5b5460eff15405495dc8a1ddc5aa096a527401ee0d2602666b8f17d777ce78a1c86f6e08e44f3774363207a675d6203a05cef4b673feb27c61c58144c40b456938dffc1d04c439af217be18762645039d3c2ff3a20608a36141ac17d964badc8745535a43d0ecd4cf9bd9a9a3454678a5bd84ceba36ad0b5b342f972c3cc0e73619b91d345eae63dae2bf8abd304cc1f0be3a1a697308224b1ca702c314967fc35d288c4c8324446b195e0e17bd4824ba89dbe10116823398886890f20df6777c1cf104e8afaaec99d5f87f0145b8a2332b40e03f43cae2168c0a43ef21d3d0f88c7432fc844a9302cec169668a5ef586c5421e19f84275764f4e76cca93419ac2232a0b98f466521d746060f9cce9dbb596dcb444b91ff12a8a526f4f216f83b6ade2291f05400e1de5d103097b3944dc66c2bd7cff6a0e02bc7e4eea2a0f435011e70b55c3ebe12e511333a092a50e50b23e08983270392122f20fc3b69193f665797a6bb085db9699dc44e2c67578ad1685095b220d3236a3da107577933390dd7b275e09fe9a0334d15f2a9ed6fc07fb87b25f877dcf6ea62d2a508081e6fc9f7fa133d75e2f3314bc5ca94c4fd291f7a3cadfca2292c6a673a8ed73865d73e6120d4531a36d58615d277b1281049f85b8ed27e84d60e28217d57a00390c518e20ccc1d9e2e546959bbd2d7e1fd649617abb070604041bd6ba7b7927e802bb00e041e498aff2286ecc696da0d84158534e6054962b858063f0d6c323f41f07b9ab52a366efa5dc2fd0000ae57fc203b509aa3849ca5f8f8edff0e73c0ec7788f792b9a5f3eeebc61c7fda87b76e683772bd82765d1c78e514a656c864e0063b1a22f5d9d7bce01c2ffb8bacc21e307f85386a16e17f06aad7154125a673ee71c1e6a59929743653d494fe795b298028593ee2510865f608478966a6f070edc04188c7799379e4a4f2d908fa1ba54a9fbdaa001be0e7249f59252a75715c328c79ce0d8ad161c4f6141a7fd55fee235c0d1b57715e756b051d321f38986e2a03158fed80e25fc8cdb2eebd9462044f0f334b7fd43fd94b0b6c1cd06947a55a9d22642ee4b4cb59afbb73550fc72909f7911f2aa07d13879b27ded48d417991068a2d95a0260c8e5075305324d4726d416bc9f8e52875766816ec31d47f5078946e5d1efe279f74ca6254896d7947b1b997019afc1b7a3e2a3ce9191ea163909ae83c3cc8db7ee3befb24432566104973f66e6e97c8fa65854324eda2a50d790e921738ce17c34d53cb07acf4c9f43a5a9d99b69c4a19a00e38b347af6d902aae990e8b111f1b5b073b81829107e58c11a0cb0bee8d358c13d5ff1462034b1b9227645518699a40c253974181dcfc2d9aed0f703e6df4dbf2a71b61f90898fbfb1e730bf76afeb8b82b0fdbfc9858dde27e4b88555dd93a2ba057f6b5a2d1ce46f94678f5b7230a86c136a1a55670c4d4c9c060d10dd135c0da4a5a9d659e676b28657244d742a99d7d9f8ffcad9b71fc855cac1a863434bfcddcd066b5a99b4f5e27d787137ceec013e9c413d1e3f690301ecd8f3e794cd06229f6f7ed94f7bfcdb54b15fb4e011af0d3b31692b6e8d570ed75af71338522bc57567267668bd4291094cd8216cd629543c3459ec538d999459bc56410cc3b52c98b7dd1317d31ed474fba8b25efbc7e134b0f1dd5d7ad5c1b84e83d88006fbd9259e7811e109634a6a4e3ab6d51ac0f619bd68033ba90da917b3687703527d794bcf7f5bb6dff819298a9a2a448a097a584cd1298b1452a00c4046d50f7003181b6dc7d86192f6b45c52bcf428e3d04a942025aed618bf0f96259dcebc263bbebac22f1990d3e92d75b3242d2c749eb5a1faa7b88fa64867fe6c0ba4247c6cf8cc8186ad79e978c72dd8e7a4ef1e79e7b61426b04b8ce9ace0c17605e785adce4531bc93c7118f46f03724a98190853c729be10e79c98dee855c83972d928f9c551049033bd62f3069d9bac0f840a531f7c3af4d4a7f7ae2205cd43087ed44ed71842a60759a726b833c364e8db3e8fdc26f4c582fb143388436b24c9501c959731ec62ae60bfd998d450672136fb93f0b7bff7ca8206f4a33e6dde00f29", 0xa87}], 0x8}}], 0x1, 0x0) splice(r9, 0x0, r8, 0x0, 0x7ffff000, 0x6) ioctl$sock_SIOCGIFINDEX_802154(r7, 0x8933, &(0x7f0000000ec0)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_DEL_SEC_KEY(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000380)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="010000000000000000001800000008000300", @ANYRES32=r10, @ANYBLOB="300030802c0001800800010000000000200003"], 0x4c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000380)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_GET_SEC_KEY(r4, &(0x7f0000000480)={&(0x7f0000000340), 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x48, r6, 0x8, 0x70bd2a, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r11}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}]}, 0x48}, 0x1, 0x0, 0x0, 0x1}, 0x10) r12 = socket(0x10, 0x803, 0x8) sendmsg$IPVS_CMD_SET_INFO(r12, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x2d}, 0x1, 0x0, 0x0, 0x8801}, 0x8000) getsockname$packet(r12, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) getsockopt$SO_J1939_PROMISC(r12, 0x6b, 0x2, &(0x7f0000000140), &(0x7f00000001c0)=0x4) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000000c0)={'bridge0\x00'}) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000feffff10850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 3.161122141s ago: executing program 6 (id=2963): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=@base={0x5, 0x4, 0x9, 0x8}, 0x50) r1 = epoll_create1(0x0) r2 = socket$unix(0x1, 0x1, 0x0) close(r2) socket$nl_rdma(0x10, 0x3, 0x14) setsockopt$sock_int(r2, 0x1, 0x2e, &(0x7f0000000040)=0x10009, 0x4) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r2, &(0x7f0000000000)={0xa0000000}) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x14, &(0x7f0000000580)=ANY=[@ANYBLOB="1802000000000000000000000000000018010000786c6c2500000000070000007b1af8ff00000000bfa100000000000007010000f8ffffffb700000000000000b7030000000000fd850000002d00000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 2.893428501s ago: executing program 6 (id=2966): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x4, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000feffff10850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x846428418dd40aa1, 0x70, '\x00', 0x0, @fallback=0x2b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = accept4$packet(0xffffffffffffffff, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000380)=0x14, 0x800) connect$packet(r1, &(0x7f00000003c0)={0x11, 0x8, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) (async, rerun: 32) getpid() (async, rerun: 32) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000100)={0x6, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000002000000000000000008082295"], &(0x7f0000000240)='syzkaller\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r2, 0x5, 0xb68, 0xffffffffffffff6b, &(0x7f0000000000)="ff", 0x0, 0x149c, 0x503, 0x0, 0x0, 0x0, 0x0, 0x2, 0xffff80fe}, 0x48) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000001c0)={r0, 0x0, 0x30, 0x0, @val=@netkit={@void, @value=r2}}, 0x1c) (async, rerun: 32) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) (rerun: 32) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000096c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newtaction={0x14, 0x30, 0x1}, 0x14}, 0x1, 0x0, 0x0, 0x4000004}, 0x0) (async, rerun: 64) bind$bt_l2cap(r3, &(0x7f00000002c0)={0x1f, 0x0, @any, 0xfffa}, 0xe) (async, rerun: 64) r5 = socket$nl_route(0x10, 0x3, 0x0) (async, rerun: 64) socket$inet_icmp_raw(0x2, 0x3, 0x1) (async, rerun: 64) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) (async) close(0x4) (async) syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/pid_for_children\x00') (async) unshare(0x6a040000) (async) ioctl$FS_IOC_GETFSMAP(r4, 0xc0c0583b, &(0x7f00000004c0)={0x0, 0x0, 0x2, 0x0, '\x00', [{0xffff7d3e, 0x83f0, 0x8a, 0x1, 0x649, 0x4}, {0xcab5, 0xffffff00, 0x7, 0x0, 0x7, 0x3ff}], ['\x00', '\x00']}) socket$nl_route(0x10, 0x3, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$GTP_CMD_GETPDP(r6, &(0x7f0000000700)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000006c0)={&(0x7f0000000680)={0x28, 0x0, 0x200, 0x70bd2a, 0x25dfdbfc, {}, [@GTPA_TID={0xc, 0x3, 0x1}, @GTPA_PEER_ADDRESS={0x8, 0x4, @multicast1}]}, 0x28}}, 0x24000082) (async) r7 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_STRSET_GET(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000880)={0x1c, r7, 0x705, 0x70bd2b, 0x25dfdbff, {}, [@ETHTOOL_A_STRSET_STRINGSETS={0x4}, @ETHTOOL_A_STRSET_COUNTS_ONLY={0x4}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40008d0}, 0x0) (async) sendmsg$nl_route(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="5400000010000104000000000000000000000006", @ANYRES32=0x0, @ANYBLOB="00000000060000000a0003000000000000000000280012800b000100697036746e6c00008014000200fe8000000000000000000000000000aa"], 0x54}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) (async) sendmsg$IPSET_CMD_ADD(r8, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=ANY=[@ANYBLOB="50000000090601020000000000000000020000840900020073797a31000000000500010007000000280007800c00018008000140fffffff70500070084000000060004404e22000006000540"], 0x50}, 0x1, 0x0, 0x0, 0x10000082}, 0x90) (async) r9 = syz_init_net_socket$ax25(0x3, 0x2, 0x7) ioctl$sock_ax25_SIOCADDRT(r9, 0x890b, &(0x7f00000000c0)={@default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x0, [@default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @null]}) socket$inet6(0xa, 0x80000, 0x2) 2.890999136s ago: executing program 2 (id=2967): socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) sendmmsg$inet(r0, &(0x7f0000001540)=[{{0x0, 0xfffffffffffffda1, 0x0, 0x0, 0x0, 0x0, 0xd0010100}}], 0x40001b6, 0x0) connect$tipc(r0, &(0x7f00000000c0)=@nameseq={0x1e, 0x1, 0x0, {0x1, 0x3, 0x4}}, 0x10) 2.59725894s ago: executing program 2 (id=2968): r0 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000080"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) close(r0) r1 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r1, &(0x7f0000f5dfe4)={0xa, 0x4e20}, 0x1c) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@ipv6_newaddrlabel={0x38, 0x48, 0xe4945d2eb074039d, 0x0, 0x0, {}, [@IFAL_LABEL={0x8}, @IFAL_ADDRESS={0x14, 0x1, @mcast2={0xff, 0x5}}]}, 0x38}}, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xf, 0x4, 0x4, 0x12}, 0x50) r4 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0xe, 0x4, &(0x7f0000000400)=ANY=[@ANYBLOB="18020000801000000000000004000000850000002700000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00}, 0x80) r5 = socket(0x15, 0x800, 0x1) socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000580)={'veth0_to_team\x00', 0x0}) r7 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r7, &(0x7f0000000240)="800000800000210ee7decd7a0000000088a8", 0x12, 0x0, &(0x7f00000001c0)={0x11, 0x8100, r6, 0x1, 0xd8, 0x6, @broadcast}, 0x14) sendmsg$nl_route_sched(r5, &(0x7f0000000440)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2b, 0x25dfdbfd, {0x0, 0x0, 0x0, r6, {0x2, 0x3}, {0xfff1, 0x1}, {0x3, 0xb}}, ["", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x6044841}, 0x1c69d8c8a0d305b8) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000600)={@cgroup, r4, 0x5, 0x0, 0x0, @void, @value=r0}, 0x20) r8 = socket$inet6_udplite(0xa, 0x2, 0x88) getsockopt$inet6_int(r8, 0x29, 0x31, 0x0, &(0x7f00000004c0)) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000001c0)={{r3}, &(0x7f0000000140), &(0x7f0000000180)=r0}, 0x20) ioctl$sock_SIOCOUTQNSD(r7, 0x894b, &(0x7f0000000540)) socket$can_bcm(0x1d, 0x2, 0x2) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0xffffffff, 0x10000007, 0x4, 0xffffffffffffffff, 0x1, 0x4}, 0x0, &(0x7f00000002c0)={0x3ff, 0x400000, 0x8, 0x9, 0x0, 0x201, 0x7fffffff, 0xfffffffffffffffe}, 0x0, 0x0) syz_emit_ethernet(0x91, &(0x7f0000000280)=ANY=[@ANYBLOB="ffffffffffffbbbbbbbbbbbb86dd6a000000005b1100fe8000000000000000000000000000aafe8000000000000000000000000000aa4e1d4e20005b90"], 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f00000005c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000500)=0x14) 2.485296517s ago: executing program 6 (id=2969): r0 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e24, @multicast2}, 0x10) connect$inet(r0, &(0x7f00000009c0)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x21}}, 0x10) (async) r1 = bpf$ITER_CREATE(0x21, &(0x7f0000000140), 0x8) ioctl$IOCTL_GET_NCIDEV_IDX(r1, 0x0, &(0x7f0000000200)) (async, rerun: 32) r2 = socket$rxrpc(0x21, 0x2, 0xa) (rerun: 32) setsockopt$RXRPC_SECURITY_KEY(r2, 0x110, 0x1, &(0x7f0000000000)='\xe8!3\x00', 0x4) (async) r3 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0xca02}) socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="340000003e000701feffffff00000000017c0000040042800c000180060200a990390000100002"], 0x34}, 0x1, 0x0, 0x0, 0x4004095}, 0xc000) (async) r5 = socket$nl_generic(0x10, 0x3, 0x10) bpf$OBJ_GET_MAP(0x7, &(0x7f00000002c0)=@generic={&(0x7f0000000280)='./file0\x00', 0x0, 0x18}, 0x18) (async) sendmsg$nl_generic(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)=ANY=[@ANYBLOB="340000003e000701fe", @ANYRESHEX=r1], 0x34}, 0x1, 0x0, 0x0, 0x4000895}, 0xc000) r6 = socket(0x10, 0x3, 0xc0) (async, rerun: 64) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) (async, rerun: 64) r7 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x800) sendmmsg$alg(r7, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) (async) recvmsg(r7, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000003c0), r7) ioctl$SIOCAX25OPTRT(r6, 0x89e7, &(0x7f0000000100)={@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0x2, 0x44}) preadv(r3, &(0x7f0000000340)=[{&(0x7f0000000000)=""/30, 0x1e}], 0x1, 0x8, 0x2) (async) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) (async) r8 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r8, &(0x7f0000000000)="c5", 0x1, 0x0, &(0x7f00000000c0)={0xa, 0x0, 0x20000, @local, 0x13}, 0x1c) (async) setsockopt$inet_sctp6_SCTP_MAX_BURST(r8, 0x84, 0x14, &(0x7f0000000300)=@int=0x800, 0x4) (async, rerun: 64) setsockopt$sock_timeval(r1, 0x1, 0x15, &(0x7f0000000380)={0x77359400}, 0x10) (async, rerun: 64) syz_emit_ethernet(0x66, &(0x7f0000000b00)=ANY=[@ANYBLOB="0180c20000000180c200000e86dd6b5925ab0030670120010000000000000000000000000002ff020040000000000000000000000001ccd8212d969360d3098be45cb7dfcba098ab564e43df94e07d38cc1abf5ae3415ac869de83ee42d5b0c264225602c82a"], &(0x7f0000000d80)={0x0, 0x2, [0x304, 0xb43, 0x400, 0x174]}) (async) sendmmsg(r0, &(0x7f000000bb80)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000a00)="5249855f29ffa36c2200fe6c26026506137d5a21ef8690d9f11ce41a28541f585b1a9a07a16abd8ba2e1c8caef478b5da364", 0x32}], 0x1}}], 0x1, 0x4000005) 2.203124106s ago: executing program 6 (id=2972): epoll_create1(0x80000) r0 = socket$unix(0x1, 0x2, 0x0) r1 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r1, &(0x7f00000005c0), 0x10) recvmmsg(r1, 0x0, 0x0, 0x10002, 0x0) sendmsg$can_bcm(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="050000007f0000000000010000000000", @ANYRES64=0x0, @ANYRES64=0x2710], 0x48}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000680)={0x7c, 0x2, 0x6, 0x801, 0x0, 0x0, {0x7, 0x0, 0x4}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x30, 0x7, 0x0, 0x1, [@IPSET_ATTR_BUCKETSIZE={0x5, 0x15, 0x8}, @IPSET_ATTR_CADT_FLAGS={0x8, 0x8, 0x1, 0x0, 0x4}, @IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @broadcast}}, @IPSET_ATTR_MARKMASK={0x8, 0xb, 0x1, 0x0, 0x200}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4e21}]}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x0}]}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:ip,mark\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x1}]}, 0x7c}}, 0x0) setsockopt$SO_TIMESTAMP(r1, 0x1, 0x1d, &(0x7f0000000180)=0x2, 0x4) recvfrom$packet(r1, &(0x7f0000000140)=""/34, 0x22, 0x40000000, 0x0, 0x0) r3 = socket(0x2, 0x80805, 0x0) r4 = socket$inet(0x2, 0x2, 0x0) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x33, &(0x7f0000000040)={0x1, &(0x7f0000000140)=[{0x6, 0x8, 0x1, 0xfffffffd}]}, 0x10) sendmmsg$inet(r3, &(0x7f0000000600)=[{{&(0x7f0000000080)={0x2, 0x0, @multicast2}, 0x10, &(0x7f0000000000)=[{&(0x7f00000000c0)='`', 0x1}], 0x1}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYRES16=r1], 0x10}}], 0x2, 0x0) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="000000000000fff21400077f08001140000000000500150000000000050005000a000000050001000700000005000400000000000900020073797a310000000011000300686173683a69702c6d61726b00000000"], 0x60}, 0x1, 0x0, 0x0, 0x24004080}, 0x0) r7 = socket(0x2000000015, 0x80005, 0x0) bind$inet6(r7, &(0x7f0000000180)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000006280)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000800)={0x3, 0x5, &(0x7f0000000140)=ANY=[@ANYBLOB], 0x0, 0x2, 0x0, 0x0, 0x41000, 0x20, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x80000000}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) r8 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r8, &(0x7f0000002140)={0xa, 0x4e25, 0x1, @mcast2, 0x7}, 0x1c) sendmmsg$inet6(r8, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}}], 0x400000000000172, 0x4001c00) getsockname$packet(r7, 0x0, &(0x7f0000000300)) bpf$MAP_CREATE(0x0, &(0x7f00000007c0)=ANY=[@ANYRESHEX=r7, @ANYRES64=0x0, @ANYBLOB="0300"/20, @ANYRES8=r8, @ANYRES32, @ANYRES8=0x0], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0xe, &(0x7f0000000680)=ANY=[], &(0x7f0000000400)='syzkaller\x00', 0x3, 0x1006, &(0x7f0000002080)=""/4102, 0x0, 0xb, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x9d8}, 0x94) sendmsg$NL80211_CMD_DEL_PMKSA(r3, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000000c0)={&(0x7f0000000700)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="040028bd7000fcdbdf0000001200f3ff08001f010100000008001f01090000000a00060050505050505000000600fd0003000000000000000000000000000ed1482bf07d7fb6cfdfc172409d37577919498d8201c03a03d8fa815e7623a245a93949517a8d6be3d40dafea1c968c23fb0eeabf17541c732c27c675f911a82a4de525bd66ac7cffedf1b218ae38c11ab0ff30362211afe9f9d31703a4f3698f5118418c109c24dd261572b94f99dbc51318"], 0x44}, 0x1, 0x0, 0x0, 0x20000014}, 0x20008090) setsockopt$sock_int(r0, 0x1, 0x2e, &(0x7f0000000040)=0x80, 0x4) 1.869330067s ago: executing program 6 (id=2975): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-twofish-3way\x00'}, 0x45) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x50, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x14}, @NFTA_SET_DESC={0xc, 0x9, 0x0, 0x1, [@NFTA_SET_DESC_SIZE={0x8, 0x1, 0x1, 0x0, 0x81}]}]}, @NFT_MSG_NEWSETELEM={0x40, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, "d103"}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xb8}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) (async) r2 = accept4(r0, 0x0, 0x0, 0x0) getsockopt$MRT(r2, 0x0, 0xcf, &(0x7f00000000c0), &(0x7f00000001c0)=0x4) (async) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000200)="ad00"/16, 0x10) (async) readv(r2, &(0x7f0000000140)=[{&(0x7f0000000600)=""/152, 0x98}], 0x1) (async) recvmmsg(r2, &(0x7f0000002440), 0x3ffffffffffff67, 0x0, 0x0) (async) read$alg(r2, &(0x7f0000000080)=""/47, 0x2f) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)={0x24, 0x2c, 0x107, 0x70bd2b, 0x25dfdbff, {0x5, 0x7c}, [@nested={0xc, 0x1, 0x0, 0x1, [@typed={0x8, 0x16, 0x0, 0x0, @fd=r3}]}, @nested={0x4, 0x3}]}, 0x24}, 0x1, 0x0, 0x0, 0xc000}, 0xc010) (async) sendmmsg$unix(r2, &(0x7f0000001040)=[{{0x0, 0x0, &(0x7f00000007c0)=[{&(0x7f00000002c0)="0a690b6528a1f42d548655afb9", 0xd}, {&(0x7f0000000300)="dd5722a4ada647acf96f7778f3ab8a7dd0ecdc630c69655dff751cbf8e247fdab0058811f721758f4e5671f2093b80", 0x2f}, {&(0x7f00000003c0)="107b5c9b209d083fd0dee19bf2ae62f83fad9168be3cb66dcb11fa2dcac0d3120e5e4a3e38", 0x25}, {&(0x7f00000004c0)="15daa9013e28e13b10413e820291e0290267f7ef53a02da4a4630ee72b9e492821e9764377379dcb0e58575488acd91a74c343b40966bc", 0x37}], 0x4, 0x0, 0x0, 0x200400c4}}], 0x1, 0xc000) 1.711873123s ago: executing program 2 (id=2978): socket$netlink(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000000c0)) r0 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000240)={0x0, 0x24}}, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB="200000006a0083130000"], 0x20}}, 0x0) sendmmsg(r1, &(0x7f00000002c0), 0x40000000000009f, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000ac0), r2) sendmsg$NLBL_CALIPSO_C_ADD(r2, &(0x7f0000000b80)={0x0, 0x11, &(0x7f0000000b40)={&(0x7f0000000400)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="017000fd030200000802000000000000000000bcced54b966b67b899cdd2ca0bf412cca896385dab7ca972febba0d7311914364cf94314f2b3a3a41a1aefc8322797cf92eca6aac7680f373a64027ac112047ead982efc44c8f1ebeed483d44f161bc6b33b03ebec752ca80880451ba7bf193e540ae7d4eab376a68c3e18f63686c2e8d171e35d107c4b3996d6593fe88953ee5e3371"], 0x24}, 0x1, 0x0, 0x0, 0x24004810}, 0x20020000) close(0x4) syz_open_procfs$namespace(0x0, 0x0) r4 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x161042, 0x0) ioctl$PPPIOCNEWUNIT(r4, 0xc004743e, &(0x7f00000001c0)=0x3) ioctl$PPPIOCSPASS(r4, 0x40107447, &(0x7f0000000080)={0x2, &(0x7f0000000100)=[{0x54, 0xff, 0x0, 0x8}, {0x6, 0x74, 0x6}]}) unshare(0x6a040000) socket$inet_tcp(0x2, 0x1, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x801, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x54, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0xc}, @NFTA_SET_FLAGS={0x5, 0x3, 0x1, 0x0, 0x8}, @NFTA_SET_DATA_LEN={0x8, 0x7, 0x1, 0x0, 0x31}, @NFTA_SET_DATA_TYPE={0x8}]}, @NFT_MSG_NEWSETELEM={0x38, 0xc, 0xa, 0x101, 0x0, 0x0, {0x7}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x0, 0x1, 'syz0\x00'}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0xd4}}, 0x884) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000001240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="5c000000020605000a0000000000000000000000100003006269746d61703a706f72740005000400000000000900020073797a300000000005000500050000000500010006000000140007800600044000000000060005"], 0x5c}, 0x1, 0x0, 0x0, 0x4000}, 0x24000800) bind$inet6(r5, &(0x7f0000d84000)={0xa, 0x2, 0x0, @loopback}, 0x1c) shutdown(r5, 0x1) setsockopt$inet6_tcp_TCP_MD5SIG(r5, 0x6, 0xe, &(0x7f0000000300)={@in6={{0xa, 0x4e21, 0x0, @dev={0xfe, 0x80, '\x00', 0x12}}}, 0x0, 0x0, 0x22, 0x0, "bb353738cb473fc7c9f1cf53b6a7b4e23602a3c364ca41d6e5615445244740bd4c0b42a21d7214bf92594925208a0e2f964e654dc534a6324d4993fcf19b2df3ee818a118a7c49462189316d556d2ccd"}, 0xd8) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000004c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}]}, @NFT_MSG_NEWRULE={0x60, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0xfffd}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x38, 0x4, 0x0, 0x1, [{0x61, 0x1, 0x0, 0x1, @xfrm={{0x9}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_XFRM_DIR={0x5, 0x3, 0x1}, @NFTA_XFRM_SPNUM={0x8, 0x4, 0x1, 0x0, 0x6}, @NFTA_XFRM_DREG={0x8, 0x1, 0x1, 0x0, 0x15}, @NFTA_XFRM_KEY={0x8, 0x2, 0x1, 0x0, 0x2}]}}}]}]}], {0x14}}, 0xd4}}, 0x4000040) 1.472664367s ago: executing program 1 (id=2981): r0 = socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0xd, 0x4, &(0x7f00000000c0)=ANY=[@ANYBLOB="180000000000000000000000000000006119c0000000000095000000000000007b713d150b62647a41798408f774250fd2638b0eeac8c7666bb43da414305727012b31da31efd0441b32bfa3edaf86ee01f3116ed74e0c78c25ddb5daaa11900"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xf}, 0xb6) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000000)={'dummy0\x00', &(0x7f00000001c0)=@ethtool_eeprom={0xc, 0x5, 0xb, 0xd0, "1390c264998292b413da997b22d02a3d8f7bc3ce547afe6dd017f1407d1ba55ab902425555fcb6f6c8a737ca81da8d6bebfd6f11b7224c0f7db8122b85db886801a8d5303dd80b26dda58283d52c74d427887b8dc66a2a8d58a584e950f24040300d1b95a088bbb893a007d53ed814e23c1c252174f0fd81776fef3c7270543e69f95a87babfb18b1cfe10984318ee52f8908b7badf14c8f1e038f0275d307462dec2eac81f861f0364e4a075dea112c054a3d4943b929573ed65b7a338c51f3e7435bbd5317ad34e4062b4aecb051b9"}}) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="4c0000001000ffff27bd7000fedbdf2500000000", @ANYRES32=0x0, @ANYBLOB="150c0000000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32, @ANYBLOB="080004001bff0f"], 0x4c}, 0x1, 0x0, 0x0, 0x28001}, 0x8000) 1.422814771s ago: executing program 4 (id=2982): unshare(0x2c020400) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1004c, '\x00', 0x0, @sk_reuseport, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0xffb5, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x43}, 0x90) (async) r0 = socket(0xa, 0x3, 0x3a) (async) r1 = socket$nl_route(0x10, 0x3, 0x0) (async) r2 = socket$inet_udp(0x2, 0x2, 0x0) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=@newlink={0x40, 0x10, 0x401, 0x70bd29, 0x0, {0x0, 0x0, 0x0, 0x0, 0x32b}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @gtp={{0x8}, {0x14, 0x2, 0x0, 0x1, [@IFLA_GTP_FD0={0x8, 0x1, @udp=r2}, @IFLA_GTP_FD1={0x8, 0x2, @udp=r2}]}}}]}, 0x40}}, 0x0) setsockopt$MRT6_ADD_MFC_PROXY(r0, 0x29, 0xd2, &(0x7f0000000600)={{0xa, 0x0, 0x8, @local}, {0xa, 0x0, 0x0, @empty}, 0x1}, 0x5c) setsockopt$MRT6_ADD_MFC_PROXY(r0, 0x29, 0xd3, &(0x7f00000000c0)={{0xa, 0x0, 0x0, @local}, {0xa, 0x0, 0x0, @empty}, 0x1, {[0x0, 0x0, 0x0, 0x0, 0x0, 0xe3]}}, 0x5c) (async) read(0xffffffffffffffff, &(0x7f00000005c0)=""/93, 0x5d) (async) r3 = socket$xdp(0x2c, 0x3, 0x0) getsockopt$XDP_MMAP_OFFSETS(r3, 0x11b, 0x1, 0x0, &(0x7f0000000380)) (async) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r5 = openat$cgroup_ro(r4, &(0x7f0000000380)='memory.stat\x00', 0x275a, 0x0) read(r5, &(0x7f0000000040)=""/190, 0xbe) (async) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[@ANYRESDEC, @ANYRES16=0x0, @ANYBLOB="feffffff00"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000000000000000000000000000bccd2d6b769f184b"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x6, 0xc, &(0x7f00000006c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x7}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r6}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xffff8441}, {}, {0x4}, {0x6, 0x0, 0xa}, {}, {}, {0x85, 0x0, 0x0, 0x33}}]}, &(0x7f00000004c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0x2, 0x2172, 0xffffffffffffffff, 0x0) (async) r7 = socket$nl_generic(0x10, 0x3, 0x10) (async) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) mmap(&(0x7f0000005000/0x1000)=nil, 0x1000, 0x0, 0x13, r7, 0x0) (async) mmap(&(0x7f0000007000/0x1000)=nil, 0x1000, 0x1000009, 0x11, r8, 0xd371f000) (async) mmap(&(0x7f0000002000/0x2000)=nil, 0x2000, 0x2000007, 0x12, r7, 0x12574000) (async) r9 = socket$inet6_udp(0xa, 0x2, 0x0) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x300000b, 0x12, r9, 0xa6d63000) r10 = socket$rds(0x15, 0x5, 0x0) mmap(&(0x7f0000004000/0x3000)=nil, 0x3000, 0x0, 0x13, r10, 0x9d535000) (async) r11 = socket$inet6_tcp(0xa, 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000300)={&(0x7f0000000440)=ANY=[@ANYBLOB="9feb01001800000000000000010000007c00000002000000000000000000000e0000000000000000000000000680000d00000000000000000000000000000000000000000000000000000000030000000000000009000000000000000000000000000000000000000000000c00000000000000000000000900000000090000000000000200000000000000000000000902"], 0x0, 0x96}, 0x28) (async) setsockopt$IP6T_SO_SET_REPLACE(r11, 0x29, 0x40, &(0x7f0000000040)=@raw={'raw\x00', 0x3c1, 0x3, 0x3f8, 0x0, 0xc8, 0x8, 0x0, 0x5803, 0x328, 0x2e8, 0x2e8, 0x328, 0x2e8, 0x3, 0x0, {[{{@ipv6={@local, @private1, [0xffffff00, 0xff000000], [0xff, 0x34da508f3e8fb0eb, 0xffffff00, 0xff], 'veth0_to_batadv\x00', 'veth1_to_team\x00', {0xff}, {0xff}, 0x89, 0x7, 0x7, 0x38}, 0x0, 0x190, 0x1c8, 0x0, {0x0, 0x2000000000000}, [@common=@unspec=@string={{0xc0}, {0x0, 0x100, 'bm\x00', "cfcaf80c672f61cd17ae5119b5135c2aee0500000000000000ecef50c3234e082555f67222476147864fa03182f5cf11d8c348cbd06d7d4e252c3394fed47bf78c70f607b0178fa5ea3350ebc989f1f34a214e67442ce98bbaa8e0f7323a4ca0a7be6c60c527bac2b500", 0x1, 0x3}}, @common=@inet=@set2={{0x28}, {{0xfffe, 0x5, 0x4}}}]}, @common=@inet=@SET3={0x38, 'SET\x00', 0x3, {{0x3, 0x6, 0x7}, {0x3, 0x3, 0x6}, {0x1, 0x1, 0x2}, 0x3, 0x29b}}}, {{@ipv6={@remote, @loopback, [], [], 'macvtap0\x00', 'syzkaller1\x00', {}, {0xff}, 0x0, 0x0, 0x2}, 0x0, 0xf8, 0x160, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x0, 0x0, 0x0, 0x0, 'netbios-ns\x00', 'syz1\x00', {0xfffffffffffffffd}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x458) 1.363029304s ago: executing program 4 (id=2983): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="600000001000030d2dbd7000fbdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="8621020017820000400012800e0001006970366772657461700000002c000280140006000000000000000000000000000000000114000700ff"], 0x60}, 0x1, 0x0, 0x0, 0x2000c010}, 0x16c3035570970880) r1 = epoll_create1(0x0) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r2, &(0x7f0000000000)={0x40002000}) sendmsg$inet(r2, &(0x7f0000000480)={0x0, 0x0, 0x0}, 0x20040005) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$bt_BT_VOICE(r3, 0x112, 0xb, &(0x7f0000000040)=0x60, 0x2) 1.285309469s ago: executing program 1 (id=2984): r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) r1 = syz_init_net_socket$bt_rfcomm(0x1f, 0x3, 0x3) getsockopt$bt_rfcomm_RFCOMM_CONNINFO(r1, 0x12, 0x2, &(0x7f0000000040)=""/224, &(0x7f0000000140)=0xe0) connect$bt_rfcomm(r0, &(0x7f0000000000)={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0xf}, 0x1}, 0xa) getpeername(r1, 0x0, &(0x7f0000000180)) 1.23397684s ago: executing program 4 (id=2985): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'bond0\x00', 0x0}) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32=0x1, @ANYBLOB='\r\x00'/20, @ANYRES32=r1, @ANYRES32, @ANYBLOB="8800"/12], 0x50) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000200)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0x0}, 0x50) r3 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000980)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x1, '\x00', 0x0, 0x0}, 0x50) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_NL_LINK_SET(r4, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1060600}, 0xc, &(0x7f0000000080)={&(0x7f00000003c0)={0x170, r5, 0x800, 0x70bd2a, 0x25dfdbfd, {}, [@TIPC_NLA_SOCK={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x5}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x4}]}, @TIPC_NLA_NET={0x28, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0x20}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x6}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x5}]}, @TIPC_NLA_BEARER={0x48, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e24, 0x40, @dev={0xfe, 0x80, '\x00', 0x40}, 0xfffffc36}}, {0x20, 0x2, @in6={0xa, 0x4e20, 0xfffffffe, @empty, 0x2}}}}]}, @TIPC_NLA_PUBL={0x2c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x7}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x2}, @TIPC_NLA_PUBL_LOWER={0x8}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x1}, @TIPC_NLA_PUBL_TYPE={0x8}]}, @TIPC_NLA_BEARER={0x4}, @TIPC_NLA_BEARER={0xa8, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xe, 0x1, @l2={'eth', 0x3a, 'vlan0\x00'}}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0xa926}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x5, @private0={0xfc, 0x0, '\x00', 0x1}, 0x9}}, {0x14, 0x2, @in={0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}}}}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e24, 0x2, @private0={0xfc, 0x0, '\x00', 0x1}, 0x8}}, {0x14, 0x2, @in={0x2, 0x4e22, @broadcast}}}}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x4}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}]}]}, 0x170}, 0x1, 0x0, 0x0, 0x20000000}, 0x840) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x11, 0x1c, &(0x7f00000002c0)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0xfffff7dd}, {{0x18, 0x1, 0x1, 0x0, r3}, {}, {}, {0x85, 0x0, 0x0, 0x5}, {0x4, 0x1, 0xb, 0x9, 0xa}}, {{0x5, 0x0, 0x3}}, [@snprintf={{0x7, 0x0, 0xb, 0x2}, {0x3, 0x2, 0x3, 0xa, 0x9}, {0x5, 0x0, 0xb, 0x9, 0x0, 0x0, 0x1}, {0x3, 0x3, 0x6, 0xa, 0xa, 0xfff8, 0xf1}, {0x7, 0x1, 0xb, 0x6, 0x8}, {0x7, 0x0, 0x0, 0x8, 0x0, 0x0, 0xfffffdff}, {}, {}, {0x7, 0x0, 0xc}, {0x18, 0x2, 0x2, 0x0, r2}, {}, {0x46, 0x8, 0xfff0, 0x76}}], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000001b00)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0xa, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800000}, 0x94) 1.164905525s ago: executing program 2 (id=2986): mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x800005, 0x32, 0xffffffffffffffff, 0x852ac000) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmmsg$inet6(r0, &(0x7f0000000bc0)=[{{&(0x7f00000000c0)={0xa, 0x4e20, 0x1, @local, 0x7}, 0x1c, &(0x7f00000003c0)=[{&(0x7f0000002700)="89", 0x1}], 0x1}}, {{&(0x7f00000084c0)={0xa, 0x4e21, 0x0, @private0={0xfc, 0x0, '\x00', 0x1}}, 0x1c, &(0x7f00000002c0)=[{&(0x7f0000008500)="88", 0x1}], 0x1}}], 0x2, 0x24040040) shutdown(r0, 0x1) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r0, 0x84, 0x18, &(0x7f0000000340), &(0x7f0000000380)=0x8) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000040), &(0x7f0000000100)=0xc) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x2) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x14}}, 0x0) getsockname$packet(r6, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700000086d7c0d6c878f064eb", @ANYRES32=r7, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) r8 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r8, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r4) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) sendmsg$nl_route_sched(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x2c, 0x24, 0x5820a61ca228651, 0x0, 0x0, {0x0, 0x0, 0x0, r9, {0x0, 0x9}, {0xffff, 0xffff}, {0x0, 0x10}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000440)=@newtfilter={0x3c, 0x28, 0xd27, 0x1000004, 0x25dfdbfc, {0x0, 0x0, 0x0, r9, {0xd, 0x9}, {0x4}, {0xfff2, 0xa}}, [@filter_kind_options=@f_cgroup={{0xb}, {0x4}}, @TCA_RATE={0x6, 0x5, {0x3, 0x4}}]}, 0x3c}}, 0x4000) r10 = socket$nl_route(0x10, 0x3, 0x0) r11 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000680)={'bridge0\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=ANY=[@ANYBLOB="4800000010000104000000000007000000000000", @ANYRES32=r12, @ANYBLOB="3f00000006020400280012800b0001006272696467650000180002800c002e0003000000030000000500070008"], 0x48}, 0x1, 0x0, 0x0, 0x44000}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x14, &(0x7f0000000580)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8f, 0x0, 0x0, 0x0, 0xb}, {{0x18, 0x1, 0x1, 0x0, r1}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x700}, {0x85, 0x0, 0x0, 0x86}}, {}, [@jmp={0x5, 0x1, 0xb, 0xa, 0x0, 0x6}, @jmp={0x5, 0x0, 0xa, 0x0, 0x0, 0xfffffffffffffff4, 0xfffffffffffffffc}, @initr0={0x18, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x9}, @jmp={0x5, 0x1, 0x4, 0x0, 0x9, 0xfffffffffffffff8}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x3}, {0x85, 0x0, 0x0, 0x2a}}}, &(0x7f0000000080)='GPL\x00', 0x9, 0x1000, &(0x7f0000000cc0)=""/4096, 0x41100, 0x3}, 0x94) 949.263759ms ago: executing program 2 (id=2987): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) (async) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r2) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000700)={&(0x7f00000007c0)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYRESOCT=r2], 0x38}, 0x1, 0x0, 0x0, 0x4000801}, 0x0) (async) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000080)={'syzkaller0\x00', @broadcast}) r4 = socket$unix(0x1, 0x1, 0x0) (async) r5 = socket$nl_route(0x10, 0x3, 0x0) (async) r6 = socket$inet_udplite(0x2, 0x2, 0x88) (async) r7 = socket$l2tp6(0xa, 0x2, 0x73) (async) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000140)={0xffffffffffffffff, 0x58, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) sendmsg$inet(r7, &(0x7f00000001c0)={&(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10, &(0x7f0000000100)=[{&(0x7f0000000040)}], 0x1, &(0x7f0000000640)=[@ip_ttl={{0x14, 0x0, 0x2, 0x6}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x9}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0x8a}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {r8, @local, @private=0xa010101}}}], 0x68}, 0x0) unshare(0x2c060000) unshare(0x24020400) (async) r9 = socket$unix(0x1, 0x1, 0x0) bind$unix(r9, &(0x7f00000000c0)=@file={0x1, './file0\x00'}, 0x6e) (async) bpf$OBJ_GET_PROG(0x7, &(0x7f0000000180)=@generic={&(0x7f0000000140)='./file0\x00', 0x0, 0x10}, 0x18) (async) setsockopt$IPT_SO_SET_REPLACE(r6, 0x0, 0x40, &(0x7f0000000300)=@raw={'raw\x00', 0x8, 0x3, 0x2a8, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x210, 0xffffff7a, 0xffffffff, 0x210, 0xffffffff, 0x7fffffe, 0x0, {[{{@uncond, 0x6, 0x130, 0x178, 0x0, {}, [@common=@unspec=@string={{0xc0}, {0x88, 0x88, 'bm\x00', "00000100cbd047da9ca965f96ad5801f0514d363ee84bb895919d9490f6785fba3c4a44f1e25ecefef2a2d6054f5260ece5ce1a56a5ef73be11d65bfe8c37674024c183ebacdf741cea92ded3a9ca54de15dd9ec8ef62f9e000000000000000000ffffff7f00", 0x80, 0x0, {0x4}}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x1, 0x6, 0x3, 0x6, '\x00', {0x3}}}}, {{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @loopback, 0x0, 0xff000000, 'team_slave_0\x00', 'ip6gre0\x00', {0xff}, {}, 0x6, 0x3}, 0x0, 0x70, 0x98}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0x0, 0x0, 0x4}, {0x4, 0x5, 0x6}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x308) sendmsg$nl_route(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=@newlink={0x50, 0x10, 0xffffffffffffffff, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, 0x50a32, 0x823}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @ip6gre={{0xb}, {0x18, 0x2, 0x0, 0x1, [@IFLA_GRE_REMOTE={0x14, 0x7, @loopback={0xff00000000000000}}]}}}, @IFLA_MTU={0x8, 0x4, 0x5}]}, 0x50}, 0x1, 0x0, 0x0, 0x4000080}, 0xc010) recvmmsg$unix(0xffffffffffffffff, &(0x7f00000006c0), 0x0, 0x40000160, &(0x7f00000019c0)) (async) r10 = socket$unix(0x1, 0x1, 0x0) r11 = socket$nl_route(0x10, 0x3, 0x0) (async) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r11, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000740)=@newqdisc={0x68, 0x24, 0x4ee4e6a52ff56541, 0x4, 0x12, {0x0, 0x0, 0x0, r12, {0x0, 0xb}, {0xffff, 0xffff}, {0x0, 0xfff1}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x3c, 0x2, [@TCA_TBF_PBURST={0x8, 0x7, 0xb86}, @TCA_TBF_PARMS={0x28, 0x1, {{0xa, 0x2, 0xffff, 0x7, 0xcc, 0x3}, {0x0, 0x1, 0x7, 0x8, 0x7f, 0x9}, 0x7fff, 0x7, 0x1bb6}}, @TCA_TBF_BURST={0x8, 0x6, 0x7f}]}}]}, 0x68}, 0x1, 0x0, 0x0, 0x4048000}, 0x0) (async) r13 = socket$nl_route(0x10, 0x3, 0x0) (async) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r13, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x70b923, 0x80000, {0x0, 0x0, 0x0, r14, {}, {0xd, 0xb}, {0xffe0, 0xd}}, [@qdisc_kind_options=@q_etf={{0x8}, {0x14, 0x2, @TCA_ETF_PARMS={0x10, 0x1, {0x9, 0xb, 0x4}}}}]}, 0x40}}, 0x4010004) ioctl$SIOCSIFHWADDR(r1, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="640000004ec6"}) 779.508899ms ago: executing program 2 (id=2988): r0 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000080"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) close(r0) r1 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r1, &(0x7f0000f5dfe4)={0xa, 0x4e20}, 0x1c) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@ipv6_newaddrlabel={0x38, 0x48, 0xe4945d2eb074039d, 0x0, 0x0, {}, [@IFAL_LABEL={0x8}, @IFAL_ADDRESS={0x14, 0x1, @mcast2={0xff, 0x5}}]}, 0x38}}, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xf, 0x4, 0x4, 0x12}, 0x50) r4 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0xe, 0x4, &(0x7f0000000400)=ANY=[@ANYBLOB="18020000801000000000000004000000850000002700000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00}, 0x80) r5 = socket(0x15, 0x800, 0x1) socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000580)={'veth0_to_team\x00', 0x0}) r7 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r7, &(0x7f0000000240)="800000800000210ee7decd7a0000000088a8", 0x12, 0x0, &(0x7f00000001c0)={0x11, 0x8100, r6, 0x1, 0xd8, 0x6, @broadcast}, 0x14) sendmsg$nl_route_sched(r5, &(0x7f0000000440)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2b, 0x25dfdbfd, {0x0, 0x0, 0x0, r6, {0x2, 0x3}, {0xfff1, 0x1}, {0x3, 0xb}}, ["", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x6044841}, 0x1c69d8c8a0d305b8) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000600)={@cgroup, r4, 0x5, 0x0, 0x0, @void, @value=r0}, 0x20) r8 = socket$inet6_udplite(0xa, 0x2, 0x88) getsockopt$inet6_int(r8, 0x29, 0x31, 0x0, &(0x7f00000004c0)) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000001c0)={{r3}, &(0x7f0000000140), &(0x7f0000000180)=r0}, 0x20) ioctl$sock_SIOCOUTQNSD(r7, 0x894b, &(0x7f0000000540)) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0xffffffff, 0x10000007, 0x4, 0xffffffffffffffff, 0x1, 0x4}, 0x0, &(0x7f00000002c0)={0x3ff, 0x400000, 0x8, 0x9, 0x0, 0x201, 0x7fffffff, 0xfffffffffffffffe}, 0x0, 0x0) syz_emit_ethernet(0x91, &(0x7f0000000280)=ANY=[@ANYBLOB="ffffffffffffbbbbbbbbbbbb86dd6a000000005b1100fe8000000000000000000000000000aafe8000000000000000000000000000aa4e1d4e20005b90"], 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f00000005c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000500)=0x14) 731.149772ms ago: executing program 4 (id=2989): mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000001c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0x0}, 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000300)={r0, 0xffffffffffffffff}, 0x4) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000002180)=ANY=[@ANYBLOB="b70200001a000000bfa30000000000000703000000feffff7a0af0ff0100000079a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b70000000000000095000000000000005ecefab8f2e85c6c1ca711fcd0cdfa146ec561750379585e5a076d839240d29c034055b67dafe6c8dc3d5d78c07fa1f7e655ce34e4d5b3185fec0e07004e60c08dc8b8dbf11e6e94d75938321a3aa502cd2424a66e6d2ef831ab7ea0c34f17e3946e0ebc622003b538dfd8e012e79578e51bc53099e90f4580d760551b5b341a29f31e3106d1ddd6152f7cbdb9cd38bdb2209c67deca8e0400000000000000c61e4dd11183a13477bf7e860e3670ef0e789f65f1328d6704902cbe7bc04b82d2789cb132b8667c2147661df28d9961b63e1a9cf6c2a660a1fe3c184b751c51160fb20b1c581e7b148ba532e6ea09c346dfebd38608b3280080005d9a9500000000000000334d83239dd27080851dcac3c12233f9a1fb9c2aec61ce63a38d2fd50117b89a9ab359b4eea0c6e95767d42b4e54861d0227dbfd2e6d7f715a7f3deadd7130856f756436303767d2e24f29e5dad9796edb697aeea0182babd18cac1bd4f4390af9a9ceafd0002cab154ad029a1090000002780870014f51c3c975d5aec84222fd3a0ec4be3e563112f0b39501aafe234870072858dc06e7c337642d3e5a815232f5e16c1b30c3a6a71bc85018e5ff2c91018afc9ffc2cc788bee1b47683db01a469398685211dfbbae3e2ed0a50e7313bff5d4c391ddece00fc772dd6b4d4de2a41990f05ca3bdfc92c88c5b74cd36e7487afa447e2edfae4f390a8337841cef386e22cc22ee17476d738952229682e24b92533ac2a9f5a699593f084419cae0b4532bcc97d3ae486aca54183fb01c73f979ca9857399537f5dc2a2d0e0000000000000578673f8b6e74ce23877a6b36db0e067345560942fa629fbef2461c96a088a22e8b15c3e233db7ab22e30d46a9d24d37cef099ece010000000100000010223fdae7ed04935c3c90d3add8eebc8619d73415cda2130f50714600fb6241c6e955031795b2c2f56411e48455b5a8b90dfae158b94f50adab988dd8e12baf5cc9398fff00404d5d99f82e20ee6a8c88e18c2977aab37d9ac4cfc1c7b400000000000007ff57c39495c826b956ba859ac8e3c177b91bd7d5e41ff814f7ca1664fe2f3ced846891180604b6dd2499d16d7d9158ffff854797f29d0000002d8c38a967c1bbe09315c29877a308bcc87dc3addb08141bdee5d27874b2f663ddeedd005b3d96c7aabf4df517d90bdc01e73835d5a3e1a90800c66ee2b1ad76dff9f9000071414c99d4894ee7f8249dc1e3428d2129369ee1b85af6eb2eea0d0df414b315f651c8412392191fa83ee830548f11e1036a8debd64cbe359454a3f2239cfe35f81b7a490f167e6d5c1109000000000000000042b8ff8c21ad702ccacad5b39eef213d1ca296d2a27798c8ce2a305c0c7d35cf4b22549a4bd92052188bd1f285f653b621491dc6aaee0200e2ff08644fb94c06006eff1be2f633c1d987591ec3db58a7bb3042ec3f771f7a1338a5c3dd35e92604e1026e09c58e273cd905deb28c13c1ed1c0d9cae846bcbfa8cce7b893e578af7dc7d5e87d44ff828de453f34c2b18660b080efc707e676e1fb4d5825c0ca177a4c7fbb4eda0545c00f576b2b5cc7f819abd0f885cc4806f40300966fcf1e54f5a2d38708294cd6f496e5dee734fe7da3770845cf442d488afdc0e17000000000000000000000000000000000000000000000000000005205000000dc1c56d59f35d367632952a93466ae595c6a8cda690d192a070886df42b27098773b45198b4a34ac977ebd4450e121d01342703f5bf030e935878a6d169c80aa4252d4ea6b8f6216ff202b5b5a182cb5e838b307632d03a7ca6f6d0339f9953c3093c36981edbf1f000000000000004d16d29c28eb5167e9936ed327fb237a56224e49d9ea955a5f0dec1b3ce852364600000000000000000000000000000000000000000000000000000000000026ded4dd6fe1518cc7802043ecfe69f743f1213bf8179ecd9e5a225d67521dc728eac7d80a5656ac2cbde21d3ebfbf69ff861f4394836ddf128d6d19079e64336e7c676505c78ad67548f4b192be1827fcd95cf107753cb0a6a979d3db0c407081c6281e2d8429a863903ca75f4c7df3ea8fc2018d07af1491ef060cd4403a099f32468f65bd06b4082d43e121861b5cc03f1a1561f0589e0d12969bc982ff5d8e9b986c0c6c747d9a1cc500bb892c3a16ff10feea20bdac0000000000000000ca65f037b21f3289f86a6826c69fa35ba5cbc3f2db1516ffc5c6e3fa618b24a6ce16d6c7010bb37b61fa0a2d8974e69115d33394e86e4b838297ba20f96936b7e4746e92dea6c5d1d33d84d96b50fb000000ae07c65b00000000000000a5ace293bec833c13e3229432ad71d646218b5229dd88137fc7c59aa242af3bb4efb82055a3b61227ad40f52c9f2500579aca11033ec14bb9cc16bd83a00840e31d828ec78e116ae46c4897e2795b6ff92e9a1e24b0b855c02f2b7add58f0225f3390343c12aa51810134d3dfbf71f6516737be55c06d9cdcfb1e20280e14700eb4acff907560500ecf9f58afd3c19b5c4558ba9af6b7333c894a1fb29ad72a89a7f6d74126f327bf7dfa718d3e1e9ad75c9c022e8d03fe28bc358684492aa771dbfe80745fe89ad349ffaad76ff9dd643796caffdf67af5dd476c37e7e9a84e2e5da2696e285a59b53f2fb0e16d7462c080c159ce40c14089c82759106f425a2554644b2582b42e3e8484ea5a6ad9aa52106eafe0e0caea1ad4cb23f3c2b8a0f455ba69ea284c268d54b43158a8b1d128d02af263b3dc1cab794c9ac57a2a7332f4d8764c302ccd5aac114482b619fc575aa0dd2777e881e29a854380e2f1e49db5a1517ec40bb3fa44f9959bad67ccaba76408da35c9f1534c8bd48bbd61627a2e0a74b5e6aefb7eee403502734137ff17320adda5867947257f164391c673b6079e65d7295eed164ca63e4ea26dce0fb3ce0f6591d80dfb8f386bb74b5589829b6b0679b5d65a927de6f4c09f4b742e037381c85d2ec7bb2a8152f0d6a99a0370e0cbd65744eb2efd7b65f04aa7e72588757b9612bb4253a63bb303c0c68a07f115d104f2007237a4f771416741bfd63fdfe3ae6f8bea755d8b7202c2bbae137dc1c3cf40db74a4c1c219d8ddec8f91dae2cdea1353fe062830fa1d233296ec9d8317872257e154665485e7f31cdbfbf435517faf93015b57417d84b8bc8662e097d5ba55d02d48e1000000b81b6790062e61cd000000acb1b33c38ddd302e28e8e30b5c180d38bb1cd770195799c541a7481f5d34ca75d74b3833d399371c8f09f6745d0e43d46f7c82ff1b7d6c04467d083fc708348f35ae9bb9b78f2984a0ee55647d4c4a63c4f438fdec726e7d8228eaff2374b2300b9c35f4259e3452b53ee114bb8a6c0ea6fc89a55fef6673013d7dd4597660865423e978dd6e41e201bb3a584d6fe6f24e290613b677271603c558ee2021be29c4a06a057b2acc5bfd34898afac0d839079bbcb3acd43532563367ac8ae6c4379fb5fdcdab5fe55e1a3a521284209871216817338073cbc4ec9903725b788a25b5a6003b579b8f0e20d78be3d885557292971e65f4f1daefad2c5ccbca608b46406ffff25610c3cbae9c3d6d47678f482e2c1f7cdfc5ce2a67c1545c1192f2ac3990f9c850788401469fbca801e73cd9efbcc6ea52ff414cdff5c49e706d699b5bfa75526f700c4e32611b826b2787f99532c02262a9c60e4b07a09377c38747c7f05e38b6db5d8cc625873af8fc5a7d362334c509f6bb4e36e1c9e08949679e0ed9f84e668588b9f1b21069bd5ffe263b191d1a7f5d4e85de1a2a46579d497000000000000000000000000000085890d719cfd2eef4805fc5ebd790e94908d24a9002b0e658d593da7811e099e1c7c5699331e98eda4c706a90e22047fe27cae6994f70772815879c3d6a16e769eb6a745ca0ebcd90d81d109c1569129c0f26bb037806c424ae349391b4a5723afeffdb940ac1de55b1022c7d9aee805706e8fcdfaf3ab14ca4eae5b534fea2565d4dfa5a0fe38d7aa7d9f3c7bc6e895852a9035283b89ddbc41c54dbf9392c8dcc65178726eae650e"], &(0x7f0000000340)='syzkaller\x00'}, 0x44) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r2, 0x18000000000002a0, 0xe2f, 0x6000004d, &(0x7f0000000100)="b90000000044268cb89e14f086dd65e0ffff01032c00631177fbac141416e000030a44079f030000000000000000000000222f050b038da1880b25181aa59d943be3f4aed50ea5a6b8686731cb89ef77123c899b699eeaa8eaa007346111960500000000000000000000000059b6d3296e8ca31bce1d8392078b72f24996ae17dffc2e43c8174b54b620636894aaacf28ff62616363c70a440aec4014caf28c0adc043084617d7ecf41e9d134589d46e5dfc4ca5780d38cae870b9a1df48b238190da450296b0ac01496ace23eefc9d4246dd14afbf79a2283a0bb7e1d235f3df126c3acc240d75a058f6efa6d1f5f7ff4000000000000000000", 0x0, 0xfe, 0x60000000, 0x0, 0x0, &(0x7f0000000ac0)="4313a5e1de73ef94a52904aad04fce16f49604c1dc63d9c8cc35e6d2e21bad5f52f04dde32f51f1857b0a340996c2daaeef13787fa577badae0fbafd3f609eda08ec9ebbeddabc201ebe14f7634882897578faa4a3fc0438525683562027d26fe8d349e08100ac9f654e6e2e4b2dc800652266b0720296c690c6b47afecc028741048e97cfdd5a078b1ba3fde5b21f61b40bf334853a68f5", &(0x7f0000000a00), 0x0, 0x700}, 0x2c) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000880)={0x11, 0x10, &(0x7f00000003c0)=ANY=[@ANYBLOB="180000000000000000000000000000e0b6080000000000007b8af8ff00000000b7080000020000007b8af0ff00000000bfa17150f784000007010000f8ffffffbfa400000000000007040000f0ffffffb77768000800000018230000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70500000800000085000000a50000009500000000000000"], &(0x7f0000000240)='GPL\x00', 0x4, 0x4, &(0x7f0000002500)=""/4105, 0x0, 0x68}, 0x94) 633.458983ms ago: executing program 4 (id=2990): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=@newtfilter={0x48, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x0, 0x9}, {}, {0xd, 0xfff1}}, [@filter_kind_options=@f_cgroup={{0xb}, {0x18, 0x2, [@TCA_CGROUP_EMATCHES={0x14, 0x3, 0x0, 0x1, [@TCA_EMATCH_TREE_LIST={0x10, 0x2, 0x0, 0x1, [@TCF_EM_IPT={0xc, 0x1, 0x0, 0x0, {{0x3, 0x9, 0x80}}}]}]}]}}]}, 0x48}}, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="4000000010000305000000000007000000000000", @ANYRES32=0x0, @ANYBLOB="0000000000100000180012800e0001007769726567756172640000000400028008000a"], 0x40}, 0x1, 0x0, 0x0, 0x800}, 0xc0b0) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="01000000060000000800000008"], 0x50) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0b00000007000000010001000900000001"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x11, 0xd, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0xfffffff7}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x80}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}, @call={0x85, 0x0, 0x0, 0x23}]}, &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0xd, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000003c0)={r1}, 0xc) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001700)=ANY=[@ANYBLOB="64000000190001002abd7000fbdbdf251d010900500012"], 0x64}, 0x1, 0x0, 0x0, 0x5}, 0x0) r3 = socket(0x10, 0x803, 0x0) getsockopt$inet_sctp6_SCTP_ASSOCINFO(r3, 0x84, 0x1, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[], 0x1c}}, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000003c0)=@newlink={0x3c, 0x10, 0x1, 0x70bd2d, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, 0x3dd88, 0x17200}, [@IFLA_EVENT={0x8, 0x2c, 0xffff7fff}, @IFLA_VFINFO_LIST={0x8, 0x16, 0x0, 0x1, [{0x4}]}, @IFLA_ADDRESS={0xa, 0x1, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1c}}]}, 0x3c}, 0x1, 0x8100, 0x0, 0x4010}, 0x848) sendmmsg(r4, &(0x7f00000002c0), 0x40000000000009f, 0x0) 488.000623ms ago: executing program 4 (id=2991): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r0, 0x80000000) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="01000000050000000100000007"], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000640), &(0x7f0000000740), 0x20075, r1}, 0x38) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], 0x0, 0x0, 0xfffffffffffffe8b, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r2 = socket$packet(0x11, 0x2, 0x300) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r4, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r4, 0x0) epoll_ctl$EPOLL_CTL_MOD(r4, 0x3, r1, &(0x7f0000000040)={0x2}) setsockopt$sock_attach_bpf(r2, 0x1, 0x32, &(0x7f0000000180)=r3, 0x4) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) bpf$MAP_CREATE(0xb00000000000014, &(0x7f0000000080)=ANY=[@ANYRESDEC=0x0], 0x48) sendmsg$netlink(r6, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000000c0)=ANY=[@ANYBLOB="140100002500010300000000c00e0000010100800c0001"], 0x114}], 0x1}, 0x40000) sendmsg$nl_generic(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000001ac0)={&(0x7f0000001b00)={0x14, 0x25, 0xfffffffffffffffd, 0x70bd2a, 0x25dfdbfe, {0x15}}, 0x14}, 0x1, 0x0, 0x0, 0x4004019}, 0x240000c4) setsockopt$inet6_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000780)={@in6={{0xa, 0x4e24, 0x2, @empty, 0xc}}, 0x0, 0x0, 0x20, 0x0, "9c0fe2154aa786d10084ecfbe8e86f7d312fcc8fde38d5823d22fbbb55a7837e5f2329f4d662f2185f18fae43e09d661d12a01669d6eef2e4733c2c29a3c3d16ef45c7c1c8ecfcc76b47d9ab9a573f11"}, 0xd8) r7 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240), r4) sendmsg$IPVS_CMD_NEW_SERVICE(r6, &(0x7f0000000380)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x48, r7, 0x4, 0x70bd2d, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_DEST={0x34, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_ADDR_FAMILY={0x6, 0xb, 0xa}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0xd}, @IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0xffff}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e21}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e22}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}]}]}, 0x48}}, 0x48014) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x9, &(0x7f00000003c0)=@raw=[@ringbuf_output={{}, {}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}}], &(0x7f0000000280)='syzkaller\x00', 0x8, 0xde, &(0x7f0000003e40)=""/222, 0x680f0936988f8ccd, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6}, 0x90) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r8, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000880)=ANY=[@ANYBLOB="24000000070605000000000000000000070000070500010007"], 0x24}, 0x1, 0x0, 0x0, 0x8800}, 0x20040000) setsockopt$inet6_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000680)={@in6={{0xa, 0x4e21, 0x1, @private2={0xfc, 0x2, '\x00', 0x1}, 0x81}}, 0x0, 0x0, 0x40, 0x0, "2b20a1a47cddc63b223be606d7303a4d4d11e10450d766feb63b382d54bab577021cad5de4fe7630a33b6deca160b1267ff02123bc27830000000000ffff40000000000000b5b29049cb65f00300"}, 0xd8) r9 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$sock_attach_bpf(r9, 0x1, 0x4a, &(0x7f0000000500), 0x4) writev(0xffffffffffffffff, &(0x7f0000000540)=[{&(0x7f0000000180)="580000001400192340834b80040d8c560a066f0200ff000000000000000058000b4824ca945f64009400ff0325010ebc000000000000008000f0effeffe809005300fff5dd00000010000100080c10000000000000000000", 0x58}], 0x1) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000640)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000600)={&(0x7f0000000940)={0x84, 0x2, 0x6, 0x301, 0x0, 0x0, {0x2, 0x0, 0x3}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_TYPENAME={0xd, 0x3, 'list:set\x00'}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x3}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x1}, @IPSET_ATTR_DATA={0x48, 0x7, 0x0, 0x1, [@IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0x1000}, @IPSET_ATTR_NETMASK={0x5, 0x14, 0x80}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4e22}, @IPSET_ATTR_CIDR={0x5, 0x3, 0x5}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4e23}, @IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @loopback}}, @IPSET_ATTR_LINENO={0x8, 0x9, 0x1, 0x0, 0x8000}, @IPSET_ATTR_CADT_FLAGS={0x8, 0x8, 0x1, 0x0, 0x19}]}]}, 0x84}}, 0x40000000) 427.164352ms ago: executing program 1 (id=2992): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000b80)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWSETELEM={0x14, 0xc, 0xa, 0x0, 0x0, 0x0, {0xa, 0x0, 0x7}}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0x3c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000000) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000001140)={&(0x7f00000000c0)=@newlink={0x20, 0x10, 0x503, 0x70bd2a, 0x0, {0x0, 0x0, 0x0, 0x0, 0x2000}}, 0x20}, 0x1, 0x0, 0x0, 0x4004804}, 0x800) 305.385256ms ago: executing program 1 (id=2993): r0 = socket(0x2000000000000021, 0x2, 0x10000000000002) connect$rxrpc(r0, &(0x7f0000000140)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x400}}, 0x24) (async) sendmmsg(r0, &(0x7f0000001840)=[{{&(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @remote}, 0x3, 0x2, 0x3, 0x2}}, 0x80, &(0x7f00000004c0)=[{&(0x7f0000000180)="b72640ca451b24323d524e08f9f8f6646783c7139f920c00163b4320c71c182a3bb7f710b89384171f3d79b0e071c4d1c76b6f37bb1ad37bf18479556b0c60d373ef45516ba4640cb65584647fb80872ec08b8076633105115c4c5e9b2963f1d9d2d699b5e84996dc05de9e89824ae548da643e9ff07527ea16625a6b559f4194b19c8ec7c2f9dcbd4152566f09f424862092237ef70d3ac9337d00dc2ca847370600ed2a533a497504eebdeccece5c9c69d25f1ea65656460672140f9451e9a98ad762257c4d5718117d98e", 0xcc}, {&(0x7f0000000280)="38ff302ae52e76b0bacb3be6371a2a44f8885d04ae1a721ab3bab77cb10a3ed3b5de9dbb3a3d4267866e3f74ace195180b7b700de346a25d896e05842529c5f94584121564a88c9d124686ee217c525bebc2e29b6d8a0798fda99b81db926aae2b96f9a0b2ced8d515a7b68fef1b2a36fc0c413885d4d61db590b26702af66eb0d501495fcb4fdf127ed91fcc5e98210518f63eaf0c3d7823f3fcffeac7b8bef24b89e232b3b4f75f22f7390107c170beadcc421a96e2bc120bd2ab1d1d6f11f05c3160baa9ee22212", 0xc9}, {&(0x7f0000000080)="ac62519e04973fa004cb9f72fda5bb49f0c0ddd2e50e88fa8bffa9a26d58212ff333f9674546257e71c982a32072c9a98a435d0e96e56905c6ef9f7c328697d839741a7fb77a9e72cff5a86415778d9a5c3ca6e10af999610583e92e4995e46a6bc84a1e127a88785b7519b5a6c1b1c99c3e45aa63d3db3fb1831aafd211b7bf37295555f2cf0949c5bb", 0x8a}, {&(0x7f0000000380)="054227ba20f15fa4da", 0x9}, {&(0x7f00000003c0)="0a5d8a9581a6fe42ac4dd000ab0a6fad010f294595c3151e553cbab182afaa10e73257248423cb5d8ebb32a23391deda17d9302e7a3b9af5bddfe677d457778a83cfd8987b82f0c6c893b52adcb0aedbbec066942fa823718241e9d3554bfbdcc442a6b3a4377f1cde37c593f40967774e02efd8676e2709656ac38a0c4f470737dcf187c16aa5fb8600fb6f127824590f981663cb410ac718e14df4eb890f7d781b00448698705fe438765ab0ae5581f68d6b5048abfec8d9b662e2c09dd56140c854f7", 0xc4}], 0x5, &(0x7f0000001880)}}], 0x1, 0x4008040) 197.037833ms ago: executing program 1 (id=2995): r0 = socket$packet(0x11, 0x2, 0x300) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0xb, 0x8, 0xc, 0x80000000, 0x1}, 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r1}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$tun(r3, &(0x7f0000000000)=ANY=[], 0x38) (async) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x10012, r3, 0x0) (async, rerun: 32) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x1, 0xc, &(0x7f0000000200)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x27, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, 0x94) (rerun: 32) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000000180)=r4, 0x4) ioctl$TUNSETTXFILTER(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)=ANY=[@ANYBLOB='..']) (async, rerun: 32) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) (rerun: 32) write$cgroup_subtree(r5, &(0x7f0000000100)=ANY=[], 0x32600) (async, rerun: 64) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r0, 0x2000) (rerun: 64) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000340), r0) sendmsg$NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL(r3, &(0x7f00000004c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000400)={&(0x7f0000000700)=ANY=[@ANYBLOB="5c00000835750424e6108cc87bc826e21d9a926ef83008733aa83891823511fb6d674dde59a48845f3f606ae58ebdfe0207d52fad3cd1ccf24d0e8a458c7869cf2f5d29825b4aa5ad6020cb9f9c5b63d76d64af68bd30a5ff8b36cf55b7751fd669421aceda5c971c75160380c1d6f501d4c77067d4c5b4d4ee5fadc939438e612a88c6373f6c653a60be54a24d389dc50e65023d5", @ANYRES16=r6, @ANYBLOB="000029bd7000fedbdf25380000000c0058006c000000000000000c0058006c000000000000000c0058001f000000000000000c0058006c000000000000000c0058007a000000000000000c0058000800000000000000"], 0x5c}, 0x1, 0x0, 0x0, 0x4000}, 0x8000) (async, rerun: 64) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/mnt\x00') (async, rerun: 64) r7 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000b00)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f00000002c0)='syzkaller\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r7, 0x5, 0xb68, 0x560b0000, &(0x7f0000000000)="259a53f271a76d2673004c6588a8", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) (async) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000006c0)={{r1}, &(0x7f0000000580), &(0x7f00000005c0)=r2}, 0x20) 0s ago: executing program 1 (id=2996): r0 = socket(0xf, 0x5, 0x80000001) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$IPSET_CMD_DESTROY(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)=ANY=[], 0x30}, 0x1, 0x0, 0x0, 0x90}, 0x10) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x32, &(0x7f0000000080)={0x0}, 0x1, 0x0, 0x0, 0x80854}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) r2 = socket(0x2a, 0x2, 0x0) getsockname$packet(r2, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000003c0)=@newtfilter={0x90, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0xfffa}, {}, {0x1c, 0xfff9}}, [@filter_kind_options=@f_flower={{0xb}, {0x60, 0x2, [@TCA_FLOWER_ACT={0x54, 0x3, [@m_connmark={0x50, 0x1, 0x0, 0x0, {{0xd}, {0x20, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0xfffffff8, 0xfff, 0x0, 0x200, 0xa}, 0x3}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3, 0x3}}}}]}, @TCA_FLOWER_FLAGS={0x8, 0x16, 0x12}]}}]}, 0x90}, 0x1, 0x0, 0x0, 0x20000004}, 0x24000000) sendmmsg(r1, &(0x7f00000002c0), 0x40000000000009f, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r0, 0x89e0, &(0x7f0000000100)) kernel console output (not intermixed with test programs): 0000000000004 [ 375.823613][T11180] RBP: 00007f121439a090 R08: 0000000000000000 R09: 0000000000000000 [ 375.823622][T11180] R10: 0000000000040800 R11: 0000000000000246 R12: 0000000000000002 [ 375.823633][T11180] R13: 00007f1213816038 R14: 00007f1213815fa0 R15: 00007ffebea000d8 [ 375.823660][T11180] [ 376.140724][T11187] openvswitch: netlink: VXLAN extension 51 out of range max 1 [ 376.202870][T11187] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1276'. [ 376.559859][T11210] netlink: 'syz.5.1284': attribute type 13 has an invalid length. [ 376.579735][T11210] netlink: 'syz.5.1284': attribute type 17 has an invalid length. [ 376.853212][T11210] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 377.038568][T11233] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1289'. [ 377.128109][T11239] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1289'. [ 377.143199][T11239] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1289'. [ 377.212813][T11246] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1293'. [ 377.223038][T11246] netlink: 'syz.2.1293': attribute type 2 has an invalid length. [ 377.264493][T11250] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1295'. [ 377.277449][T11251] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1295'. [ 377.288874][T11249] netlink: 24 bytes leftover after parsing attributes in process `syz.5.1295'. [ 377.318652][T11253] FAULT_INJECTION: forcing a failure. [ 377.318652][T11253] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 377.332419][T11253] CPU: 1 UID: 0 PID: 11253 Comm: syz.2.1296 Not tainted syzkaller #0 PREEMPT(full) [ 377.332444][T11253] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 377.332454][T11253] Call Trace: [ 377.332461][T11253] [ 377.332468][T11253] dump_stack_lvl+0xe8/0x150 [ 377.332494][T11253] should_fail_ex+0x412/0x560 [ 377.332517][T11253] _copy_from_iter+0x1d3/0x1670 [ 377.332537][T11253] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 377.332558][T11253] ? __pfx_policy_nodemask+0x10/0x10 [ 377.332578][T11253] ? __pfx__copy_from_iter+0x10/0x10 [ 377.332603][T11253] ? set_page_refcounted+0xa0/0x1e0 [ 377.332628][T11253] af_alg_sendmsg+0x151c/0x24c0 [ 377.332670][T11253] ? __pfx_af_alg_sendmsg+0x10/0x10 [ 377.332690][T11253] ? __pfx_aa_sk_perm+0x10/0x10 [ 377.332707][T11253] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 377.332734][T11253] ? aa_sock_msg_perm+0xf1/0x1b0 [ 377.332755][T11253] ? skcipher_sendmsg+0x26/0xf0 [ 377.332772][T11253] ? __pfx_skcipher_sendmsg+0x10/0x10 [ 377.332794][T11253] ____sys_sendmsg+0xa68/0xad0 [ 377.332815][T11253] ? __might_fault+0xaf/0x130 [ 377.332843][T11253] ? __pfx_____sys_sendmsg+0x10/0x10 [ 377.332872][T11253] ? import_iovec+0x73/0xa0 [ 377.332898][T11253] ___sys_sendmsg+0x2a5/0x360 [ 377.332918][T11253] ? __lock_acquire+0x6b5/0x2cf0 [ 377.332945][T11253] ? __pfx____sys_sendmsg+0x10/0x10 [ 377.332973][T11253] ? kstrtouint+0x6e/0xe0 [ 377.333019][T11253] ? __fget_files+0x2a/0x420 [ 377.333036][T11253] ? __fget_files+0x3a0/0x420 [ 377.333059][T11253] __sys_sendmmsg+0x27c/0x4e0 [ 377.333085][T11253] ? __pfx___sys_sendmmsg+0x10/0x10 [ 377.333104][T11253] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 377.333154][T11253] ? ksys_write+0x242/0x270 [ 377.333179][T11253] ? __pfx_ksys_write+0x10/0x10 [ 377.333208][T11253] __x64_sys_sendmmsg+0xa0/0xc0 [ 377.333232][T11253] do_syscall_64+0xe2/0xf80 [ 377.333253][T11253] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 377.333269][T11253] ? trace_irq_disable+0x37/0x100 [ 377.333285][T11253] ? clear_bhb_loop+0x60/0xb0 [ 377.333305][T11253] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 377.333320][T11253] RIP: 0033:0x7fe050b9aeb9 [ 377.333336][T11253] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 377.333350][T11253] RSP: 002b:00007fe051aa5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 377.333376][T11253] RAX: ffffffffffffffda RBX: 00007fe050e15fa0 RCX: 00007fe050b9aeb9 [ 377.333386][T11253] RDX: 0000000000000001 RSI: 0000200000000040 RDI: 0000000000000004 [ 377.333397][T11253] RBP: 00007fe051aa5090 R08: 0000000000000000 R09: 0000000000000000 [ 377.333407][T11253] R10: 0000000000040800 R11: 0000000000000246 R12: 0000000000000002 [ 377.333417][T11253] R13: 00007fe050e16038 R14: 00007fe050e15fa0 R15: 00007fff21901968 [ 377.333444][T11253] [ 377.941463][T11261] IPv6: Can't replace route, no match found [ 377.948359][T11262] IPv6: Can't replace route, no match found [ 378.288460][T11281] team0 (unregistering): Port device team_slave_0 removed [ 378.317782][T11281] team0 (unregistering): Port device team_slave_1 removed [ 378.348448][T11289] netlink: 'syz.5.1306': attribute type 1 has an invalid length. [ 378.354846][T11281] team0 (unregistering): Port device dummy0 removed [ 378.365250][T11289] netlink: 'syz.5.1306': attribute type 1 has an invalid length. [ 378.530739][T11304] tipc: Can't bind to reserved service type 1 [ 378.552762][T11304] tipc: Failed to remove unknown binding: 66,1,1/0:3804546577/3804546578 [ 378.563649][T11304] tipc: Failed to remove unknown binding: 66,1,1/0:3804546577/3804546578 [ 378.572310][T11304] tipc: Failed to remove unknown binding: 66,1,1/0:3804546577/3804546578 [ 378.610170][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.784403][T11323] FAULT_INJECTION: forcing a failure. [ 378.784403][T11323] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 378.820608][T11323] CPU: 1 UID: 0 PID: 11323 Comm: syz.4.1317 Not tainted syzkaller #0 PREEMPT(full) [ 378.820635][T11323] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 378.820645][T11323] Call Trace: [ 378.820651][T11323] [ 378.820659][T11323] dump_stack_lvl+0xe8/0x150 [ 378.820686][T11323] should_fail_ex+0x412/0x560 [ 378.820712][T11323] prepare_alloc_pages+0x22a/0x650 [ 378.820739][T11323] __alloc_frozen_pages_noprof+0x12f/0x380 [ 378.820762][T11323] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 378.820785][T11323] ? __pfx_policy_nodemask+0x10/0x10 [ 378.820807][T11323] ? __pfx__copy_from_iter+0x10/0x10 [ 378.820831][T11323] alloc_pages_mpol+0x232/0x4a0 [ 378.820856][T11323] alloc_pages_noprof+0xa8/0x190 [ 378.820878][T11323] af_alg_sendmsg+0x1404/0x24c0 [ 378.820922][T11323] ? __pfx_af_alg_sendmsg+0x10/0x10 [ 378.820943][T11323] ? __pfx_aa_sk_perm+0x10/0x10 [ 378.820960][T11323] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 378.820988][T11323] ? aa_sock_msg_perm+0xf1/0x1b0 [ 378.821009][T11323] ? skcipher_sendmsg+0x26/0xf0 [ 378.821026][T11323] ? __pfx_skcipher_sendmsg+0x10/0x10 [ 378.821048][T11323] ____sys_sendmsg+0xa68/0xad0 [ 378.821070][T11323] ? __might_fault+0xaf/0x130 [ 378.821098][T11323] ? __pfx_____sys_sendmsg+0x10/0x10 [ 378.821129][T11323] ? import_iovec+0x73/0xa0 [ 378.821154][T11323] ___sys_sendmsg+0x2a5/0x360 [ 378.821175][T11323] ? __lock_acquire+0x6b5/0x2cf0 [ 378.821201][T11323] ? __pfx____sys_sendmsg+0x10/0x10 [ 378.821227][T11323] ? kstrtouint+0x6e/0xe0 [ 378.821274][T11323] ? __fget_files+0x2a/0x420 [ 378.821292][T11323] ? __fget_files+0x3a0/0x420 [ 378.821328][T11323] __sys_sendmmsg+0x27c/0x4e0 [ 378.821356][T11323] ? __pfx___sys_sendmmsg+0x10/0x10 [ 378.821375][T11323] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 378.821420][T11323] ? ksys_write+0x242/0x270 [ 378.821443][T11323] ? __pfx_ksys_write+0x10/0x10 [ 378.821472][T11323] __x64_sys_sendmmsg+0xa0/0xc0 [ 378.821496][T11323] do_syscall_64+0xe2/0xf80 [ 378.821517][T11323] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 378.821534][T11323] ? trace_irq_disable+0x37/0x100 [ 378.821551][T11323] ? clear_bhb_loop+0x60/0xb0 [ 378.821572][T11323] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 378.821589][T11323] RIP: 0033:0x7f121359aeb9 [ 378.821608][T11323] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 378.821622][T11323] RSP: 002b:00007f121439a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 378.821641][T11323] RAX: ffffffffffffffda RBX: 00007f1213815fa0 RCX: 00007f121359aeb9 [ 378.821653][T11323] RDX: 0000000000000001 RSI: 0000200000000040 RDI: 0000000000000004 [ 378.821663][T11323] RBP: 00007f121439a090 R08: 0000000000000000 R09: 0000000000000000 [ 378.821673][T11323] R10: 0000000000040800 R11: 0000000000000246 R12: 0000000000000002 [ 378.821683][T11323] R13: 00007f1213816038 R14: 00007f1213815fa0 R15: 00007ffebea000d8 [ 378.821713][T11323] [ 379.275547][T11339] netlink: 'syz.1.1319': attribute type 15 has an invalid length. [ 379.301601][T11341] batadv_slave_0: entered promiscuous mode [ 379.541512][T11336] batadv_slave_0: left promiscuous mode [ 380.390019][T11405] netlink: 'syz.2.1338': attribute type 1 has an invalid length. [ 380.491504][T11405] bond5: entered promiscuous mode [ 380.499605][T11405] 8021q: adding VLAN 0 to HW filter on device bond5 [ 380.544958][T11415] bond5: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 380.577232][T11415] bond5: (slave ipvlan2): The slave device specified does not support setting the MAC address [ 380.588109][T11415] bond5: (slave ipvlan2): Setting fail_over_mac to active for active-backup mode [ 380.675897][T11420] __nla_validate_parse: 15 callbacks suppressed [ 380.675918][T11420] netlink: 596 bytes leftover after parsing attributes in process `syz.5.1337'. [ 380.746891][T11422] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1341'. [ 380.830450][T11418] netlink: 'syz.5.1337': attribute type 29 has an invalid length. [ 380.846725][T11419] netlink: 'syz.5.1337': attribute type 29 has an invalid length. [ 380.878785][T11422] bond6: option lp_interval: invalid value (0) [ 380.885204][T11422] bond6: option lp_interval: allowed values 1 - 2147483647 [ 381.029370][T11422] bond6 (unregistering): Released all slaves [ 381.108519][T11425] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1342'. [ 381.287999][T11436] sctp: [Deprecated]: syz.1.1345 (pid 11436) Use of struct sctp_assoc_value in delayed_ack socket option. [ 381.287999][T11436] Use struct sctp_sack_info instead [ 382.476547][T11477] x_tables: duplicate underflow at hook 1 [ 382.641850][T11487] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1357'. [ 382.659000][T11487] netlink: 168 bytes leftover after parsing attributes in process `syz.2.1357'. [ 382.669435][T11487] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1357'. [ 382.679878][T11487] netlink: 'syz.2.1357': attribute type 1 has an invalid length. [ 382.782018][T11491] netlink: 32 bytes leftover after parsing attributes in process `syz.3.1359'. [ 382.815123][T11487] 8021q: adding VLAN 0 to HW filter on device bond6 [ 382.855270][T11489] bond6: up delay (35976) is not a multiple of miimon (100), value rounded to 35900 ms [ 383.088167][T11502] syzkaller0: entered promiscuous mode [ 383.100506][T11502] syzkaller0: entered allmulticast mode [ 383.120831][T11502] PF_CAN: dropped non conform CAN FD skbuff: dev type 280, len 65487 [ 383.283204][T11518] netlink: 52 bytes leftover after parsing attributes in process `syz.1.1370'. [ 383.302366][T11518] netlink: 52 bytes leftover after parsing attributes in process `syz.1.1370'. [ 383.345267][T11523] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1371'. [ 383.562909][T11536] A link change request failed with some changes committed already. Interface ip6gretap0 may have been left with an inconsistent configuration, please check. [ 384.066942][T11573] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 384.125936][T11577] netlink: 'syz.3.1385': attribute type 1 has an invalid length. [ 384.141811][T11577] netlink: 'syz.3.1385': attribute type 1 has an invalid length. [ 384.153519][T11577] netlink: 'syz.3.1385': attribute type 8 has an invalid length. [ 384.832585][T11604] geneve0: entered promiscuous mode [ 385.299665][ T30] audit: type=1804 audit(1770621638.319:3): pid=11635 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.2.1403" name="/newroot/284/memory.events" dev="tmpfs" ino=1474 res=1 errno=0 [ 385.326934][ T30] audit: type=1800 audit(1770621638.349:4): pid=11635 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.1403" name="memory.events" dev="tmpfs" ino=1474 res=0 errno=0 [ 385.350672][ T30] audit: type=1804 audit(1770621638.349:5): pid=11636 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.2.1403" name="/newroot/284/memory.events" dev="tmpfs" ino=1474 res=1 errno=0 [ 385.736705][T11652] __nla_validate_parse: 12 callbacks suppressed [ 385.736724][T11652] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1410'. [ 385.761104][T11649] xfrm1: entered allmulticast mode [ 385.827487][T11656] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1409'. [ 386.024666][T11667] bond3 (unregistering): Released all slaves [ 386.043152][T11672] netlink: 'syz.5.1415': attribute type 10 has an invalid length. [ 386.211090][T11680] vlan2: entered allmulticast mode [ 386.217278][T11680] veth0_to_bond: entered allmulticast mode [ 386.277832][T11680] netlink: 16178 bytes leftover after parsing attributes in process `syz.5.1417'. [ 387.624282][T11750] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 387.918026][T11763] netdevsim netdevsim2: loading /lib/firmware/. failed with error -22 [ 387.926978][T11763] netdevsim netdevsim2: Direct firmware load for . failed with error -22 [ 387.935603][T11763] netdevsim netdevsim2: Falling back to sysfs fallback for: . [ 387.992388][T11767] bridge0: entered promiscuous mode [ 387.998233][T11767] bridge0: entered allmulticast mode [ 388.087823][T11770] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1437'. [ 388.153761][T11772] tipc: Enabled bearer , priority 0 [ 388.161876][T11772] syzkaller0: entered promiscuous mode [ 388.170684][T11772] syzkaller0: entered allmulticast mode [ 388.197617][T11774] FAULT_INJECTION: forcing a failure. [ 388.197617][T11774] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 388.211819][T11772] tipc: Resetting bearer [ 388.215789][T11774] CPU: 1 UID: 0 PID: 11774 Comm: syz.5.1439 Not tainted syzkaller #0 PREEMPT(full) [ 388.215814][T11774] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 388.215824][T11774] Call Trace: [ 388.215833][T11774] [ 388.215841][T11774] dump_stack_lvl+0xe8/0x150 [ 388.215868][T11774] should_fail_ex+0x412/0x560 [ 388.215894][T11774] prepare_alloc_pages+0x22a/0x650 [ 388.215922][T11774] __alloc_frozen_pages_noprof+0x12f/0x380 [ 388.215944][T11774] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 388.215967][T11774] ? __pfx_policy_nodemask+0x10/0x10 [ 388.215989][T11774] ? __pfx__copy_from_iter+0x10/0x10 [ 388.216014][T11774] alloc_pages_mpol+0x232/0x4a0 [ 388.216041][T11774] alloc_pages_noprof+0xa8/0x190 [ 388.216062][T11774] af_alg_sendmsg+0x1404/0x24c0 [ 388.216105][T11774] ? __pfx_af_alg_sendmsg+0x10/0x10 [ 388.216126][T11774] ? __pfx_aa_sk_perm+0x10/0x10 [ 388.216143][T11774] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 388.216170][T11774] ? aa_sock_msg_perm+0xf1/0x1b0 [ 388.216190][T11774] ? skcipher_sendmsg+0x26/0xf0 [ 388.216206][T11774] ? __pfx_skcipher_sendmsg+0x10/0x10 [ 388.216228][T11774] ____sys_sendmsg+0xa68/0xad0 [ 388.216256][T11774] ? __might_fault+0xaf/0x130 [ 388.216284][T11774] ? __pfx_____sys_sendmsg+0x10/0x10 [ 388.216314][T11774] ? import_iovec+0x73/0xa0 [ 388.216339][T11774] ___sys_sendmsg+0x2a5/0x360 [ 388.216359][T11774] ? __lock_acquire+0x6b5/0x2cf0 [ 388.216384][T11774] ? __pfx____sys_sendmsg+0x10/0x10 [ 388.216410][T11774] ? kstrtouint+0x6e/0xe0 [ 388.216453][T11774] ? __fget_files+0x2a/0x420 [ 388.216470][T11774] ? __fget_files+0x3a0/0x420 [ 388.216497][T11774] __sys_sendmmsg+0x27c/0x4e0 [ 388.216523][T11774] ? __pfx___sys_sendmmsg+0x10/0x10 [ 388.216542][T11774] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 388.216589][T11774] ? ksys_write+0x242/0x270 [ 388.216613][T11774] ? __pfx_ksys_write+0x10/0x10 [ 388.216641][T11774] __x64_sys_sendmmsg+0xa0/0xc0 [ 388.216664][T11774] do_syscall_64+0xe2/0xf80 [ 388.216685][T11774] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 388.216701][T11774] ? trace_irq_disable+0x37/0x100 [ 388.216716][T11774] ? clear_bhb_loop+0x60/0xb0 [ 388.216735][T11774] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 388.216752][T11774] RIP: 0033:0x7f000679aeb9 [ 388.216768][T11774] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 388.216782][T11774] RSP: 002b:00007f000765c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 388.216801][T11774] RAX: ffffffffffffffda RBX: 00007f0006a15fa0 RCX: 00007f000679aeb9 [ 388.216812][T11774] RDX: 0000000000000001 RSI: 0000200000000040 RDI: 0000000000000004 [ 388.216823][T11774] RBP: 00007f000765c090 R08: 0000000000000000 R09: 0000000000000000 [ 388.216833][T11774] R10: 0000000000040800 R11: 0000000000000246 R12: 0000000000000002 [ 388.216843][T11774] R13: 00007f0006a16038 R14: 00007f0006a15fa0 R15: 00007ffcd2b7bb88 [ 388.216873][T11774] [ 388.521051][T11776] tipc: Resetting bearer [ 388.540192][T11776] tipc: Disabling bearer [ 388.996775][T11792] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1443'. [ 389.222764][T11792] bond0: entered promiscuous mode [ 389.241975][T11792] bond_slave_0: entered promiscuous mode [ 389.261401][T11792] bond_slave_1: entered promiscuous mode [ 389.271123][T11794] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1444'. [ 389.296481][T11792] syz_tun: entered promiscuous mode [ 389.310380][T11792] gretap0: entered promiscuous mode [ 389.316618][T11792] debugfs: 'hsr1' already exists in 'hsr' [ 389.322384][T11792] Cannot create hsr debugfs directory [ 389.330658][T11792] hsr1: entered promiscuous mode [ 390.079799][T11831] syzkaller0: entered promiscuous mode [ 390.105011][T11831] syzkaller0: entered allmulticast mode [ 390.154200][T11833] bond3: entered promiscuous mode [ 390.159853][T11833] 8021q: adding VLAN 0 to HW filter on device bond3 [ 390.413673][T11856] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1461'. [ 390.705560][T11877] netlink: 6040 bytes leftover after parsing attributes in process `syz.1.1465'. [ 390.715551][T11879] netlink: 'syz.5.1466': attribute type 1 has an invalid length. [ 390.762005][T11880] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1465'. [ 390.786559][ T97] block nbd3: Possible stuck request ffff888025818000: control (read@0,1024B). Runtime 60 seconds [ 390.797431][ T97] block nbd3: Possible stuck request ffff888025818200: control (read@1024,1024B). Runtime 60 seconds [ 390.816420][ T97] block nbd3: Possible stuck request ffff888025818400: control (read@2048,1024B). Runtime 60 seconds [ 390.827909][ T97] block nbd3: Possible stuck request ffff888025818600: control (read@3072,1024B). Runtime 60 seconds [ 390.861127][T11881] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1465'. [ 390.986281][T11889] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1470'. [ 391.044942][T11892] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1469'. [ 391.195451][T11900] netlink: 'syz.1.1472': attribute type 1 has an invalid length. [ 391.221098][T11904] netlink: 40 bytes leftover after parsing attributes in process `syz.4.1473'. [ 391.382200][T11917] netlink: 176 bytes leftover after parsing attributes in process `syz.3.1475'. [ 391.528379][T11927] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1479'. [ 391.542216][T11931] netlink: 'syz.3.1481': attribute type 1 has an invalid length. [ 392.289205][T11959] netlink: 'syz.3.1488': attribute type 10 has an invalid length. [ 392.531637][T11966] batadv_slave_1: entered promiscuous mode [ 392.690834][T11978] x_tables: ip_tables: recent.0 match: invalid size 216 (kernel) != (user) 4096 [ 392.826937][T11982] bridge2: entered promiscuous mode [ 392.857155][T11982] bridge2: entered allmulticast mode [ 393.112437][T11955] batadv_slave_1: left promiscuous mode [ 393.129565][T12012] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1499'. [ 393.142707][T12012] hsr_slave_0: left promiscuous mode [ 393.221887][T12018] netlink: 'syz.3.1505': attribute type 10 has an invalid length. [ 393.230167][T12018] netlink: 65015 bytes leftover after parsing attributes in process `syz.3.1505'. [ 393.241084][T12018] netlink: 32 bytes leftover after parsing attributes in process `syz.3.1505'. [ 393.339114][T12021] bond4: option coupled_control: mode dependency failed, not supported in mode balance-rr(0) [ 393.355172][T12021] bond4 (unregistering): Released all slaves [ 393.518386][T12035] : entered promiscuous mode [ 393.584101][T12037] syzkaller1: entered promiscuous mode [ 393.592404][T12037] syzkaller1: entered allmulticast mode [ 394.560430][T12100] macsec1: entered promiscuous mode [ 394.567430][T12100] ip6gretap0: entered promiscuous mode [ 394.597633][T12065] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 394.618177][T12100] ip6gretap0: left promiscuous mode [ 394.931877][T12120] syzkaller0: entered promiscuous mode [ 394.937824][T12120] syzkaller0: entered allmulticast mode [ 395.005865][T12119] syzkaller0: entered promiscuous mode [ 395.013663][T12114] openvswitch: netlink: Flow key attr not present in new flow. [ 395.016573][T12119] syzkaller0: entered allmulticast mode [ 397.975884][T12135] batadv_slave_1: entered promiscuous mode [ 398.018334][T12157] bond0: Device is already in use. [ 398.089319][T12139] batadv_slave_1: left promiscuous mode [ 398.165665][T12165] __nla_validate_parse: 4 callbacks suppressed [ 398.165686][T12165] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1545'. [ 398.190724][T12166] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1544'. [ 398.200312][T12166] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1544'. [ 398.327112][T12171] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1546'. [ 398.350318][T12166] batadv0: entered promiscuous mode [ 398.366809][T12166] batadv0: left promiscuous mode [ 398.454213][T12165] bond2: option tlb_dynamic_lb: invalid value (5) [ 398.507734][T12165] bond2 (unregistering): Released all slaves [ 398.914152][T12182] syzkaller0: entered promiscuous mode [ 398.920836][T12182] syzkaller0: entered allmulticast mode [ 398.932277][T12182] 0: reclassify loop, rule prio 0, protocol 800 [ 399.517447][T12226] openvswitch: netlink: Message has 4 unknown bytes. [ 399.543842][T12225] tipc: New replicast peer: 0000:0000:0000:0000:0000:0000:0000:0001 [ 399.589945][T12225] tipc: Enabled bearer , priority 10 [ 399.764758][T12246] netlink: 180 bytes leftover after parsing attributes in process `syz.3.1563'. [ 399.794609][T12246] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1563'. [ 399.845064][T12246] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1563'. [ 399.895754][T12239] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1563'. [ 399.932431][T12254] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1565'. [ 399.938981][T12250] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1566'. [ 400.058403][T12250] xt_CT: You must specify a L4 protocol and not use inversions on it [ 400.271915][T12273] macsec1: entered promiscuous mode [ 400.279899][T12273] macsec1: entered allmulticast mode [ 400.435908][T12282] gre2: entered allmulticast mode [ 400.870969][T12304] bond0: (slave dummy0): Releasing backup interface [ 400.929755][T12304] dummy0: left promiscuous mode [ 400.982316][T12304] bond0: (slave bond_slave_0): Releasing backup interface [ 401.070268][T12304] bond_slave_0: left promiscuous mode [ 401.089169][T12304] bond0: (slave bond_slave_1): Releasing backup interface [ 401.108618][T12304] bond_slave_1: left promiscuous mode [ 401.133986][T12304] team0: Port device team_slave_0 removed [ 401.157998][T12304] team0: Port device team_slave_1 removed [ 401.164560][T12304] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 401.187204][T12304] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 401.216749][T12304] veth1_vlan: left allmulticast mode [ 401.240907][T12304] team0: Port device macvlan0 removed [ 401.259430][T12304] bond1: (slave macvlan2): Removing an active aggregator [ 401.276819][T12304] bond1: (slave macvlan2): Releasing backup interface [ 401.307186][T12304] bond3: (slave veth3): Releasing active interface [ 401.321426][T12304] bond5: (slave bridge5): Releasing active interface [ 401.357921][T12324] xt_ecn: cannot match TCP bits for non-tcp packets [ 401.545645][T12319] syzkaller0: entered promiscuous mode [ 401.560244][T12319] syzkaller0: entered allmulticast mode [ 401.570947][T12331] netlink: 'syz.2.1583': attribute type 33 has an invalid length. [ 401.598153][T12331] `: renamed from team0 [ 402.264363][T12365] netlink: 'syz.3.1593': attribute type 1 has an invalid length. [ 402.413988][T12365] bond4: entered promiscuous mode [ 402.446716][T12365] 8021q: adding VLAN 0 to HW filter on device bond4 [ 402.996415][T12398] netlink: 'syz.4.1601': attribute type 10 has an invalid length. [ 403.385182][T12422] __nla_validate_parse: 8 callbacks suppressed [ 403.385200][T12422] netlink: 76 bytes leftover after parsing attributes in process `syz.4.1608'. [ 403.517739][T12428] bridge0: port 3(veth0_to_bridge) entered blocking state [ 403.535611][T12428] bridge0: port 3(veth0_to_bridge) entered disabled state [ 403.569987][T12428] veth0_to_bridge: entered allmulticast mode [ 403.589917][T12428] veth0_to_bridge: entered promiscuous mode [ 403.702763][T12430] xt_hashlimit: size too large, truncated to 1048576 [ 403.766231][T12437] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1610'. [ 403.782831][T12408] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1602'. [ 403.864973][T12437] bridge_slave_0 (unregistering): left allmulticast mode [ 403.896404][T12437] bridge_slave_0 (unregistering): left promiscuous mode [ 403.906342][T12437] bridge0: port 1(bridge_slave_0) entered disabled state [ 403.954395][T12436] netlink: 'syz.3.1602': attribute type 1 has an invalid length. [ 404.317086][T12451] netlink: 232 bytes leftover after parsing attributes in process `syz.5.1616'. [ 404.364553][T12459] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1618'. [ 404.373993][T12459] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1618'. [ 404.410480][T12454] syzkaller0: entered allmulticast mode [ 404.416789][T12464] netlink: 240 bytes leftover after parsing attributes in process `syz.4.1619'. [ 404.453213][T12454] syzkaller0: entered promiscuous mode [ 404.474410][T12464] ip6t_rpfilter: unknown options [ 404.481228][T12454] syzkaller0 (unregistering): left promiscuous mode [ 404.506207][T12454] syzkaller0 (unregistering): left allmulticast mode [ 404.630552][T12479] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1624'. [ 404.727496][T12479] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1624'. [ 404.799593][T12483] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1624'. [ 405.926407][T12518] syzkaller0: entered promiscuous mode [ 405.934542][T12518] syzkaller0: entered allmulticast mode [ 406.268915][T12542] netlink: 'syz.4.1643': attribute type 2 has an invalid length. [ 406.293595][T12538] kthread_run failed with err -4 [ 406.715847][T12574] netlink: 'syz.1.1653': attribute type 7 has an invalid length. [ 406.772872][T12574] netlink: 'syz.1.1653': attribute type 8 has an invalid length. [ 406.839039][T12578] x_tables: duplicate underflow at hook 1 [ 407.229772][T12607] ipip2: entered promiscuous mode [ 407.269581][T12613] hsr0: entered promiscuous mode [ 407.276929][T12611] hsr0: left promiscuous mode [ 407.317474][T12614] tipc: Enabling of bearer rejected, failed to enable media [ 408.735902][T12663] __nla_validate_parse: 9 callbacks suppressed [ 408.735919][T12663] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1674'. [ 408.763104][T12663] macvlan2: entered promiscuous mode [ 408.772215][T12663] macvlan2: entered allmulticast mode [ 408.778860][T12663] mac80211_hwsim hwsim10 wlan0: entered allmulticast mode [ 409.031268][T12681] tipc: Enabled bearer , priority 0 [ 409.044992][T12681] syzkaller0: entered promiscuous mode [ 409.051120][T12681] syzkaller0: entered allmulticast mode [ 409.099572][T12688] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1678'. [ 409.119478][T12689] tipc: Cannot configure node identity twice [ 409.140399][T12678] tipc: Resetting bearer [ 409.192456][T12678] tipc: Disabling bearer [ 409.379742][T12699] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1681'. [ 409.432349][T12702] xt_bpf: check failed: parse error [ 409.457301][T12702] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1681'. [ 409.482052][T12702] tipc: Enabling of bearer rejected, failed to enable media [ 409.629682][T12712] ip6gretap2: entered promiscuous mode [ 409.875240][T12723] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1686'. [ 409.911456][T12728] x_tables: ip_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 410.141935][T12739] netlink: 'syz.3.1692': attribute type 1 has an invalid length. [ 410.244217][T12743] bridge6: entered promiscuous mode [ 410.260381][T12743] bridge6: entered allmulticast mode [ 410.274684][T12726] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1689'. [ 410.276679][T12743] team0: Port device bridge6 added [ 410.336355][T12741] bridge0: port 1(team0) entered blocking state [ 410.344199][T12741] bridge0: port 1(team0) entered disabled state [ 410.378834][T12741] team0: entered allmulticast mode [ 410.390120][T12746] netlink: 'syz.3.1694': attribute type 1 has an invalid length. [ 410.395370][T12741] team0: entered promiscuous mode [ 410.519612][T12747] bond5: (slave bridge7): Enslaving as a backup interface with an up link [ 410.580623][T12749] bond5: (slave bridge8): Enslaving as a backup interface with a down link [ 410.702176][T12765] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_rx_wq": -EINTR [ 410.705581][T12766] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_cmd_wq": -EINTR [ 411.003663][T12788] netlink: 'syz.4.1704': attribute type 10 has an invalid length. [ 411.170656][T12794] netlink: 'syz.1.1705': attribute type 16 has an invalid length. [ 411.202178][T12788] netlink: 'syz.4.1704': attribute type 10 has an invalid length. [ 411.226227][T12794] netlink: 64138 bytes leftover after parsing attributes in process `syz.1.1705'. [ 411.739714][T12812] x_tables: ip_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 412.076569][T12824] dvmrp1: entered allmulticast mode [ 412.174754][T12835] netlink: 'syz.5.1713': attribute type 12 has an invalid length. [ 412.224077][T12837] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1715'. [ 412.229810][T12835] netlink: 190972 bytes leftover after parsing attributes in process `syz.5.1713'. [ 412.301793][T12829] syzkaller1: entered promiscuous mode [ 412.308611][T12829] syzkaller1: entered allmulticast mode [ 412.473934][T12846] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1717'. [ 412.491654][T12788] netlink: 'syz.4.1704': attribute type 1 has an invalid length. [ 412.531387][T12844] xt_TCPMSS: Only works on TCP SYN packets [ 412.549988][T12845] xt_TCPMSS: Only works on TCP SYN packets [ 414.037485][T12863] __nla_validate_parse: 1 callbacks suppressed [ 414.037503][T12863] netlink: 40 bytes leftover after parsing attributes in process `syz.5.1722'. [ 414.095912][T12863] netlink: 20 bytes leftover after parsing attributes in process `syz.5.1722'. [ 414.504005][T12894] netlink: 'syz.2.1729': attribute type 39 has an invalid length. [ 414.555622][T12893] netlink: 44 bytes leftover after parsing attributes in process `syz.2.1729'. [ 414.599264][T12893] netlink: 43 bytes leftover after parsing attributes in process `syz.2.1729'. [ 414.621750][T12893] netlink: 'syz.2.1729': attribute type 5 has an invalid length. [ 414.632096][T12893] netlink: 43 bytes leftover after parsing attributes in process `syz.2.1729'. [ 414.686372][T12901] netlink: 52 bytes leftover after parsing attributes in process `syz.1.1730'. [ 415.290806][T12927] vlan2: entered promiscuous mode [ 415.293667][T12935] netlink: 212348 bytes leftover after parsing attributes in process `syz.5.1737'. [ 415.295890][T12927] bridge0: entered promiscuous mode [ 415.370857][T12935] netlink: Conntrack attr has 3 unknown bytes [ 415.371923][T12941] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 415.405689][T12930] vlan2: entered promiscuous mode [ 415.412039][T12942] netlink: 48 bytes leftover after parsing attributes in process `syz.5.1737'. [ 415.644544][T12959] netlink: 44 bytes leftover after parsing attributes in process `syz.2.1743'. [ 415.773404][T12968] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1745'. [ 416.132239][T12992] syzkaller0: entered promiscuous mode [ 416.138878][T12992] syzkaller0: entered allmulticast mode [ 416.329599][T13001] 8021q: VLANs not supported on ip6tnl0 [ 416.653953][T13019] team_slave_1: Caught tx_queue_len zero misconfig [ 416.941902][T13029] syzkaller1: left promiscuous mode [ 416.964576][T13029] syzkaller1: left allmulticast mode [ 417.028912][T13029] netlink: 'syz.2.1756': attribute type 1 has an invalid length. [ 417.195270][T13029] bond7: entered promiscuous mode [ 417.219158][T13029] 8021q: adding VLAN 0 to HW filter on device bond7 [ 417.363316][T13054] bond7: (slave bridge6): making interface the new active one [ 417.399186][T13054] bridge6: entered promiscuous mode [ 417.416934][T13054] bond7: (slave bridge6): Enslaving as an active interface with an up link [ 417.996802][T13082] vlan3: entered promiscuous mode [ 418.001890][T13082] bridge0: entered promiscuous mode [ 418.560048][T13121] netlink: 'syz.5.1776': attribute type 1 has an invalid length. [ 418.640189][T13130] netlink: 'syz.4.1777': attribute type 7 has an invalid length. [ 418.702318][T13123] bond6: option active_slave: mode dependency failed, not supported in mode balance-xor(2) [ 418.735275][T13123] bond6 (unregistering): Released all slaves [ 418.753963][T13132] netlink: 'syz.5.1778': attribute type 1 has an invalid length. [ 418.807625][T13137] sch_tbf: burst 7 is lower than device tunl0 mtu (1280) ! [ 419.034060][T13154] netlink: 'syz.3.1785': attribute type 1 has an invalid length. [ 419.144478][T13158] __nla_validate_parse: 9 callbacks suppressed [ 419.144498][T13158] netlink: 76 bytes leftover after parsing attributes in process `syz.1.1788'. [ 419.182885][T13160] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1787'. [ 419.310571][T13169] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1791'. [ 419.398971][T13174] Unsupported ieee802154 address type: 0 [ 419.530040][T13177] xt_policy: output policy not valid in PREROUTING and INPUT [ 419.545196][T13182] netlink: 'syz.1.1795': attribute type 1 has an invalid length. [ 419.577640][T13185] SET target dimension over the limit! [ 419.860965][T13207] netlink: 'syz.5.1798': attribute type 13 has an invalid length. [ 419.870179][T13207] netlink: 'syz.5.1798': attribute type 17 has an invalid length. [ 419.884605][T13192] bond6: option arp_all_targets: invalid value (129) [ 419.921222][T13192] bond6 (unregistering): Released all slaves [ 420.055206][T13207] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 420.138599][T13218] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1804'. [ 420.172510][T13218] netlink: 15 bytes leftover after parsing attributes in process `syz.4.1804'. [ 420.177322][T13216] syzkaller0: entered promiscuous mode [ 420.236939][T13216] syzkaller0: entered allmulticast mode [ 420.384271][T13234] bridge_slave_0: entered promiscuous mode [ 420.394776][T13234] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 420.517888][T13238] netlink: 128 bytes leftover after parsing attributes in process `syz.1.1808'. [ 420.715277][T13253] netlink: 'syz.4.1813': attribute type 1 has an invalid length. [ 420.848186][ T97] block nbd3: Possible stuck request ffff888025818000: control (read@0,1024B). Runtime 90 seconds [ 420.861410][ T97] block nbd3: Possible stuck request ffff888025818200: control (read@1024,1024B). Runtime 90 seconds [ 420.872480][ T97] block nbd3: Possible stuck request ffff888025818400: control (read@2048,1024B). Runtime 90 seconds [ 420.883599][ T97] block nbd3: Possible stuck request ffff888025818600: control (read@3072,1024B). Runtime 90 seconds [ 421.128426][T13284] netlink: 32 bytes leftover after parsing attributes in process `syz.2.1819'. [ 421.291489][ T51] Bluetooth: hci5: link tx timeout [ 421.301227][ T51] Bluetooth: hci5: killing stalled connection 11:aa:aa:aa:aa:aa [ 421.312410][ T51] Bluetooth: hci5: link tx timeout [ 421.318223][ T51] Bluetooth: hci5: killing stalled connection 11:aa:aa:aa:aa:aa [ 421.405607][ T51] Bluetooth: hci5: link tx timeout [ 421.413506][ T51] Bluetooth: hci5: killing stalled connection 11:aa:aa:aa:aa:aa [ 421.427180][ T51] Bluetooth: hci5: link tx timeout [ 421.432586][ T51] Bluetooth: hci5: killing stalled connection 11:aa:aa:aa:aa:aa [ 421.466703][T13296] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1822'. [ 421.481008][ T51] Bluetooth: hci5: link tx timeout [ 421.487838][ T51] Bluetooth: hci5: killing stalled connection 11:aa:aa:aa:aa:aa [ 421.603162][T13300] 8021q: VLANs not supported on gre0 [ 421.711907][T13309] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1823'. [ 421.952872][T13317] xt_CONNSECMARK: invalid mode: 0 [ 422.430714][T13330] netlink: 100 bytes leftover after parsing attributes in process `syz.4.1829'. [ 422.447705][ T51] Bluetooth: hci5: link tx timeout [ 422.455181][ T51] Bluetooth: hci5: killing stalled connection 11:aa:aa:aa:aa:aa [ 422.585315][ T51] Bluetooth: hci5: link tx timeout [ 422.590599][ T51] Bluetooth: hci5: killing stalled connection 11:aa:aa:aa:aa:aa [ 422.929078][ T51] Bluetooth: hci5: link tx timeout [ 422.934261][ T51] Bluetooth: hci5: killing stalled connection 11:aa:aa:aa:aa:aa [ 423.031494][ T51] Bluetooth: hci5: link tx timeout [ 423.037354][ T51] Bluetooth: hci5: killing stalled connection 11:aa:aa:aa:aa:aa [ 423.057520][T13353] syzkaller0: entered promiscuous mode [ 423.087839][T13353] syzkaller0: entered allmulticast mode [ 423.237397][ T51] Bluetooth: hci5: link tx timeout [ 423.242708][ T51] Bluetooth: hci5: killing stalled connection 11:aa:aa:aa:aa:aa [ 423.327903][ T51] Bluetooth: hci5: command 0x0406 tx timeout [ 425.633659][T13360] __nla_validate_parse: 2 callbacks suppressed [ 425.633677][T13360] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1835'. [ 425.652531][T13374] netlink: 'syz.1.1839': attribute type 1 has an invalid length. [ 426.171063][T13403] netlink: 212360 bytes leftover after parsing attributes in process `syz.4.1849'. [ 426.206562][T13403] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1849'. [ 426.574345][T13416] netlink: 'syz.1.1852': attribute type 1 has an invalid length. [ 426.822692][T13424] macsec2: entered promiscuous mode [ 426.859736][T13424] macsec2: entered allmulticast mode [ 426.911567][T13434] openvswitch: netlink: IP tunnel dst address not specified [ 427.039998][T13441] IPVS: set_ctl: invalid protocol: 2 224.0.0.2:20002 [ 427.129755][T13444] netlink: 16 bytes leftover after parsing attributes in process `syz.5.1860'. [ 427.139229][T13445] netlink: 16 bytes leftover after parsing attributes in process `syz.5.1860'. [ 427.154713][T13444] veth0_to_team: entered promiscuous mode [ 427.174184][T13444] veth0_to_team: left promiscuous mode [ 427.200561][T13445] veth0_to_team: entered promiscuous mode [ 427.208201][T13445] veth0_to_team: left promiscuous mode [ 427.235969][T13450] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1862'. [ 427.413722][T13458] netlink: 212348 bytes leftover after parsing attributes in process `syz.1.1865'. [ 427.423552][T13458] netlink: ct family unspecified [ 427.517340][T13463] netlink: 'syz.5.1864': attribute type 1 has an invalid length. [ 427.591587][T13461] netlink: 192 bytes leftover after parsing attributes in process `syz.4.1866'. [ 427.622364][T13466] 8021q: adding VLAN 0 to HW filter on device bond6 [ 427.663387][T13470] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1868'. [ 427.706574][T13470] netlink: 16 bytes leftover after parsing attributes in process `syz.5.1868'. [ 428.037519][T13473] bridge0: port 1(team0) entered disabled state [ 428.069751][T13473] batadv0: left promiscuous mode [ 428.090318][T13473] batadv0: left allmulticast mode [ 428.183915][T13473] bridge_slave_0: left promiscuous mode [ 428.314037][T13473] batadv_slave_1: left promiscuous mode [ 428.506752][T13473] macvlan0: left promiscuous mode [ 428.511848][T13473] macvlan0: left allmulticast mode [ 428.628442][T13473] gtp0: left promiscuous mode [ 428.642960][T13473] gtp0: left allmulticast mode [ 428.662164][T13473] bond2: left promiscuous mode [ 428.686705][T13473] bridge2: left promiscuous mode [ 428.696631][T13473] bridge2: left allmulticast mode [ 428.727297][T13473] mac80211_hwsim hwsim3 wlan1: left promiscuous mode [ 428.744506][T13473] macvtap1: left promiscuous mode [ 428.770825][T13473] bridge0: left promiscuous mode [ 428.781172][T13473] bridge0: left allmulticast mode [ 428.793329][T13473] ipip2: left promiscuous mode [ 428.812176][T13473] macsec2: left promiscuous mode [ 428.817579][T13473] macsec2: left allmulticast mode [ 428.831167][T13484] sch_tbf: burst 0 is lower than device veth0_to_team mtu (1514) ! [ 428.873480][ T6007] netdevsim netdevsim1 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 428.896096][ T6007] netdevsim netdevsim1 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 428.913620][ T6007] netdevsim netdevsim1 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 428.935903][ T6007] netdevsim netdevsim1 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 429.124247][ T6007] netdevsim netdevsim1 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 429.138568][ T6007] netdevsim netdevsim1 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 429.149222][ T6007] netdevsim netdevsim1 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 429.160070][ T6007] netdevsim netdevsim1 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 429.578761][T13547] netlink: 'syz.4.1879': attribute type 1 has an invalid length. [ 429.683690][T13547] 8021q: adding VLAN 0 to HW filter on device bond4 [ 429.967775][T13564] hsr_slave_1 (unregistering): left promiscuous mode [ 429.997321][T13570] netlink: 'syz.5.1885': attribute type 21 has an invalid length. [ 430.274062][T13583] x_tables: duplicate underflow at hook 1 [ 430.592974][T13609] 8021q: VLANs not supported on pimreg [ 430.835678][T13628] netlink: 'syz.5.1900': attribute type 10 has an invalid length. [ 430.865369][T13628] __nla_validate_parse: 5 callbacks suppressed [ 430.865389][T13628] netlink: 156 bytes leftover after parsing attributes in process `syz.5.1900'. [ 430.903606][T13628] netlink: 17 bytes leftover after parsing attributes in process `syz.5.1900'. [ 430.921311][T13628] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1900'. [ 430.933569][T13631] netlink: 288 bytes leftover after parsing attributes in process `syz.1.1901'. [ 431.263541][T13649] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1904'. [ 431.538391][T13659] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1908'. [ 431.554936][T13660] x_tables: duplicate underflow at hook 4 [ 431.566222][ T51] Bluetooth: hci5: command 0x0406 tx timeout [ 431.746291][T13668] tipc: Enabled bearer , priority 0 [ 431.788591][T13668] tipc: Resetting bearer [ 431.856955][T13667] tipc: Disabling bearer [ 432.161502][T13691] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1913'. [ 432.673033][T13719] netlink: 5648 bytes leftover after parsing attributes in process `syz.5.1923'. [ 432.729387][T13719] netlink: 'syz.5.1923': attribute type 11 has an invalid length. [ 433.069315][T13758] netlink: 116 bytes leftover after parsing attributes in process `syz.5.1928'. [ 433.398640][T13773] netlink: 'syz.3.1935': attribute type 13 has an invalid length. [ 433.408320][T13773] netlink: 'syz.3.1935': attribute type 27 has an invalid length. [ 433.668717][T13777] veth0: Caught tx_queue_len zero misconfig [ 433.858229][T13786] x_tables: duplicate underflow at hook 3 [ 434.009935][T13780] syzkaller1: entered promiscuous mode [ 434.015435][T13780] syzkaller1: entered allmulticast mode [ 434.233781][T13805] netlink: 2 bytes leftover after parsing attributes in process `syz.5.1945'. [ 434.328843][T13810] netlink: 'syz.2.1946': attribute type 5 has an invalid length. [ 434.613007][T13820] netlink: 'syz.5.1949': attribute type 12 has an invalid length. [ 434.651843][T13823] tipc: Invalid UDP bearer configuration [ 434.651889][T13823] tipc: Enabling of bearer rejected, failed to enable media [ 436.511916][T13841] __nla_validate_parse: 4 callbacks suppressed [ 436.511934][T13841] netlink: 256 bytes leftover after parsing attributes in process `syz.5.1956'. [ 436.759218][T13855] ip6tnl0: Caught tx_queue_len zero misconfig [ 436.835645][T13855] netlink: 144 bytes leftover after parsing attributes in process `syz.4.1960'. [ 436.973854][T13849] netlink: 52 bytes leftover after parsing attributes in process `syz.3.1958'. [ 437.165961][T13884] netlink: 5120 bytes leftover after parsing attributes in process `syz.5.1965'. [ 437.189364][T13883] netlink: 'syz.2.1964': attribute type 3 has an invalid length. [ 437.211354][T13888] netlink: 'syz.2.1964': attribute type 3 has an invalid length. [ 437.274088][ T5900] IPVS: starting estimator thread 0... [ 437.345564][T13891] syzkaller0: entered promiscuous mode [ 437.364454][T13891] syzkaller0: entered allmulticast mode [ 437.396258][T13893] IPVS: using max 30 ests per chain, 72000 per kthread [ 437.464400][T13899] netlink: 212368 bytes leftover after parsing attributes in process `syz.1.1967'. [ 437.614449][T13909] tipc: Failed to remove unknown binding: 66,0,0/1704187191:336913849/336913850 [ 437.669124][T13900] netlink: 48 bytes leftover after parsing attributes in process `syz.2.1969'. [ 437.765307][T13900] netlink: 'syz.2.1969': attribute type 1 has an invalid length. [ 437.970867][T13924] netlink: 'syz.4.1974': attribute type 16 has an invalid length. [ 437.981214][T13924] netlink: 'syz.4.1974': attribute type 17 has an invalid length. [ 438.023857][T13924] bridge0: left allmulticast mode [ 438.033474][T13924] 0X: left allmulticast mode [ 438.040386][T13924] A link change request failed with some changes committed already. Interface 60X may have been left with an inconsistent configuration, please check. [ 438.747023][T13969] netlink: 56 bytes leftover after parsing attributes in process `syz.3.1985'. [ 438.803655][T13975] netlink: 'syz.2.1987': attribute type 1 has an invalid length. [ 439.047074][T13986] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1990'. [ 439.077466][T13990] IPv6: NLM_F_CREATE should be specified when creating new route [ 439.113917][T13992] sctp: [Deprecated]: syz.2.1991 (pid 13992) Use of int in maxseg socket option. [ 439.113917][T13992] Use struct sctp_assoc_value instead [ 439.293284][T14010] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1994'. [ 439.443616][T13998] tipc: Enabling of bearer rejected, already enabled [ 439.836923][T14043] netlink: 108 bytes leftover after parsing attributes in process `syz.1.2002'. [ 439.914648][T14043] tipc: Enabled bearer , priority 0 [ 439.943678][T14053] syzkaller0: entered promiscuous mode [ 439.956164][T14053] syzkaller0: entered allmulticast mode [ 440.087260][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.440671][T14073] tipc: Resetting bearer [ 440.466783][T14081] sctp: [Deprecated]: syz.4.2008 (pid 14081) Use of struct sctp_assoc_value in delayed_ack socket option. [ 440.466783][T14081] Use struct sctp_sack_info instead [ 440.486770][T14032] tipc: Resetting bearer [ 440.560227][T14032] tipc: Disabling bearer [ 440.640670][T14084] tipc: Enabled bearer , priority 0 [ 440.657227][T14084] syzkaller0: entered promiscuous mode [ 440.664319][T14084] syzkaller0: entered allmulticast mode [ 440.753433][T14084] tipc: Resetting bearer [ 440.809090][T14083] tipc: Resetting bearer [ 440.997098][T14083] tipc: Disabling bearer [ 441.462333][T14137] netlink: 'syz.1.2020': attribute type 5 has an invalid length. [ 441.952725][T14163] __nla_validate_parse: 8 callbacks suppressed [ 441.952753][T14163] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2024'. [ 441.985972][T14163] netlink: 'syz.2.2024': attribute type 23 has an invalid length. [ 442.168846][T14174] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2027'. [ 442.183829][T14172] bond8: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 442.186483][T14176] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2026'. [ 442.223850][T14172] bond8 (unregistering): Released all slaves [ 442.281993][T14181] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2028'. [ 442.298779][T14181] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2028'. [ 442.377048][T14174] bridge9: port 1(veth5) entered blocking state [ 442.400426][T14174] bridge9: port 1(veth5) entered disabled state [ 442.427243][T14174] veth5: entered allmulticast mode [ 442.444685][T14174] veth5: entered promiscuous mode [ 442.462360][T14174] bridge9: port 1(veth5) entered blocking state [ 442.468839][T14174] bridge9: port 1(veth5) entered forwarding state [ 442.519870][T14181] syzkaller0: tun_chr_ioctl cmd 1074025681 [ 442.899377][ T6009] bridge9: port 1(veth5) entered disabled state [ 442.910746][T14220] netlink: 'syz.2.2036': attribute type 1 has an invalid length. [ 442.925586][T14217] bond0: (slave xfrm1): refused to change device type [ 442.994978][T14227] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2036'. [ 443.051234][T14220] bond8: entered promiscuous mode [ 443.058723][T14220] 8021q: adding VLAN 0 to HW filter on device bond8 [ 443.116453][T14227] bond8: entered allmulticast mode [ 443.220056][T14220] bond8: (slave bridge7): making interface the new active one [ 443.264793][T14220] bridge7: entered promiscuous mode [ 443.286740][T14220] bridge7: entered allmulticast mode [ 443.303827][T14220] bond8: (slave bridge7): Enslaving as an active interface with an up link [ 443.507756][T14249] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2042'. [ 443.528963][T14250] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2042'. [ 443.580882][T14249] tipc: Enabled bearer , priority 0 [ 443.589187][T14256] syzkaller0: entered promiscuous mode [ 443.594837][T14256] syzkaller0: entered allmulticast mode [ 443.733310][T14261] IPVS: set_ctl: invalid protocol: 94 172.30.0.5:20000 [ 443.740773][T14256] tipc: Resetting bearer [ 443.776603][T14256] tipc: Disabling bearer [ 444.045776][T14278] bond7: option ad_select: invalid value (34) [ 444.053677][T14278] bond7 (unregistering): Released all slaves [ 444.203954][T14293] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2050'. [ 444.255154][T14295] netlink: 'syz.2.2052': attribute type 13 has an invalid length. [ 444.319986][T14295] syzkaller0: default qdisc (pfifo_fast) fail, fallback to noqueue [ 444.329994][T14295] syzkaller0: entered promiscuous mode [ 444.335499][T14295] syzkaller0: entered allmulticast mode [ 444.343967][T14301] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 444.369559][T14295] tipc: Enabled bearer , priority 0 [ 444.378079][T14294] tipc: Resetting bearer [ 444.419443][T14294] tipc: Disabling bearer [ 444.442356][T14305] syz_tun (unregistering): left allmulticast mode [ 444.449287][T14305] syz_tun (unregistering): left promiscuous mode [ 444.455715][T14305] bridge0: port 2(syz_tun) entered disabled state [ 444.527946][T14306] bridge10: entered promiscuous mode [ 444.533516][T14306] bridge10: entered allmulticast mode [ 444.547292][T14306] team0: Port device bridge10 added [ 444.608798][T14310] syzkaller0: entered promiscuous mode [ 444.614863][T14310] syzkaller0: entered allmulticast mode [ 444.888535][T14334] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2062'. [ 445.260205][T14349] can-isotp: isotp_sendmsg: can_send_ret -ENETDOWN [ 446.015862][T14388] xt_hashlimit: size too large, truncated to 1048576 [ 446.287130][ T5142] Bluetooth: hci5: command 0x0406 tx timeout [ 446.488626][T14420] syzkaller0: entered promiscuous mode [ 446.505994][T14420] syzkaller0: entered allmulticast mode [ 446.939157][T14457] xt_TPROXY: Can be used only with -p tcp or -p udp [ 447.194026][T14450] bond7: (slave bridge8): Enslaving as an active interface with an up link [ 447.464341][T14476] __nla_validate_parse: 9 callbacks suppressed [ 447.464362][T14476] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2099'. [ 447.565509][T14478] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2100'. [ 447.650790][T14486] lo: Caught tx_queue_len zero misconfig [ 447.657706][T14486] sch_tbf: peakrate 7 is lower than or equals to rate 6829859379779001161 ! [ 448.040239][T14513] netlink: 'syz.2.2108': attribute type 32 has an invalid length. [ 448.052052][T14513] netlink: 60 bytes leftover after parsing attributes in process `syz.2.2108'. [ 448.076489][T14508] netlink: 'syz.1.2107': attribute type 13 has an invalid length. [ 448.182546][T14522] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 448.195442][T14516] syzkaller1: entered promiscuous mode [ 448.201815][T14516] syzkaller1: entered allmulticast mode [ 448.220851][T14522] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 448.223775][T14518] pim6reg99999999: entered allmulticast mode [ 448.327351][T14530] xt_ecn: cannot match TCP bits for non-tcp packets [ 448.532359][T14539] x_tables: duplicate underflow at hook 2 [ 448.550499][T14540] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2114'. [ 448.580636][T14508] netlink: 32 bytes leftover after parsing attributes in process `syz.1.2107'. [ 448.686518][ T10] syzkaller0: tun_net_xmit 76 [ 448.694872][T14540] syzkaller0: create flow: hash 1429554177 index 1 [ 448.773052][T14550] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2114'. [ 448.831240][ T10] syzkaller0: tun_net_xmit 76 [ 448.896280][ T10] syzkaller0: tun_net_xmit 76 [ 448.980374][T14563] netlink: 23 bytes leftover after parsing attributes in process `syz.3.2121'. [ 449.007501][ T10] syzkaller0: tun_net_xmit 76 [ 449.129158][T14569] netlink: 260 bytes leftover after parsing attributes in process `syz.1.2122'. [ 449.227141][T14538] syzkaller0: delete flow: hash 1429554177 index 1 [ 449.451054][T14580] netlink: 'syz.3.2126': attribute type 1 has an invalid length. [ 450.931356][ T97] block nbd3: Possible stuck request ffff888025818000: control (read@0,1024B). Runtime 120 seconds [ 450.942573][ T97] block nbd3: Possible stuck request ffff888025818200: control (read@1024,1024B). Runtime 120 seconds [ 450.955390][ T97] block nbd3: Possible stuck request ffff888025818400: control (read@2048,1024B). Runtime 120 seconds [ 450.966769][ T97] block nbd3: Possible stuck request ffff888025818600: control (read@3072,1024B). Runtime 120 seconds [ 451.060964][T14601] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2133'. [ 451.429952][T14624] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 451.455569][T14616] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 451.569213][T14630] syzkaller0: entered promiscuous mode [ 451.574807][T14630] syzkaller0: entered allmulticast mode [ 451.701785][T14633] syzkaller0: entered promiscuous mode [ 451.707985][T14633] syzkaller0: entered allmulticast mode [ 451.829892][T14637] netlink: 2 bytes leftover after parsing attributes in process `syz.2.2141'. [ 452.034738][T14649] netlink: 'syz.1.2144': attribute type 9 has an invalid length. [ 452.066350][T14649] netlink: 'syz.1.2144': attribute type 11 has an invalid length. [ 452.086202][T14649] netlink: 'syz.1.2144': attribute type 12 has an invalid length. [ 452.668530][T14676] __nla_validate_parse: 2 callbacks suppressed [ 452.668547][T14676] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2148'. [ 452.802775][T14674] xt_l2tp: invalid flags combination: 0 [ 452.972729][T14688] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2150'. [ 452.995410][T14688] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2150'. [ 453.024325][T14688] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2150'. [ 453.205339][T14699] netlink: 'syz.4.2154': attribute type 49 has an invalid length. [ 453.509415][T14713] netlink: 'syz.2.2157': attribute type 36 has an invalid length. [ 453.592855][T14713] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2157'. [ 453.913416][T14729] hsr0: entered promiscuous mode [ 453.924369][T14731] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2159'. [ 453.973412][T14731] hsr_slave_0: left promiscuous mode [ 453.989015][T14731] hsr0 (unregistering): left promiscuous mode [ 457.336935][ T5191] udevd[5191]: worker [6903] /devices/virtual/block/nbd3 is taking a long time [ 481.017507][ T97] block nbd3: Possible stuck request ffff888025818000: control (read@0,1024B). Runtime 150 seconds [ 481.028421][ T97] block nbd3: Possible stuck request ffff888025818200: control (read@1024,1024B). Runtime 150 seconds [ 481.039519][ T97] block nbd3: Possible stuck request ffff888025818400: control (read@2048,1024B). Runtime 150 seconds [ 481.051085][ T97] block nbd3: Possible stuck request ffff888025818600: control (read@3072,1024B). Runtime 150 seconds [ 481.466435][ T5142] Bluetooth: hci5: link tx timeout [ 481.471616][ T5142] Bluetooth: hci5: killing stalled connection 10:aa:aa:aa:aa:aa [ 483.494447][ T5142] Bluetooth: hci5: command 0x0406 tx timeout [ 501.489681][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 510.594282][ T5191] udevd[5191]: worker [6903] /devices/virtual/block/nbd3 timeout; kill it [ 510.603719][ T5191] udevd[5191]: seq 14123 '/devices/virtual/block/nbd3' killed [ 511.086796][ T97] block nbd3: Possible stuck request ffff888025818000: control (read@0,1024B). Runtime 180 seconds [ 511.097680][ T97] block nbd3: Possible stuck request ffff888025818200: control (read@1024,1024B). Runtime 180 seconds [ 511.109080][ T97] block nbd3: Possible stuck request ffff888025818400: control (read@2048,1024B). Runtime 180 seconds [ 511.120307][ T97] block nbd3: Possible stuck request ffff888025818600: control (read@3072,1024B). Runtime 180 seconds [ 517.410957][T14848] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2165'. [ 517.537643][T14856] netlink: 'syz.4.2168': attribute type 4 has an invalid length. [ 517.551777][ T5142] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 517.562715][ T5142] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 517.574283][ T5142] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 517.588833][ T5142] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 517.607454][ T5142] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 517.645817][T14853] syzkaller0: entered promiscuous mode [ 517.666296][T14853] syzkaller0: entered allmulticast mode [ 517.684812][T14856] bridge_slave_1: left allmulticast mode [ 517.692775][T14863] netlink: 212368 bytes leftover after parsing attributes in process `syz.1.2169'. [ 517.704788][T14856] bridge_slave_1: left promiscuous mode [ 517.740661][T14856] bridge0: port 2(bridge_slave_1) entered disabled state [ 517.778494][T14875] netlink: 'syz.2.2171': attribute type 1 has an invalid length. [ 517.789185][T14856] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 517.798844][T14856] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 517.817129][T14856] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 517.862950][T14875] 8021q: adding VLAN 0 to HW filter on device bond9 [ 517.885553][T14879] vlan0: entered promiscuous mode [ 517.891044][T14879] bond9: entered promiscuous mode [ 517.896736][T14879] vlan0: entered allmulticast mode [ 517.901994][T14879] bond9: entered allmulticast mode [ 517.937133][T14875] bond9: (slave bridge8): making interface the new active one [ 517.944704][T14875] bridge8: entered promiscuous mode [ 517.951397][T14875] bridge8: entered allmulticast mode [ 517.968673][T14875] bond9: (slave bridge8): Enslaving as an active interface with an up link [ 519.619791][T14878] syzkaller0: entered promiscuous mode [ 519.625523][T14878] syzkaller0: entered allmulticast mode [ 519.647500][ T5142] Bluetooth: hci6: command tx timeout [ 520.031605][T14931] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2183'. [ 520.050896][T14855] chnl_net:caif_netlink_parms(): no params data found [ 520.117989][T14933] netlink: 'syz.3.2185': attribute type 3 has an invalid length. [ 520.138162][T14933] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2185'. [ 520.175419][T14855] bridge0: port 1(bridge_slave_0) entered blocking state [ 520.184907][T14855] bridge0: port 1(bridge_slave_0) entered disabled state [ 520.193201][T14855] bridge_slave_0: entered allmulticast mode [ 520.201088][T14855] bridge_slave_0: entered promiscuous mode [ 520.210440][T14855] bridge0: port 2(bridge_slave_1) entered blocking state [ 520.217802][T14855] bridge0: port 2(bridge_slave_1) entered disabled state [ 520.225373][T14855] bridge_slave_1: entered allmulticast mode [ 520.233193][T14855] bridge_slave_1: entered promiscuous mode [ 520.506392][T14949] netlink: 'syz.3.2189': attribute type 4 has an invalid length. [ 520.752413][T14855] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 520.960765][T14855] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 521.150893][T14855] team0: Port device team_slave_0 added [ 521.178577][T14855] team0: Port device team_slave_1 added [ 521.281501][T14855] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 521.288883][T14855] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 521.320121][T14855] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 521.375408][T14855] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 521.395020][T14855] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 521.438978][T14855] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 521.620933][T14855] hsr_slave_0: entered promiscuous mode [ 521.628020][T14855] hsr_slave_1: entered promiscuous mode [ 521.727103][ T5142] Bluetooth: hci6: command tx timeout [ 521.902530][T14983] netlink: 'syz.4.2198': attribute type 1 has an invalid length. [ 521.917198][T14983] netlink: 280 bytes leftover after parsing attributes in process `syz.4.2198'. [ 522.121797][T15005] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2202'. [ 522.247632][T15013] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2205'. [ 522.256952][T15014] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2205'. [ 522.301097][T14855] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 522.321875][T14855] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 522.387813][T14855] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 522.414546][T14855] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 522.483898][T15020] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2205'. [ 522.875953][T14855] 8021q: adding VLAN 0 to HW filter on device bond0 [ 522.915809][T14855] 8021q: adding VLAN 0 to HW filter on device team0 [ 522.957176][T15046] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2212'. [ 523.000018][ T6016] bridge0: port 1(bridge_slave_0) entered blocking state [ 523.007265][ T6016] bridge0: port 1(bridge_slave_0) entered forwarding state [ 523.033022][ T6016] bridge0: port 2(bridge_slave_1) entered blocking state [ 523.040286][ T6016] bridge0: port 2(bridge_slave_1) entered forwarding state [ 523.286934][T15058] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2215'. [ 523.413777][T15071] xt_TPROXY: Can be used only with -p tcp or -p udp [ 523.481857][T15064] bond10: option arp_validate: mode dependency failed, not supported in mode 802.3ad(4) [ 523.518428][T15064] bond10 (unregistering): Released all slaves [ 523.613468][T15077] openvswitch: netlink: IP tunnel dst address not specified [ 523.650058][T14855] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 523.777049][T15083] pim6reg1: entered promiscuous mode [ 523.789315][T15083] pim6reg1: entered allmulticast mode [ 523.808517][ T5142] Bluetooth: hci6: command tx timeout [ 523.969645][T15091] xt_hashlimit: size too large, truncated to 1048576 [ 523.984741][T15099] netlink: 'syz.4.2227': attribute type 11 has an invalid length. [ 523.993001][T15098] xt_hashlimit: size too large, truncated to 1048576 [ 524.002327][T15100] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2225'. [ 524.012587][T15100] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2225'. [ 524.021980][T15099] netlink: 199828 bytes leftover after parsing attributes in process `syz.4.2227'. [ 524.051294][T15100] geneve3: entered promiscuous mode [ 524.068951][T15100] geneve3: entered allmulticast mode [ 524.275646][ T6033] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 524.296331][ T6033] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 524.311858][ T6033] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 524.354448][ T6033] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 524.521620][T14855] veth0_vlan: entered promiscuous mode [ 524.540419][T14855] veth1_vlan: entered promiscuous mode [ 524.563303][T15120] netlink: 176 bytes leftover after parsing attributes in process `syz.4.2231'. [ 524.606179][T14855] veth0_macvtap: entered promiscuous mode [ 524.647017][T14855] veth1_macvtap: entered promiscuous mode [ 524.680811][T14855] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 524.704259][T14855] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 524.718271][ T6034] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 524.763132][ T6034] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 524.811144][ T6034] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 524.834667][ T6034] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 524.957554][T15138] netlink: zone id is out of range [ 524.962885][T15138] netlink: zone id is out of range [ 524.968725][T15138] netlink: zone id is out of range [ 524.974946][T15138] netlink: zone id is out of range [ 524.980500][T15138] netlink: zone id is out of range [ 524.986454][T15138] netlink: zone id is out of range [ 524.991898][T15138] netlink: zone id is out of range [ 525.000542][T15138] netlink: zone id is out of range [ 525.009051][T15138] netlink: zone id is out of range [ 525.276957][T15139] lo speed is unknown, defaulting to 1000 [ 525.300221][T15137] pimreg: entered allmulticast mode [ 525.315204][T15142] tap0: tun_chr_ioctl cmd 1074025681 [ 525.340931][T15139] lo speed is unknown, defaulting to 1000 [ 525.379816][T15139] lo speed is unknown, defaulting to 1000 [ 525.386769][T15154] netlink: 284 bytes leftover after parsing attributes in process `syz.3.2238'. [ 525.453334][T15139] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98 [ 525.559069][T15156] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2240'. [ 525.577198][T15139] lo speed is unknown, defaulting to 1000 [ 525.629732][ T6004] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 525.639051][ T6004] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 525.673699][T15139] lo speed is unknown, defaulting to 1000 [ 525.718224][T15159] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2240'. [ 525.754134][T15139] lo speed is unknown, defaulting to 1000 [ 525.862734][T15139] lo speed is unknown, defaulting to 1000 [ 525.888317][ T5142] Bluetooth: hci6: command tx timeout [ 525.895488][T15139] lo speed is unknown, defaulting to 1000 [ 525.904371][ T6031] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 525.906766][T15139] lo speed is unknown, defaulting to 1000 [ 525.932575][ T6031] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 525.943341][T15139] lo speed is unknown, defaulting to 1000 [ 526.000813][T15139] lo speed is unknown, defaulting to 1000 [ 526.044877][T15177] sctp: [Deprecated]: syz.3.2246 (pid 15177) Use of struct sctp_assoc_value in delayed_ack socket option. [ 526.044877][T15177] Use struct sctp_sack_info instead [ 526.179612][T15179] syzkaller0: entered promiscuous mode [ 526.202109][T15179] syzkaller0: entered allmulticast mode [ 526.420064][T15204] netlink: 'syz.4.2250': attribute type 1 has an invalid length. [ 528.269800][T15220] __nla_validate_parse: 2 callbacks suppressed [ 528.269822][T15220] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2254'. [ 528.287685][T15220] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2254'. [ 528.622204][T15235] bridge5: entered promiscuous mode [ 528.658328][T15235] bridge5: entered allmulticast mode [ 529.196998][T15251] netlink: 'syz.4.2264': attribute type 2 has an invalid length. [ 529.205404][T15250] netlink: 'syz.4.2264': attribute type 2 has an invalid length. [ 529.227374][T15250] geneve1: entered promiscuous mode [ 529.562199][T15272] netlink: 24 bytes leftover after parsing attributes in process `syz.6.2272'. [ 529.712335][T15278] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2272'. [ 529.734450][T15278] netlink: 12 bytes leftover after parsing attributes in process `syz.6.2272'. [ 529.748815][T15275] bond1: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 529.784568][T15275] bond1 (unregistering): Released all slaves [ 529.872378][T15279] netlink: 36 bytes leftover after parsing attributes in process `syz.3.2273'. [ 529.883700][T15279] netlink: 36 bytes leftover after parsing attributes in process `syz.3.2273'. [ 529.903924][T15279] netlink: 36 bytes leftover after parsing attributes in process `syz.3.2273'. [ 529.924548][T15279] netlink: 36 bytes leftover after parsing attributes in process `syz.3.2273'. [ 529.954293][T15279] netlink: 36 bytes leftover after parsing attributes in process `syz.3.2273'. [ 530.424221][T15284] netlink: 'syz.4.2275': attribute type 8 has an invalid length. [ 530.438699][T15284] bond0: entered promiscuous mode [ 530.443782][T15284] bridge1: entered promiscuous mode [ 530.450811][T15284] gretap0: entered promiscuous mode [ 530.477847][T15284] bond0: left promiscuous mode [ 530.486736][T15284] bridge1: left promiscuous mode [ 530.508317][T15284] gretap0: left promiscuous mode [ 530.719545][T15296] net_ratelimit: 46 callbacks suppressed [ 530.719566][T15296] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 531.050434][T15315] IPv6: NLM_F_CREATE should be specified when creating new route [ 531.433253][T15334] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 532.205161][T15341] netlink: 'syz.1.2292': attribute type 1 has an invalid length. [ 532.214596][T15341] netlink: 'syz.1.2292': attribute type 2 has an invalid length. [ 532.222577][T15341] netlink: 'syz.1.2292': attribute type 1 has an invalid length. [ 532.230783][T15341] netlink: 'syz.1.2292': attribute type 3 has an invalid length. [ 532.244361][T15338] netlink: 'syz.4.2291': attribute type 1 has an invalid length. [ 533.585635][T15355] lo speed is unknown, defaulting to 1000 [ 533.588999][T15361] __nla_validate_parse: 119 callbacks suppressed [ 533.589416][T15361] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2298'. [ 533.605777][T15330] lo speed is unknown, defaulting to 1000 [ 533.707525][T15366] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2300'. [ 533.721970][T15368] netlink: 'syz.2.2301': attribute type 10 has an invalid length. [ 533.745233][T15368] `: Port device dummy0 added [ 533.753881][T15368] netlink: 'syz.2.2301': attribute type 10 has an invalid length. [ 533.850662][T15368] `: Port device dummy0 removed [ 533.862902][T15370] netlink: 48 bytes leftover after parsing attributes in process `syz.1.2299'. [ 533.885755][T15368] dummy0: entered promiscuous mode [ 533.908096][T15368] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 534.049114][T15385] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2305'. [ 534.240570][T15396] IPVS: set_ctl: invalid protocol: 43 224.0.0.1:20002 [ 534.244089][T15391] netlink: 12 bytes leftover after parsing attributes in process `syz.6.2306'. [ 534.284496][T15391] vlan2: entered promiscuous mode [ 534.308998][T15391] bond0: entered promiscuous mode [ 534.320432][T15391] bond_slave_0: entered promiscuous mode [ 534.332504][T15391] bond_slave_1: entered promiscuous mode [ 534.410012][T15407] dvmrp6: entered allmulticast mode [ 534.471257][T15401] bond5: invalid ARP target 0.0.0.0 specified for addition [ 534.479033][T15401] bond5: option arp_ip_target: invalid value (0) [ 534.492312][T15401] bond5 (unregistering): Released all slaves [ 534.538507][T15414] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2315'. [ 534.560416][T15414] gretap2: entered promiscuous mode [ 534.576433][T15416] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2315'. [ 534.631648][T15414] netlink: 56 bytes leftover after parsing attributes in process `syz.3.2315'. [ 534.829222][T15431] openvswitch: netlink: nsh attr 0 has unexpected len 1 expected 0 [ 535.091842][T15447] netlink: 48 bytes leftover after parsing attributes in process `syz.3.2322'. [ 535.216840][T15449] block nbd4: server does not support multiple connections per device. [ 535.241045][T15449] block nbd4: shutting down sockets [ 535.278914][T15456] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2325'. [ 535.679054][T15479] mac80211_hwsim hwsim16 syzkaller0: entered promiscuous mode [ 535.687155][T15479] mac80211_hwsim hwsim16 syzkaller0: entered allmulticast mode [ 535.801671][T15487] 8021q: adding VLAN 0 to HW filter on device bond5 [ 535.884006][T15486] syzkaller0: entered promiscuous mode [ 535.892847][T15486] syzkaller0: entered allmulticast mode [ 536.009159][T15500] lo speed is unknown, defaulting to 1000 [ 536.242796][T15513] x_tables: duplicate underflow at hook 3 [ 538.038198][T15543] netlink: 'syz.2.2351': attribute type 10 has an invalid length. [ 538.249797][T15570] lo: Caught tx_queue_len zero misconfig [ 538.383347][T15581] ieee802154 phy0 wpan0: encryption failed: -90 [ 538.459884][T15590] vxcan3: entered promiscuous mode [ 538.642638][T15600] team0: left promiscuous mode [ 538.677958][T15600] bridge6: left promiscuous mode [ 538.745201][T15599] lo speed is unknown, defaulting to 1000 [ 538.780572][T15598] lo speed is unknown, defaulting to 1000 [ 538.962673][T15612] __nla_validate_parse: 25 callbacks suppressed [ 538.962693][T15612] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2366'. [ 539.165117][T15621] x_tables: duplicate underflow at hook 1 [ 539.167961][T15622] x_tables: duplicate underflow at hook 1 [ 539.215389][T15619] bond8: Removing last arp target with arp_interval on [ 539.346871][T15631] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2371'. [ 539.421873][T15640] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2371'. [ 539.492745][T15643] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2371'. [ 539.699416][T15658] netlink: 27 bytes leftover after parsing attributes in process `syz.2.2380'. [ 539.748918][T15663] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 539.757550][T15663] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 539.776228][T15663] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 539.793726][T15663] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 539.871161][T15670] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2383'. [ 540.094472][T15676] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2386'. [ 540.385820][T15703] syzkaller0: entered promiscuous mode [ 540.393812][T15703] syzkaller0: entered allmulticast mode [ 540.437999][T15699] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2390'. [ 541.187481][ T97] block nbd3: Possible stuck request ffff888025818000: control (read@0,1024B). Runtime 210 seconds [ 541.198611][ T97] block nbd3: Possible stuck request ffff888025818200: control (read@1024,1024B). Runtime 210 seconds [ 541.209917][ T97] block nbd3: Possible stuck request ffff888025818400: control (read@2048,1024B). Runtime 210 seconds [ 541.221530][ T97] block nbd3: Possible stuck request ffff888025818600: control (read@3072,1024B). Runtime 210 seconds [ 541.948510][T15706] lo speed is unknown, defaulting to 1000 [ 542.280767][T15725] netlink: 'syz.4.2395': attribute type 1 has an invalid length. [ 543.110787][T15694] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 543.269145][T15734] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2397'. [ 543.276513][T15735] netlink: 'syz.2.2398': attribute type 2 has an invalid length. [ 543.331476][T15728] lo speed is unknown, defaulting to 1000 [ 543.346338][T15735] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2398'. [ 543.484451][T15747] ip6tnl0: Caught tx_queue_len zero misconfig [ 543.641200][T15751] lo speed is unknown, defaulting to 1000 [ 543.845572][T15773] geneve4: entered promiscuous mode [ 543.861821][ T6009] netdevsim netdevsim3 eth0: set [1, 1] type 2 family 0 port 40967 - 0 [ 543.887365][ T6009] netdevsim netdevsim3 eth1: set [1, 1] type 2 family 0 port 40967 - 0 [ 543.902479][ T6009] netdevsim netdevsim3 eth2: set [1, 1] type 2 family 0 port 40967 - 0 [ 543.950433][ T6009] netdevsim netdevsim3 eth3: set [1, 1] type 2 family 0 port 40967 - 0 [ 544.259113][T15796] netlink: 12 bytes leftover after parsing attributes in process `syz.6.2413'. [ 544.419491][T15804] netlink: 'syz.2.2416': attribute type 1 has an invalid length. [ 544.428202][T15800] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2414'. [ 544.437499][T15804] netlink: 780 bytes leftover after parsing attributes in process `syz.2.2416'. [ 544.476230][T15805] netlink: 'syz.2.2416': attribute type 1 has an invalid length. [ 544.491888][T15805] netlink: 780 bytes leftover after parsing attributes in process `syz.2.2416'. [ 544.499941][T15806] netlink: 212368 bytes leftover after parsing attributes in process `syz.4.2415'. [ 544.686440][T15817] netlink: 180 bytes leftover after parsing attributes in process `syz.1.2418'. [ 544.695605][T15817] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2418'. [ 544.725896][T15817] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2418'. [ 544.761453][T15822] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 544.871311][T15820] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 544.907729][T15826] bond10: option arp_all_targets: invalid value (129) [ 544.934671][T15826] bond10 (unregistering): Released all slaves [ 545.110059][T15849] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2428'. [ 545.136572][T15851] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2429'. [ 545.164471][T15853] netlink: 'syz.6.2430': attribute type 1 has an invalid length. [ 545.270308][T15862] IPVS: length: 49 != 24 [ 545.352602][T15867] netlink: 'syz.1.2434': attribute type 29 has an invalid length. [ 545.391973][T15870] sctp: [Deprecated]: syz.3.2435 (pid 15870) Use of struct sctp_assoc_value in delayed_ack socket option. [ 545.391973][T15870] Use struct sctp_sack_info instead [ 545.392309][T15871] netlink: 'syz.6.2436': attribute type 4 has an invalid length. [ 545.492273][ T51] Bluetooth: hci6: command 0x0405 tx timeout [ 545.557076][T15879] netlink: 'syz.3.2437': attribute type 19 has an invalid length. [ 545.804801][T15893] netlink: 'syz.4.2441': attribute type 4 has an invalid length. [ 546.019778][T15903] RDS: rds_bind could not find a transport for ::ffff:172.20.20.187, load rds_tcp or rds_rdma? [ 547.311752][T15951] dummy0: entered promiscuous mode [ 547.312227][T15941] xt_addrtype: ipv6 BLACKHOLE matching not supported [ 547.317203][T15951] vlan2: entered promiscuous mode [ 548.080897][T15973] lo speed is unknown, defaulting to 1000 [ 548.099474][T15978] syzkaller0: entered promiscuous mode [ 548.104990][T15978] syzkaller0: entered allmulticast mode [ 548.326946][T15987] veth6: entered allmulticast mode [ 548.561786][T15975] IPVS: length: 132 != 8 [ 548.574171][T15975] pimreg: entered allmulticast mode [ 548.582938][T15975] pimreg: left allmulticast mode [ 549.023393][T16012] workqueue: Failed to create a rescuer kthread for wq "bond10": -EINTR [ 549.223897][T16022] debugfs: '&%Q0@æjʫ}!' already exists in 'ieee80211' [ 549.277845][T16025] batman_adv: batadv0: Adding interface: macvlan1 [ 549.284314][T16025] batman_adv: batadv0: The MTU of interface macvlan1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 549.317152][T16025] batman_adv: batadv0: Not using interface macvlan1 (retrying later): interface not active [ 549.488813][T16026] netlink: 'syz.3.2475': attribute type 1 has an invalid length. [ 549.523975][T16029] __nla_validate_parse: 10 callbacks suppressed [ 549.523997][T16029] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2476'. [ 549.564097][T16033] netlink: 'syz.6.2478': attribute type 142 has an invalid length. [ 549.659236][T16039] netlink: 32 bytes leftover after parsing attributes in process `syz.6.2481'. [ 549.784868][T16054] netlink: 176 bytes leftover after parsing attributes in process `syz.2.2485'. [ 549.784868][T16053] netlink: 176 bytes leftover after parsing attributes in process `syz.2.2485'. [ 549.960122][T16064] netlink: 256 bytes leftover after parsing attributes in process `syz.2.2487'. [ 549.973075][T16060] tipc: Started in network mode [ 549.978033][T16060] tipc: Node identity 6ed56c9186c1, cluster identity 4711 [ 549.985762][T16060] tipc: Enabled bearer , priority 0 [ 550.105343][T16048] tipc: Disabling bearer [ 550.294841][T16075] pimreg: entered allmulticast mode [ 550.336442][T16075] pimreg: left allmulticast mode [ 550.398475][T16082] pimreg: entered allmulticast mode [ 550.595025][T16094] netlink: 'syz.4.2493': attribute type 7 has an invalid length. [ 550.608812][T16085] netlink: 'syz.6.2491': attribute type 29 has an invalid length. [ 550.617680][T16094] netlink: 148 bytes leftover after parsing attributes in process `syz.4.2493'. [ 550.638375][T16094] ipt_rpfilter: unknown options [ 550.643591][T16096] netlink: 'syz.1.2494': attribute type 1 has an invalid length. [ 550.666170][T16096] netlink: 244 bytes leftover after parsing attributes in process `syz.1.2494'. [ 550.671903][T16097] netlink: 'syz.4.2493': attribute type 7 has an invalid length. [ 550.684622][T16085] netlink: 'syz.6.2491': attribute type 29 has an invalid length. [ 550.727047][T16094] ipt_rpfilter: unknown options [ 550.734861][T16097] netlink: 148 bytes leftover after parsing attributes in process `syz.4.2493'. [ 550.758993][T16101] netlink: 500 bytes leftover after parsing attributes in process `syz.6.2491'. [ 550.836743][T16101] unsupported nla_type 58 [ 551.191038][T16123] xt_bpf: check failed: parse error [ 551.252456][T16124] lo speed is unknown, defaulting to 1000 [ 551.364432][T16127] syzkaller0: entered promiscuous mode [ 551.372667][T16127] syzkaller0: entered allmulticast mode [ 551.708763][T16141] netlink: 20 bytes leftover after parsing attributes in process `syz.6.2505'. [ 551.718200][T16140] dvmrp0: entered allmulticast mode [ 551.950792][T16149] lo speed is unknown, defaulting to 1000 [ 551.958724][T16150] syzkaller1: entered allmulticast mode [ 552.123411][T16166] netlink: 'syz.2.2513': attribute type 11 has an invalid length. [ 552.207745][T16160] lo speed is unknown, defaulting to 1000 [ 552.436937][T16179] netlink: zone id is out of range [ 552.576229][T16179] netlink: zone id is out of range [ 552.600114][T16179] netlink: zone id is out of range [ 552.616851][T16179] netlink: zone id is out of range [ 552.643225][T16179] netlink: zone id is out of range [ 552.663290][T16179] netlink: zone id is out of range [ 552.680333][T16179] netlink: zone id is out of range [ 552.698854][T16179] netlink: zone id is out of range [ 552.708968][T16179] netlink: zone id is out of range [ 552.723380][T16179] netlink: zone id is out of range [ 552.772887][ T24] hid-generic 0005:0006:5508.0002: hidraw0: BLUETOOTH HID vc3.36 Device [syz0] on aa:aa:aa:aa:aa:aa [ 552.940578][T16193] fido_id[16193]: Failed to open report descriptor at '/sys/devices/virtual/bluetooth/hci6/hci6:200/report_descriptor': No such file or directory [ 553.256857][T16214] netlink: 'syz.6.2525': attribute type 1 has an invalid length. [ 553.509307][T16231] lo speed is unknown, defaulting to 1000 [ 553.561133][T16238] team_slave_0: Caught tx_queue_len zero misconfig [ 553.579708][T16234] netlink: 'syz.3.2529': attribute type 10 has an invalid length. [ 554.122488][T16257] lo speed is unknown, defaulting to 1000 [ 554.674169][T16299] __nla_validate_parse: 9 callbacks suppressed [ 554.674190][T16299] netlink: 5 bytes leftover after parsing attributes in process `syz.4.2545'. [ 554.691309][T16303] 8021q: VLANs not supported on xfrm0 [ 554.757386][T16306] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2544'. [ 555.292140][T16345] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2552'. [ 555.390647][T16350] netlink: 100 bytes leftover after parsing attributes in process `syz.4.2556'. [ 555.403501][T16347] sctp: [Deprecated]: syz.2.2553 (pid 16347) Use of int in maxseg socket option. [ 555.403501][T16347] Use struct sctp_assoc_value instead [ 555.418426][T16350] netlink: 100 bytes leftover after parsing attributes in process `syz.4.2556'. [ 555.704074][T16360] tipc: Enabled bearer , priority 0 [ 555.729211][T16360] syzkaller0: entered promiscuous mode [ 555.735195][T16360] syzkaller0: entered allmulticast mode [ 555.774071][T16360] tipc: Resetting bearer [ 555.809607][T16360] tipc: Resetting bearer [ 555.884081][T16360] tipc: Disabling bearer [ 555.915053][T16372] lo speed is unknown, defaulting to 1000 [ 556.075715][T16388] netlink: 207952 bytes leftover after parsing attributes in process `syz.4.2566'. [ 556.129771][T16393] xt_TCPMSS: path-MTU clamping only supported in FORWARD, OUTPUT and POSTROUTING hooks [ 556.337409][T16395] syzkaller0: entered promiscuous mode [ 556.342907][T16395] syzkaller0: entered allmulticast mode [ 556.402110][T16397] netlink: 36 bytes leftover after parsing attributes in process `syz.4.2569'. [ 556.939322][T16417] netlink: 88 bytes leftover after parsing attributes in process `syz.2.2571'. [ 557.811173][ T51] Bluetooth: hci6: command 0x0405 tx timeout [ 558.129237][T16424] netlink: 43 bytes leftover after parsing attributes in process `syz.4.2575'. [ 558.149761][T16428] netlink: 43 bytes leftover after parsing attributes in process `syz.4.2575'. [ 558.202821][T16424] IPv6: sit1: Disabled Multicast RS [ 558.219872][T16424] sit1: entered allmulticast mode [ 558.283562][T16430] lo speed is unknown, defaulting to 1000 [ 558.786746][T16470] validate_nla: 3 callbacks suppressed [ 558.786764][T16470] netlink: 'syz.4.2587': attribute type 10 has an invalid length. [ 559.299766][T16508] bridge0: port 2(bridge_slave_0) entered blocking state [ 559.316646][T16508] bridge0: port 2(bridge_slave_0) entered disabled state [ 559.323840][T16508] bridge_slave_0: entered allmulticast mode [ 559.333209][T16508] bridge_slave_0: entered promiscuous mode [ 559.339548][T16508] team0: entered promiscuous mode [ 559.344596][T16508] bridge6: entered promiscuous mode [ 559.685488][T16524] netlink: 'syz.6.2602': attribute type 1 has an invalid length. [ 559.771527][T16528] netlink: 'syz.6.2604': attribute type 1 has an invalid length. [ 559.790475][T16528] __nla_validate_parse: 6 callbacks suppressed [ 559.790491][T16528] netlink: 476 bytes leftover after parsing attributes in process `syz.6.2604'. [ 559.809767][T16528] netlink: 1041 bytes leftover after parsing attributes in process `syz.6.2604'. [ 559.823756][T16535] netlink: 88 bytes leftover after parsing attributes in process `syz.1.2605'. [ 560.063534][T16555] netlink: 33 bytes leftover after parsing attributes in process `syz.1.2608'. [ 560.186495][T16567] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2613'. [ 560.382518][T16577] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2617'. [ 560.465283][T16579] lo speed is unknown, defaulting to 1000 [ 562.747059][T16531] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 562.849372][T16590] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2620'. [ 562.935163][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 562.997182][T16604] netlink: 'syz.2.2625': attribute type 30 has an invalid length. [ 563.054225][T16609] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2628'. [ 563.198687][T16621] netlink: 12 bytes leftover after parsing attributes in process `syz.6.2630'. [ 563.236519][T16621] bridge0: entered allmulticast mode [ 563.252192][T16621] delete_channel: no stack [ 563.283553][T16621] delete_channel: no stack [ 563.292826][T16625] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2631'. [ 563.348428][T16625] bridge5: entered allmulticast mode [ 563.358360][T16625] bridge5: left allmulticast mode [ 563.606501][T16642] gretap3: entered allmulticast mode [ 563.699084][T16648] net_ratelimit: 34 callbacks suppressed [ 563.699102][T16648] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 563.831936][T16652] bridge2: trying to set multicast query interval above maximum, setting to 8640000 (86400000ms) [ 563.863183][T16655] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 563.995145][T16663] openvswitch: netlink: Key type 13082 is out of range max 32 [ 564.145159][T16670] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 564.265677][T16678] lo speed is unknown, defaulting to 1000 [ 564.741562][T16707] lo speed is unknown, defaulting to 1000 [ 564.923570][T16717] __nla_validate_parse: 7 callbacks suppressed [ 564.923582][T16717] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2659'. [ 564.942708][T16717] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2659'. [ 565.114133][T16725] lo speed is unknown, defaulting to 1000 [ 565.508792][T16749] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2667'. [ 565.549849][T16751] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 565.774868][T16767] ip6gretap5: entered promiscuous mode [ 565.780881][T16767] ip6gretap5: entered allmulticast mode [ 565.953459][T16783] netlink: 'syz.1.2679': attribute type 21 has an invalid length. [ 565.970948][T16783] netlink: 132 bytes leftover after parsing attributes in process `syz.1.2679'. [ 565.983066][T16783] netlink: 'syz.1.2679': attribute type 21 has an invalid length. [ 565.993361][T16783] netlink: 132 bytes leftover after parsing attributes in process `syz.1.2679'. [ 566.005638][T16783] netlink: 'syz.1.2679': attribute type 21 has an invalid length. [ 566.015598][T16783] netlink: 132 bytes leftover after parsing attributes in process `syz.1.2679'. [ 566.025286][T16783] netlink: 'syz.1.2679': attribute type 21 has an invalid length. [ 566.033916][T16783] netlink: 132 bytes leftover after parsing attributes in process `syz.1.2679'. [ 566.093525][T16783] netlink: 'syz.1.2679': attribute type 21 has an invalid length. [ 566.117980][T16783] netlink: 132 bytes leftover after parsing attributes in process `syz.1.2679'. [ 566.142135][T16783] netlink: 'syz.1.2679': attribute type 21 has an invalid length. [ 566.152888][T16783] netlink: 132 bytes leftover after parsing attributes in process `syz.1.2679'. [ 566.165700][T16783] netlink: 'syz.1.2679': attribute type 21 has an invalid length. [ 566.174046][T16783] netlink: 132 bytes leftover after parsing attributes in process `syz.1.2679'. [ 566.183452][T16783] netlink: 'syz.1.2679': attribute type 21 has an invalid length. [ 566.216529][T16783] netlink: 'syz.1.2679': attribute type 21 has an invalid length. [ 566.224662][T16783] netlink: 'syz.1.2679': attribute type 21 has an invalid length. [ 566.503166][T16799] xt_CT: No such helper "syz0" [ 566.660521][T16818] lo: entered allmulticast mode [ 566.676504][T16818] lo: left allmulticast mode [ 567.053418][T16851] xt_CT: You must specify a L4 protocol and not use inversions on it [ 567.212073][T16858] tipc: Enabled bearer , priority 0 [ 568.008083][T16907] IPv6: NLM_F_CREATE should be specified when creating new route [ 568.024571][T16907] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 568.031890][T16907] IPv6: NLM_F_CREATE should be set when creating new route [ 568.039194][T16907] IPv6: NLM_F_CREATE should be set when creating new route [ 568.046460][T16907] IPv6: NLM_F_CREATE should be set when creating new route [ 568.243868][T16918] Unsupported ieee802154 address type: 0 [ 568.383901][T16927] bond9: option ad_actor_sys_prio: mode dependency failed, not supported in mode balance-rr(0) [ 568.448824][T16927] bond9 (unregistering): Released all slaves [ 568.532509][ T51] Bluetooth: hci6: command 0x0405 tx timeout [ 569.034767][T16982] sch_tbf: burst 6 is lower than device gretap0 mtu (1550) ! [ 569.541196][T17008] openvswitch: netlink: Unknown nsh attribute 0 [ 569.747101][T17020] syzkaller0: create flow: hash 1429554177 index 1 [ 569.767610][ T24] syzkaller0: tun_net_xmit 76 [ 569.801988][T17014] syzkaller0: delete flow: hash 1429554177 index 1 [ 571.250282][ T97] block nbd3: Possible stuck request ffff888025818000: control (read@0,1024B). Runtime 240 seconds [ 571.262616][ T97] block nbd3: Possible stuck request ffff888025818200: control (read@1024,1024B). Runtime 240 seconds [ 571.273704][ T97] block nbd3: Possible stuck request ffff888025818400: control (read@2048,1024B). Runtime 240 seconds [ 571.284913][ T97] block nbd3: Possible stuck request ffff888025818600: control (read@3072,1024B). Runtime 240 seconds [ 571.412684][T17025] lo speed is unknown, defaulting to 1000 [ 571.665123][T17055] __nla_validate_parse: 46 callbacks suppressed [ 571.665138][T17055] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2756'. [ 571.724968][T17058] netlink: 52 bytes leftover after parsing attributes in process `syz.4.2757'. [ 571.914052][T17064] sctp: [Deprecated]: syz.4.2760 (pid 17064) Use of int in max_burst socket option. [ 571.914052][T17064] Use struct sctp_assoc_value instead [ 572.592709][T17072] validate_nla: 32 callbacks suppressed [ 572.592757][T17072] netlink: 'syz.2.2762': attribute type 1 has an invalid length. [ 572.620918][T17072] 8021q: adding VLAN 0 to HW filter on device bond11 [ 572.677605][T17016] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 572.904242][T17079] netlink: 'syz.3.2764': attribute type 83 has an invalid length. [ 573.722103][T17145] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2779'. [ 573.746447][T17145] netlink: 56 bytes leftover after parsing attributes in process `syz.2.2779'. [ 573.781418][T17145] netlink: 32 bytes leftover after parsing attributes in process `syz.2.2779'. [ 573.830313][T17145] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2779'. [ 573.927389][ T5142] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 573.938032][ T5142] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 573.951891][ T5142] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 573.960495][ T5142] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 573.969808][ T5142] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 574.050987][T17152] lo speed is unknown, defaulting to 1000 [ 574.422855][T17175] netlink: 'syz.3.2787': attribute type 1 has an invalid length. [ 574.463924][T17175] netlink: 'syz.3.2787': attribute type 3 has an invalid length. [ 574.493506][T17175] netlink: 224 bytes leftover after parsing attributes in process `syz.3.2787'. [ 574.581592][T17176] bond6: option arp_all_targets: invalid value (129) [ 574.590862][T17176] bond6 (unregistering): Released all slaves [ 574.670534][T17152] chnl_net:caif_netlink_parms(): no params data found [ 574.775589][T17193] netlink: 'syz.6.2793': attribute type 2 has an invalid length. [ 574.821249][T17193] !9: entered promiscuous mode [ 574.827199][T17197] netlink: 'syz.6.2793': attribute type 2 has an invalid length. [ 574.879061][T17197] !9: left promiscuous mode [ 574.901656][T17204] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2796'. [ 574.953719][T17204] vlan3: entered promiscuous mode [ 574.959167][T17204] gretap0: entered promiscuous mode [ 575.004046][T17152] bridge0: port 1(bridge_slave_0) entered blocking state [ 575.023503][T17152] bridge0: port 1(bridge_slave_0) entered disabled state [ 575.033666][T17152] bridge_slave_0: entered allmulticast mode [ 575.044556][T17152] bridge_slave_0: entered promiscuous mode [ 575.065244][T17152] bridge0: port 2(bridge_slave_1) entered blocking state [ 575.099217][T17152] bridge0: port 2(bridge_slave_1) entered disabled state [ 575.119590][T17152] bridge_slave_1: entered allmulticast mode [ 575.135406][T17152] bridge_slave_1: entered promiscuous mode [ 575.227030][T17152] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 575.251114][T17152] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 575.343300][T17152] team0: Port device team_slave_0 added [ 575.362838][T17152] team0: Port device team_slave_1 added [ 575.441393][T17152] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 575.456256][T17152] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 575.513241][T17152] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 575.539937][T17152] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 575.554729][T17152] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 575.609697][T17152] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 575.649813][T17221] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2802'. [ 575.773983][T17152] hsr_slave_0: entered promiscuous mode [ 575.798538][T17152] hsr_slave_1: entered promiscuous mode [ 575.817948][T17152] debugfs: 'hsr0' already exists in 'hsr' [ 575.835887][T17152] Cannot create hsr debugfs directory [ 576.046772][ T51] Bluetooth: hci7: command tx timeout [ 576.760432][T17266] netem: change failed [ 577.031666][T17152] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 577.048105][T17152] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 577.063298][T17152] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 577.076999][T17152] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 577.189289][T17152] 8021q: adding VLAN 0 to HW filter on device bond0 [ 577.224420][T17286] gretap3: entered promiscuous mode [ 577.248753][T17152] 8021q: adding VLAN 0 to HW filter on device team0 [ 577.273960][ T3015] bridge0: port 1(bridge_slave_0) entered blocking state [ 577.281229][ T3015] bridge0: port 1(bridge_slave_0) entered forwarding state [ 577.313419][ T3015] bridge0: port 2(bridge_slave_1) entered blocking state [ 577.320654][ T3015] bridge0: port 2(bridge_slave_1) entered forwarding state [ 577.503116][T17291] bridge11: entered promiscuous mode [ 577.509835][T17291] bridge11: entered allmulticast mode [ 577.521231][T17291] team0: Port device bridge11 added [ 577.544913][T17291] bridge0: port 2(team0) entered blocking state [ 577.552839][T17291] bridge0: port 2(team0) entered disabled state [ 577.586424][T17291] team0: entered allmulticast mode [ 577.598496][T17291] team_slave_0: entered allmulticast mode [ 577.607573][T17291] team_slave_1: entered allmulticast mode [ 577.615987][T17291] team0: entered promiscuous mode [ 577.622926][T17291] team_slave_0: entered promiscuous mode [ 577.633002][T17291] team_slave_1: entered promiscuous mode [ 577.875208][T17152] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 577.996181][T17316] IPVS: sync thread started: state = BACKUP, mcast_ifn = macvtap0, syncid = 2, id = 0 [ 578.113283][T17152] veth0_vlan: entered promiscuous mode [ 578.128657][ T51] Bluetooth: hci7: command tx timeout [ 578.161089][T17152] veth1_vlan: entered promiscuous mode [ 578.206072][T17152] veth0_macvtap: entered promiscuous mode [ 578.235198][T17152] veth1_macvtap: entered promiscuous mode [ 578.271696][T17152] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 578.301316][T17152] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 578.362582][T17331] netlink: 116 bytes leftover after parsing attributes in process `syz.3.2827'. [ 578.372602][ T6031] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 578.396678][ T6031] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 578.405588][ T6031] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 578.483357][ T6031] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 578.662548][ T6007] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 578.709077][ T6007] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 578.771239][ T6031] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 578.789971][ T6031] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 578.952485][T17358] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2833'. [ 578.955142][T17359] netlink: 14 bytes leftover after parsing attributes in process `syz.1.2780'. [ 579.002861][T17359] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 579.044044][T17359] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 579.075392][T17359] bond0 (unregistering): Released all slaves [ 579.182353][ T5486] veth0_vlan: left promiscuous mode [ 579.239491][ T5486] veth0_vlan: entered promiscuous mode [ 579.536190][T17376] xt_connbytes: Forcing CT accounting to be enabled [ 579.632533][ T5142] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 579.649690][ T5142] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 579.660167][ T5142] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 579.668293][ T5142] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 579.698720][ T5142] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 579.802172][T17383] lo speed is unknown, defaulting to 1000 [ 579.837160][T17389] C: renamed from team_slave_0 (while UP) [ 579.882751][T17389] netlink: 164 bytes leftover after parsing attributes in process `syz.6.2838'. [ 580.171556][T17379] lo speed is unknown, defaulting to 1000 [ 580.178326][T17399] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2839'. [ 580.207228][ T5142] Bluetooth: hci7: command tx timeout [ 580.245005][T17400] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2839'. [ 580.267610][T17399] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2839'. [ 580.787174][T17429] macsec2: entered promiscuous mode [ 580.805088][T17429] dummy0: entered promiscuous mode [ 580.818259][T17429] macsec2: entered allmulticast mode [ 580.823715][T17429] dummy0: entered allmulticast mode [ 580.833116][T17429] dummy0: left allmulticast mode [ 580.842208][T17429] dummy0: left promiscuous mode [ 580.895488][T17423] lo speed is unknown, defaulting to 1000 [ 580.981682][T17379] chnl_net:caif_netlink_parms(): no params data found [ 581.137300][T17379] bridge0: port 1(bridge_slave_0) entered blocking state [ 581.144828][T17379] bridge0: port 1(bridge_slave_0) entered disabled state [ 581.154396][T17379] bridge_slave_0: entered allmulticast mode [ 581.163356][T17379] bridge_slave_0: entered promiscuous mode [ 581.178073][T17379] bridge0: port 2(bridge_slave_1) entered blocking state [ 581.185601][T17379] bridge0: port 2(bridge_slave_1) entered disabled state [ 581.193364][T17379] bridge_slave_1: entered allmulticast mode [ 581.202223][T17379] bridge_slave_1: entered promiscuous mode [ 581.246367][T17379] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 581.267017][T17379] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 581.310968][T17379] team0: Port device team_slave_0 added [ 581.321998][T17379] team0: Port device team_slave_1 added [ 581.379398][T17379] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 581.394350][T17379] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 581.423911][T17379] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 581.439301][T17379] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 581.446604][T17379] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 581.474833][T17379] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 581.586714][T17379] hsr_slave_0: entered promiscuous mode [ 581.593834][T17379] hsr_slave_1: entered promiscuous mode [ 581.600860][T17379] debugfs: 'hsr0' already exists in 'hsr' [ 581.607015][T17379] Cannot create hsr debugfs directory [ 581.625160][T17450] syzkaller0: entered promiscuous mode [ 581.632505][T17450] syzkaller0: entered allmulticast mode [ 581.817135][ T5142] Bluetooth: hci0: command tx timeout [ 582.141918][T17461] lo speed is unknown, defaulting to 1000 [ 582.298780][ T5142] Bluetooth: hci7: command tx timeout [ 582.378691][T17379] netdevsim netdevsim4 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 582.389172][T17379] netdevsim netdevsim4 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 582.503419][T17379] netdevsim netdevsim4 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 582.523659][T17379] netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 582.594147][T17379] netdevsim netdevsim4 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 582.604093][T17379] netdevsim netdevsim4 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 582.681759][T17379] netdevsim netdevsim4 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 582.692850][T17379] netdevsim netdevsim4 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 583.527601][T17416] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 583.543142][T17379] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 583.652043][T17379] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 583.693214][T17379] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 583.720505][T17379] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 583.732163][T17478] netlink: 'syz.3.2856': attribute type 27 has an invalid length. [ 583.888070][ T5142] Bluetooth: hci0: command tx timeout [ 583.940570][T17379] 8021q: adding VLAN 0 to HW filter on device bond0 [ 584.005958][T17379] 8021q: adding VLAN 0 to HW filter on device team0 [ 584.031016][T17492] netlink: 16 bytes leftover after parsing attributes in process `syz.6.2857'. [ 584.041663][ T6034] bridge0: port 1(bridge_slave_0) entered blocking state [ 584.048887][ T6034] bridge0: port 1(bridge_slave_0) entered forwarding state [ 584.092935][ T6034] bridge0: port 2(bridge_slave_1) entered blocking state [ 584.100148][ T6034] bridge0: port 2(bridge_slave_1) entered forwarding state [ 584.259524][T17497] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 584.428565][T17511] syzkaller0: entered promiscuous mode [ 584.444386][T17511] syzkaller0: entered allmulticast mode [ 584.465695][T17506] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 584.518647][T17516] netlink: 104 bytes leftover after parsing attributes in process `syz.2.2866'. [ 584.640180][T17520] netlink: 292 bytes leftover after parsing attributes in process `syz.2.2868'. [ 584.662819][T17379] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 584.854051][T17531] netlink: 64 bytes leftover after parsing attributes in process `syz.3.2870'. [ 585.032663][T17545] batman_adv: batadv0: Interface deactivated: geneve2 [ 585.063909][T17545] bond3: left promiscuous mode [ 585.078554][T17545] macsec1: left promiscuous mode [ 585.088575][T17545] macsec1: left allmulticast mode [ 585.116374][T17545] gre2: left allmulticast mode [ 585.124529][T17545] bond4: left promiscuous mode [ 585.186232][T17545] ip6gretap2: left promiscuous mode [ 585.274803][T17545] tipc: Resetting bearer [ 585.287716][T17545] mac80211_hwsim hwsim16 syzkaller0: left promiscuous mode [ 585.295156][T17545] mac80211_hwsim hwsim16 syzkaller0: left allmulticast mode [ 585.317210][T17545] gretap2: left promiscuous mode [ 585.335805][T17545] geneve4: left promiscuous mode [ 585.345796][T17545] gretap3: left promiscuous mode [ 585.364697][ T6009] netdevsim netdevsim3 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 585.374681][ T6009] netdevsim netdevsim3 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 585.383721][ T6009] netdevsim netdevsim3 eth0: unset [1, 1] type 2 family 0 port 40967 - 0 [ 585.394515][T17544] syzkaller1: entered promiscuous mode [ 585.401146][T17544] syzkaller1: entered allmulticast mode [ 585.421178][ T6009] netdevsim netdevsim3 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 585.448045][ T6009] netdevsim netdevsim3 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 585.477276][ T6009] netdevsim netdevsim3 eth1: unset [1, 1] type 2 family 0 port 40967 - 0 [ 585.560330][ T6009] netdevsim netdevsim3 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 585.577676][ T6009] netdevsim netdevsim3 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 585.593121][ T6009] netdevsim netdevsim3 eth2: unset [1, 1] type 2 family 0 port 40967 - 0 [ 585.605345][ T6009] netdevsim netdevsim3 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 585.626748][ T6009] netdevsim netdevsim3 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 585.637665][ T6009] netdevsim netdevsim3 eth3: unset [1, 1] type 2 family 0 port 40967 - 0 [ 585.640128][T17572] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2878'. [ 585.655301][T17567] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2878'. [ 585.682477][T17577] netlink: 20 bytes leftover after parsing attributes in process `syz.6.2881'. [ 585.742429][T17379] veth0_vlan: entered promiscuous mode [ 585.763122][T17580] rdma_rxe: rxe_newlink: failed to add xfrm0 [ 585.796458][T17379] veth1_vlan: entered promiscuous mode [ 585.803320][T17577] lo speed is unknown, defaulting to 1000 [ 585.923277][T17588] netlink: 52 bytes leftover after parsing attributes in process `syz.2.2885'. [ 585.974119][ T5142] Bluetooth: hci0: command tx timeout [ 585.975424][T17379] veth0_macvtap: entered promiscuous mode [ 586.104282][T17379] veth1_macvtap: entered promiscuous mode [ 586.112487][T17593] netlink: 'syz.2.2887': attribute type 3 has an invalid length. [ 586.177942][T17379] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 586.197512][T17379] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 586.273325][ T6031] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 586.284941][ T6031] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 586.332440][ T6031] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 586.355657][ T6031] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 586.415057][T17612] ip6t_REJECT: TCP_RESET illegal for non-tcp [ 586.551079][T17624] netlink: 'syz.1.2895': attribute type 1 has an invalid length. [ 586.662143][ T6031] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 586.685164][T17630] ip6gre1: entered promiscuous mode [ 586.706142][ T6031] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 586.781685][T17631] netlink: 'syz.6.2896': attribute type 1 has an invalid length. [ 586.805241][T17631] netlink: 64 bytes leftover after parsing attributes in process `syz.6.2896'. [ 586.818008][ T6007] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 586.836827][ T6007] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 586.881393][T17641] netlink: 212368 bytes leftover after parsing attributes in process `syz.3.2898'. [ 587.152021][T17645] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 587.361102][ T51] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 587.371382][ T51] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 587.381778][ T51] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 587.389775][ T51] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 587.397918][ T51] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 587.455703][T17657] lo speed is unknown, defaulting to 1000 [ 587.659271][ T5826] bond0: (slave syz_tun): Releasing backup interface [ 587.677425][ T5826] syz_tun (unregistering): left promiscuous mode [ 587.877642][T17657] chnl_net:caif_netlink_parms(): no params data found [ 588.011216][T17657] bridge0: port 1(bridge_slave_0) entered blocking state [ 588.018601][T17657] bridge0: port 1(bridge_slave_0) entered disabled state [ 588.025979][T17657] bridge_slave_0: entered allmulticast mode [ 588.034041][T17657] bridge_slave_0: entered promiscuous mode [ 588.046632][T17657] bridge0: port 2(bridge_slave_1) entered blocking state [ 588.049180][ T51] Bluetooth: hci0: command tx timeout [ 588.053932][T17657] bridge0: port 2(bridge_slave_1) entered disabled state [ 588.066539][T17657] bridge_slave_1: entered allmulticast mode [ 588.076145][T17657] bridge_slave_1: entered promiscuous mode [ 588.129226][T17657] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 588.145986][T17657] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 588.220922][T17657] team0: Port device team_slave_0 added [ 588.247327][T17657] team0: Port device team_slave_1 added [ 588.274654][T17695] mac80211_hwsim hwsim16 syzkaller0: entered allmulticast mode [ 588.305208][T17657] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 588.317657][T17657] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 588.350822][T17657] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 588.365566][T17693] mac80211_hwsim hwsim16 syzkaller0: left allmulticast mode [ 588.379157][T17657] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 588.407772][T17657] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 588.463582][T17657] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 588.564541][T17657] hsr_slave_0: entered promiscuous mode [ 588.628669][T17657] hsr_slave_1: entered promiscuous mode [ 588.634877][T17657] debugfs: 'hsr0' already exists in 'hsr' [ 588.653612][T17657] Cannot create hsr debugfs directory [ 588.928374][T17657] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 589.000071][T17738] tipc: Enabling of bearer rejected, failed to enable media [ 589.023327][T17657] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 589.114158][T17657] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 589.168440][T17657] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 589.441690][T17657] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 589.468882][T17657] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 589.489087][ T51] Bluetooth: hci4: command tx timeout [ 589.492861][T17657] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 589.529721][T17657] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 589.814448][T17790] __nla_validate_parse: 70 callbacks suppressed [ 589.814470][T17790] netlink: 64 bytes leftover after parsing attributes in process `syz.1.2939'. [ 589.821328][T17657] 8021q: adding VLAN 0 to HW filter on device bond0 [ 589.982106][T17657] 8021q: adding VLAN 0 to HW filter on device team0 [ 589.991071][T17800] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 590.001408][T17800] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 590.010350][T17800] batman_adv: batadv0: Removing interface: geneve2 [ 590.063141][ T6026] bridge0: port 1(bridge_slave_0) entered blocking state [ 590.070458][ T6026] bridge0: port 1(bridge_slave_0) entered forwarding state [ 590.086646][T17802] tipc: Started in network mode [ 590.091550][T17802] tipc: Node identity 7e1c98880dfd, cluster identity 4711 [ 590.115210][T17802] tipc: Enabled bearer , priority 0 [ 590.131861][ T6026] bridge0: port 2(bridge_slave_1) entered blocking state [ 590.139181][ T6026] bridge0: port 2(bridge_slave_1) entered forwarding state [ 590.157230][T17802] syzkaller0: entered promiscuous mode [ 590.162734][T17802] syzkaller0: entered allmulticast mode [ 590.202606][T17802] tipc: Resetting bearer [ 590.248420][T17801] tipc: Resetting bearer [ 590.279493][T17801] tipc: Disabling bearer [ 590.289812][T17812] FAULT_INJECTION: forcing a failure. [ 590.289812][T17812] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 590.308785][T17812] CPU: 0 UID: 0 PID: 17812 Comm: syz.3.2945 Not tainted syzkaller #0 PREEMPT(full) [ 590.308828][T17812] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 590.308848][T17812] Call Trace: [ 590.308856][T17812] [ 590.308863][T17812] dump_stack_lvl+0xe8/0x150 [ 590.308889][T17812] should_fail_ex+0x412/0x560 [ 590.308914][T17812] _copy_from_user+0x2d/0xb0 [ 590.308937][T17812] ___sys_sendmsg+0x1c6/0x360 [ 590.308957][T17812] ? __lock_acquire+0x6b5/0x2cf0 [ 590.308982][T17812] ? __pfx____sys_sendmsg+0x10/0x10 [ 590.309001][T17812] ? __lock_acquire+0x6b5/0x2cf0 [ 590.309024][T17812] ? kstrtouint+0x6e/0xe0 [ 590.309079][T17812] __sys_sendmmsg+0x27c/0x4e0 [ 590.309105][T17812] ? __pfx___sys_sendmmsg+0x10/0x10 [ 590.309123][T17812] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 590.309165][T17812] ? ksys_write+0x242/0x270 [ 590.309188][T17812] ? __pfx_ksys_write+0x10/0x10 [ 590.309223][T17812] __x64_sys_sendmmsg+0xa0/0xc0 [ 590.309247][T17812] do_syscall_64+0xe2/0xf80 [ 590.309265][T17812] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 590.309281][T17812] ? trace_irq_disable+0x37/0x100 [ 590.309297][T17812] ? clear_bhb_loop+0x60/0xb0 [ 590.309316][T17812] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 590.309333][T17812] RIP: 0033:0x7f1a8d39aeb9 [ 590.309347][T17812] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 590.309361][T17812] RSP: 002b:00007f1a8e311028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 590.309380][T17812] RAX: ffffffffffffffda RBX: 00007f1a8d615fa0 RCX: 00007f1a8d39aeb9 [ 590.309390][T17812] RDX: 00000000040001b6 RSI: 0000200000001540 RDI: 0000000000000003 [ 590.309400][T17812] RBP: 00007f1a8e311090 R08: 0000000000000000 R09: 0000000000000000 [ 590.309411][T17812] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 590.309421][T17812] R13: 00007f1a8d616038 R14: 00007f1a8d615fa0 R15: 00007ffc1371ffa8 [ 590.309446][T17812] [ 590.338989][T17657] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 590.529163][T17657] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 590.604441][T17821] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2948'. [ 590.674387][T17830] netlink: 'syz.4.2951': attribute type 10 has an invalid length. [ 590.747657][T17830] team0: Port device dummy0 added [ 590.781907][T17839] netlink: 20 bytes leftover after parsing attributes in process `syz.6.2950'. [ 590.797445][T17839] netlink: 40 bytes leftover after parsing attributes in process `syz.6.2950'. [ 591.033688][T17657] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 591.127910][T17846] syzkaller1: entered promiscuous mode [ 591.133599][T17846] syzkaller1: entered allmulticast mode [ 591.180074][T17657] veth0_vlan: entered promiscuous mode [ 591.211537][T17657] veth1_vlan: entered promiscuous mode [ 591.288590][T17657] veth0_macvtap: entered promiscuous mode [ 591.312187][T17657] veth1_macvtap: entered promiscuous mode [ 591.383655][T17657] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 591.395572][T17657] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 591.440204][ T6026] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 591.482944][ T6026] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 591.518302][ T6026] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 591.533222][ T6026] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 591.567603][ T51] Bluetooth: hci4: command tx timeout [ 591.839718][ T6016] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 591.893666][ T6016] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 592.002704][ T6016] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 592.049496][ T6016] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 592.312907][T17901] netlink: 152 bytes leftover after parsing attributes in process `syz.4.2960'. [ 592.535084][T17906] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2962'. [ 592.640879][T17916] syzkaller0: entered promiscuous mode [ 592.648021][T17916] syzkaller0: entered allmulticast mode [ 593.200509][T17938] netlink: 'syz.6.2969': attribute type 2 has an invalid length. [ 593.268127][T17938] : entered promiscuous mode [ 593.320947][T17945] netlink: 68 bytes leftover after parsing attributes in process `syz.1.2970'. [ 593.449838][T17952] : renamed from bond_slave_0 (while UP) [ 593.507573][T17957] sch_tbf: burst 1 is lower than device syzkaller0 mtu (1500) ! [ 593.542939][T17957] syzkaller0: entered promiscuous mode [ 593.549593][T17957] syzkaller0: entered allmulticast mode [ 593.564135][T17957] bridge0: entered promiscuous mode [ 593.595771][T17964] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2974'. [ 593.627074][T17964] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2974'. [ 593.654068][ T51] Bluetooth: hci4: command tx timeout [ 593.801466][T17977] syzkaller1: entered promiscuous mode [ 593.811978][T17977] syzkaller1: entered allmulticast mode [ 593.921230][T17981] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2978'. [ 593.989086][T17983] netlink: 'syz.4.2979': attribute type 3 has an invalid length. [ 594.091580][T17981] lo speed is unknown, defaulting to 1000 [ 594.092028][T17986] netlink: 'syz.2.2978': attribute type 3 has an invalid length. [ 595.551004][T18035] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 595.567824][ T31] INFO: task syz.5.2001:14038 blocked for more than 143 seconds. [ 595.575601][ T31] Not tainted syzkaller #0 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 595.620216][T18035] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 595.626211][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 595.635960][ T31] task:syz.5.2001 state:D stack:26192 pid:14038 tgid:14036 ppid:9302 task_flags:0x400140 flags:0x00080002 [ 595.652394][T18035] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 595.680947][T18035] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 595.717633][T18035] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 595.727184][T18035] Bluetooth: hci4: command tx timeout [ 595.747494][ T31] Call Trace: [ 595.750964][ T31] [ 595.754953][ T31] __schedule+0x14ea/0x5050 [ 595.796893][ T31] ? __pfx___schedule+0x10/0x10 [ 595.801817][ T31] ? schedule+0x90/0x360 [ 595.816102][ T31] schedule+0x164/0x360 [ 595.820571][ T31] schedule_preempt_disabled+0x13/0x30 [ 595.836198][ T31] __mutex_lock+0x7fe/0x1300 [ 595.840861][ T31] ? __mutex_lock+0x5ac/0x1300 [ 595.845652][ T31] ? nfsd_nl_rpc_status_get_dumpit+0xdc/0x1410 [ 595.852179][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 595.858246][ T31] ? stack_trace_save+0xa9/0x100 [ 595.863215][ T31] ? __pfx_stack_trace_save+0x10/0x10 [ 595.869044][ T31] nfsd_nl_rpc_status_get_dumpit+0xdc/0x1410 [ 595.875292][ T31] ? kasan_save_track+0x4f/0x80 [ 595.880336][ T31] ? kasan_save_track+0x3e/0x80 [ 595.885221][ T31] ? __kasan_kmalloc+0x93/0xb0 [ 595.906173][ T31] ? __alloc_skb+0x2c1/0x7d0 [ 595.910202][T18034] lo speed is unknown, defaulting to 1000 [ 595.910859][ T31] ? netlink_dump+0x1ef/0xe80 [ 595.936331][ T31] ? __netlink_dump_start+0x5cb/0x7e0 [ 595.941757][ T31] ? genl_family_rcv_msg_dumpit+0x213/0x310 [ 595.956641][ T31] ? genl_rcv_msg+0x5e8/0x7a0 [ 595.962439][ T31] ? netlink_rcv_skb+0x232/0x4b0 [ 595.987152][ T31] ? genl_rcv+0x28/0x40 [ 595.991371][ T31] ? netlink_unicast+0x80f/0x9b0 [ 596.006192][ T31] ? netlink_sendmsg+0x813/0xb40 [ 596.011192][ T31] ? ____sys_sendmsg+0xa68/0xad0 [ 596.026155][ T31] ? ___sys_sendmsg+0x2a5/0x360 [ 596.031069][ T31] ? __x64_sys_sendmsg+0x1bd/0x2a0 [ 596.056119][ T31] ? do_syscall_64+0xe2/0xf80 [ 596.067029][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 596.073155][ T31] ? __pfx_nfsd_nl_rpc_status_get_dumpit+0x10/0x10 [ 596.106552][ T31] ? rcu_is_watching+0x15/0xb0 [ 596.111372][ T31] ? trace_kmalloc+0x1f/0xb0 [ 596.115972][ T31] ? __kmalloc_node_track_caller_noprof+0x577/0x7f0 [ 596.156144][ T31] genl_dumpit+0x10b/0x1b0 [ 596.160632][ T31] netlink_dump+0x722/0xe80 [ 596.167190][ T31] ? __pfx_netlink_dump+0x10/0x10 [ 596.172270][ T31] ? genl_start+0x499/0x6c0 [ 596.177148][ T31] __netlink_dump_start+0x5cb/0x7e0 [ 596.182592][ T31] genl_family_rcv_msg_dumpit+0x213/0x310 [ 596.188690][ T31] ? __pfx_genl_family_rcv_msg_dumpit+0x10/0x10 [ 596.194953][ T31] ? genl_get_cmd+0x4a8/0x930 [ 596.200054][ T31] ? __pfx_genl_start+0x10/0x10 [ 596.204925][ T31] ? __pfx_genl_dumpit+0x10/0x10 [ 596.213012][ T31] ? __pfx_genl_done+0x10/0x10 [ 596.218360][ T31] ? __dev_queue_xmit+0x274/0x3850 [ 596.223505][ T31] genl_rcv_msg+0x5e8/0x7a0 [ 596.228478][ T31] ? __pfx_genl_rcv_msg+0x10/0x10 [ 596.233610][ T31] ? __pfx_nfsd_nl_rpc_status_get_dumpit+0x10/0x10 [ 596.240510][ T31] ? __pfx_ref_tracker_free+0x10/0x10 [ 596.245909][ T31] netlink_rcv_skb+0x232/0x4b0 [ 596.251123][ T31] ? __pfx_genl_rcv_msg+0x10/0x10 [ 596.256396][ T31] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 596.261689][ T31] ? genl_rcv+0x19/0x40 [ 596.267390][ T31] ? down_read+0x272/0x2e0 [ 596.271829][ T31] ? genl_rcv+0xd/0x40 [ 596.275917][ T31] genl_rcv+0x28/0x40 [ 596.280505][ T31] netlink_unicast+0x80f/0x9b0 [ 596.285290][ T31] ? __pfx_netlink_unicast+0x10/0x10 [ 596.292272][ T31] ? netlink_sendmsg+0x650/0xb40 [ 596.297517][ T31] ? skb_put+0x11b/0x210 [ 596.301782][ T31] netlink_sendmsg+0x813/0xb40 [ 596.306891][ T31] ? __pfx_netlink_sendmsg+0x10/0x10 [ 596.312199][ T31] ? aa_sock_msg_perm+0xf1/0x1b0 [ 596.317496][ T31] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 596.322800][ T31] ? __pfx_netlink_sendmsg+0x10/0x10 [ 596.328518][ T31] ____sys_sendmsg+0xa68/0xad0 [ 596.333306][ T31] ? __might_fault+0xaf/0x130 [ 596.338415][ T31] ? __pfx_____sys_sendmsg+0x10/0x10 [ 596.343729][ T31] ? import_iovec+0x73/0xa0 [ 596.348701][ T31] ___sys_sendmsg+0x2a5/0x360 [ 596.353398][ T31] ? __lock_acquire+0x6b5/0x2cf0 [ 596.358689][ T31] ? __pfx____sys_sendmsg+0x10/0x10 [ 596.363910][ T31] ? futex_wait+0x29a/0x380 [ 596.370065][ T31] ? __fget_files+0x2a/0x420 [ 596.374678][ T31] ? __fget_files+0x3a0/0x420 [ 596.396112][ T31] __x64_sys_sendmsg+0x1bd/0x2a0 [ 596.401109][ T31] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 596.416393][ T31] ? rcu_is_watching+0x15/0xb0 [ 596.421222][ T31] do_syscall_64+0xe2/0xf80 [ 596.425739][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 596.446106][ T31] ? trace_irq_disable+0x37/0x100 [ 596.451193][ T31] ? clear_bhb_loop+0x60/0xb0 [ 596.455901][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 596.468123][ T31] RIP: 0033:0x7f000679aeb9 [ 596.473718][ T31] RSP: 002b:00007f000765c028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 596.482589][ T31] RAX: ffffffffffffffda RBX: 00007f0006a15fa0 RCX: 00007f000679aeb9 [ 596.491018][ T31] RDX: 0000000000000800 RSI: 0000200000000180 RDI: 0000000000000003 [ 596.499435][ T31] RBP: 00007f0006808c1f R08: 0000000000000000 R09: 0000000000000000 [ 596.507882][ T31] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 596.515893][ T31] R13: 00007f0006a16038 R14: 00007f0006a15fa0 R15: 00007ffcd2b7bb88 [ 596.524415][ T31] [ 596.528153][ T31] [ 596.528153][ T31] Showing all locks held in the system: [ 596.535923][ T31] 1 lock held by khungtaskd/31: [ 596.547753][ T31] #0: ffffffff8e55a360 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 596.558170][ T31] 3 locks held by kworker/0:3/983: [ 596.563296][ T31] #0: ffff88813fe55948 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x9d4/0x17a0 [ 596.575762][ T31] #1: ffffc900037f7bc0 ((fqdir_free_work).work){+.+.}-{0:0}, at: process_scheduled_works+0xa0f/0x17a0 [ 596.607319][ T31] #2: ffffffff8e560b40 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x580 [ 596.646158][ T31] 3 locks held by kworker/u9:1/5142: [ 596.651500][ T31] #0: ffff8880287e6148 ((wq_completion)hci4){+.+.}-{0:0}, at: process_scheduled_works+0x9d4/0x17a0 [ 596.696160][ T31] #1: ffffc9000f28fbc0 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa0f/0x17a0 [ 596.737003][ T31] #2: ffff888069f00ec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x1d3/0x400 [ 596.786421][ T31] 2 locks held by getty/5585: [ 596.791146][ T31] #0: ffff8880348650a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 596.816095][ T31] #1: ffffc9000362b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45c/0x13c0 [ 596.836153][ T31] 3 locks held by syz-executor/5825: [ 596.841483][ T31] #0: ffff88802930cec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_unregister_dev+0x212/0x5a0 [ 596.866270][ T31] #1: ffff88802930c0c0 (&hdev->lock){+.+.}-{4:4}, at: hci_dev_close_sync+0x640/0x10e0 [ 596.896110][ T31] #2: ffffffff8e560c78 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x2d0/0x770 [ 596.916453][ T31] 3 locks held by kworker/1:4/5833: [ 596.921775][ T31] #0: ffff88813fe55948 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x9d4/0x17a0 [ 596.946234][ T31] #1: ffffc90004b4fbc0 (free_ipc_work){+.+.}-{0:0}, at: process_scheduled_works+0xa0f/0x17a0 [ 596.977329][ T31] #2: ffffffff8e560c78 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x38d/0x770 [ 597.016093][ T31] 4 locks held by kworker/0:6/5900: [ 597.021325][ T31] 3 locks held by kworker/u8:21/6016: [ 597.046206][ T31] #0: ffff88801b2e7148 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x9d4/0x17a0 [ 597.067681][ T31] #1: ffffc9000b477bc0 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0xa0f/0x17a0 [ 597.103632][ T31] #2: ffffffff8f99d690 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xf4/0x800 [ 597.113361][ T31] 1 lock held by udevd/6903: [ 597.118347][ T31] #0: ffff8880251b5358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0xe0/0xd30 [ 597.128262][ T31] 2 locks held by syz.0.619/8505: [ 597.133294][ T31] #0: ffffffff8fa19af0 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 597.141939][ T31] #1: ffffffff8e879428 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_nl_listener_set_doit+0x141/0x16c0 [ 597.152445][ T31] 3 locks held by syz.5.2001/14038: [ 597.158018][ T31] #0: ffffffff8fa19af0 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 597.167507][ T31] #1: ffff888029a856f0 (nlk_cb_mutex-GENERIC){+.+.}-{4:4}, at: __netlink_dump_start+0xfe/0x7e0 [ 597.178259][ T31] #2: ffffffff8e879428 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_nl_rpc_status_get_dumpit+0xdc/0x1410 [ 597.190776][ T31] 1 lock held by syz.6.2975/17972: [ 597.195914][ T31] 3 locks held by syz.4.2991/18022: [ 597.202114][ T31] #0: ffff888087ef0ec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_unregister_dev+0x212/0x5a0 [ 597.212449][ T31] #1: ffff888087ef00c0 (&hdev->lock){+.+.}-{4:4}, at: hci_dev_close_sync+0x640/0x10e0 [ 597.222410][ T31] #2: ffffffff8fb38628 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_hash_flush+0xa1/0x260 [ 597.232771][ T31] 3 locks held by syz-executor/18034: [ 597.238486][ T31] #0: ffff888058b5cec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_unregister_dev+0x212/0x5a0 [ 597.249070][ T31] #1: ffff888058b5c0c0 (&hdev->lock){+.+.}-{4:4}, at: hci_dev_close_sync+0x640/0x10e0 [ 597.259125][ T31] #2: ffffffff8fb38628 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_hash_flush+0xa1/0x260 [ 597.269502][ T31] 6 locks held by kworker/u9:3/18035: [ 597.274890][ T31] #0: ffff888030955148 ((wq_completion)hci6){+.+.}-{0:0}, at: process_scheduled_works+0x9d4/0x17a0 [ 597.286292][ T31] #1: ffffc90004b5fbc0 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa0f/0x17a0 [ 597.300818][ T31] #2: ffff888029718ec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x1d3/0x400 [ 597.312899][ T31] #3: ffff8880297180c0 (&hdev->lock){+.+.}-{4:4}, at: hci_abort_conn_sync+0xa6f/0x1190 [ 597.323145][ T31] #4: ffffffff8fb38628 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_failed+0x165/0x340 [ 597.333675][ T31] #5: ffff888027ae52f8 (&conn->lock#2){+.+.}-{4:4}, at: l2cap_conn_del+0x7b/0x5c0 [ 597.343409][ T31] 3 locks held by syz.1.2997/18040: [ 597.348922][ T31] #0: ffff88804f064ec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_unregister_dev+0x212/0x5a0 [ 597.359211][ T31] #1: ffff88804f0640c0 (&hdev->lock){+.+.}-{4:4}, at: hci_dev_close_sync+0x640/0x10e0 [ 597.369363][ T31] #2: ffffffff8fb38628 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_hash_flush+0xa1/0x260 [ 597.379831][ T31] [ 597.392242][ T31] ============================================= [ 597.392242][ T31] [ 597.403985][ T31] NMI backtrace for cpu 1 [ 597.404006][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 597.404048][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 597.404069][ T31] Call Trace: [ 597.404082][ T31] [ 597.404098][ T31] dump_stack_lvl+0xe8/0x150 [ 597.404150][ T31] nmi_cpu_backtrace+0x274/0x2d0 [ 597.404192][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 597.404253][ T31] nmi_trigger_cpumask_backtrace+0x17a/0x300 [ 597.404302][ T31] sys_info+0x135/0x170 [ 597.404336][ T31] watchdog+0xf90/0xfe0 [ 597.404389][ T31] ? watchdog+0x209/0xfe0 [ 597.404445][ T31] kthread+0x726/0x8b0 [ 597.404496][ T31] ? __pfx_watchdog+0x10/0x10 [ 597.404516][ T31] ? __pfx_kthread+0x10/0x10 [ 597.404538][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 597.404557][ T31] ? __pfx_kthread+0x10/0x10 [ 597.404577][ T31] ret_from_fork+0x51b/0xa40 [ 597.404595][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 597.404618][ T31] ? __switch_to+0xc82/0x1410 [ 597.404643][ T31] ? __pfx_kthread+0x10/0x10 [ 597.404662][ T31] ret_from_fork_asm+0x1a/0x30 [ 597.404698][ T31] [ 597.404704][ T31] Sending NMI from CPU 1 to CPUs 0: [ 597.532744][ C0] NMI backtrace for cpu 0 [ 597.532762][ C0] CPU: 0 UID: 0 PID: 18014 Comm: syz.2.2988 Not tainted syzkaller #0 PREEMPT(full) [ 597.532780][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 597.532789][ C0] RIP: 0010:unwind_next_frame+0xcb9/0x23c0 [ 597.532811][ C0] Code: 0f 85 68 11 00 00 49 89 df 49 c1 ef 03 41 0f b6 04 2f 84 c0 0f 85 78 11 00 00 0f b6 76 01 83 e6 07 83 fe 04 0f 84 4e 04 00 00 <83> fe 03 0f 84 f5 01 00 00 83 fe 02 0f 85 a8 07 00 00 4c 89 7c 24 [ 597.532824][ C0] RSP: 0018:ffffc9000ef97558 EFLAGS: 00000293 [ 597.532838][ C0] RAX: 0000000000000000 RBX: ffffffff912999bb RCX: ffffffff9076a1b4 [ 597.532848][ C0] RDX: ffffffff912999b6 RSI: 0000000000000002 RDI: ffffffff8c0739a0 [ 597.532858][ C0] RBP: dffffc0000000000 R08: 0000000000000001 R09: ffffffff8e55a360 [ 597.532868][ C0] R10: ffffc9000ef97678 R11: ffffffff81af9170 R12: ffffc9000ef97f48 [ 597.532879][ C0] R13: ffffc9000ef97678 R14: ffffc9000ef97628 R15: 1ffffffff2253337 [ 597.532890][ C0] FS: 0000000000000000(0000) GS:ffff8881256ea000(0000) knlGS:0000000000000000 [ 597.532901][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 597.532912][ C0] CR2: 0000200001000000 CR3: 000000007c4a0000 CR4: 00000000003526f0 [ 597.532925][ C0] Call Trace: [ 597.532931][ C0] [ 597.532941][ C0] ? unwind_next_frame+0xa5/0x23c0 [ 597.532956][ C0] ? do_syscall_64+0x2b7/0xf80 [ 597.532974][ C0] ? do_syscall_64+0x2b7/0xf80 [ 597.532992][ C0] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 597.533009][ C0] arch_stack_walk+0x11b/0x150 [ 597.533026][ C0] ? do_syscall_64+0x2b7/0xf80 [ 597.533045][ C0] stack_trace_save+0xa9/0x100 [ 597.533061][ C0] ? __pfx_stack_trace_save+0x10/0x10 [ 597.533082][ C0] save_stack+0x122/0x230 [ 597.533102][ C0] ? __pfx_save_stack+0x10/0x10 [ 597.533118][ C0] ? __free_frozen_pages+0xbf8/0xd70 [ 597.533132][ C0] ? vfree+0x25a/0x400 [ 597.533148][ C0] ? kcov_close+0x28/0x50 [ 597.533161][ C0] ? __fput+0x44f/0xa70 [ 597.533176][ C0] ? task_work_run+0x1d9/0x270 [ 597.533191][ C0] ? do_exit+0x69b/0x2310 [ 597.533206][ C0] ? do_group_exit+0x21b/0x2d0 [ 597.533221][ C0] ? get_signal+0x1284/0x1330 [ 597.533237][ C0] ? arch_do_signal_or_restart+0xbc/0x830 [ 597.533254][ C0] ? exit_to_user_mode_loop+0x86/0x480 [ 597.533270][ C0] ? do_syscall_64+0x2b7/0xf80 [ 597.533294][ C0] __reset_page_owner+0x71/0x1f0 [ 597.533313][ C0] __free_frozen_pages+0xbf8/0xd70 [ 597.533331][ C0] vfree+0x25a/0x400 [ 597.533349][ C0] ? __pfx_kcov_close+0x10/0x10 [ 597.533363][ C0] kcov_close+0x28/0x50 [ 597.533376][ C0] __fput+0x44f/0xa70 [ 597.533397][ C0] task_work_run+0x1d9/0x270 [ 597.533414][ C0] ? __pfx_task_work_run+0x10/0x10 [ 597.533430][ C0] ? kmem_cache_free+0x195/0x610 [ 597.533444][ C0] ? do_exit+0x696/0x2310 [ 597.533461][ C0] do_exit+0x69b/0x2310 [ 597.533480][ C0] ? __pfx_do_exit+0x10/0x10 [ 597.533497][ C0] ? do_raw_spin_lock+0x12b/0x2f0 [ 597.533517][ C0] do_group_exit+0x21b/0x2d0 [ 597.533532][ C0] ? _raw_spin_unlock_irq+0x23/0x50 [ 597.533550][ C0] get_signal+0x1284/0x1330 [ 597.533582][ C0] arch_do_signal_or_restart+0xbc/0x830 [ 597.533601][ C0] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 597.533623][ C0] ? __pfx___se_sys_pselect6+0x10/0x10 [ 597.533641][ C0] exit_to_user_mode_loop+0x86/0x480 [ 597.533658][ C0] ? rcu_is_watching+0x15/0xb0 [ 597.533673][ C0] do_syscall_64+0x2b7/0xf80 [ 597.533689][ C0] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 597.533703][ C0] ? trace_irq_disable+0x37/0x100 [ 597.533716][ C0] ? clear_bhb_loop+0x60/0xb0 [ 597.533732][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 597.533745][ C0] RIP: 0033:0x7fc66a59aeb9 [ 597.533757][ C0] Code: Unable to access opcode bytes at 0x7fc66a59ae8f. [ 597.533765][ C0] RSP: 002b:00007fc66b3d0028 EFLAGS: 00000246 ORIG_RAX: 000000000000010e [ 597.533779][ C0] RAX: 0000000000000007 RBX: 00007fc66a815fa0 RCX: 00007fc66a59aeb9 [ 597.533789][ C0] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 0000000000000040 [ 597.533799][ C0] RBP: 00007fc66a608c1f R08: 0000000000000000 R09: 0000000000000000 [ 597.533807][ C0] R10: 00002000000002c0 R11: 0000000000000246 R12: 0000000000000000 [ 597.533817][ C0] R13: 00007fc66a816038 R14: 00007fc66a815fa0 R15: 00007fffc314d028 [ 597.533835][ C0] [ 597.808018][T18035] Bluetooth: hci2: command tx timeout [ 597.808060][T18035] Bluetooth: hci4: command 0x0405 tx timeout [ 597.994982][ T31] Kernel panic - not syncing: hung_task: blocked tasks [ 598.001878][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 598.010998][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 598.021049][ T31] Call Trace: [ 598.024322][ T31] [ 598.027241][ T31] vpanic+0x1e0/0x670 [ 598.031219][ T31] panic+0xc5/0xd0 [ 598.034927][ T31] ? __pfx_panic+0x10/0x10 [ 598.039333][ T31] ? preempt_schedule_thunk+0x16/0x30 [ 598.044702][ T31] ? nmi_trigger_cpumask_backtrace+0x2bb/0x300 [ 598.050847][ T31] watchdog+0xfda/0xfe0 [ 598.055001][ T31] ? watchdog+0x209/0xfe0 [ 598.059335][ T31] kthread+0x726/0x8b0 [ 598.063397][ T31] ? __pfx_watchdog+0x10/0x10 [ 598.068062][ T31] ? __pfx_kthread+0x10/0x10 [ 598.072644][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 598.077831][ T31] ? __pfx_kthread+0x10/0x10 [ 598.082408][ T31] ret_from_fork+0x51b/0xa40 [ 598.086985][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 598.092090][ T31] ? __switch_to+0xc82/0x1410 [ 598.096766][ T31] ? __pfx_kthread+0x10/0x10 [ 598.101347][ T31] ret_from_fork_asm+0x1a/0x30 [ 598.106115][ T31] [ 598.109643][ T31] Kernel Offset: disabled [ 598.114039][ T31] Rebooting in 86400 seconds..